RESEARCH REPORT 143 Review of the risk assessment of HSE

HSE
Health & Safety
Executive
Review of the risk assessment of
buoyancy loss (RABL) project
Prepared by BMT Fluid Mechanics Limited for the
Health and Safety Executive 2003
RESEARCH REPORT 143
HSE
Health & Safety
Executive
Review of the risk assessment of
buoyancy loss (RABL) project
R.G. Standing
BMT Fluid Mechanics Limited
Orlando House
1 Waldegrave Road
Teddington
Middlesex
TW11 8LZ, UK
This report presents a review of the Norwegian ‘Risk Assessment of Buoyancy Loss’ (RABL) project,
completed in 1988. RABL was undertaken in the aftermath of the Alexander L. Kielland and Ocean
Ranger accidents. RABL’s stated purpose was to investigate causes of loss of buoyancy of
semisubmersible drilling platforms, with the overall objective of developing an analytical procedure for
consideration of buoyancy loss. This procedure was intended to be analogous to guidelines applied to
fixed platforms in Norwegian waters.
RABL demonstrated that it is practical to carry out a risk assessment of buoyancy loss for
semisubmersibles. The RABL methodology and procedure were considered to be robust and sensitive
to differences between concepts, and RABL recommended that the new analysis methodology should
be used to assess safety levels for new platform designs, or for existing platforms subject to changes in
operational premises.
This report and the work it describes were funded by the Health and Safety Executive (HSE). Its
contents, including any opinions and/or conclusions expressed, are those of the authors alone and do
not necessarily reflect HSE policy.
HSE BOOKS
© Crown copyright 2003
First published 2003
ISBN 0 7176 2729 2
All rights reserved. No part of this publication may be
reproduced, stored in a retrieval system, or transmitted in
any form or by any means (electronic, mechanical,
photocopying, recording or otherwise) without the prior
written permission of the copyright owner.
Applications for reproduction should be made in writing to: Licensing Division, Her Majesty's Stationery Office, St Clements House, 2-16 Colegate, Norwich NR3 1BQ or by e-mail to [email protected]
ii
iv
EXECUTIVE SUMMARY This report presents a review of the Norwegian ‘Risk Assessment of Buoyancy Loss’ (RABL) project,
completed in 1988. RABL was undertaken in the aftermath of the Alexander L. Kielland and Ocean
Ranger accidents. RABL’s stated purpose was to investigate causes of loss of buoyancy of semi­
submersible drilling platforms, with the overall objective of developing an analytical procedure for
consideration of buoyancy loss. This procedure was intended to be analogous to guidelines applied to
fixed platforms in Norwegian waters.
RABL demonstrated that it is practical to carry out a risk assessment of buoyancy loss for semi­
submersibles. The RABL methodology and procedure were considered to be robust and sensitive to
differences between concepts, and RABL recommended that the new analysis methodology should be
used to assess safety levels for new platform designs, or for existing platforms subject to changes in
operational premises.
RABL found that the main hazards were ship collisions, ballast system failures and blowouts.
Technical recommendations were made on each of these aspects.
RABL concluded that upper-deck reserve buoyancy (as required by NMD) provides a significant and
essential margin of safety against moderate impacts from small vessels travelling at full speed. Loss of
buoyancy from a column, following such a collision, was regarded as a ‘reasonably foreseeable’ event.
These benefits must not be compromised, however, by structural damage to the deck/ column
connection occurring at the same time as column failure. RABL’s findings suggest that the merits of
upper-deck reserve buoyancy should be assessed again, to evaluate the likely practical benefits and
difficulties of introducing such requirements for new platforms, or where existing rigs are converted
for alternative use.
Key benefits of carrying out a risk-based assessment of buoyancy loss are:
•
It provides a rational basis for considering different damage and flooding conditions (rather than
the arbitrary damage areas and depths specified in traditional deterministic standards), for
managing risks to personnel and to the rig itself, and for assessing the relative importance of
different hazards.
•
It quantifies the probabilities of occurrence of different accidental events, and their consequences
(whereas traditional deterministic stability standards are concerned only with consequences of
specified arbitrary damage events).
•
It sets loss of buoyancy within the framework of quantitative risk assessment for the vessel and its
operations as a whole.
The key question, however, is whether there is any pressing need to adopt risk-based stability
standards. There seems to have been little pressure to change existing deterministic stability standards
for semi-submersibles since RABL completed its work. There is no obvious evidence to suggest that
rigs built to traditional stability standards are unsafe, and no obvious reason to subject the industry to
the inconvenience and expense of change. Future developments therefore depend very largely on the
industry and its regulators perceiving a pressing need for, and practical benefits from, such a change.
Practical difficulties will also undoubtedly emerge when risk-based procedures are used in earnest
under real design conditions. The number of damage and flooding cases to be analysed, and the
complexity of the analysis, require careful consideration before introducing new procedures, to ensure
that the analysis is practical and not excessive.
A further key difficulty is that the RABL analysis and resulting risks were location-specific. It seems
impractical to require MODU owners to re-analyse their unit before every rig move. It will therefore be
necessary to develop a methodology for assessing risks based on a lifetime of use, rather than risks
specific to one particular location.
RABL also recognised the vulnerability of any risk assessment procedure to lack of statistical data and
to lack of insight about what are relevant and important failure modes. These are still issues of concern.
v
vi
Contents
Page
Executive Summary ................................................................................................................................. v
1.
Introduction ..................................................................................................................................... 1
1.1
Project Objectives............................................................................................................... 1
2.
Scope of Work ................................................................................................................................. 3
2.1
RABL Project Reports........................................................................................................ 3
3.
Background to the RABL Project.................................................................................................... 5
3.1
General ............................................................................................................................... 5
3.2
Key Events.......................................................................................................................... 5
3.3
Norwegian Initiatives ......................................................................................................... 6
4.
Summary of the RABL Project........................................................................................................ 7
4.1
RABL Project Objectives ................................................................................................... 7
4.2
Safety Functions ................................................................................................................. 7
4.3
General Approach............................................................................................................... 9
4.4
Key Analysis Stages ........................................................................................................... 9
4.5
Case Studies...................................................................................................................... 12
4.6
RABL Conclusions and Recommendations...................................................................... 19
5.
Related Issues ................................................................................................................................ 21
5.1
Probabilistic Stability Standards for Ships ....................................................................... 21
5.2
Damage Stability Standards for Passenger Ships and Cargo Vessels............................... 21
5.3
Tankers and FPSOs .......................................................................................................... 23
5.4
Jack-ups ............................................................................................................................ 23
5.5
Risk Acceptance Issues .................................................................................................... 24
5.6
Collision Frequencies ....................................................................................................... 25
6.
Discussion...................................................................................................................................... 27
6.1
Comments on RABL and Ship Experience ...................................................................... 27
6.2
Key Factors Affecting Semi-Submersible Stability.......................................................... 27
6.3
Stability Calculations........................................................................................................ 28
6.4
Benefits and Practical Difficulties in Implementing Risk-Based Methods....................... 28
6.5
Reserve Buoyancy ............................................................................................................ 29
7.
Conclusions ................................................................................................................................... 31
8.
References ..................................................................................................................................... 33
Abbreviations and Notation.................................................................................................................... 37
Appendix A: Summary of RABL Project Reports ................................................................................ 39
vii
viii
Review of the Risk Assessment of
Buoyancy Loss (RABL) Project
1. INTRODUCTION
BMT Fluid Mechanics Limited (BMT) was commissioned by the Health and Safety Executive (HSE)
to review a series of reports [1 to 11] from the Norwegian ‘Risk Assessment of Buoyancy Loss’
(RABL) Project, issued in 1987 and 1988.
A full list of these and other references may be found in Section 8 on page 33 of this report.
The RABL Project was undertaken in the aftermath of the losses of the Alexander L. Kielland and
Ocean Ranger in 1980 and 1982. RABL’s stated purpose was to investigate causes of loss of buoyancy
of semi-submersible drilling platforms, with the overall objective of developing an analytical procedure
for consideration of buoyancy loss. This procedure was intended to be analogous to guidelines applied
to fixed platforms in Norwegian waters.
1.1 PROJECT OBJECTIVES
The original objectives of the present review study were defined to be as follows:
• To review a series of reports generated during the Norwegian RABL project (and related
documents), in order to identify key issues affecting the assessment of semi-submersible stability;
• To assess the practical difficulties of implementing QRA methods for evaluating the stability of
semi-submersibles, and of reconciling this approach with traditional prescriptive stability criteria;
• To review how risk-based stability assessment procedures are likely to impinge on other aspects of
the design process, such as the evaluation of ship collision risks, fire and explosion risks, pollution
risks, structural assessment issues, evacuation, escape and rescue, and human factors;
• To make observations on how a risk-based approach for assessing the stability of semi­
submersibles might be developed in the medium to long term.
The first two objectives were met during the present study, as described in this report. The third
objective was met by reviewing the way in which risk-based stability assessment procedures place
demands on other aspects of the design process. Investigations into ship collision risks, fire and
explosion risks, structural failure assessment, evacuation, escape and rescue, and human factors are
thus pre-requisites for carrying out a risk-based stability assessment. The fourth objective was
interpreted in terms of assessing the merits and feasibility of developing a risk-based stability
approach.
1
2
2. SCOPE OF WORK BMT’s main task was to review a series of RABL project reports [1 to 11] and related City University
Conference papers [12 to 15], with a view to identifying issues that affect the assessment of semi­
submersible stability. Key RABL project conclusions were reviewed, paying particular attention to
conclusions about the practicality and difficulties of implementing risk-based procedures in design.
BMT also carried out a brief literature review to identify other key papers and reports, which were
available in the public domain and relate to probabilistic and risk-based stability assessment. These
documents related in particular to IMO probabilistic stability standards for ships, and risk assessment
work for the HSE on jack-ups in transit.
2.1 RABL PROJECT REPORTS
The RABL project addressed the following issues:
•
RABL report no. 1 [1] presents results from a review of past blowout incidents, and from model
tests to evaluate the dynamic effects on a rig moored over a rising gas plume.
•
RABL report no. 2 [2] describes an analysis methodology for assessing ballast systems, which was
applied subsequently during RABL, and presents results from an initial ballast-system case study.
•
RABL report no. 3 [3] presents an investigation into the frequency of collisions between ships and
MODUs working on the Norwegian continental shelf.
•
RABL report no. 4 [4] describes an analytical procedure for assessing the risk of buoyancy loss of
a MODU following structural damage due to abnormal loads.
•
RABL report no. 5 [5] investigates the probability that a mooring-induced accidental condition
(i.e. tripping) will lead to capsize or sinking.
•
RABL report no. 6 [6] presents the first of the two main case studies undertaken during RABL.
Two different MODUs were investigated: the first for all hazards, and the second for ballast
system failures only.
•
RABL report no. 7 [7] presents the second of the two main case studies undertaken during RABL.
A further two MODUs were investigated: the first for collisions, ballast system failures and fire/
explosions, and the second for ballast system failures only.
•
RABL report no. 8 [8] is a synthesis report on the first phase of RABL, summarising analysis
procedures, key results and conclusions from case studies performed up to that point.
•
RABL report no. 9 [9] presents results from a follow-up investigation into a semi-submersible
used as an accommodation platform (flotel).
•
RABL report no. 10 [10] presents results from a further follow-up investigation into a semi­
submersible used as a production platform.
•
RABL report no. 11 [11] is a final summary report on the entire RABL programme, incorporating
findings from the final two follow-up studies.
These eleven RABL project reports are summarised in Appendix A.
3
4
3. BACKGROUND TO THE RABL PROJECT
3.1 GENERAL
BMT’s present review study complements an earlier review for the HSE [16] of issues associated with
the stability of semi-submersibles. The earlier review focussed almost exclusively on traditional
deterministic stability standards, and excluded detailed discussion on risk-based methods. The
practical difficulties of implementing risk-based methods in the short-term were noted, but the longer
term benefits of placing stability assessment within a more rational and broader risk-based framework
were recognised.
Probabilistic and risk-based procedures aim to quantify the risk of occurrence of events that may lead
to loss of buoyancy, as well as the consequences of those events. Traditional deterministic stability
criteria, in contrast, are concerned exclusively with ensuring the vessel’s safety after certain prescribed
initiating events (i.e. specified damage and flooding conditions) have already taken place.
Probabilistic and risk-based procedures therefore have to address a far broader range of issues than
traditional deterministic stability standards. The title of the RABL project refers to ‘buoyancy loss’
rather than stability, indicating the broader approach required. Storm damage, ship collision, ballast
system failure, blowout, fire or explosion, or human error, for example, can all lead to buoyancy loss.
The consequences also vary, depending on the severity of buoyancy loss. A small amount of flooding
can result in the rig taking up an angle of heel, making it difficult for those on board to reach lifeboat
stations or launch lifeboats, and affecting prospects for evacuation and escape. More severe damage
and flooding can cause rapid sinking or capsize. Risks of all these different types of initiating events,
together with consequential risks to personnel and rig, have to be considered.
Other related hazards and consequences may also have to be considered. Damage to a floating
production unit can cause pollution risks. Although pollution risks are outside the remit of the HSE,
the consequential risks of fire and explosion are of direct concern.
The benefits of probabilistic and risk-based methods have been widely recognised for many years, and
probabilistic damage stability criteria have been developed for various classes of ships. Such methods
enable risks from various sources to be compared, and the most important sources of risk to be
identified, allowing decisions to be prioritised in a rational and cost-effective manner. Risk-based
methods can also help when assessing research priorities, enabling scarce resources to be directed at
issues that are likely to prove of most benefit.
The practical difficulties of implementing probabilistic and risk-based methods in vessel stability
analysis have also been long recognised, however. Probabilistic methods are more complex to
implement than traditional deterministic stability standards, because they have to consider many more
damage conditions, and risks associated with complex combinations of events. Much of the detailed
information needed to carry out such an assessment (such as the historical risks of certain rare events)
is often lacking, or of uncertain accuracy.
Probabilistic and risk-based methods have nonetheless developed considerably since the RABL studies
were completed, and are fundamental to the safety case approach adopted by the HSE and safety
authorities elsewhere. It therefore seemed appropriate to re-examine the results from the RABL
project, and to assess whether probabilistic and risk-based methods offer a practical means to carry out
stability assessment work - either now or in the longer term.
3.2 KEY EVENTS
The Risk Assessment of Buoyancy Loss (RABL) Project was one of several initiatives by the
Norwegian Maritime Directorate (NMD) following the loss of the Alexander L. Kielland in 1980 [17],
and of the Ocean Ranger in 1982 [18, 19, 20]. Both accidents resulted in major loss of life (123 out of
212 on board the Alexander L. Kielland, and the entire 84-man crew of the Ocean Ranger), and
subsequently led to major changes in the design of semi-submersibles, and in operating and regulatory
practices worldwide.
5
The Alexander L. Kielland was a Pentagone-type design, and lost one of its five main support columns
after failure of a horizontal bracing member in severe weather.
The resulting massive loss of
buoyancy led to capsize within about 30 minutes.
The Ocean Ranger was lost after a complex sequence of events, starting with breakage of a ballast
control room window in heavy weather, malfunction of the ballast control panel, flooding of the
forward ballast tanks, inability to empty these tanks because pump rooms were located at the stern of
the vessel, errors by the crew in attempting to do so, and flooding of the chain lockers. Capsize took
several hours, and a large number of crew members managed to evacuate by lifeboat or life-raft, but
could not be rescued.
These and other accidents involving loss of stability of semi-submersibles are discussed further in
BMT’s earlier review [16].
The issue of risk assessment of buoyancy loss for semi-submersibles has been brought into sharper
focus by the recent loss of the P-36 semi-submersible floating production unit on the Brazilian
Roncador Field in March 2001 [21]. Investigations indicated the following complex sequence of key
events: over-pressure and rupture of an emergency drain tank (following earlier removal of a pump,
insertion of blind flanges and valve leakage), leakage of gas and subsequent dispersion through
ventilation ducts and opened hatches, gas ignition and explosion (killing 11 fire brigade members),
automatic start-up of fire pumps causing flooding through a ruptured sea water pipe, progressive
flooding of various tanks and compartments, submergence of chain locker hawse pipes initiating down­
flooding. The unit had sufficient reserve buoyancy, however, to remain afloat for five days, allowing
safe evacuation of all those who survived the initial explosion.
3.3 NORWEGIAN INITIATIVES
After the Alexander L. Kielland accident the NMD adopted a three-tier approach to stability standards.
The first two tiers were the established intact and damaged stability philosophies, and the third was a
requirement that the unit should withstand loss of buoyancy from either the whole or a major part of
one column, but without any requirement to return to the upright position. The objective in this case
was to allow the crew time to evacuate the unit. This requirement was expressed in terms of providing
a maximum angle of heel after a large loss of righting moment, and a minimum level of reserve
buoyancy above the damaged waterline. The concept of providing some level of reserve buoyancy,
beyond that necessary to meet basic code requirements, has since been widely accepted [22]. The
NMD’s proposals are not mandatory outside Norway, however, and International Maritime
Organisation (IMO) Resolution A.651(16) [23] describes them as an ‘example’ of an alternative to the
MODU Code 7o stability range and minimum righting arm requirements, applying only to units which
have buoyant volumes contained in watertight upper-deck structures. NMD [24] requires all semi­
submersible units to satisfy both their own conventional damage (based on a minimum area ratio) and
reserve buoyancy criteria simultaneously.
The Norwegian Mobile Offshore Platform Stability (MOPS) project [25] considered alternative
philosophies that might be adopted when developing future stability standards. While recommending
no immediate changes to existing Norwegian regulations, MOPS recommended a move away from
rigid prescriptive regulations to simple statements of aim, supported by non-mandatory guidelines.
Such moves were considered likely to increase the overall safety of units, while encouraging stability
to be integrated within an overall safety assessment. This general philosophy has now been embraced
by various regulatory authorities, including the HSE.
MOPS considered that risk levels associated with different forms of damage should be further
explored, and thus led directly to the RABL project, the aim of which was to develop an analysis
procedure for defining accidental conditions and loads relating to buoyancy loss for mobile semi­
submersible platforms. Criteria were also established for assessing whether a floating platform has
satisfactory ‘floatability’ and stability.
6
4. SUMMARY OF THE RABL PROJECT
4.1 RABL PROJECT OBJECTIVES
None of the main RABL project reports contains a clear definitive statement of the project’s objectives.
Appendix 1 of the final summary report [11] simply noted that the project’s main objective was to
develop an analysis procedure for defining accidental conditions and loads related to loss of buoyancy
for mobile semi-submersible platforms. A separate sub-contractor report [3] enlarged on this objective,
stating that the purpose was to investigate various causes of loss of buoyancy of semi-submersible
drilling platforms, with the overall objective of developing an analytical procedure for consideration of
buoyancy loss. The aim was that this procedure should be analogous to guidelines for platform
Concept Safety Evaluation (CSE), which were currently applied to fixed platforms in Norwegian
waters. This overall objective was to be met in three ways:
i)
by developing risk analysis methods for hazards affecting the seaworthiness of mobile platforms,
ii)
by collecting data and establishing databases to supplement the methods and models developed,
iii) by carrying out case studies to demonstrate the methods and the use of the data.
4.2 SAFETY FUNCTIONS
The Norwegian Petroleum Act of 1985 defines three aspects of ‘total safety’:
•
Personnel safety,
•
Environmental safety,
•
Safety related to investment/ production regularity.
The Norwegian Petroleum Directorate (NPD) requires that: ‘The platform design must be such that a
design accidental event related to complete or partial (progressive) loss of buoyancy does not cause
harm to personnel outside the area of the initial accident, or (for the partial loss) a danger to the
platform integrity.’
The safety criteria and functions considered during the RABL programme were based on the ‘total
safety’ concept, but placed primary emphasis on personnel safety. The design therefore had to ensure
that rapid sinking or capsizing would not occur. Protection of the platform as an investment was
considered to be a secondary priority. Environmental hazards were not considered.
A necessary survival period is needed to protect personnel as well as the installation itself, and five
functional measures of platform safety were defined for this purpose. These so-called ‘safety
functions’ were defined in relation to the effects of buoyancy loss, to match the concerns of the RABL
project:
SF1:
the platform shall remain in a floating condition for a period until external salvage assistance
is possible (‘floatability’ function);
SF2:
the platform shall remain in a condition with limited inclination so as to allow a safe
evacuation, taking into consideration the accidental conditions that will exist on the platform
(‘evacuation’ function);
SF3:
at least one escape route shall be usable from central positions to a usable muster station for at
least one hour after the accident (‘escape ways’ function);
SF4:
the shelter area shall not be flooded until a safe evacuation has been completed (‘shelter area’
function);
SF5:
safety control of marine and drilling operations shall not be lost until a safe evacuation has
been completed (‘marine controls’ function).
Impairment of each of these safety functions was considered in relation to changes in the heel angle of
the vessel over a period of time. Figure 1 illustrates typical relationships between safety functions and
their limiting states. For example: impairment of the SF3 safety function does not occur provided the
7
inclination angle remains below a critical value (which RABL assumed to be 15o) for at least one hour.
The intention in this case is to give sufficient time for personnel to escape safely. Other safety
functions and associated durations are interpreted in a similar manner.
Figure 1: Illustrative relationship between safety functions and their limiting states.
The ‘floatability’ safety function is intended to ensure that the platform remains intact and afloat for
long enough to obtain external salvage assistance, and is the only safety function concerned with
protecting the installation itself. The platform may have to remain in this condition for a period of
several days. This period should be not less than the time required to evacuate personnel.
RABL noted that this criterion could be interpreted simplistically as copying standard damage stability
requirements, which determine maximum static heel angles associated with different combinations of
failed compartments.
Loss of floatability may result in either capsize or sinking. These two scenarios were treated separately
in the analysis where appropriate. RABL noted that it is possible to salvage a capsized platform,
provided that it does not sink. For the purposes of RABL, however, it was assumed for simplicity that
floatability is impaired if complete capsize occurs.
NMD requirements state that it should be possible to evacuate the platform in a safe and realistic
manner within 15 minutes of the alarm being given. This time may be insufficient, however, to allow
for seeking and assisting injured personnel. NPD requirements for production installations require that
escape ways should be useable for one hour after an incident. RABL suggested that the time period
associated with the ‘escape ways’ safety function should be sufficient to allow safe escape from all
main areas, allowing for escape of injured personnel and control of the platform. This time period is
both installation and location dependent. It will depend on available means of evacuation, possible
external resources, distances to other installations and onshore, and other traffic in the area.
Helicopters and lifeboats may be considered for evacuation. One hour was proposed [8] as the
minimum time required for safe evacuation, unless particular circumstances justify a shorter period.
RABL assumed that personnel can only move safely and efficiently about the deck if the rig’s heel
angle is less than 15o. This angle was therefore taken to be the upper limit for the ‘escape ways’ (SF3)
safety function. Because this limiting angle is small, the frequency of impairment will often be highest
for the SF3 safety function.
Safety functions were defined as functional requirements only. These general requirements have to be
interpreted in relation to the design, layout and hazards present on the particular platform being
analysed.
RABL report no. 10 [10] noted that a floating production unit operating on the Norwegian continental
shelf falls under the jurisdiction of NPD. RABL did not concern itself with possible differences
between the safety functions defined by NPD and those considered in the RABL project. The report
noted, however, that the five safety functions considered by RABL covered a broader range than those
8
defined by NPD (escape ways, shelter area and support structure), and concluded that the RABL safety
functions should be applicable to production units. The report also noted that RABL’s proposed cut­
off limit (see Section 4.4.7) also matched that defined by NPD.
4.3 GENERAL APPROACH
The analysis approach developed during the RABL project was essentially the same as would be
adopted in any risk assessment study. Key stages were summarised [11] as follows:
1.
System description,
2.
Hazard identification,
3.
Definition of relevant accidental events,
4.
Evaluation of consequences relative to the main safety functions,
5.
Division into Design Accidental Events (DAEs) and Residual Accidental Events (RAEs),
6.
Evaluation of RAE frequencies,
7.
Comparison with cut-off limits,
8.
Design load specification.
4.4 KEY ANALYSIS STAGES
4.4.1 System Description
The first stage, that of system description, is a relatively straightforward task. It involves preparing a
general description of the system, limiting the extent of that system, identifying and describing system
features that may be important for risk assessment.
4.4.2 Hazard Identification
The RABL programme was concerned with accidental loss of buoyancy through major ballasting
failures, severe collisions or other high-energy related events. Attention was focussed primarily on
severe events, although minor events with potential to escalate (and thereby become major events)
were also considered. Hazards from the following initiating events were considered [8] to be
applicable to large-scale buoyancy loss for semi-submersibles operating as drilling units in the North
Sea and Northern Norway offshore areas:
•
Subsea gas blowout,
•
Ballast system failure,
•
Collision with a ship or other installation,
•
Mooring-induced heel,
•
Dropped object or abnormal weight condition,
•
Structural failure.
Structural failure events were further subdivided [8] into the following four categories:
•
Burning blowout,
•
Utility systems fire and explosion,
•
Inherent structural failure,
•
Extreme environmental loading.
The main part of the RABL programme was concerned with MODUs engaged in exploration drilling,
appraisal and development drilling, but follow-up studies [9, 10] also considered hazards to
accommodation and floating production units.
9
4.4.3 Definition of Relevant Accidental Events
The first stage in defining relevant accidental events is to develop a series of alternative accidental
event trees. After the most relevant accidental event tree sequences have been identified, the next stage
is to assess these event sequences in terms of their consequences and effects on the platform, and their
frequencies of occurrence. The primary objective initially is to classify these accidental events into
Design Accidental Events (DAEs), that the platform must be designed to withstand, and Residual
Accidental Events (RAEs), which may impair one or more of the safety functions. These two types of
events are treated separately in the analysis, as discussed in Section 4.4.5. Section 4.4.6 discusses the
calculation of accidental event frequencies.
4.4.4 Evaluation of Consequences
There are two distinct stages in evaluating the risk of impairment of the safety functions: the first
involves assessing the frequency of occurrence of the accidental event itself, and the second involves
assessing the consequences of that event for the platform’s safety. A frequently-occurring accidental
event is only significant for platform safety if it impairs one or more of the safety functions.
All accidental events and sequences therefore had to be assessed with regard to their consequences for
platform safety. The RABL reports emphasised that the assessment of accidental effects was not part
of the project’s work scope, and the analysis was therefore based on consequence models that already
existed. These were found to be adequate for the purpose.
The assessment of accidental effects included traditional analyses, such as stability calculations and
structural analyses, based on combinations of accidental events identified in the event trees. Certain
event sequences had such severe and obvious consequences that the effects did not require further
investigation. The analysis effort was therefore focussed on identifying critical conditions and loads
that caused marginal impairment of the safety functions, and on the frequency of occurrence of those
conditions.
4.4.5 Division into DAEs and RAEs
Accidental events that may lead to buoyancy loss are grouped into two separate classes, which are
treated in two different ways in the analysis:
•
‘Design Accidental Events’ (DAEs) are events or conditions, the effects of which the platform
must be designed to withstand. By definition, design accidental events do not impair any of the
safety functions. A substantial amount of design analysis (e.g. structural and stability analysis) may
be needed to identify critical design accidental events, and to ensure that the platform remains
intact with no more than local damage.
•
‘Residual Accidental Events’ (RAEs) are events or conditions, the effects of which the platform
is assumed to be incapable of withstanding. These events may cause impairment of one or more of
the safety functions. No detailed design analysis is performed for these conditions. A risk analysis
is performed instead, to ensure that the annual frequency of such events lies below an acceptable
cut-off limit for each hazard category and for each safety function.
This approach keeps the design analysis within rationally defined limits, focussing on critical design
conditions. At the same time it allows residual risks to the platform to be quantified.
RABL noted that there is often an element of iteration involved in the analysis process, especially in
the classification of Design and Residual Accidental Events. Initial calculations may show that the risk
associated with a particular hazard is so high that it has to be re-classified from a RAE to a DAE, or
conversely that the risk is so low that the event may be considered a RAE rather than a DAE.
4.4.6 Evaluation of RAE Frequencies
RAE frequencies are estimated using standard risk/ probability procedures for combining frequencies
in an event tree. Some of the frequency values used in the analysis are likely to be standard values,
while others may be based on historical accident statistics combined with engineering judgement.
Certain frequency values may have to be estimated subjectively, and may be little more than order-of10
magnitude estimates. Such estimates should generally err on the conservative side, thus overestimating
some of the risks. Cut-off limits should therefore always be considered in relation to levels of
uncertainty and conservatism in the underlying frequency estimates.
Accidental event frequencies are strictly only needed for Residual Accidental Events, although it is
often appropriate to assess frequencies of all accidental events, on the grounds that it is not known
initially which events will be classified as DAEs, and which as RAEs.
4.4.7 Comparison with Cut-off Limits
The RABL programme assumed that an acceptable cut-off limit for each hazard category and safety
function would generally lie in the range 5×10-5 to 5×10-4 per platform year, with a central value equal
to 1×10-4 per platform year.
Figure 2: Illustration of the use of cut-off limits.
Figure 2 illustrates the way in which these cut-off limits were applied. It shows the annual frequency of
occurrence for each identified hazard category (e.g. ship collision, ballast system failure, blowout, etc.)
A reduction in the frequency of occurrence of a particular hazard is regarded as imperative if the
frequency is found to be greater than 5×10-4 per platform year, and must be considered if the frequency
is greater than 5×10-5 per platform year. No reduction is necessary if the frequency is less than 5×10-5
per platform year, although some reduction in certain hazards may be worthwhile.
Finding an RAE frequency value above the cut-off limit does not necessarily mean that reduction
measures will always have to be implemented - only that the feasibility of such measures must be
assessed in relation to technical and economic factors (i.e. consistent with ALARP principles.)
Impairment frequencies below the cut-off limit do not necessarily mean that no further actions can be
implemented - only that they are voluntary.
The approach adopted in RABL [8] was to evaluate RAE frequencies against cut-off limits for each
hazard and each safety function separately 1, this approach being consistent with principles used by
NPD [26]. A very low value in one category must not therefore be used to compensate for a high value
in another. It is necessary, however, to add together risks associated with all accidental events within a
1
There is clear justification for considering RAE frequencies for each safety function
separately, because these functions provide different measures of platform safety, and the risk
of impairment of every one of these measures must be low. The rationale for considering RAE
frequencies for each hazard separately is not so obvious, however. RAE frequencies
calculated in this way depend on the way in which hazards are classified, and it might be
argued that the total risk from all hazards is more critical for overall platform safety than the
risk from each hazard individually.
11
single hazard category, before comparing the total risk with the cut-off criterion. Thus risks from all
types of vessel collisions have to be combined together, before making the comparison.
RABL noted [8] that life cycle risks may be estimated for fixed installations, but not for mobile units,
because a mobile unit may operate anywhere in the world. The RABL assessment was therefore based
on assuming that the rig carries out the same type of operation at one location for one complete year.
This assumption should also be borne in mind when assessing the need for risk reduction measures.
4.4.8 Design Load Specification
The Design Accidental Events identified above are intended to form the design basis for the platform in
cases where the safety evaluation is performed prior to detailed design. The initial DAE assessment
assumes that certain loads and conditions can be tolerated by the platform systems and structure. The
role of detailed engineering design is to ensure that these assumptions are correct. Detailed design
must be in accordance with the safety standards assumed when carrying out the initial DAE
assessment.
Details of design conditions considered during the RABL project are described in the case study
reports.
4.5 CASE STUDIES
Case studies were performed on semi-submersible units designed to several different standards,
operating at various locations on the Norwegian continental shelf, in order to demonstrate the analysis
procedure, reveal areas of difficulty and uncertainty, discover the most important risk elements,
quantify those risks and their sensitivity to platform location, design and operations. These case
studies included:
•
An initial study [2], to demonstrate the RABL analysis methodology for ballast system failures, on
West Vision, a so-called ‘third-generation’ 2 drilling rig.
•
A comparative study of two ‘second generation’ 2 units [6], based on Deep Sea Bergen and
Treasure Scout. Deep Sea Bergen was built in 1982 to NMD regulations issued after the
Alexander L. Kielland accident, with sufficient reserve buoyancy to withstand loss of buoyancy
from a complete column. Treasure Scout was a Pacesetter platform, delivered in 1982 and
subsequently converted to comply with NMD post-Alexander L. Kielland requirements. Both rigs
had only one ballast pump room in each pontoon. Deep Sea Bergen was investigated for all
hazards, and Treasure Scout for ballast system failures only.
•
A further comparative study [7] based on the unconverted (‘first generation’ 2 ) version of Treasure
Hunter and West Vision. Treasure Hunter was built in 1977, before NMD regulations were revised
in 1982/3, with no reserve buoyancy and only one pump room in each pontoon. West Vision was
representative of a ‘third generation’ 2 design, with reserve buoyancy and pump rooms at both ends
of each pontoon. Treasure Hunter was investigated for collisions, ballast system failures and fire/
explosion, and West Vision for ballast system failures only.
•
Follow-up studies [9, 10] investigated differences between semi-submersibles used as drilling rigs,
accommodation and floating production units.
Supporting work was undertaken to assess the following aspects of the analysis:
•
2
An initial evaluation of blowout risks and consequences [1];
‘First generation’ units were designed and built according to regulations in force before the
Alexander L. Kielland accident. ‘Second generation’ units were designed and built after the
Alexander L. Kielland accident, from 1982 onwards, and complied with NMD regulations
requiring reserve buoyancy within the deck structure (see Section 3.3). ‘Third generation’
units were designed and built after the Ocean Ranger accident, from 1985/6 onwards, with
ballast rooms at both ends of each pontoon, and improved stability characteristics.
12
•
An investigation [3] into risks of collision from different classes of ships (powered passing vessels,
drifting vessels, and powered visiting vessels) at three alternative locations (Askeladden in the
Troms area, Troll and Statfjord Fields);
•
An assessment [4] of the risk of buoyancy loss following structural damage due to abnormal loads;
•
An assessment [5] of the risk that a mooring-induced accidental condition (‘tripping’) will lead to
capsize or sinking.
Key results and conclusions from these studies are summarised below.
4.5.1 Methodology
These case studies demonstrated that it was feasible to apply the analysis methodology developed
during RABL to specific platform designs, and the results were reasonable. The methodology seemed
robust enough to differentiate between different platform designs and concepts.
The risk associated with ballast system failures was reduced to a low level for a third-generation
platform. In this case all significant hazards were associated with loss of structural integrity.
Consequence calculations were therefore focussed primarily on structural aspects rather than stability
issues [8]. Large uncertainties were found in some of the parameters in the structural response
analysis, and the most appropriate way to reflect these uncertainties in the end results would be through
the use of reliability analysis methods. One case study showed that this was feasible.
Stability assessment requirements were largely met by using information contained in conventional
stability books.
The ballast failure frequency model was developed using an event/ fault tree approach. A new fault
tree had to be constructed for each ballast system to reflect specific system features. Significant
difficulties were found in modelling human factors, control systems and common mode failures, the
first of which had the greatest impact on the results [8].
Figure 3: Residual risk levels for a typical second-generation MODU.
The case studies focussed primarily on three safety functions, in the following order of priority:
•
The ‘escape ways’ safety function (SF3): based on whether the vessel’s inclination exceeded 15o
within one hour, making escape over the deck difficult;
13
•
The ‘floatability’ safety function (SF1): based on whether the vessel’s inclination exceeded a
critical angle at which stability was permanently lost, causing rapid filling, followed by sinking or
capsize;
•
The ‘evacuation’ safety function (SF2).
In one case study [6] all safety functions were assessed for ballast system failure only.
Figure 3 shows residual levels of risk for a typical second-generation semi-submersible drilling unit,
built in 1982, engaged in exploration drilling at the Smørbukk Sør location [6]. Results are shown for
the ‘escape ways’ and ‘floatability’ (SF3 and SF1) safety functions for all types of hazards. Ship
collisions, burning blowouts and ballast system failures (for SF3) were the most critical classes of
hazards in this case, with high levels of risk. Other risks were generally considered to be small.
4.5.2 Ship Collisions
RABL [3] found that the probability of a high-energy ship collision was higher than had previously
been anticipated, and that there was a significant risk of severe damage in consequence. Special
attention was therefore paid to quantifying ship collision risks. The analysis considered various sizes
of powered passing vessels, drifting vessels and powered visiting vessels. It considered shipping routes
and densities, effectiveness of watch-keeping, failure to take corrective action, the ‘plannability’ factor
(i.e. the probability that the ship’s master will make plans in advance to avoid the platform), and
platform-initiated recovery (i.e. the probability that the platform will alert the ship in time to prevent a
collision).
Figure 4 shows annual frequencies of SF1 (floatability) impairment due to collisions from different
classes of ships - for a ‘second-generation’ drilling unit operating at the Smørbukk Sør and Draugen
locations [11]. Passing merchant vessels were the dominating risk factor at Draugen, because it was
close to a route used by ore carriers. Even small changes in location were found to have a significant
effect on risk levels.
Figure 4: Comparison between SF1 impairment frequencies through collision
at the Draugen and Smørbukk Sør locations.
RABL [3] recommended various actions to reduce uncertainties in these estimates. These uncertainties
related mainly to the possibility of last-minute evasive action, differences between permanent
installations and MODUs (the latter not being marked on navigational charts), differences in
navigational behaviour around stand-alone mobile units and units operating close to other installations,
14
the platform’s location relative to the shipping lane, and statistical uncertainties in traffic and other
parameters.
RABL [8] suggested that the case study results have an uncertainty of about one order of magnitude,
but noted that ship collisions would still be a significant risk factor, even if their frequency was reduced
by one order of magnitude. Impact energies in the range 20 to 80 MJ were found to have the highest
frequencies [8].
Upper-deck reserve buoyancy provided a survival capacity equivalent to an impact energy in the range
60 MJ to 70 MJ, whereas a rig without reserve buoyancy failed at 20 MJ to 25 MJ. Reserve buoyancy
therefore provides a significant level of protection against visiting vessels (e.g. supply vessels typical
of those in use at the time of RABL, colliding at high speed) 3. Collisions of this type occur with
significant frequency. Upper-deck reserve buoyancy also protects against collisions by the smaller of
the passing merchant vessels. No protection is possible against collision with larger merchant vessels,
but the frequency of these collisions is low at most offshore locations.
Case study results [7] for a ‘first-generation’ rig showed that a collision from any class of ship could
lead to ‘two-compartment’ damage, causing a heel angle greater than 15o, and therefore impairment of
the ‘escape ways’ (SF3) safety function. A collision from a ship with a displacement greater than
about 1,100 tonnes would most probably lead to rig capsize (i.e. impairment of the ‘floatability’ safety
function, SF1).
The two case studies found relatively little difference [8] between ‘escape ways’ impairment
frequencies for ‘first’ and ‘second-generation’ rigs (Treasure Hunter and Deep Sea Bergen).
Impairment frequencies for these two rigs, when engaged in exploration drilling at the Troll West
location, were 2.7×10-2 and 2.0×10-2 per platform year respectively.
Calculations showed [8] that a collision sufficiently severe to cause structural failure of a column of the
‘second-generation’ rig was also likely to cause openings in the upper deck structure large enough to
cause flooding within one hour, thereby impairing upper-deck reserve buoyancy and the SF1 safety
function.
Case study results [8] indicated that the impairment frequency for the SF1 (floatability) safety function
was between 1.9×10-3 and 1.7×10-2 per platform year, depending on location. A value of 2.3×10-3 was
indicated by WOAD worldwide accident statistics. These values also fell within the (very broad) range
indicated by an earlier JP Kenny study. 4
The final RABL report [11] noted that, although collision frequencies were high for mobile platforms,
they were significantly lower for semi-submersibles used as accommodation (flotel) or production
units. The main reason was that producing installations (including the installation to which the flotel is
attached) are marked on navigation charts. There is an additional source of collision risk for a flotel,
however: that of drifting into the fixed platform, following mooring line failure. The resulting risks
were assessed to be small on a third-generation platform, because most modern platforms have
significant thruster capacity, which can counteract the effects of multiple mooring line failure.
4.5.3 Ballast System Failure
The second main contributor to risk, for second-generation and earlier rigs, proved to be ballast system
failures. Table 1 compares frequencies of impairment of the ‘escape ways’ safety function (SF3) due
to ballast system failures for all four case study platforms [8].
3
The RABL analysis assumed a 2,200 tonne visiting vessel colliding head-on at 15 knots,
having an impact energy in the 60 MJ to 70 MJ range. Reserve buoyancy will only provide
protection against a large modern platform supply vessel colliding at low to moderate speeds.
4
BMT’s review study [16] suggested that it is over-simplistic to compare collision frequencies
predicted by RABL with total MODU accident statistics, without considering the causes of
those accidents. Collisions seemed to be a minor factor in the accidents considered in [16].
15
There were some inconsistencies in the analyses applied to these four platforms. Secondary effects of
fires, explosions and collisions on the ballast system were included in some cases, but not in others.
The results nonetheless indicate only small differences between impairment frequencies for the ‘first
generation’ and ‘second generation’ units, all of which had a single pump room at one end of each
pontoon. The ‘third generation’ design showed a significant reduction in risk associated with ballast
system failure. This improvement was partly the result of having two pump rooms, fore and aft, in
each pontoon, but also partly due to the higher level of flexibility and redundancy in this system.
Redundancy, in particular, had a clear influence on risk levels.
Table 1: Impairment frequencies for the ‘escape ways’ safety function (SF3)
due to ballast system failures.
Platform
Treasure Hunter (unconverted)
Deep Sea Bergen
Treasure Scout
West Vision
Type 5
Frequency per platform year
First generation
Second generation
Second generation
Third generation
1.0×10-3
1.8×10-3
1.2×10-3
1.0×10-5
The West Vision case study [7] also showed that:
•
Human maloperation of the ballast system, combined with single component failure, was probably
the most critical combination of failure conditions;
•
Corrective actions could prevent the platform from reaching its critical heel angle, because of
operational flexibility and tolerances built into the system design;
•
Operational and survival draughts for West Vision were identical. Impairment frequencies would
be higher on a platform where the ballast system has to be activated to go from operational to
survival draught in severe weather.
It was found necessary to take the detailed layout and design of each particular ballast system into
account, including possible combinations of failure conditions. FMEA alone would not be sufficient
for this type of assessment.
Differences between the stability characteristics of the four platforms (i.e. which accidental flooding
conditions the platform could tolerate without excessive heeling) also had a significant effect on
impairment frequencies.
Impairment frequencies for an accommodation or production unit, due to ballast system failures, were
considered likely to be approximately the same as for a drilling unit, assuming an identical vessel and
ballast system [11].
4.5.4 Fire, Explosion and Blowout
Blowout (including consequent risks of explosion, fire and loss of buoyancy) turned out to be the third
main contributor to impairment risk.
Total blowout frequencies during exploration and development drilling worldwide were found [1] to be
7.2×10-3 and 2.1×10-3 per well year respectively. These frequencies increased to 2.4×10-2 and 7.3×10-3
respectively per platform year. Annual frequencies for exploration drilling were considered to be so
high that a detailed analysis of consequences was recommended.
When consequences were taken into account, RAE frequencies for impairment of the ‘escape ways’
safety function (SF3) due to blowout were reduced to 7.4×10-4 and 1.7×10-6 per platform year for Deep
Sea Bergen and Treasure Hunter respectively [8]. Differences between these two results seem to have
5
See footnote on page 12.
16
been due partly to differences between the structural capabilities of the two platforms, and partly due to
differences of opinion in the two case study analyses.
Blowouts often have very severe consequences that cannot be designed against. The only effective
ways to reduce risk are therefore either to reduce the frequency of blowout, or to reduce the risk of
exposure to the consequences of blowout. The first (and most cost-effective) priority is therefore to
prevent blowout in the first place. The second is to ensure that the platform can re-locate quickly in the
event of blowout.
Model test investigations showed that reduced fluid density and up-welling posed little direct threat to
the stability of a semi-submersible moored above a rising gas plume [1]. The main hazards were
associated with ignition of the gas or oil, creating a long-lasting fire, possibly combined with an
explosion. These hazards clearly depend strongly on field and reservoir characteristics.
A mobile platform has an advantage over a fixed platform, because it can re-locate, thereby escaping
burning oil and gas on the sea surface. Experience on the Norwegian continental shelf nonetheless
indicated that reliable re-location may be a problem [11].
Blowout is clearly not a hazard for an accommodation platform, but is a significant hazard for a
production unit with wells directly beneath the unit. Statistics showed, however, that blowout
frequencies are somewhat lower during the production phase than during exploration drilling.
A number of other fire and explosion hazards were also considered during RABL. These included
hydrocarbon leaks from utility systems, or from process systems, risers and pipelines on production
units. Risks were generally found to be less than those from blowout. Process system fires would be
located mainly on upper decks, and would have limited potential to cause major structural problems.
Riser leaks, however, especially from flexible risers without subsea isolation, were considered to be a
significant hazard [11]. They could cause a long-lasting and severe fire, threatening platform integrity.
4.5.5
Other Hazards
Other hazards listed in Section 4.4.2 were generally found to be of minor importance (see Figure 3).
Falling loads, mooring-induced heel (‘tripping’), inherent structural failures and extreme environmental
loads all came into this category. Some of these hazards might become more significant, however, if
risk levels associated with collisions and ballast system failures are reduced.
4.5.6 Stability Analysis Findings
The consequence analyses undertaken during RABL were based largely on standard hydrostatic
stability and structural analysis procedures. The hazards of interest were considered to be those
associated with damage stability conditions. Intact stability was not considered to be an issue.
Righting (GZ) and heeling moment arm curves contained in ordinary stability books largely served as
the basis for evaluating impairment of safety functions. The analysis considered the possibility of
multi-compartment damage, in addition to one-compartment damage conditions specified in the IMO
MODU Code [27]. All except the oldest rig (Treasure Hunter) complied with current Norwegian
(NMD) regulations [24], and were designed to survive much higher levels of damage than are specified
in the MODU Code, having sufficient reserve buoyancy in the upper deck to withstand loss of
buoyancy from any one column.
Relevant findings from the case studies [6, 7] were as follows:
1.
The first-generation rig, Treasure Hunter, had not been designed to withstand major loss of
buoyancy from a single column. Analyses undertaken by RABL found that:
•
Filling one of the forward ballast tanks or a machinery/ pump room caused the rig’s heel
angle to exceed 15o in the absence of wind, causing impairment of the ‘escape ways’ safety
function (SF3),
•
Filling any one of certain other ballast tanks was also unacceptable in severe weather,
•
Filling of other single tanks might be critical, depending on wave motions,
17
•
Unintentional filling of two or more tanks was unacceptable. This could result in flooding
of the chain lockers, and further filling of compartments through air pipes, threatening the
‘floatability’ safety function (SF1).
2. All of the other three rigs had been designed to current NMD regulations, and one-compartment
filling never caused the heel angle of any of these three rigs to exceed 15o, although it sometimes
came close to this value.
3. In all three cases, several combinations of two-compartment flooding in a strong (50 knot) wind
led to impairment of the ‘escape ways’ safety function (SF3).
4. In the case of Deep Sea Bergen, filling of more than two tanks was not considered, as it was
concluded that the platform could not tolerate this level of filling without exceeding the critical
heel angle.
5. Treasure Scout was more robust against two-tank filling than Deep Sea Bergen. The probability
of exceeding the critical 15o heel angle on Treasure Scout was 0.44, considering all combinations
of two flooded ballast tanks, and taking into account the possibility of flooding more than two
tanks.
6.
Although the initiating event frequency for ballast system failures on Treasure Scout was slightly
higher than for Deep Sea Bergen, resulting impairment frequencies for all safety functions on
Treasure Scout were significantly lower, because of this rig’s greater robustness against flooding.
The difference between impairment frequencies was relatively small for the ‘escape ways’ (SF3)
safety function, and greatest for the ‘floatability’ (SF1) safety function.
7.
System flexibility was found to be essential in cases where there was only one ballast pump room
in each pontoon. Stability characteristics were also very important, however, defining accidental
flooding conditions that the platform could withstand without incurring excessive heel.
8. RABL strongly supported Norwegian regulations [24] requiring reserve buoyancy in the upper
deck. This issue is discussed further in Section 4.5.7.
4.5.7 Reserve Buoyancy
RABL [8] noted that the most likely mode of failure, following a major ship collision, was structural
failure of a column, and recommended that damage stability standards should address this scenario.
A structural investigation [6] on Deep Sea Bergen investigated the benefits of having deck reserve
buoyancy. The RABL synthesis report [8] concluded that a platform with reserve buoyancy could
survive impacts with energies up to about 65 MJ, whereas the same platform without reserve buoyancy
would fail at around 22 MJ. This result was based on calculations which showed that a semi­
submersible shell structure could absorb impacts in the 20 MJ to 25 MJ range without suffering
indentations greater than 1.5m (the maximum depth of damage specified in traditional damaged
stability standards). At 60 MJ to 70 MJ the structural integrity of the column as a whole, and of the
deck-structure connection, became doubtful.
Probabilities of exceeding the 22 MJ and 65 MJ survival thresholds were estimated [8] at two different
locations (high and low traffic densities). At the low traffic density location (ignoring low-speed
attendant vessels) there was 98% probability of exceeding the 1.5m penetration depth, given that
collision occurs, whereas there was only 66% probability of exceeding the reserve buoyancy limit.
Corresponding values for the high traffic density location were 98% and 22% respectively.
Case study results indicated, however, that a significant part of the deck volume could be flooded in the
same incident as the column, due to failure in the connection between the deck and column, largely
negating the benefits gained through having reserve buoyancy in the deck. Some form of watertight
division between the deck and column was therefore suggested [11] to ensure that reserve deck
buoyancy remains effective, and this solution was regarded as being both practical and relatively
cheap.
The case study concluded that reserve buoyancy in the deck structure, as required by NMD [24]
regulations (see Section 3.3), provides a significant and necessary increase in the safety margin for
18
such platforms [8]. Collisions were found to be the only type of accident, however, where the risk
level was sufficiently high to show a demonstrable need for reserve buoyancy.
4.6 RABL CONCLUSIONS AND RECOMMENDATIONS
RABL report no. 11 [11] summarised the project’s final conclusions and recommendations. The
analysis methodology and procedure were considered to be robust and sensitive to differences between
concepts, and it was recommended that the new analysis methodology should be used to assess safety
levels for new platform designs, or for existing platforms subject to changes in operational premises.
RABL nonetheless recognised the vulnerability of any risk assessment procedure to lack of statistical
data and to lack of insight about what are relevant and important failure modes. Risk assessment has
become more firmly established, and accident statistics more available, since the RABL work took
place, but the limitations of the historical record and lack of insight are still major concerns.
RABL found that the main hazards were ship collisions, ballast system failures and blowouts.
Technical recommendations [11] included the following:
•
Collision risk requires the greatest attention, particularly focussing on collision prevention
measures. These might include warning systems and extended exclusion zones in specific cases.
The report also recommended further studies to define true collision risk levels.
•
Reserve buoyancy in the upper deck was regarded as essential to protect the platform against ship
collisions, and should be made as effective as possible, to withstand moderate collisions with a
small vessel travelling at full speed. The design should also prevent, as far as possible, loss of
reserve deck buoyancy following structural failure of a column. Loss of reserve deck buoyancy
after such failures might be avoided quite simply and cheaply.
•
Having ballast rooms at all four corners of the rig significantly reduced risk levels. Such systems
also provide important benefits in terms of redundancy and flexibility. It is important, however, to
arrange the system so that human failure cannot easily lead to a critical condition.
•
Risk assessment was recommended, in addition to FMEA studies on ballast systems, because
FMEA studies are not capable of assessing failure combinations adequately.
•
The most effective way to reduce risks associated with blowouts is to reduce their frequency of
occurrence. Risks associated with fire and explosion can be reduced by maximising the probability
of being able to relocate the platform quickly following a blowout.
•
Risks associated with semi-submersibles used as accommodation units were generally similar to
those associated with mobile drilling units, and the same recommendations applied.
•
The main additional recommendation for a floating production unit was to prevent long-lasting gas
fires caused by pipeline or riser leaks, especially where flexible gas export risers are used. Subsea
isolation of the leak is particularly worthwhile.
19
20
5. RELATED ISSUES
5.1 PROBABILISTIC STABILITY STANDARDS FOR SHIPS
The approach developed by RABL for semi-submersible units has been paralleled by developments in
probabilistic stability standards for ships. The practical difficulties experienced in developing, gaining
acceptance for, and implementing these standards are relevant to the discussion on developing
probabilistic standards for semi-submersibles.
The International Maritime Organisation (IMO) has long recognised the deficiencies of traditional
deterministic ship stability standards, and started a programme of work to develop ‘rational’ criteria in
the late 1960s. This was recognised to be a difficult task, however, because there is no simple
relationship between a ship’s parameters and its ability to survive all possible dangerous situations that
it may encounter during its life.
Kobylinski [28], reviewing the history of the IMO’s attempts to develop ‘rational’ criteria, noted that
the word ‘rational’ means different things to different people. Research efforts have therefore diverged
in many different directions. The development of probabilistic stability standards was part of this broad
range of activities. An IMO working group had recommended long-term theoretical and experimental
investigations, including measurements on board ships, and indicated that it was unrealistic to expect to
achieve results in the short term. The present state of knowledge on the physics of capsize was
regarded as inadequate. Research was to be encouraged to better understand ship motions in confused
seas and capsizing phenomena, and the identification of parameters influencing capsize.
Noting, however, that operational factors (including human factors) have been responsible for 80% to
90% of casualties at sea, Kobylinski [28] now considered that the best way forward was likely to be
through a combination of operational measures, including advice to masters, education and training,
together with the adoption of Formal Safety Assessment (FSA) methods. This methodology should
include risk evaluation using probabilistic methods, and might involve calculating a risk function in
selected conditions considered to be dangerous.
Strong arguments have been put forward in favour of developing probabilistic stability standards for
ships, and numerous papers have been published on this topic, many at a series of Conferences on the
Stability of Ships and Ocean Vehicles. The fifth such conference in 1994 featured a special workshop
on the probabilistic approach to stability standards. The word ‘probabilistic’ has been interpreted in
different ways by different researchers, however. Attempts have been made to develop probabilistic
models of the environment, of the ship’s characteristics and behaviour, human factors, and the hazards
experienced over its lifetime. Kobylinski [28] noted that the complexities of non-linear behaviour of
even fairly simple mathematical models make the results very difficult to interpret in terms of
probabilities of capsize. He believed that none of these approaches is likely to be practical or realistic
at present or in the near future, and concluded that existing criteria adequately serve the design
purpose, although they cannot assure absolute safety.
Svensen [29] nonetheless argued for the adoption of probabilistic methods, on the grounds that they are
less arbitrary than deterministic standards, and provide a more objective measure of the vessel’s
survival capability in case of damage. Events having a higher likelihood carry a heavier weight, and
events with a very low probability of occurrence have a smaller influence on the results. Deterministic
concepts of rule damage of a predefined size do not always reflect real life.
The challenge is to come up with a probabilistic standard that is practical to use, is sufficiently rigorous
to manage important risks, is applicable to a sufficiently wide class of vessels, and gives sufficient
freedom to achieve efficiency and economy in design.
5.2 DAMAGE STABILITY STANDARDS FOR PASSENGER SHIPS AND CARGO
VESSELS
Probabilistic damage stability standards for passenger vessels were first introduced by IMO in 1967 as
an alternative to the deterministic requirements of SOLAS-60. IMO Resolution A.265(VIII) for
passenger ships [30], adopted in 1973, took the probability of survival after collision as a measure of
21
the ship’s safety in the damaged condition, taking both one-compartment and multiple-compartment
damage into account. The criteria defined in Resolution A.265(VIII) may still be used for passenger
ships, as an alternative to the stability standards in SOLAS 2001 [31], which remain deterministic.
Probabilistic subdivision and damage stability standards for cargo ships have, however, already been
incorporated into Part B-1 of SOLAS 2001 [31].
These probabilistic stability standards compare a so-called ‘Attained Subdivision Index’, A, with a
‘Required Subdivision Index’, R. The ‘Attained Subdivision Index’ is defined as A =
p i s i , where
∑
pi represents the probability of flooding of a given compartment or group of compartments, and si
represents the probability of survival with that given damage. The Attained Index has to take into
account all possible sizes of damage, and each damage condition is weighted according to the
probability that such damage can be expected. Specified formulae for calculating R and pi depend on
the number of passengers carried and lifeboats available (in the case of passenger ships), the
subdivision length of the ship, and the locations and lengths of compartments. Survivability is
measured in terms of the parameter si , calculated from properties of the residual stability curve.
The SOLAS-90 standard came into force in 1990, following a number of passenger ship casualties.
Svensen [29] noted, however, that both SOLAS-90 and existing IMO probabilistic standards, such as
Resolution A.265(VIII), have several major shortcomings when applied to passenger Ro-Ro vessels.
Flooding of the car deck does not have to be considered, and cargo shifting is not considered as a risk.
Svensen recommended that any new standard for passenger Ro-Ro vessels should be based on the
probabilistic approach, and should include major risks such as flooding of the car deck and cargo shift.
It should also aim to manage residual risks, so as to prevent rapid capsize in damage conditions where
the vessel does not survive, so that the number of fatalities is kept as low as reasonably practical.
Work undertaken by organisations from a number of North-West European countries, following the
Estonia and Herald of Free Enterprise accidents, led to the so-called ‘Stockholm Agreement’ [32],
which now applies to all UK Ro-Ro passenger ships in certain classes, and to non-UK ships when they
are in UK ports. This standard is still based on SOLAS-90 deterministic procedures, however.
Svensen [29] and Rusås [33] describe the objectives and work scope of a North-West European project
‘Safety of Passenger/ Ro-Ro Vessels’. The primary aim of this project was to devise proposals for new
design requirements leading to improved safety for new vessels, paying special attention to damaged
and flooded conditions. The project group recognised early on, however, that other risks should be
considered in an overall risk assessment. In particular, it was considered important to ensure that other
risks were not increased as a consequence of design changes made to increase vessel stability.
The IMO SLF Committee is currently revising Chapter II-1 of the SOLAS standard, with the aim of
harmonising the subdivision and damage stability provisions for passenger and cargo ships. It is
understood that the new standard is likely to be based on the probabilistic ‘Attained Subdivision Index’
approach, and will take account of results from the EU ‘HARDER’ research project. The Committee
aims to complete its work in 2003, and the revised chapter is planned to take effect in 2006.
5.2.1 Reported Problem Issues
Several authors have reported difficulties in applying IMO probabilistic standards, such as resolution
A.265(VIII). Compared with traditional deterministic procedures, greater effort is needed to carry out
the analysis, and significantly more damage cases have to be considered. Real vessels may require
thousands of damage cases to be considered, and only the use of special-purpose programs makes this
feasible [34].
Koelman et al. [35] cited further difficulties. The large number of damage cases proved to be a major
problem when designing the vessel and finding the maximum allowable KG, because of the amount of
re-analysis that was necessary. Gaining approval was reported to be a problem, because of the amount
of re-analysis that had to be performed by the approving body, and the vast quantity of results that had
to be submitted for approval. The authors noted that the standard formulae sometimes gave negative
probabilities of occurrence, and the sum of all probabilities was not one. The method for handling
multi-compartment damage sometimes led to inconsistencies. The authors also noted that the
22
probabilistic method is entirely based on the concept of side damage, whereas only 12% of casualties
in 1993 had been caused by side damage. A number of simplifications to the rules were suggested.
Jensen et al. [36] noted the following difficulties: how to establish realistic probability distributions for
the location and extent of damage, how to extend the procedure to cover grounding as well as side
collisions, realistic criteria for the probability of surviving given damage, definitions of the probability
of damage to compartments and groups of compartments, definitions of compartment permeabilities,
and the description of water ingress.
Vassalos and Tuzcu [37] noted the present confusion and uncertainty in the present regulatory regime,
especially for passenger Ro-Ro vessels, and the bewildering choice of alternative damage stability­
related standards available to the designer. They then sought to demonstrate and quantify the link
between deterministic and probabilistic damage stability regulations, and performance-based standards,
by focussing on the ‘safety equivalence’ concept.
5.3 TANKERS AND FPSOS
Oil tankers are subject to both SOLAS stability regulations and MARPOL [38] marine pollution
regulations, but there is on-going discussion about the applicability of MARPOL, SOLAS and Load
Line requirements to FPSOs (Floating Production, Storage and Offloading systems) and FSUs
(Floating Storage Units). One view is that FPSOs and FSUs should be regarded as floating platforms
rather than oil tankers or cargo ships, but others consider that this classification might endanger the
marine environment [39].
When operating in UK waters an FPSO or FSU has to comply with HSE Safety Case regulations.
Safety Case regulations require a suitable and sufficient quantified risk analysis of all major accident
scenarios.
Dyer [40] reviewed the standards applicable to FPSOs and FSUs, noting that there is a need to balance
environmental and safety risks. It is not always easy to cope with conflicting requirements, however,
especially as these requirements are often specified by different regulatory authorities. Dyer
recommended that a probabilistic assessment should be made of pollution risks, considering different
levels of damage and spill rates, using procedures similar to those used to calculate the ‘Attained
Subdivision Index’ in a probabilistic damage stability analysis. In this case a ‘Pollution Index’, E, was
defined as E =
p i v i , where pi is the probability that i adjacent compartments are damaged, and vi is
∑
the theoretical outflow of oil from the i compartments under consideration. Dyer noted, however, that
there are major differences between levels of damage specified by MARPOL, SOLAS, the IMO
MODU Code, UK and Norwegian national stability standards.
Karsan et al. [41] presented a quantitative risk assessment study on an FPSO operating in the Gulf of
Mexico. This study had been undertaken as a Joint Industry Project to demonstrate the acceptability of
FPSOs in the Gulf of Mexico, to identify accidental events and FPSO components with high risks of
environmental pollution, loss of life or financial loss, and to recommend practical risk-reducing
measures. This investigation covered a broad range of hazards, but did not specifically address loss of
buoyancy.
5.4 JACK-UPS
Noble Denton [42] undertook a quantitative risk assessment of a representative North Sea jack-up rig
move, in order to determine the risks to the jack-up itself and to personnel. The jack-up was found to
be vulnerable to four types of hazards when afloat: flooding, collision, structural damage (due to
excessive motions and wave action) and grounding. It was found to be vulnerable to two further types
of hazards when on site: weather damage (e.g. inadequate air gap) and punch-through. The majority of
fatalities and major accidents were likely to be associated with towing. Bad weather was the largest
individual factor contributing to fatalities and major damage, and improved weather forecasting
techniques could reduce the fatality potential by about 30%. Various other risk-reduction measures
were also proposed.
23
This investigation addressed a broad range of risks and their consequences. Hazards resulting in loss
of buoyancy or capsize included: ballast system failures; failures of sea-fastenings, derrick or
substructure; design, planning, operational and weight control errors; loss of watertight integrity;
excessive weather; tug, tow-line or jacking system failures; fire and collision.
5.5 RISK ACCEPTANCE ISSUES
Konovessis and Vassalos [43] outlined a procedure for integrating quantitative risk assessment into the
design framework for passenger ships, and applied this procedure to three different upgrading
arrangements for a passenger Ro-Ro vessel.
A key issue is the level of risk that is tolerable both to the individual and to society. Although IMO has
no established explicit risk acceptance criteria, a paper submitted to IMO [44] has proposed the
following criteria for risks to an individual person on board a ship:
•
Maximum tolerable risk for crew members:
10-4 per year,
•
Maximum tolerable risk for passengers:
10-5 per year.
The same paper proposed the use of a so-called ‘F-N’ curve for determining tolerable ‘societal’ risks to
passengers. The proposed criteria for passenger Ro-Ro vessels are reproduced in Figure 5. F
represents the frequency of occurrence of N fatalities in one incident. The tolerable number of
fatalities therefore reduces as the number of fatalities increases. Two orders of magnitude reduction is
risk is seen as necessary if the number of fatalities increases from 1 to 100. In this figure risks are
classified as either ‘negligible’, ‘ALARP’ or ‘intolerable’.
Figure 5: Proposed F-N acceptance criteria for passenger Ro-Ro vessels (from [43]).
Konovessis and Vassalos noted that environmental risks and property loss also have to be considered in
the overall assessment. The vessel must also meet a number of other design criteria, such as achieving
a specified carrying capacity, a certain speed with minimum installed power, passenger comfort and
performance requirements.
24
Cost-benefit was assessed using the ‘Implied Cost to Avert a Fatality’ (ICAF), which represents the net
annual cost of the measure divided by the reduction in the annual fatality rate. The authors noted that
measures with an ICAF less than £2m per fatality averted are generally considered to be cost-effective.
Measures in the £2m to £50m per fatality averted should be considered if individual or societal risks
are high in the ALARP region. Measures with costs above £50m per fatality averted are not normally
considered unless individual or societal costs are intolerable. The authors concluded that any decision
taken without considering appropriate trade-offs between different aspects of the problem would result
in an incomplete solution.
5.6 COLLISION FREQUENCIES
The RABL case studies found that ship collisions were the dominant hazard for MODUs operating on
the Norwegian continental shelf. Follow-up studies were recommended to reduce uncertainties in the
collision risk model.
Spouge [45] described one such follow-up study for locations on the UK Continental Shelf, and
presented sample results. He noted that no ship-platform collision on the UKCS has ever caused a
platform to collapse. There have nonetheless been four major collision incidents, where the vessels
Gisna, Marag Mette, La Paloma and Irving Forest struck fixed or mobile platforms on the UKCS. The
first incident involved a collision with the semi-submersible Sea Quest. In the last incident the vessel
collided with a jack-up, which reportedly came close to collapse. All vessels were under power, and
had suffered some kind of watch-keeping failure. There have also been several incidents where large
ships drifted close to platforms. Another 29 incidents were noted worldwide, including four that
caused total loss of the platform, and two involving loaded tankers, where the cargos ignited causing
severe damage. Collisions were therefore seen to be a significant hazard, requiring careful evaluation
under the platform’s Safety Case.
Commenting on the RABL work, Spouge noted that improved shipping traffic data had become
available through the European COST-301 programme [46]. There were growing indications that the
collision model used during the RABL project over-predicted the risks. The UK Department of Energy
subsequently commissioned Technica to update this collision model (known as CRASH), to calibrate it
against actual collision experience, and to make it available to the industry.
This new version of CRASH was used [45] to predict collision frequencies for all 119 platforms in the
UK and Irish sectors installed before 1990. Predicted collision frequencies varied between 10-7 per
year to 0.12 collisions per year. The highest frequencies were for platforms in the Southern North Sea,
near busy traffic lanes, where new platforms were located in gaps between existing established
platforms. Vessels tend to use these gaps in order to avoid established platforms. The average
predicted collision frequency was 8.7×10-3 per platform year. The total collision frequency for all 119
platforms was 1.0 per year. 2.8% of the risk was, on average, from drifting vessels. The collision
frequency for mobile platforms was predicted to be ten times higher than for fixed platforms of a
similar size at the same location, because mobile platforms are not marked on navigation charts.
Spouge noted that that the amended CRASH model would be slightly conservative for predicting risks
in later life for platforms installed since 1987. He also noted that the presence of platforms changes the
shipping lanes - and would eventually make the CRASH database out of date.
Haugen and Vollen [47] described work undertaken during the ‘Collide’ project, aimed at developing a
more realistic model for the process leading up to a vessel passing a platform, and the probability of
collision. Risk reduction measures were also reviewed. Phase I of ‘Collide’ considered the Norwegian
continental shelf, and Phase II extended the study to the entire North Sea. Few results are presented,
and it is not possible to make comparison with results from the RABL work.
Incident statistics recorded in the HSE’s ‘Ship/Platform Incident Database’ have been analysed
recently, and key results were presented by Boothby [48]. The mean collision incident frequency,
based on all reported incidents to semi-submersibles operating on the UKCS between 1975 and
October 2001, was 0.24 per year, and the frequency of incidents to semi-submersibles resulting in
moderate or severe damage was 0.049 per year. No incidents to semi-submersibles from passing
vessels were reported during this period. The paper concluded that there is a significant statistical risk
25
of collision, and that it is ‘reasonably foreseeable’. Most collision risks are from attendant vessels,
within management control. The paper noted that HSE and UKOOA have initiated a work group to
draw up industry guidelines for the management of collision risk, and that these guidelines will be
published by UKOOA.
26
6. DISCUSSION
6.1 COMMENTS ON RABL AND SHIP EXPERIENCE
The probabilistic methods and principles developed for semi-submersibles during the RABL Project
have not been developed further into a regulatory framework. International and Norwegian stability
requirements for MODUs are still based firmly on traditional deterministic procedures, and there seems
to be no obvious pressure from any quarter to change this situation.
This situation contrasts with that for ships, where the international regulatory position is now very
confused. There have been strong pressures from some quarters to introduce probabilistic damage
stability standards, and there is now a bewildering range of alternative stability assessment procedures
(both deterministic and probabilistic) available to designers of passenger and cargo ships. IMO is
currently aiming to harmonise the regulations for passenger and cargo vessels, based around the
probabilistic approach.
Procedures developed during the RABL project and IMO probabilistic damage stability standards for
ships have a common aim of providing a more rational basis for assessing risks and consequences of
buoyancy loss resulting from failure of various combinations of compartments. There are several key
differences between the RABL and IMO approaches, however:
•
There is little obvious physical basis for the formulae defined in the IMO standards, and no
obvious relationships with real lifetime probabilities of flooding and survival. RABL procedures
aim to quantify impairment risks explicitly, whereas IMO procedures are based on a so-called
‘Attained Subdivision Index’. This Index is compared with a target parameter based on the ship’s
subdivision length, and this parameter has no obvious connection with lifetime or annual risk.
•
The IMO formulae appear in fact to have more in common with traditional rule-based methods
than with a goal-setting, risk-based approach.
•
RABL considered all hazards that may lead to loss of buoyancy, whereas IMO probabilistic
criteria focus primarily on damage due to collisions.
•
RABL considered a number of alternative measures of safety (five Safety Functions). IMO
procedures generally address vessel survival only.
•
RABL considered the frequency of impairment for a MODU operating at a single location for an
entire year, whereas a risk analysis for a ship has to consider its entire voyage life. It is not obvious
how to quantify lifetime risks in a rational manner for a vessel engaged in worldwide trade.
An area of difficulty, at least for ships, has proved to be the level of complexity and number of damage
cases that have to be considered. A very broad range of hazards had to be considered in the RABL
analysis, also leading to a very complex analysis. Major risk and structural assessment studies were
needed to quantify risks associated with the two main hazards (collisions and ballast system failures).
6.2 KEY FACTORS AFFECTING SEMI-SUBMERSIBLE STABILITY
The RABL investigations identified three primary initiating hazards for MODUs operating in
Norwegian waters: ship collisions, ballast system failures and blowouts.
The risk from ship collisions varied significantly, depending on the rig’s location in relation to ship
traffic routes, and whether it lay near a fixed installation marked on navigation charts. Uncertainties in
collision risk estimates, and collision risk prevention measures warrant further investigation.
The risk from ballast system failures depended on the number and layout of pump rooms (e.g. whether
the rig had only one or two pump rooms in each pontoon), on the design of the system against human
failures, and on the stability characteristics of the vessel. Having four pump rooms provided important
redundancy and flexibility benefits.
27
The most effective risk-reduction measure against blowouts was to reduce the occurrence of blowouts
themselves. Risks associated with fire and explosion can be reduced by ensuring that the platform can
be relocated quickly following a blowout.
Long-lasting fires caused by pipeline or riser leaks were found to be a hazard for semi-submersible
floating production units.
These hazards caused significant risks of impairment to both the ‘escape ways’ and ‘floatability’ safety
functions. The ‘escape ways’ safety function was a measure of the ability of personnel to use escape
routes to muster stations following an accidental event. The ‘floatability safety function was a
measure of the ability of the rig to remain afloat for long enough to allow salvage assistance.
RABL regarded reserve buoyancy in the deck as an essential form of protection against collision from
a small vessel travelling at full speed. Reserve buoyancy should be made more effective, however, by
preventing failure between the connections between the deck and main columns.
6.3 STABILITY CALCULATIONS
RABL did not question the principles underlying traditional stability analysis procedures, based on
static wind heeling moment and still-water righting moment curves. It simply placed these calculations
within an overall risk analysis framework. The stability calculations were therefore identical to those
performed during a traditional stability analysis, although additional damage conditions (e.g. several
compartments flooded simultaneously) had to be considered. RABL reported that the information
contained in standard stability books was generally sufficient for this purpose.
Large numbers of damage conditions (possibly running into thousands) reportedly have to be
considered when carrying out a probabilistic stability analysis of a ship. RABL, by contrast, seems to
found it necessary to analyse only a small number of additional damage cases, possibly because:
•
A third-generation or later rig, complying with current Norwegian or IMO stability standards, is
capable of sustaining one-compartment flooding without impairment of any of its safety functions.
•
Relatively stringent limiting conditions were applied to impairment of the ‘escape ways’ safety
function (the heel angle should remain less than 15o for at least one hour). Various combinations of
two-compartment flooding exceeded this limit.
•
Two-compartment flooding seems generally to have been the highest level of damage considered
during the RABL studies. Higher levels of damage were generally assumed to impair the ‘escape
ways’ safety function, and therefore did not require a stability analysis.
•
Third-generation and later rigs, complying with Norwegian reserve buoyancy requirements, should
be capable of sustaining loss of buoyancy from one column without impairing the ‘floatability’
safety function. Structural analysis, rather than stability analysis, was the primary tool used to
assess major damage of this type.
•
RABL efforts were concentrated primarily of the ‘escape ways’ and ‘floatability’ safety functions.
Other safety functions were considered in less detail, or not at all.
It is not clear whether these assumptions would be adequate when carrying out a real rig design, or
whether they were simplifications introduced to meet the less onerous objectives of the RABL JIP. A
broader range of flooding and damage conditions might have to be considered in cases where rigs do
not comply with Norwegian reserve buoyancy requirements, increasing the number of damage cases
and the amount of stability analysis required.
6.4 BENEFITS AND PRACTICAL DIFFICULTIES IN IMPLEMENTING RISKBASED METHODS
RABL considered the analysis methodology and procedures developed during the project to be both
robust and practical, and recommended that this methodology should be used to assess safety levels for
new platform designs or those subject to changes in operational premises.
28
Key benefits of carrying out a risk-based assessment of buoyancy loss are:
•
It provides a rational basis for considering different damage and flooding conditions (rather than
the arbitrary damage areas and depths specified in traditional deterministic standards), for
managing risks to personnel and to the rig itself, and for assessing the relative importance of
different hazards.
•
It quantifies the probabilities of occurrence of different accidental events, and their consequences
(whereas traditional deterministic stability standards are concerned only with the consequences of
specified arbitrary damage events).
•
It sets loss of buoyancy within the framework of quantitative risk assessment for the vessel and its
operations as a whole.
Risks associated with buoyancy loss can thus be set in the context of risks associated with fire and
explosion, environmental pollution, structural failure, mooring and DP failure, evacuation, escape and
rescue issues, and many other aspects of design. Some form of risk analysis, though possibly not at the
detailed level required for assessment of buoyancy loss, will generally be needed as part of the Safety
Case submitted to the HSE, to ensure that risks are ‘as low as reasonably practical’.
Key difficulties in implementing risk-based stability standard for semi-submersibles are likely to be:
•
The greater level of complexity, and the greater number of damage cases considered during the
risk-based assessment, compared with traditional deterministic stability procedures (although the
number of additional cases considered by RABL does not seem to have been excessive).
•
The location-specific nature of the RABL analysis and calculated risk levels. It seems impractical
to require MODU owners to re-analyse their unit before every rig move.
•
Significant levels of uncertainty in some of the values used in the analysis.
There are likely to be further practical barriers hindering the introduction of risk-based methods for
assessing buoyancy loss:
•
The lack of any obvious pressing need for change. There is no obvious evidence to suggest that
rigs built to traditional stability standards are unsafe, and no obvious reason to subject the industry
to the inconvenience and expense of change.
•
Higher costs associated with the greater analysis effort required to implement risk-based methods.
•
The high level of cohesion, co-ordination and management commitment needed to bring together
the necessary information on many different design and operational issues and hazards.
•
A natural reluctance to embrace change in a traditionally conservative industry.
•
Difficulties in comparing safety levels for rigs designed using traditional stability standards with
those designed using risk-based methods.
•
Difficulties in understanding risk-based and probabilistic concepts.
•
Difficulties in agreeing acceptable limits of risk (for individuals and groups of people, and for the
rig itself), and in deciding whether a given level of risk should be regarded as acceptable,
intolerable or ALARP.
•
Difficulties in using such procedures during design, because of the large amount of re-analysis
implied by any change to the design.
•
Difficulties in obtaining approval from certification bodies, because of the complexity of the
analysis, and difficulties of verification.
•
Lack of existing standard computer software for analysing the large numbers of damage cases.
6.5 RESERVE BUOYANCY
The original objectives of this review study were to assess the practicality of, and likely benefits from,
implementing risk-based stability standards for semi-submersibles. A further important issue came out
29
of the RABL work, however, which may have greater implications for platform safety than the
implementation of risk-based stability standards.
RABL recommended that new semi-submersibles should be designed to Norwegian stability standards
[24], which require reserve buoyancy to be provided in the upper deck. Assuming that the upper deck
remains intact following major structural failure or flooding of a column, reserve deck buoyancy can
provide a significant enhancement to platform safety, keeping the platform afloat for long enough to
permit safe evacuation, and possibly long enough to permit salvage. RABL considered that the only
type of incident where reserve buoyancy offers significant additional safety is a major ship collision,
causing structural failure of a column. The P-36 accident [21] provides evidence to suggest, however,
that there may also be benefits from reserve buoyancy following a major explosion and flooding.
The RABL case studies showed that, without the additional safety offered by reserve buoyancy, the
‘escape ways’ safety function could be impaired by flooding only two compartments, and that loss of
buoyancy from a column following a ship collision is a ‘reasonably foreseeable’ event. Structural
failure and loss of buoyancy from a column could result from a collision with anything larger than a
small vessel travelling at speed.
These findings suggest that the merits of requiring upper deck reserve buoyancy should be assessed
again, to evaluate the likely practical benefits and difficulties of introducing such requirements for new
platforms, or where existing rigs are converted for alternative use. Any such requirements must ensure
that reserve buoyancy remains effective after the initiating event, however, and is not compromised by
structural damage to the deck/ column connection in the same incident that causes column failure.
30
7. CONCLUSIONS RABL demonstrated that it is practical to carry out a risk assessment of buoyancy loss for semi­
submersibles. The RABL methodology and procedure were considered to be robust and sensitive to
differences between concepts, and RABL recommended that the new analysis methodology should be
used to assess safety levels for new platform designs, or for existing platforms subject to changes in
operational premises.
RABL found that the main hazards were ship collisions, ballast system failures and blowouts.
Technical recommendations included the following:
•
Collision risk requires the greatest attention, especially collision prevention measures. These
might include warning systems and extended exclusion zones in specific cases. RABL
recommended further studies to define true collision risks.
•
Reserve buoyancy in the upper deck was regarded as essential to protect the platform against ship
collisions, and should be made as effective as possible, to withstand moderate collisions with a
small vessel travelling at full speed. The design should prevent, as far as possible, loss of reserve
deck buoyancy following structural failure of a column. Failures leading to loss of reserve deck
buoyancy might be avoided quite simply and cheaply.
•
Having ballast rooms at all four corners of the rig significantly reduced risk levels. Such systems
also provide important benefits in terms of redundancy and flexibility. It is important, however, to
design the system so that human failure cannot easily lead to a critical condition.
•
Risk assessment was recommended, in addition to FMEA studies on ballast systems, because
FMEA studies are not capable of assessing failure combinations adequately.
•
The most effective way to reduce risks associated with blowouts is to reduce their frequency of
occurrence. Risks associated with fire and explosion can be reduced by maximising the probability
of being able to relocate the platform quickly following a blowout.
•
Risks associated with semi-submersibles used as accommodation units were generally similar to
those associated with mobile drilling units, and the same recommendations applied.
•
The main additional recommendation for a floating production unit was to prevent long-lasting gas
fires caused by pipeline or riser leaks, especially where flexible gas export risers are used. Subsea
isolation of the leak is particularly worthwhile.
RABL concluded that upper-deck reserve buoyancy (as required by NMD) provides a significant and
essential margin of safety against moderate impacts from small vessels travelling at full speed. Loss of
buoyancy from a column, following such a collision, was regarded as a ‘reasonably foreseeable’ event.
RABL’s findings suggest that the merits of upper-deck reserve buoyancy should be assessed again, to
evaluate the likely practical benefits and difficulties of introducing such requirements for new
platforms, or where existing rigs are converted for alternative use.
Key benefits of carrying out a risk-based assessment of buoyancy loss are:
•
It provides a rational basis for considering different damage and flooding conditions (rather than
the arbitrary damage areas and depths specified in traditional deterministic standards), for
managing risks to personnel and to the rig itself, and for assessing the relative importance of
different hazards.
•
It quantifies the probabilities of occurrence of different accidental events, and their consequences
(whereas traditional deterministic stability standards are concerned only with the consequences of
specified arbitrary damage events).
•
It sets loss of buoyancy within the framework of quantitative risk assessment for the vessel and its
operations as a whole.
The key question, however, is whether there is any pressing need to adopt risk-based stability
standards. There seems to have been little pressure to change existing deterministic stability standards
for semi-submersibles since RABL completed its work. There is no obvious evidence to suggest that
31
rigs built to traditional stability standards are unsafe, and no obvious reason to subject the industry to
the inconvenience and expense of change. Future developments therefore depend very largely on the
industry and its regulators perceiving a pressing need for, and practical benefits from, such a change.
Practical difficulties will also undoubtedly emerge when risk-based procedures are used in earnest
under real design conditions. The number of damage and flooding cases to be analysed, and the
complexity of the analysis, require careful consideration before introducing new procedures, to ensure
that the analysis is practical and not excessive.
A further key difficulty is that the RABL analysis and resulting risks were location-specific. It seems
impractical to require MODU owners to re-analyse their unit before every rig move. It will therefore be
necessary to develop a methodology for assessing risks based on a lifetime of use, rather than risks
specific to one particular location.
RABL also recognised the vulnerability of any risk assessment procedure to lack of statistical data and
to lack of insight about what are relevant and important failure modes. Risk assessment has become
more firmly established, and accident statistics more available, since the RABL work took place, but
the limitations of the historical record and lack of insight are still major concerns.
32
8. REFERENCES 1.
SikteC A/S, Loss of Buoyancy due to Blowout, SikteC report no. ST-87-RR-007-02, RABL
report no. 1, 1988.
2.
V
eritec, Risk Assessment of Buoyancy Loss and Other Faulty Weight Conditions; PP3:
Ballast System, Veritec report no. 87-3451, RABL report no. 2, 1987.
3.
T
echnica, Risk Assessment of Buoyancy Loss; Project PP4 - Assessment of MODU Collision
Frequencies, final report, RABL report no. 3, 1987.
4.
SINTEF, Veritec, SikteC A/S, Risk Assessment of Buoyancy Loss;
SINTEF report no. STF71 F87034, RABL report no. 4, 1987.
5.
V
eritec, Mooring Induced Accidental Floating Condition, Veritec report no. 87-3125, RABL
report no. 5, 1987.
6.
SikteC A/S, Risk Assessment of Buoyancy Loss; Case Study 1, SikteC report no. ST-87-RR009-02, RABL report no. 6, 1987.
7.
V
eritec, Risk Assessment of Buoyancy Loss; Case Study 2, RABL report no. 7, 1987.
8.
SikteC A/S, Risk Assessment of Buoyancy Loss; Project Synthesis: Updated and Final Report,
SikteC report no. ST-87-RR-013-02, RABL report no. 8, 1988.
9.
SikteC A/S, Risk Assessment of Buoyancy Loss; Accommodation Platforms, SikteC report no.
ST-87-RR-021-01, RABL report no. 9, 1988.
10.
SikteC A/S, Risk Assessment of Buoyancy Loss; Production Platforms, SikteC report no. ST87-RR-022-01, RABL report no. 10, 1988.
11.
SikteC A/S, Risk Assessment of Buoyancy Loss; Summary Report, SikteC report no. ST-87RF-024-01, RABL report no. 11, 1988.
12. Vinnem, J.E., and Haugen, S., Risk Assessment of Buoyancy Loss (RABL); Introduction to
Analytical Approach, Intl. Conf. Mobile Offshore Structures, City University, London,
September 1987.
13. Amdahl, S., Haugen, S., and Vinnem, J.E., Risk Assessment of Buoyancy Loss; Case Study 1,
Intl. Conf. Mobile Offshore Structures, City University, London, September 1987.
14.
Mørland, M., Risk Assessment of Buoyancy Loss; Case Study 2, Intl. Conf. Mobile Offshore
Structures, City University, London, September 1987.
15.
V
innem, J.E., Risk Assessment of Buoyancy Loss (RABL), Summary of Programme Results,
Intl. Conf. Mobile Offshore Structures, City University, London, September 1987.
16. BMT Fluid Mechanics Limited, Review of Issues Associated with the Stability of Semisubmersibles, report no. 44208r13, October 2000.
17. The Norwegian Royal Commission Report on the Alexander L. Kielland Disaster, 1981.
18. The Royal Commission on the Ocean Ranger Marine Disaster, Report no. 1, The Loss of the
Semisubmersible Drill Rig Ocean Ranger and its Crew, 1984.
19. The Royal Commission on the Ocean Ranger Marine Disaster, Report no. 2, Safety Offshore
Eastern Canada, 1985.
33
Structural Damage,
20.
National Transportation Safety Board, Capsizing and Sinking of the U.S. Mobile Offshore
Drilling Unit OCEAN RANGER off the East Coast of Canada, 166 Nautical Miles East of St.
John’s, Newfoundland, February 15, 1982, Marine Accident Report no. NTSB-MAR-83-2,
1983.
21.
Barusco, P., The Accident of P-36 FPS, Offshore Technology Conference paper no.
OTC 14159, Houston, 2002.
22. Mills, P.J., Stoneman, G.S., and Wilson, T.B., Stability of Ships and Mobile Offshore Units.
Recent Developments in Legislation, Lloyd’s Register Technical Association paper no. 7,
1991.
23.
International Maritime Organisation, An Example of Alternative Stability Criteria for a Range
of Positive Stability after Damage or Flooding for Column-Stabilized Semisubmersible Units,
Resolution no. A.651(16), 1989.
24. Norwegian Maritime Directorate, Regulations for Mobile Offshore Units, 1999.
25.
Norwegian Hydrodynamic Laboratories, Mobile Platform Stability. Project Abstract, MOPS
report no. 22, NHL report no. 184491, project no. 520010.08, 1984.
26. Vinnem, J.E., and Hope, B., Offshore Safety Management, Tapir, 1986.
27. International Maritime Organisation, Code for the Construction and Equipment of Mobile
Offshore Drilling Units (MODU Code), Consolidated Edition, 2001.
28.
K
obylinski, L.K., Safety Against Capsizing - Road for the Future, Marine Technology 2000,
XIX Scientific Conf. of Naval Architects and Marine Engineers, Szczecin-Dziwnówek,
Poland, May 2000.
29.
S
vensen, T.E., A New Safety Standard for Passenger/ RoRo Vessels, WEGEMT Workshop:
Damage Stability of Ships, DTU, Lyngby, October 1995.
30. International Maritime Organisation, Regulations on Subdivision and Stability of Passenger
Ships as an Equivalent to Part B of Chapter II of the International Convention for the Safety
of Life at Sea, 1960, Resolution A.265 (VIII), 1973.
31. International Maritime Organisation, SOLAS Consolidated Edition, 2001, Part B of Chapter
II-1, Subdivision and Stability, 2001.
32.
Marine Safety Agency, Agreement Concerning Specific Stability Requirements for Ro-Ro
Passenger Ships Undertaking Regular Scheduled International Voyages between or to or from
Designated Ports in North West Europe and the Baltic Sea, Merchant Shipping Notice MSN
1673 (M), 1997.
33.
Rusås, S., Designing for a Second Line of Defence, DNV Forum, No. 2, pp. 16-18, 1997.
34. Lauridsen, P.H., Jensen J.J., and Baatrup, J., Ship Design Using Probabilistic Damage
Stability Rules - a Sensitivity Study, Practical Design of Ships and Other Floating Structures,
Elsevier, 2001.
35.
K
oelman, H.J., Damage Stability Rules in Relation to Ship Design, Proc. WEMT’95, pp. 45­
56, eds. J.J. Jensen and V. Jensen, Danish Society of Naval Architecture and Marine
Engineering, Copenhagen, 1995.
36. Jensen, J.J., Baatrup, J., and Andersen, P., Probabilistic Damage Stability Calculations in
Preliminary Ship Design, Proc. Sixth Intl. Symp. on Practical Design of Ships and Mobile
34
Units (Prads’95), Vol. 1, pp. 1.565-1.577, eds. H. Kim and J.W. Lee, Soc. Naval Architects of
Korea, 1995.
37. Vassalos, D., and Tuzcu, C., Safety Equivalence - Meaning and Implementation, 5th Intl.
Workshop on Stability and Operational Safety of Ships, Trieste, paper no. 3.4.1, pp. 3.4.13.4.6, September 2001.
38.
International Maritime Organisation, International Convention for the Prevention of Pollution
from Ships, 1973, as Modified by the Protocol of 1978 Relating Thereto, MARPOL 73/78,
Consolidated Edition, 2002.
39.
International Maritime Organisation, Report to the Maritime Safety Committee and the Marine
Environment Protection Committee, Sub-Committee on Bulk Liquids and Gases, paper no.
BLG 7/15, July 2002.
40.
Dyer, R.C., Regulations and Standards - MARPOL Design and Operating Requirements, E&P
Forum, FPSO/FSU Workshop, Heathrow, June 1998.
41. Karsan, D.I., Aggarwal, R.K., Nesje, J.D., Bhattacharjee, S., Arney, C.E., Haire, B.M., and
Ballesio, J.E., Risk Assessment of a Tanker Based Floating Production Storage and
Offloading (FPSO) System in Deepwater Gulf of Mexico, Offshore Technology Conf. paper
no. OTC 11000, Houston, 1999.
42. Noble Denton Europe Ltd., Quantified Risk Assessment of Jack-up Operations Afloat, HSE
ref. OTO 98 045, August 1998.
43. Konovessis, D., and Vassalos, D., Design for Damage Survivability - Development and
Application of an Optimal Design Procedure, Proc. 2nd Intl. EuroConference on HighPerformance Marine Vehicles (HIPER’01), Hamburg, pp. 291-305, May 2001.
44. International Maritime Organisation, Decision Parameters Including Risk Acceptance
Criteria, paper no. MSC 72/16, submitted by Norway, 2000.
45.
Spouge, J.R., CRASH: Computerised Prediction of Ship-Platform Collision Risks, Soc.
Petroleum Engineers paper no. SPE 23154, presented at the Offshore Europe Conf.,
Aberdeen, 1991.
46.
Commission of the European Communities, COST-301 Shore-Based Marine Navigation Aid
Systems, report no. EUR 11304, 1988.
47. Haugen, S., and Vollen, F., Risk of Collision between Vessels and Offshore Installations in the
North Sea, Proc. Conf. Offshore Safety: Protection of Life and the Environment, Marine
Management (Holdings), pp. 65-71, May 1992.
48.
Boothby, G., Ship/ Platform Collision Risk in the UKCS: Current Levels and Management,
International Conf. on Offshore Emergencies, Energy Enterprise, Aberdeen, June 2002.
49. Andreassen, R., Posisjonering av Plattformer og Skip, Kjettingbrudd NIF Conference,
Fargernes, November 1993.
35
36
ABBREVIATIONS AND NOTATION
ALARP
BMT
CSE
DAE
DNV
DP
FMEA
FSA
FPSO
FSU
GZ
HSE
ICAF
IMO
KG
MARPOL
MODU
MOPS
NMD
NPD
QRA
RABL
RAE
Ro-Ro
SF
SLF
SOLAS
UK
UKCS
UKOOA
US
WOAD
As Low As Reasonably Practical
BMT Fluid Mechanics Limited
Concept Safety Evaluation
Design Accidental Event
Det Norske Veritas
Dynamic Positioning
Failure Modes and Effects Analysis
Formal Safety Assessment
Floating Production Storage and Offloading System
Floating Storage Unit
Righting arm parameter used in a stability analysis
The Health and Safety Executive
Implied Cost to Avert a Fatality
International Maritime Organisation
Height of the centre of gravity above keel level
IMO Regulations on Marine Pollution
Mobile Offshore Drilling Unit
Mobile Offshore Platform Stability (Project)
Norwegian Maritime Directorate
Norwegian Petroleum Directorate
Quantitative Risk Assessment
Risk Assessment of Buoyancy Loss (Project)
Residual Accidental Event
Roll-on Roll-off vessel
Safety Function
IMO Stability and Load Lines and Fishing Vessels Safety Sub-Committee
IMO Safety of Life at Sea Regulations
United Kingdom
United Kingdom Continental Shelf
United Kingdom Offshore Operators’ Association
United States
Worldwide Offshore Accident Databank
37
38
APPENDIX A: SUMMARY OF RABL PROJECT REPORTS
RABL REPORT NO. 1
RABL report no. 1 [1] summarised results from investigations into the occurrence and effects of
blowouts. A brief overall risk evaluation categorised different blowout events using event trees. The
annual probability of blowout was considered (at this early stage of RABL) to be so high that careful
consideration of possible blowout effects was recommended.
The risk of direct buoyancy failure, caused by the gas plume, was considered to be negligible. The
main hazard was considered to be indirect, through severe structural failure due to either fire or
explosion.
Appendix 1 of the report presents results from a MARINTEK study on frequencies of blowout.
Significant differences were found in risks indicated by North Sea and worldwide data. Frequencies
reported for the North Sea were very uncertain, however, because of the small number of incidents. As
it was not possible to prove any significant reduction in blowout risk for the North Sea compared with
the rest of the world, it was considered appropriate to base the analysis on the more conservative
worldwide data for both exploration and development drilling. MARINTEK considered that there was
probably significant under-reporting in the database of shallow gas blowouts outside the North Sea and
possibly the US Gulf of Mexico.
The total blowout frequencies for exploration and development drilling worldwide were 7.2×10-3 and
2.1×10-3 per well year respectively. These frequencies increased to 2.4×10-2 and 7.3×10-3 respectively
per platform year. Annual frequencies for exploration drilling were considered to be so high that a
detailed analysis of consequences was recommended.
Appendix 1 suggests that three measures to reduce the consequences of blowouts should be considered:
•
Design a better diverter system to take the oil/gas away from the platform,
•
Make a reliable system to disconnect the rig from the well quickly, even with a fire on the rig,
•
Be able to move the rig off station with minimum risk of ‘sparks’. (Dropping the anchor chain
presents a high risk of sparks.)
Appendix 2 of the report discusses the hydrodynamic effects of a blowout. This part of the
investigation involved a literature review and model tests at MARINTEK. The main conclusion from
earlier investigations was that a stationary plume caused by a gas blowout does not present any
significant risk of sinking or capsize to semi-submersibles due to buoyancy loss. Reported incidents
where ships had sunk were probably caused by a combination of heeling moment and water-filling.
Model tests investigated the transient effect of a starting blowout on the platform’s dynamic behaviour.
This investigation found that if the first burst of bubbles hits one of the rig’s corners, the pitch and roll
motions could be considerable, but the platform deck would not be flooded in calm water, provided the
blowout rate was within reasonable limits. No tests were performed in waves, which might increase
the risk of deck flooding.
This study concluded that effects of buoyancy loss due to gas blowout do not represent a direct risk to
the platform.
39
RABL REPORT NO. 2
RABL report no. 2 [2] described the development of a risk assessment model for evaluating ballast
system failures and subsequent loss of buoyancy. The risk model was based on specific safety
functions 6 necessary to protect personnel and platform integrity. These safety functions were related to
platform inclination and draught.
The report included a review of past accidents to identify causes and understand the progress of
accidental events. Literature reviewed included official investigation reports into the Ocean Ranger
accident, the MOPS project, various FMEA analyses performed according to NMD requirements, and
the Norwegian SPS (Sikkerhet på Sokkelen) project.
The safety evaluation model was based on the requirements of NMD and DNV for offshore mobile
units. A standard event tree model was developed to describe accident scenarios that might threaten
the safety functions. The event tree model was then used to calculate residual accidental event (RAE) 6
frequencies, which were then compared with established safety criteria. The methodology considered
failure sequences involving technical and operational failures, together with high environmental loads.
The report noted that operational errors are caused partly by inadequate personnel training and
procedures, and partly by inability of the system to handle abnormal conditions. It recommends use of
FMEA analysis to ensure high redundancy and operational flexibility, as already required by NMD.
Risk figures should also be quantified and evaluated against acceptance criteria.
Four safety functions 6 were considered at this stage of RABL: ‘floatability’, ‘evacuation’, ‘escape
routes’ and ‘shelter area’. (The ‘marine controls’ safety function, noted in report no. 8 [8], seems to
have been a later addition.)
The analysis in this report assessed the risk of failure of the ballast system only. The ballast water
system was defined to include ballast water tanks, pumps, associated piping, valves and power supply,
sensors and monitoring equipment, control and operation panels for pumps and valves, including signal
transmission units. The boundary was drawn at the sea chest valves.
The report notes that the history of ballast system failures includes numerous examples where human
operational failures have caused significant loss of buoyancy. The study did not consider human error
as an initiating event. This issue should nonetheless be considered as part of the overall operational
assessment.
Critical events have to be identified, and principles for classifying initiating events established. Critical
events are related to unintended filling of ballast tanks or loss of ballast water, resulting in loss of
buoyancy or abnormal list. A limited number of such events are described as top events, and are the
basis for the event trees. Stability calculations are performed to evaluate the platform against safety
criteria. These are intended to demonstrate the ability of the platform to withstand abnormal ballast
conditions, and the effect of external forces that tend to incline and capsize it.
A case study was performed on a third-generation platform, West Vision, designed to comply with
NMD stability requirements for offshore mobile units. This study showed that stringent stability
demands in both the intact and damaged conditions reduced risks associated with failure of the ballast
system. The ballast system was designed with a high degree of redundancy and operational flexibility.
Results showed that two or more ballast tanks (or compartments) had to be filled in order to obtain an
accidental situation that threatened any of the safety functions. The probability of critical ballast
system failures was low (annual frequency below 10-4). Calculations confirmed that the maximum
angle of heel of this rig never exceeded 15o with one compartment damage, as required by NMD
criteria. Filling two compartments could cause the angle to exceed 15o, however, even in normal
weather conditions. This would represent an abnormal event (i.e. RAE), requiring its frequency to be
estimated.
6
Definitions of safety functions considered during the RABL project, together with other
terminology (e.g. design and residual accidental events - DAEs and RAEs) may be found in
the accompanying notes on RABL reports nos. 8 and 11.
40
An FMEA analysis revealed no single failure or incident that might result in unintentional emptying or
filling of ballast tanks. Combinations of technical and/or human failures might cause critical situations,
but these were considered unlikely because of the high redundancy and flexibility of the system. The
possibility of human failure as an initiating event was not considered.
Survival and operating draughts are the same for this platform, and so the ballast system will not be
operated in bad weather. Ballast system failure in extreme weather conditions was therefore considered
to be unlikely.
Conservative (i.e. pessimistic) probability figures were used for basic events. Fail-safe valves are used
on this rig, and closed if either the hydraulic pressure drops or the electrical control signal is lost.
Separate hydraulic return lines from each valve reduce the probability of blocking several lines.
Unintentional transport of water from one ballast tank to another will not cause critical heel, although
this could happen, in principle, through maloperation of the system.
It was assumed that ballasting/ deballasting take place on average 12 times per year, that two tanks are
emptied/ filled on each occasion, and that the functional test interval is the same as the average interval
between operations of the ballast system (i.e. one month).
Human failures were quantified as follows:
•
Initiation of critical system failure during normal operation: 0.001 per operation,
•
Failure to correct a faulty situation: 0.01 per operation,
Conclusions from the fault tree analysis were:
•
Top event frequencies were low, and the frequency of potential RAEs was far below the
acceptance criteria. Ballast system failures did not contribute significantly to the total risk.
•
Human maloperation, combined with single component failure, was probably the most critical
combination of failure events.
•
Corrective actions may interrupt critical inclination of the platform, but only if sufficient
operational flexibility and tolerances are built into the design.
The frequency of critical system failures on West Vision was negligible, because an unacceptable
inclination would only occur in a strong wind (> 50 knots), and it is not necessary to operate the ballast
system on this rig in heavy weather. This frequency might be higher, however, on platforms that have
to go from operational to survival draught in severe weather.
The study concluded that:
•
A redundant system and its components should be designed according to NMD requirements,
•
The system should have sufficient operational flexibility to handle abnormal ballast conditions,
•
Operational procedures and training should cover handling of abnormal ballast conditions.
The event tree analysis showed that:
•
The total RAE frequency was approximately 7×10-6 per year,
•
Escape routes were most likely to be threatened (i.e. when the heel angle exceeds 15o).
The report concludes with an assessment of ‘other faulty weight conditions’, which include
accumulated weight errors, snow and ice loads, failures in seafastenings, and failures in the fire-water
system. Snow and ice loading were considered unlikely to lead to major stability problems in
Norwegian waters. There was evidence from an incident on West Vanguard that, combined with other
events such as fire and explosion, failure of the fire-water system could lead to increased heel. In
isolation, however, failure of the fire-water system was not considered to be a significant issue. Failure
in seafastenings was considered to be of minor importance. Simultaneous release of all the mooring
41
lines on one side of the rig could cause a transient heel of up to 5 degrees, but, in isolation, this would
not lead to serious stability problems.
Accumulated weight errors might typically correspond to a reduction of 0.25m in the rig’s metacentric
height, which, in isolation, does not represent a serious loss of stability, but might become important
when combined with other factors. Attention should nonetheless be paid to the possibility of
accumulated errors in weight reporting. Certain rigs pass through a low metacentric height condition
when going from operational to transit draught, or vice versa, and in such cases erroneous weight
reporting might lead to a negative metacentric height and a large heel angle. Although this is not a
stability issue, and will not lead to loss of buoyancy, it is a safety risk because it may lead to panic
among the crew.
The report’s conclusions noted that catastrophic accidents (mainly on older rigs) have occurred through
a combination of ballast system failures, operator mistakes and lack of redundant buoyancy. The latest
generation of mobile rigs for North Sea operations seemed to have sufficient redundancy and
tolerances to handle inclination, however, even in the damaged condition. Stringent stability demands
combined with a redundant and fail-safe ballast water system have reduced the risk of fatal accidents
significantly.
The final recommendations suggested that efforts should be made to identify system failures that might
lead to critical ballast operator errors. It was considered important to prepare procedures and establish
a sound understanding of how to handle system failures during critical operations.
42
RABL REPORT NO. 3
RABL report no. 3 [3] presented results from a Technica study to assess the frequencies of ship
collisions with MODUs working on the Norwegian continental shelf. The project did not consider the
consequences of collisions (which were investigated separately under various case studies).
The objectives were:
•
To develop a model to predict the frequency of ship collisions with mobile units, applicable at any
location,
•
To collect data on vessel traffic in Norwegian waters, so as to apply the model to this area.
The collision model had three main sub-models: powered vessel collision, drifting vessel collision, and
powered visiting vessel collision. The vessel traffic data fell into three main groups: merchant ships,
offshore vessels and fishing vessels.
Sample calculations were performed on an Aker H-3 MODU, carrying out either appraisal or
exploration drilling, to demonstrate the use of the models, and to provide sample results for specific
locations. Three locations were considered: Askeladden in the Troms area, the Troll field, and the
Statfjord field.
The results showed that overall collision frequencies were significant, varying between 6.7×10-2 and
1.0×10-2 per year for exploration drilling at the three locations. These results cover all collisions,
ranging from minor damage to loss of buoyancy. Contributions from different vessel types varied
significantly between different areas. The risk of any specific level of damage (not considered in this
study) will therefore vary between areas more than the overall collision risk.
The study concluded that a model had been developed to predict ship collision frequencies with mobile
units, and that vessel traffic data had been collected to enable the model to be applied with confidence
in Norwegian waters.
Although the study did not explicitly consider the consequences of collisions, some account
nonetheless had to be taken of the effects of a collision in order to limit the study. A rig designed to
the IMO MODU Code has to survive at least one-compartment damage, and NMD regulations require
it to survive higher levels of damage, including loss of buoyancy from any one column. These factors
were taken into account when defining the scope of the study and the vessels considered. Only vessels
with potential to cause loss of buoyancy were therefore considered. Only a small proportion of such
collisions, however, would be expected to actually result in loss of buoyancy.
Historical records show that the most likely vessel to collide with an offshore structure is a supply
vessel (40%), with a passing merchant vessel the next most likely (25%). The report notes, however,
significant variations in reporting levels. In many cases significant damage has to occur before an
incident is widely reported. Platform collision frequencies also vary markedly from place to place. In
some areas there is little risk, whereas in others substantial measures have to be taken to reduce risks to
an acceptable level.
Previous work had been based on the judgements of experts in human factors and reliability, ship
collision modelling and analysis, and marine traffic routing. This work had indicated that the most
probable collision vessel types were: errant vessels, blind vessels or drifting vessels. Human error is a
major contributory factor with errant and blind vessels. Drifting vessels depend only on engineering
failure. Various human error scenarios had been considered.
The new study found that a more systematic framework was needed to address the human factors
contribution. Further work was also needed to extend earlier collision modelling (for merchant vessels
and fixed platforms) to other vessels and mobile units.
Major differences between models can come from the way in which the traffic is represented.
Considerable inaccuracy can result if a traffic pattern consisting of routes is represented as an area
density.
43
Three main types of factors have been found to be important: location-specific factors, rig/ platform
specific features, and traffic behaviour. Location-specific factors include the density of traffic,
environmental conditions and the type of location (e.g. open water or coastal, existing field with other
platforms). Platform/ rig features include whether the platform is fixed or mobile, its size, anchoring
system, drilling activity, transport logistics (e.g. number and size of supply vessels), and the collision
avoidance measures in place. Traffic behaviour features include the vessel’s purpose (e.g. visiting or
passing), bridge watch-keeping standards and reliability, propulsion/ steering system performance and
reliability, which can be related to the vessel’s size.
Vessels were split into classes, depending on their type, size and purpose. Collisions from drifting
fishing vessels were not considered, because collisions were not expected to have serious
consequences. Powered visiting vessel collisions were treated separately from passing vessel
collisions, because the factors influencing the collision are different.
The powered vessel collision model was developed from previous work using the CRASH model. It
assumes that shipping is not distributed randomly, but travels along preferred routes, that vessels
keeping an effective watch will only collide with the platform if disabled, but that a certain proportion
will fail to keep effective watch. Two main classes of watch-keeping failure were identified: errant
and blind vessels. Blind vessels only occur in bad visibility conditions with ineffective radar. Other
human factors considered included ‘plannability’, watch-keeping failure for a significant period, and
platform-initiated recovery. Lack of relevant data made the analysis of human behaviour difficult, and
judgement and assumptions were necessary at several points.
The frequency of powered passing vessel collisions was expressed:
CF = N × Fd × P1 × P2 × P3
where:
CF
N
Fd
P1
=
=
=
=
P2
P3
=
=
powered collision frequency (per year), total number of vessels on the route per year, fraction of vessels that will be heading for the platform, plannability factor (probability that the vessel does not plan for the presence of the platform/ MODU), probability of a watch-keeping failure without self-initiated recovery, probability of failure of outside-initiated recovery. The simplicity of this equation belies the difficulty of selecting the probability values within it.
The drifting vessel collision model considers the following factors: the situation (e.g. where the
platform is located, what service vessels are available), the traffic (including drift characteristics of
vessels), causation factors (e.g. whether there is power available to operate the rudder), and
consequences (whether the vessel is large enough and drifting fast enough to pose a threat).
The model for drifting vessel collisions has the form:
CF = N n × P(breakdown) × P(wind) ×
collision diameter
block length
where:
CF
=
Nn
=
P(breakdown) =
P(wind)
=
collision
diameter
block length
number of drifting vessel collisions per year from block n, number of vessels per year in block n, probability of failure occurring, sufficient to cause drift, probability of wind direction from block n to MODU location,
=
ratio of vessel size to block size.
44
This expression is summed over all blocks and wind directions.
The powered visiting vessel model relates to supply vessels, standby vessels and similar, which set a
course directly for the unit. The vessel might fail to alter course or slow down, due to human or
mechanical failure, or both. The collision may be at full speed and head-on.
This model did not consider the most common form of supply boat collision, when the vessel is
manoeuvring close to the unit. Such collisions were considered unlikely to cause damage sufficient to
cause loss of buoyancy.
Direct use can be made of historical data for this type of incident, because it is not location-specific and
only depend on the average number of visits per year. The average collision frequency was found to be
1.4×10-5 per visit. It was estimated that 50% to 75% of such collisions would be full speed and head­
on.
Vessel traffic density was found to be the single most important factor influencing the risk of
collisions. This may be described in terms of defined routes (e.g. for merchant traffic) or area densities
(e.g. for fishing vessels). Vessel momentum and energy are important factors in determining the
consequences of a collision. Vessel behaviour is another key issue, covering its hydrodynamic and
manoeuvring behaviour, its purpose and activities, and crew behaviour.
The collision frequency for a MODU operating at Troll was estimated to be about 3 times greater than
for one operating at Askeladden, and about 5 times greater than for one operating at Statfjord.
Merchant vessels were the highest source (86%) of risk at Troll. The risk from drifting vessel
collisions was much less than from powered vessel collisions, and was in most cases negligible. The
risk of fishing vessel collisions was high at all three locations, but the consequences of most such
collisions would probably be small, due to the relatively small size and low speed of such vessels. The
risk from visiting and passing offshore vessels was also significant at all three locations.
Various recommendations were put forward to improve the extent, quality and usefulness of the traffic
data. Collision avoidance measures were also suggested.
The quantitative results from this study were applicable only at the locations in question. The
techniques would be applicable elsewhere, however, and similar results might be expected in other
areas of the North Sea and UKCS where similar levels of traffic density occur. Some of the data
related to shipping routes that pass through UK waters and go to UK ports. The offshore vessel traffic
related to specific fields in the Norwegian sector, including Valhall, Ekofisk, Ula, Frigg, Heimdal,
Odin, Gullfaks and Statfjord.
Appendices to the report reviewed traffic in other oil-field areas of the world, historical experience of
ship-platform collisions, environmental data and collision avoidance measures. The vessel collision
model was also described.
45
RABL REPORT NO. 4
RABL report no. 4 [4] described an analytical procedure for assessing the risk of buoyancy loss for a
MODU following structural damage due to abnormal loads. The report noted that definite conclusions
about risks of loss of buoyancy, following structural damage due to abnormal loads, awaited
completion of the case studies.
Emphasis was placed on describing methods consistent with a so-called ‘level 2’ risk assessment. The
results can nonetheless largely be processed for a ‘level 1’ assessment. Simple hand-calculation
methods were used during most of this investigation.
Abnormal structural loads may result from direct structural impact or as a consequence of a sequence
of accidental events. There is a small probability of exceeding the design load due to direct structural
impact, but there may be a significant probability of individual events occurring in the accidental event
sequence. With proper design, however, the probability of the combined event leading to an abnormal
load should be small.
Direct structural impact may result from abnormal environmental conditions, inadequate strength,
abnormal collision loads, abnormal falling load impact or accidental moveable weight. Accidental
event sequences may lead to fire/ explosion loads as a result of subsea blowouts burning at sea level,
platform blowouts causing fire/ explosion on deck, or fire/ explosion inside the structure or utility
systems.
The analysis approach was described, including event trees for structural damage. A distinction was
made between two types of collapse: immediate collapse, within seconds or minutes of the abnormal
load, and progressive collapse, which may take several hours. In the first case evacuation is not
possible, whereas in the second there are better prospects for safe evacuation. The top event in each
tree is an abnormal event, which is characterised in terms of kinetic energy, pressure-time or
temperature-time relationships, for example.
The authors also distinguished between collapse of a sub-system (i.e. an individual member or group of
members) and collapse of the total structure (i.e. the deck is immersed, either because the structure no
longer supports the deck, or because of loss of hydrostatic stability).
The usual approach is to ensure that design accidental events have a frequency smaller than a specified
value (e.g. less than 10-4 per platform year). The calculation of structural response to design accidental
events is commonly carried out in a deterministic manner, where the result is either ‘fail’ or ‘not fail’.
The authors note that this approach does not fit in with the event tree approach. Various possible ways
to deal with this problem are outlined. Probabilistic methods may sometimes be used with simplified
calculation methods. Alternatively a notional probability of collapse may be calculated by establishing
the load at which collapse occurs, then assessing variations in the weather statistics, environmental
loads and structural response.
The report outlined procedure for evaluating probabilities of initiating events. Scenarios considered
included collisions, falling objects, explosions, fire, inadequate strength, extreme environmental loads,
and accidental moveable weight. The explosions and fires scenarios were further sub-divided into
blowouts, explosions in the substructure, superstructure fires, utility system fires and sea level fires.
Collision frequencies are dealt with elsewhere (RABL report no. 3 [3]). The authors noted that it is
very difficult to assess the frequency of failure due to extreme environmental loads, because of the lack
of historical failures.
Further work was recommended on probabilities of fire/ explosion following blowout, because of the
high frequencies when based on Gulf of Mexico data. Further work was also recommended on
frequencies of inadequate strength and abnormal environmental loads, because of the lack of historical
data. Procedures for determining loads due to collisions, fires and environmental loading were
considered adequate. Further experimental work on explosions, and work to characterise loads due to
falling objects (cranes) and inadequate strength were recommended. Recommendations were also made
about improvements in structural and progressive collapse analysis.
46
The report indicated that the immediate collapse analysis could be performed in a deterministic
manner. A simple semi-deterministic approach was proposed for non-linear residual strength analysis.
Other conclusions were:
•
The RAE frequency due to falling objects will probably be so low for most platform concepts that
it may be disregarded.
•
Frequencies of explosions and fires in general are significant, and call for detailed assessment.
Frequencies of fire/ explosion due to diesel fuel leakage are low, and RAE frequencies will
probably be so low that they can be disregarded.
•
Frequency data relating to inadequate strength and abnormal environmental loads are almost non­
existent. There are indications, however, that the frequency of limited structural failures due to
inadequate strength may not be negligible.
Appendices to the report described load and structural analysis calculation procedures, the event trees,
and probability values used in these event trees.
47
RABL REPORT NO. 5
RABL report no. 5 [5] investigated the probability that a mooring-induced accidental condition (i.e.
‘tripping’) will lead to capsize or sinking.
The report concluded that tripping is very unlikely to cause capsize or sinking of a conventional semi­
submersible drilling platform. Based on statistical analysis and engineering judgement the frequency
was estimated to be in the range 10-7 to 10-6 per rig year. (WOAD data covers 1,603 rig years, and no
such accidents have been reported.)
‘Tripping’ can occur following multiple line failure on the upwind side of the platform. In accordance
with NMD regulations, the analysis did not consider the possibility of reducing heel by moving ballast.
The analysis considered the risk of mooring line failure due to ‘abnormal strength’ (e.g. weld defects in
chains, or kinks in wires), abnormal environmental conditions, incorrect anchor handling, or accidental
loads. Failure of the anchor itself was also considered.
The report assumed chain failure frequencies between 0.2 and 0.5 per rig year, based on data for chain
manufactured before 1985. No statistics on wire rope failures were available. 7 The authors noted that
anchor chains have failed in so-called ‘hard weather’, but these failures have mainly occurred in
relatively moderate sea states, and several were associated with anchor handling. Structural failure on
the rig itself (rather than failure of the mooring itself) and DP system failure were also considered.
If progressive failure of lines or anchors occurs, the period of time over which the failures develop is
important. There may be enough time to avoid a critical situation, or to evacuate safely. Statistics
indicated that more than 3 mooring lines failed in 1 out of 8 incidents in ‘bad weather’.
Disconnection of remaining mooring lines should be considered. This eliminates the possibility of heel
due to tripping, but may increase the risk of collision or grounding. Quick-release systems may
themselves fail. Riser damage or blowout may be a consequence, and also needs to be considered.
Even if the attempt to disconnect fails, there is still only a small possibility of tripping, and tripping
situations have never been reported in practice. The rig’s heel angle could nonetheless increase after
tripping, and additional factors to be considered include: ballast system failure, accidental shifting of
deck loads, and flooding of compartments.
The report suggested criteria for when tripping should be considered. It was suggested that: (a) the rig
should fulfil present NMD requirements with respect to anchor line failure, (b) the event tree chain
needs to consider the actual rig design.
An appendix to the report estimated the heel angle due to tripping for two different units (Pentagone
and twin-pontoon) in ‘survival’ conditions, under alternative assumptions about the loading. This heel
angle was in the range 2 to 6 degrees.
7
More recent data [49] suggests that chain failure frequencies have reduced to around 1×10-2
per line year for chain manufactured since 1985. Recent data also suggests a slightly lower
frequency of wire rope failures than chain failures.
48
RABL REPORT NO. 6
RABL report no. 6 [6] presented one of the two main case studies performed during the RABL project:
on the Deep Sea Bergen (Aker H3.2) and Treasure Scout (Pacesetter). The first was investigated for all
hazards, but the second for ballast system failures only.
The results showed that collision was the dominant hazard, influencing buoyancy directly through
structural failure. Ballast systems failures were also a significant risk factor, in these two cases, where
there was only one ballast pump room in each pontoon.
The comparative evaluation of ballast systems for the two platforms showed significant differences
with regard to the ‘floatability’ safety function (i.e. the frequency of accidental events causing capsize).
Risks associated with each of the main hazards were presented in the report, relating to the floatability
and escape ways safety functions for the Deep Sea Bergen operating at Smørbukk Sør.
Both platforms were found to have a high capacity to withstand accidental loads, although some
improvements should be relatively easy and cost-effective.
The frequencies of initiating events were found to be fairly high. The largest uncertainties related to
these frequencies, rather than to the evaluation of capacity and impairment probabilities. Further
investigation of these uncertainties was recommended.
The analytical methodology functioned satisfactorily, although some of the assessments were
performed in a simplified manner, due to limited resources. The report recommends that this
methodology should be applied to both existing and new platform concepts.
All frequency assessments were based on an assumed exposure period of one year at a single location.
The risk assessments were performed for three locations: Troll West, Draugen and Smørbukk Sør.
Five safety functions were considered: floatability, evacuation, escape ways, shelter area and marine
controls. The limiting state for the escape ways function was assumed to be a heel angle of 15o, after
which personnel movement on deck becomes difficult.
Deep Sea Bergen Case Study
The Deep Sea Bergen was built in 1982, according to NMD regulations issued after the Alexander L
Kielland accident in 1980, and was considered to comply with all current Norwegian authority
requirements. It had sufficient reserve buoyancy to withstand loss of buoyancy from a complete
column. It had only one ballast pump room in each pontoon, however, unlike more recent platforms,
which have two.
Hazards considered were: mooring-induced heel, collision, burning blowout, superstructure fire/
explosion, substructure fire/ explosion, inherent structural failure, falling object, extreme weather
impact, ballast system failure, subsea gas blowout, and accidental weight condition. These hazards
were assessed individually, and procedures were developed to identify possible inter-dependencies and
combinations of events. The most important combined event was ballast system failure in combination
with other accidental events. Initiating event frequencies were taken mainly from work performed
elsewhere in the RABL programme.
The evaluation of ballast system failures was based mainly on work performed for West Vision in
report no. 2 [2]. This earlier report considered filling/ emptying of only one tank, however, whereas
the follow-up work concentrated primarily on filling of two or more tanks. The initiating event
frequency (i.e. frequency of heel greater than 15o) was estimated to be 2.3×10-3 for Deep Sea Bergen
operating on Troll West. The frequency was location-dependent because of the threat of collision
impacts. The result was found to be very sensitive to assumptions made about human error, which
occurred in several places in the event tree. These frequencies were relatively high compared with
equipment failures. Further studies of ballast failures should concentrate on this aspect in more detail.
49
The influence of other accidental events, that are not critical in themselves, but may damage the ballast
system, thereby leading to a potentially critical situation, is also considerable. The result depends on
collision frequency.
The technical failure that had the largest influence on the top event frequency was common-mode
failure involving the hydraulic system, but this influence was very small.
Blowout probabilities were extracted from RABL reports nos. 1 and 4 [1, 4].
Collision frequencies were calculated using the Technica model described in RABL report no. 3 [3].
Troll West was selected as a high-risk location, and Haltenbanken as a lower-risk location. Draugen
was selected as the representative area on Haltenbanken, but after assessing frequencies for this
location it was found to be close to shipping routes for ore carriers from Narvik to European ports, and
therefore had a high collision risk. A lower-risk location on Haltenbanken was therefore also selected:
Smørbukk Sør. Moving the rig location by only a few kilometres could have a significant effect on
collision risks.
Only powered collision risks were considered. Collision frequencies for drifting ships were in all cases
less than 10-6 per year, except for passing offshore vessels at Troll. The energy level associated with
drifting standby and supply vessels was so low that the risks could be disregarded.
Frequencies for fire/ explosion were based on data from Veritec. The frequency of fires in the pump
room in the pontoon was 1.2×10-4 per platform year, and that of explosion in the pump room was
6×10-5 per platform year. RABL report no. 6 [6] had shown the frequency of a short-duration platform
fire to be 7.7×10-4 per platform year, and the frequency of a long-duration platform fire to be 1.7×10-4
per platform year.
Abnormal loads/ strength. The frequency of failure of two bracings simultaneously was estimated to
be about 10-4 per platform year.
Falling loads. A similar annual frequency was estimated for a severe hit on a pontoon by a falling
object. A simple energy assessment concluded, however, that it was virtually impossible for a crane
boom or pedestal to impair the pontoon sufficiently to cause loss of buoyancy. No type of event was
found to be capable of flooding more than one compartment.
RABL report no. 5 [5] showed that the frequency of mooring induced heel, due to multiple mooring
line failures, is very low. A further scenario was considered: release of anchor lines following a
blowout, but with a few lines remaining attached on the leeward side in a strong wind. The following
indicative frequencies of tripping situations were obtained: 2×10-4 per platform year for exploration
drilling, and 7×10-5 per platform year for development drilling.
The risk that a severe accidental weight condition would result in loss of buoyancy was disregarded,
because the moment was too small.
Particular emphasis was placed on ship collisions because: (a) the probabilities of collision were high,
and (b) collisions have potential for directly impairing buoyancy members. Two situations were
considered to be most relevant: collision against the columns, and collision against the vertical trusses
running from the columns to the deck. In the operating condition the pontoons and horizontal bracing
are deeply submerged, and will only be hit by large vessels with kinetic energies exceeding the credible
absorption capacity of the platform.
The initial response of a column was found to be governed by local indentation. The load caused by
indentation was likely to exceed the limiting collapse load in bending when the indentation was greater
than the column radius. This was taken to be the failure criterion. At the same time severe plastic
deformations were envisaged in the deck girders resting on the top of the column. Resulting cracks
would lead to flooding. Even small cracks could lead to loss of stability within one hour. The total
energy dissipated by a large column at the instant of collapse was predicted to be in the range 65 MJ to
75 MJ. The corresponding energy range for a small column was 35 MJ to 40 MJ.
50
Lower levels of damage were characterised by rupture of the shell plating in the collision area. This
event was considered to correspond to one or two compartment damage.
Major explosions in columns may lead to loss of buoyancy, either by loss of structural integrity or by
flooding due to rupture of the shell. Major explosions in the deck area above the columns may blow
out the walls of the deck girders, and jeopardise the support of the column at the deck. The column
may then be subject to progressive collapse, depending on the intensity of the wave forces. The effect
of fire on the sea surface was also considered.
The ultimate load for deck failure in extreme weather was 3 times the 100-year design wave load,
with a probability of failure estimated to be about 10-5 per year.
A damage stability analysis was performed to investigate the extent to which the platform could
tolerate water filling without developing the critical heel angle. It was assumed that one-compartment
filling would never lead to heel in excess of 15o. Damage stability calculations in the stability book for
Deep Sea Bergen were used to reduce the amount of work necessary. Results showed that the platform
has only a very limited tolerance for filling of two tanks. Three two-tank combinations were
considered to be of particular interest. Filling these tanks, on their own, would not exceed the 15o
limiting condition, but the addition of a 50-knot wind would exceed this condition. Filling of more than
two tanks was not considered, as it was concluded that the platform could not tolerate this level of
filling without incurring critical heel.
The report discussed the distinction between RAEs and DAEs, and the five safety functions considered
during this study. These are defined in accompanying notes on reports nos. 8 and 11. The analytical
assessment was limited to the SF1 and SF3 (‘floatability’ and ‘escape ways’) safety functions, due to
the limited resources that were available.
Results presented in the report include RAE frequencies for these two safety functions when in
exploration and production drilling conditions, together with frequencies of impairment of the
floatability and escape ways safety functions at the 3 platform locations. Contributions to these two
safety functions for exploration drilling at Smørbukk Sør (n.b. with low traffic density) are also shown.
Differences between frequencies for exploration and production drilling were generally small. Risk
levels for escape ways were consistently higher than for floatability. Results were location-dependent,
mainly due to differences in collision risk.
Collisions, blowout and ballast failures were the three dominant hazards. RAE frequencies for the
dominant hazards were significantly in excess of the NPD criterion of 10-4 per platform year.
Impairment frequencies due to blowout risk can be reduced mainly by reducing the frequency of
blowout itself. Results for West Vision [2] had earlier shown that having two ballast pump rooms in
each pontoon (as on a third-generation or later platform) significantly reduces frequencies associated
with ballast system failure. Reserve buoyancy did not provide much extra protection, because many of
the structural failures were likely to cause flooding of the reserve buoyancy compartment. Additional
compartmentation was suggested as a practical means to improve reserve buoyancy at relatively low
cost.
These results indicated that the ‘inherent safety level’ for a rig based on post-1982 NMD regulations
was between 5×10-4 and 10-3 per platform year. For the dominant hazards (collision, ballast failures
and blowout) a complicating factor was that these scenarios might develop into uncontrollable
conditions very rapidly.
Treasure Scout Case Study
The Treasure Scout was a Pacesetter platform, delivered in 1982, and later converted to comply with
new NMD requirements after the Alexander L. Kielland accident. Two columns were added during the
conversion. The ballast system was similar to that on Deep Sea Bergen, with one pump room in each
pontoon and a central control room on the main deck. There were two ballast pumps in each pump
room.
51
The earlier ballast system fault tree for Deep Sea Bergen was used wherever possible. On Deep Sea
Bergen it was impossible to operate the system in such a way that water could be pumped from one
tank to another. This removed one potential failure mode, but also reduced the system’s flexibility.
Water could be pumped from one tank to another on Treasure Scout.
Treasure Scout could tolerate far more combinations of two tanks being filled that Deep Sea Bergen.
In these cases, filling of two tanks did not necessarily cause the heel to exceed 15o. The calculations
for Treasure Scout gave a frequency for the top event in the fault tree of 2.7×10-3 per platform year.
This frequency was somewhat higher than for Deep Sea Bergen, but the level of uncertainty in both
sets of results was considerable, and the difference was not considered to be statistically significant. It
was considered difficult to draw final conclusions without a more detailed quantitative study.
The report compared impairment frequencies for the two platforms. Although the initiating event
frequency for Treasure Scout was slightly higher than for Deep Sea Bergen, Treasure Scout was more
robust against flooding. This meant that the impairment frequency was significantly reduced. The
difference was smallest for the ‘escape ways’ safety function. The main difference was seen in the
‘floatability’ safety function. This meant that the more severe the event, the greater was the difference
between the two platforms.
Neither platform had ballast pump rooms at both ends of each pontoon, as required by present-day
regulations.
The results showed that system flexibility is essential, when there is only one pump room in each
pontoon. Stability characteristics are also important, however.
52
RABL REPORT NO. 7
RABL report no. 7 [7] described the second case study performed during the RABL project. The
report concluded that the procedures developed during RABL were generally adequate for assessing
risk of buoyancy loss, but there was a need for further work on defining acceptance criteria for the
safety functions, and establishing basic risk data used in the consequence analysis. There was a need
for experts in several disciplines to be involved, so as to consider risks related to a range of hazards.
The platforms considered during this study were the unconverted version of Treasure Hunter and West
Vision. Treasure Hunter was an Aker H3 design, representative of a rig built in 1977, before NMD
regulations were revised in 1982/3. West Vision was representative of a third-generation design.
The Treasure Hunter study considered collisions, ballast system failures and fire/ explosion. The West
Vision study considered ballast system failures only. The report summary presented results for
Treasure Hunter during exploration drilling on the Troll and Draugen fields. Collision was found to be
the dominant hazard, as a result of high collision frequencies established in RABL report no. 3 [3]. The
report noted that some of these values were very uncertain. The most significant improvement relating
to the ballast system was the improved stability characteristics of West Vision, combined with the fact
that Treasure Hunter had only two pump rooms, whereas West Vision had four.
In view of the large risks from collisions, the report recommended use of guard boats, which were
regarded as the only feasible solution.
Treasure Hunter Case Study
As previously, only powered collisions were considered. The analysis considered impacts against a
corner column, against one of the outer horizontal bracing members, and against one of the outer
vertical diagonal bracing members. The corner column completely failed when the energy of impact
was 38 MJ, and was punctured when the energy was 5.6 MJ. Results showed that:
a) Collision between the rig and any of the listed ship categories led as a minimum to two­
compartment damage, resulting in a heel angle of more than 15o. This resulted in impairment of
the escape ways safety function.
b)
Collision with a ship of more than 1100 tonnes displacement would probably lead to capsize,
resulting in impairment of the floatability safety function.
Frequencies for impairment of the escape ways safety function due to collision were in the range 1.3 to
3.0×10-2, and frequencies for impairment of the floatability safety function were in the range 1.0 to
1.4×10-2 per platform year, depending on location and whether the rig was engaged in exploration or
appraisal drilling.
Treasure Hunter was selected to demonstrate the applicability of the analytical model for estimating
risks associated with ballast system failure. The ballast system was assumed to consist of ballast
water tanks, pumps, piping and valves located in the propulsion machinery/ pump room, the hydraulic
supply to operate the ballast valves, and the control/ monitoring system. The system boundary was
drawn at the sea chest valves. Procedures for operating the ballast system were not available, and an
analysis of human interventions was not performed.
A stability analysis had to be performed, because at the time the Treasure Hunter was built, the
authorities did not require the platform to withstand an inclining moment in the damaged condition in
heavy weather. The analysis considered the angle of inclination following unintentional filling or
emptying of single ballast tanks. The effects of wind and waves were not taken into account. Filling of
either a forward tank or machinery/ pump room exceeded the escape ways criterion (15o heel). When
the effects of wind were considered, several single-tank conditions contributed to the risk. Previous
studies had shown that wave-induced responses could also contribute significantly to the risk.
It was concluded that:
•
Filling the pump rooms or forward water ballast tanks is an unacceptable event, in terms of
impairment of escape ways,
53
•
Filling one of certain other ballast tanks is an unacceptable situation in bad weather,
•
Filling of other single tanks may be critical, depending on wave motions,
•
Unintentional filling of two or more tanks is unacceptable. This could result in flooding of the
chain lockers, and further filling of compartments through air pipes, threatening floatability.
The possibility of human error as an initiating event was not considered, but human maloperations in
connection with corrective actions (e.g. failing to close an open valve) were considered.
Minor ballasting operations were not considered. Major ballasting operations were assumed to take
place on average 12 times per year. Two tanks are emptied/ filled during each such operation (one per
pontoon). The total RAE frequency for ballast system failures related to impairment of escape ways
was estimated to be 1.0×10-3 per year.
The probability of flooding due to fire at various locations on Treasure Hunter was generally
considered small/ negligible. Risks of capsize due to blowouts were also very small.
The report presented RAE frequencies for Treasure Hunter at Draugen and Troll. In general the
differences between the two locations were found to be small, and there were only small differences in
impairment of the safety functions for ‘escape ways’ and ‘floatability’ due to collision. The second
result was due to the high level of energy to be absorbed in almost any collision. Most collision
scenarios resulted in impairment of both safety functions.
West Vision Case Study
A ballast system study was performed on the West Vision. The angle of heel following one­
compartment damage never exceeded 15o, as required by the criteria. A number of critical cases for
two-compartment damage (i.e. heel angle exceeding 15o, even during normal weather conditions) were
identified.
Frequencies of major ballasting operations were assumed to be the same as for Treasure Hunter. The
functional test interval was assumed to be equal to the interval between operations of the ballast
system.
Results showed:
•
The frequency of filling of one or more ballast tank was estimated to be 7×10-4 per platform year.
•
The frequency of potential RAEs (i.e. filling of two or more tanks) was far below the acceptance
criteria.
•
The reliability of the ballast system during other accidental conditions (e.g. fire/ explosion) was
not considered.
•
Human maloperation of the ballast system combined with single component failure is probably the
most critical combination of failures.
•
Corrective actions may be taken to prevent the platform reaching its critical heel angle, because of
operational flexibility and tolerances built into the system design.
The report noted that the operational and survival draughts on West Vision are identical. The RAE
frequency might be higher on platforms where the ballast system has to be activated in order to go from
operational to survival draught.
The calculated RAE frequencies for ballast system failures related to impairment of the ‘escape ways’
safety function were approximately 1×10-5 per platform year.
54
RABL REPORT NO. 8
RABL report no. 8 [8] was the final synthesis report on the first phase of the RABL programme. It
focussed on the analysis procedure, key results and conclusions from case studies undertaken up to that
point. These case studies were based on one platform built after 1985/6, two platforms built around
1982 to 1983, and one platform from the late 1970s. It was assumed that any mobile platform will be
designed to meet all requirements stipulated by NMD since January 1982, together with any common
classification society rules. This principle applied to ballast system and intact stability requirements.
Damage stability requirements varied between the four platforms, in order to illustrate the
consequences for a platform that does not meet full present-day NMD requirements.
The case studies demonstrated that the analysis methodology was robust and sensitive to differences in
platform concept design. The following aspects must, however, be given specific attention during the
assessment:
•
Probabilistic assessment of collision impact loads and responses;
•
Ballast system failure frequencies in relation to stability characteristics;
•
Inter-dependencies between different hazards, which may lead to combined adverse effects
(extremely important for ballast system failures).
Although this report was based on other reports in the RABL series, it did not summarise any of them.
The focus of this report was on use of the analysis procedures in practical platform evaluation, based
on results and conclusions from the RABL programme as a whole.
The approach and principles adopted were based on those developed for ‘Concept Safety Evaluation’
of fixed platforms by the NPD. This general approach had been tailored to the specific needs of
buoyancy loss of floating platforms. In particular accidental events were classified into Design
Accidental Events (DAEs) and Residual Accidental Events (RAEs). Further information on these
issues may be found below, and in accompanying notes on RABL report no. 11 [11].
Buoyancy loss due to subsea gas blowouts was found not to be a critical hazard. Ballast system
failures and structural failure caused by a collision were found to be the dominant hazards leading to
buoyancy loss. Collision risk was the most significant hazard, but there were uncertainties in the
values used during this study. The probability of total structural failure of a column was considered to
be so high that the reserve buoyancy requirement of NMD was seen to be an essential element of
protection. The same conclusion would apply even if collision frequencies were reduced by one order
of magnitude (the level of uncertainty in the present model data). Structural design should ensure that
column structural failure does not impair the reserve buoyancy function.
The report noted that RABL was never intended to develop new regulations, or propose how existing
regulations might be amended. It nonetheless indicated possible ways in which this might be done.
The terminology made an important distinction between ‘capsize’, resulting from an increase in heel
angle until progressive filling occurs, and ‘sinking’, resulting from symmetric filling and causing a
progressive increase in draught until buoyancy is lost, without significant inclination.
Analysis Approach
Details of the analysis methods may be found below, and in accompanying notes on RABL report no.
11 [11].
The analysis involved an assessment of frequencies for initiating events, together with an assessment of
conditional probabilities for specific event sequences. The aspects requiring most effort were ballast
system failure frequencies and collision frequencies. Other frequency models were more superficial.
Consequence assessments were also needed to evaluate the performance of the platform and its main
safety functions. The scope of work for RABL did not include the development of models for
assessing accidental effects, and so existing consequence models were used, these being considered
55
adequate for the purpose. The assessment of accidental effects primarily involved stability calculations
and structural analysis.
This assessment considered accidental events and conditions defined in the event tree, some of which
would have such severe consequences that they were not considered further. Critical considerations
were therefore loads that caused marginal impairment, and the frequency of occurrence of conditions
and sequences causing these marginally critical loads.
Hazard Definition
The report noted that the focus of the RABL programme was on accidental loss of buoyancy after a
major ballasting failure, severe collision or other high energy event. It noted, however, if any minor
event has the potential to escalate, and possibly cause a severe hazard, it needs to be addressed.
Hazards that cause only marginal effects, such as minor contact between a platform and supply vessel,
were considered never to impair the safety functions.
The relevant hazards considered in the RABL programme were associated with damage stability and
associated conditions. Intact stability and conditions were not considered.
The main part of the RABL programme (i.e. the part of the programme covered by Report no. 8 [8])
considered hazards associated with semi-submersibles on location engaged in exploration drilling,
appraisal and development drilling. It also concentrated on conditions typical of North Sea and
Northern Norway offshore areas.
The following hazards were defined as applicable to large scale loss of buoyancy for semi­
submersibles in drilling mode:
•
Subsea gas blowout,
•
Ballast system failure,
•
Collision with a ship or other installation,
•
Mooring induced heel,
•
Dropped object/ abnormal weight condition,
•
Structural failure.
Structural failure was further subdivided into:
•
Burning blowout,
•
Utility systems fire and explosion,
•
Inherent structural failure,
•
Extreme environmental load.
The report presented total loss frequencies for semi-submersibles, based on data from the WOAD
database for 1970-1983. It was noted that the majority of platforms from which statistics have been
generated had safety standards below present day rigs. Care is therefore needed when interpreting and
using historical statistics to estimate future risk levels.
The blowout database reported total loss of two semi-submersibles due to blowout.
Safety Criteria
The report noted that the safety criteria did not distinguish between sinking and capsize, but these
scenarios were treated separately where relevant.
It also stressed that the safety functions were defined as functional requirements only. The analysis
will have to consider how these general requirements should be interpreted for any particular platform.
Minimum requirements were established for two aspects:
56
•
The minimum time required to carry out a safe evacuation,
•
The maximum average heel angle at which safe evacuation is possible.
The ‘floatability’ (SF1) safety function is intended to ensure that the platform remains intact in the
floating condition for long enough to obtain external salvage assistance, and is the only safety function
concerned with protecting the installation itself. The platform may have to remain in this condition for
a period of several days. This period should be not less than the time required to evacuate personnel.
The report noted that this criterion may be interpreted simplistically as copying the damage stability
requirements of NMD, which will determine the maximum static heel angles associated with various
combinations of failed compartments.
The report noted that revised guidelines were being developed by the NPD, considering functional
requirements for stability, and the behaviour of the platform under dynamic as well as static loads.
Dynamic analyses were not performed during the RABL case studies.
Loss of floatability may result either in capsize or sinking. It is possible to salvage a capsized platform,
provided that it does not sink. For the purposes of RABL, however, it was assumed for simplicity that
floatability would be impaired if complete capsize occurs.
The ‘evacuation’ (SF2) safety function requires that the platform shall remain in a controlled condition
until a safe evacuation has been completed, taking accidental conditions on board the platform into
account. It is both installation and location dependent The maximum heel angle should allow safe
launching of lifeboats, and the waterline should not threaten the mustering area or the lifeboat itself.
Shelter areas should be well defined, and should remain intact until safe evacuation is completed,
taking account of the response time needed to obtain external assistance. Parameters that are important
include time duration, inclination angle, rig draught, and motions due to wind and waves. Passage from
the shelter area to the means of evacuation must be considered when evaluating the evacuation safety
function. The time for safe evacuation will depend on the means of evacuation, possible external
resources, distance to other installations and onshore, and on other traffic in the area. Helicopters and
lifeboats may be considered for evacuation. A simplistic assumption might be to use a four-hour
period, which should allow for evacuation by lifeboats or helicopter.
The ‘escape ways’ (SF3) safety function should ensure that at least one escape route from central
positions to evacuation stations is available, and remains useable from central to mustering stations for
a specified time after the incident. The escape should be to the shelter area, or to evacuation stations if
there is no shelter area. Time should be allowed to seek and assist injured personnel, and for
combating and mitigation actions.
Present NMD requirements state that it should be possible to evacuate the platform in a safe and
realistic manner within 15 minutes of the alarm being given. This time does not allow for seeking and
assisting injured personnel. Escape ways should therefore remain intact for longer than 15 minutes.
NPD requirements for production installations require that escape ways should be useable for one hour
after an incident. The report suggested, however, that instead of specifying a one-hour limit, the
functional requirement should be used. The time period should therefore be sufficient to allow safe
escape from all main areas, allowing for escape of injured personnel and control of the platform. One
hour should be regarded as the minimum time required.
The maximum heel angle at which personnel can move efficiently about the deck was defined as 15
degrees, based on discussions with parties in the RABL programme. This heel angle was considered to
be close to the maximum angle for safe launch of lifeboats. Because this angle is small, the frequency
of impairment will often be greatest for this safety function. The report suggested that RAE
frequencies above the cut-off limit may sometimes be acceptable, after evaluation of all aspects.
The ‘shelter area’ (SF4) safety function requires that the shelter area should not be flooded during a
DAE. The relevant time duration is that required for safe evacuation, such as four hours. The report
notes that it is often not necessary to distinguish between the ‘escape ways’ and ‘shelter area’ safety
functions.
57
The ‘marine controls’ (SF5) safety function requires that marine and drilling operations control
functions should not be affected by progressive inclination until after necessary shut-down and shut-in
functions have been completed. The minimum period should normally be the same as that required to
evacuate the platform.
The intention is to ensure that control functions are not impaired by a non-critical event. Relevant
marine control functions are the ballast system, DP system and anchoring system. Well control and
shut-in systems will also have to remain intact. Control centres, power systems and routing of cables/
lines should all be considered. The interpretation of this safety function depends on the flooding of
particular essential rooms, and depends strongly on platform layout.
The report showed typical relationships between heel angles and durations associated with these five
safety functions.
DAEs and RAEs
Design accidental events (DAEs) are events and conditions on which design loads are based, and their
use is part of the design process. Residual accidental events (RAEs) are used to ensure that the
platform has a satisfactory safety level.
A DAE is one that will never impair any of the safety functions in any reasonably foreseeable
condition. Design accidental loads are assessed for the most severe accidental condition which does
not lead to impairment. Accident frequencies for DAEs are only of limited interest.
Formulae for estimating RAE frequencies were quoted in the report. These were essentially standard
risk calculation formulae for combining frequencies in an event tree. The report noted that some
frequencies are standard values, while others are based on historical accident statistics combined with
engineering judgement. Some frequencies may have to be estimated subjectively. Cut-off frequencies
should always be considered in relation to the uncertainties.
The approach adopted in RABL was to evaluate RAE frequencies versus cut-off for each hazard and
each safety function separately. A very low value in one category cannot be used to compensate for a
high value in another.
It is necessary, however, to add together risks associated with all accidental events within a single
category, before comparing the total risk with the cut-off criterion. Thus risks from all types of vessel
collisions have to be combined together, before making the comparison.
A risk value above the cut-off limit does not necessarily mean that reduction measures will have to be
implemented - only that the feasibility of such measures will have to be assessed in relation to technical
and economic factors (i.e. consistent with ALARP principles.) Impairment frequencies below the cut­
off limit do not necessarily mean that no further actions can be implemented - only that they are
voluntary.
The report noted that life cycle risks may be estimated for fixed installations, but not for mobile units,
because a mobile unit may operate anywhere in the world. The assessment was therefore based on one
specific year of operation only, assuming that it carries out the same type of operation at one location
for this entire period.
DAEs form the design basis. Detailed design has to ensure that these loads and conditions will be
tolerated by the platform systems and structure. The detailed design has to be in accordance with
standards used when evaluating the platform concept.
The report notes that accidental event frequencies are strictly only needed for RAEs, but in practice it is
often necessary to estimate frequencies for both DAEs and RAEs, because it is not always obvious
which events will end up as RAEs and which as DAEs. The report also noted that frequency
assessment in a risk analysis is often less accurate than in a reliability analysis. Uncertainties are often
larger, and the results should be regarded more as orders of magnitude than as absolute values.
58
Case Study Experience
Overall experience from the four MODU case studies was discussed. These demonstrated that it is
feasible to develop a design basis by applying probabilistic design methods. The report noted that
ordinary stability books may to a large extent serve as a basis for evaluating the impairment of safety
functions.
The ballast failure frequency model used a fault tree approach, and will have to be constructed for each
ballast system to reflect specific system features. The most significant difficulties were found in
modelling human factors, control systems and common mode failures, the first of which had the
greatest impact on the results.
The case studies focussed on two safety function aspects:
•
whether the rig’s inclination exceeded 15o, making escape over the deck difficult;
•
whether the inclination exceeded a critical angle at which stability was permanently lost, causing
rapid filling, followed by sinking or capsize.
Three broad safety categories were considered:
•
when the rig’s inclination is less than 15o, and no safety function is impaired;
•
when the inclination exceeds 15o within 1 hour, but remains below the critical angle for functions
SF2, SF4 and SF5 for the initial 4 hours only, implying that SF1 and SF3 are impaired, but other
safety functions are not impaired;
•
when the inclination is as above, but remains below the capsize angle for a period of 2 to 4 days,
implying that SF3 is impaired, but SF1, SF2, SF4 and SF5 are not impaired.
The following safety functions were then given primary attention: SF3, SF1 and SF2, in this order of
priority.
In only one case study (no. 1, presented in RABL report no. 6 [6] - for ballast system failure) all safety
functions were assessed. Inherent risk levels for this same case study were also presented.
The report also presented annual frequencies of impairment due to collision from different classes of
ships at both the Smørbukk Sør and Draugen locations (the second with a much higher level of traffic).
Merchant vessels were the dominating risk factor at Draugen.
The report noted that the impairment frequency for the ‘floatability’ safety function was between
1.9×10-3 and 1.7×10-2 per platform year, depending on location. A value of 2.3×10-3 had been
indicated by the WOAD worldwide accident statistics. These values also fell within the very broad
range (8×10-5 to 9×10-2 collisions per platform year) indicated by an earlier JP Kenny study.
Collision risk levels were found to be high, and the report recommended various actions to reduce
sources of uncertainties in this area. The report suggested that the case study results have an
uncertainty of about one order of magnitude, but noted that collision risk would still be a significant
risk factor even if its value was reduced by one order of magnitude.
Damage Stability Requirements
The report recommended that the platform should be protected against a serious collision, and noted
that the most likely mode of failure is structural failure of a column. Reserve buoyancy in the upper
deck is intended to provide protection against this scenario. The report noted, however, that the results
from the case study indicated that a significant volume of the deck could be flooded in the same
incident as the column, due to failure in the coupling between the deck and column. Some form of
watertight division was suggested.
59
Norwegian reserve buoyancy requirements were seen as a necessary aspect of safety protection for
mobile platforms.
A more detailed study on the benefits of having deck reserve buoyancy was also reported (based on
results from RABL report no. 6). A platform with reserve buoyancy could survive impacts with
energies up to about 65 MJ, whereas one without reserve buoyancy failed at around 22 MJ. This result
was based on calculations which showed that a semi-submersible shell structure could absorb impacts
in the 20 MJ to 25 MJ range without suffering indentations greater than 1.5m (a level of damage
similar to that assumed in international damaged stability standards). At 60 MJ to 70 MJ the structural
integrity of the column as a whole, and of the deck-structure connection, was likely to be impaired.
The report compared the 22 MJ and 65 MJ survival thresholds with probability distributions of impact
energy at two different locations (high and low traffic densities). At the low traffic density location
(ignoring low-speed attendant vessels) there was 98% probability that the 1.5m penetration depth
would be exceeded, given that collision occurs, whereas there was 66% probability of exceeding the
reserve buoyancy limit. Corresponding values for the high traffic density location were 98% and 22%.
Comparisons
Comparisons were made between results from the four case studies for impairment of the ‘escape
ways’ safety function (SF3).
There were significant differences between the first and second-generation designs, because only the
later design had reserve buoyancy. The report noted, however, that some of the benefit of having
reserve buoyancy would be lost through damage to the deck in a severe collision.
The third-generation design showed a significant reduction in impairment frequency associated with
ballast system failure, as a result of having pump rooms fore and aft in each pontoon. A significant
contribution to the differences nonetheless came from differences in stability characteristics.
Differences in layout and design of the ballast system were also important. Each particular system
therefore required its own risk assessment to investigate combinations of failures. FMEA was not
sufficient for this type of assessment.
Differences in risks associated with fire, explosion and blowout were associated with structural
differences. The most cost-effective way to reduce the risk was nonetheless considered to be through
reducing the risk of fire or explosion in the first place.
Impact energies in the range 20 MJ to 80 MJ were found to have the highest frequencies. Reserve
buoyancy was sufficient to protect against dedicated vessels colliding at high speed (such collisions
occur with significant frequency), and also protected against collisions by the smaller of the passing
merchant vessels. The report concluded that reserve buoyancy provides a significant and necessary
improvement of the safety margin. No protection is possible against collision with larger merchant
vessels, but the frequency of these collisions is low at most offshore locations.
Collisions were found to be the only type of accident where the risk level was sufficiently high to show
a demonstrable need for reserve buoyancy in the upper deck.
60
RABL REPORT NO. 9
RABL report no. 9 [9] presented results from an additional case study on a semi-submersible used as
an accommodation platform. The analytical procedure developed for MODUs was applied to the
accommodation platform, but some modifications to the hazard models were necessary. The main
differences were:
•
the additional risk of collision with the adjacent fixed installation,
•
elimination of the direct risk from blowout at the flotel itself,
•
reduction in the risk of collision from passing ships, because a fixed installation is marked on sea
charts, and also because a flotel is ‘shielded’ behind the fixed platform from certain directions,
•
accidental events on the fixed installation (e.g. blowout, fire/ explosion, dropped objects, collision,
extreme environmental loads) may affect the flotel.
The risk of ballast system failure is almost unaffected by the change from a MODU to an
accommodation platform. The ballast system on a flotel will generally be operated less frequently than
on a MODU, however, reducing the risk for the flotel.
Indirect risks associated with events occurring on the fixed platform were considered in the analysis.
Risks arising from a ship collision and extreme environmental loading on the fixed platform were
considered to be low compared with the risks of direct collision/ environmental loading on the flotel
itself. The only events considered to present significant risks were blowouts and fire/ explosion
associated with activities on the fixed platform. Blowout is primarily of concern in relation to fire on
the sea surface. Fire on the fixed platform will generally not threaten the integrity of the flotel.
There is a close relationship between collision with the fixed platform and extreme weather. This
represents a combination of hazards. The additional risk associated with collision between the flotel
and the fixed platform represented a very small addition to the total collision risk, however, for a
modern flotel with significant thruster capacity.
It was assumed that anchor line failure is most likely when the flotel is in the storm position (typically
150m to 200m from the fixed platform), or moving to this position. A special fault tree was developed
to model collision between the flotel and fixed platform, and the consequences. This took account of
bad weather, DP failure, failure of one or more mooring lines, tripping, and tug assistance failure. The
conclusion was that the collision frequency is 3.3×10-5 per platform year for a modern flotel with K4­
type chain moorings and a DP system/ thrusters. The resulting annual frequency of global collapse of
the flotel was estimated to be in the range 3×10-6 to 3×10-9, and therefore represents a low risk event.
Although not of concern to RABL, there were indications that the risk to the fixed platform (especially
a jacket) may be more critical than the risk to the flotel.
Assuming that the annual frequency of ignited oil blowouts was 2.5×10-3, the annual frequency of a fire
burning under the flotel was estimated to be around 10-4. A similar frequency was found for ignited gas
blowouts. This value was considered significant. The estimated frequency of ignited oil riser leaks
affecting the flotel was two orders of magnitude smaller, and the risk was considered to be negligible.
The risk of a gas cloud forming around the flotel and igniting was of intermediate significance.
Based on results from earlier case studies on MODUs, the main areas of concern for flotels were
considered to be collisions from passing ships and ballast system failures. Collisions between the
floating and fixed platforms were considered to be of lesser importance.
It was noted that a flotel operating in conjunction with a fixed platform in Norwegian waters would fall
under the jurisdiction of the Norwegian Petroleum Act of 1985, and would have to meet NPD
requirements. RABL did not investigate the extent to which NPD safety functions might differ from
those of NMD.
The safety functions of concern to NPD are those associated with ‘escape ways’, ‘shelter areas’ and
‘floatability’ (i.e. the main support structure has to maintain its load-carrying capacity for a specified
61
time.) The report noted that the five safety functions considered in RABL cover a broader range of
issues. It was therefore assumed that the RABL safety functions would be applicable to flotels. It was
further suggested that it would be logical for authorities to adopt the same approach as developed in
RABL for all floating platforms.
The report questioned whether the cut-off limit, originally defined for MODUs, is appropriate to
flotels, which are operated in a different way. It was noted, however, that the cut-off used in RABL
came from NPD, and so there should be no conflict.
62
RABL REPORT NO. 10
RABL report no. 10 [10] described a further extension of the RABL programme to include production
platforms. The analytical procedure developed for MODUs was also found to be applicable to
production platforms, although some modifications to the hazard models were found to be necessary.
The most important new hazard, compared with MODUs, was found to be process-related fires and
explosions. Utility system fires only were considered for MODUs, and so an entirely new frequency
evaluation was needed. The report noted that these risks are specific to each installation, because they
depend on the process plant and the types of equipment in use. The analysis was therefore performed
on a reference system equipped for production of oil and gas, which are separated, compressed and
exported via two pipelines for the oil and gas. The export systems included equipment for metering and
pigging. Results showed that annual impairment frequencies for the support structure were below 10-4,
and therefore below the tentative cut-off limit.
The risk of ignited riser leaks (also classified under fires and explosions) was also considered to be
possibly significant. Resulting RAE frequencies for impairment of the floatability safe function, based
on a flexible gas riser without shut-off/ isolation possibilities, were around 2×10-4, and therefore above
the cut-off limit. The report noted, however, that there was considerable uncertainty in the background
data.
Other hazards considered for MODUs were found to be applicable to production units, but with
different risk levels.
The collision risk level, in particular, was considerably reduced. Production platforms remain at the
same location for many years, and are therefore marked on sea charts. Passing ships can therefore plan
to avoid the platform, and this has a significant effect on the calculated risk level. As a comparative
example, the following annual total collision frequencies were given for a semi-submersible at Troll:
•
Drilling/ exploration: 6.7×10-2
•
Drilling/ appraisal:
7.2×10-2
•
Production:
1.8×10-2
These frequencies relate to all types of collisions (minor as well as major). The report noted that there
will be a greater reduction in critical collisions than in non-critical collisions.
The frequency of blowouts on a floating production platform is often lower than for a MODU. The
report concluded, however, that blowout occurrence frequencies were still relatively high, calling for
careful consideration. Measures to prevent blowouts are therefore vital.
There are no general differences between ballast systems on production units and MODUs, and
differences in risk are therefore primarily related to the way in which the system is operated. The
report noted that one of the most important factors here is the type of riser in use. There is only a small
margin for variations in draught with tensioned risers. Careful attention will have to be paid to
ballasting and de-ballasting if there is on-board oil storage, possibly requiring frequent ballasting
operations. More limited ballasting operations will be needed if flexible risers are used.
Mooring-induced heel and accidental weight condition represented very low levels of risk (an annual
frequency of 10-6 to 10-7 for impairment of the floatability safety function).
Dropped objects leading to fire could represent a hazard for process equipment on the upper deck
without a cover. The level of risk depended on the layout of the platform and the type of equipment
exposed.
Structural hazards (inherent structural failure and extreme environmental loads) were independent of
whether the platform was used for drilling or production. These factors are concept and design
dependent, however.
63
A floating production platform on the Norwegian continental shelf falls under the jurisdiction of NPD.
RABL did not concern itself with possible differences between safety functions defined by NPD and
NMD. The report nonetheless noted that the five safety functions considered by RABL covered a
broader range than those defined by NPD (escape ways, shelter area, support structure). It therefore
concluded that the RABL safety functions were applicable to production units. The report also noted
that the RABL cut-off value matched that defined by NPD, so that there was no conflict.
The report concluded that the same three types of hazards (collision with passing ships, ballast system
failures, blowout) were the most critical for both MODUs and production systems. The risks from
collision and blowout would generally be lower for a production unit, however.
64
RABL REPORT NO. 11
RABL report no. 11 [11] presented the final summary and conclusions of the entire RABL programme,
including the two follow-up studies on semi-submersibles used as accommodation and production
platforms [9, 10].
Collision risk was found to be the most significant contribution to risk, irrespective of the mode of
operation. The most probable scenario leading to structural loss of a column was a high impact
collision from a passing vessel.
Current rig designs are capable of surviving collisions from attendant vessels impacting at low speed.
There was a significant risk of collision from attendant vessels at high speed and passing merchant
vessels. Impact energies in the range 20 MJ to 80 MJ had the highest frequencies of occurrence.
Reserve buoyancy in the upper deck provided a survival capacity equivalent to an impact energy in the
range 60 MJ to 70 MJ, protecting against attendant vessels colliding at high speed. Reserve buoyancy
was therefore considered to provide a significant and necessary improvement to the stability margin.
Ballast system failure and fire were ranked as the next most significant sources of risk.
‘Third generation’ (post Ocean Ranger, designed in 1985/6 and later) rigs were found to have a
significantly lower level of risk from ballast system failure than earlier designs, and well below the cut­
off limit above which the risk was considered significant. These designs have ballast rooms at both
ends of each pontoon, and improved stability characteristics.
There was found to be significant advantage in carrying out a ballast system reliability assessment (in
the form of a fault tree analysis) in addition to, or in lieu of, a failure modes and effects analysis.
Fire and explosion were not critical for survival of the structure, at least for mobile drilling and
accommodation platforms. The ability to move away from a blowout was considered to be critical.
Prevention of long-lasting gas fires caused by riser or pipeline leaks was recommended. Such fires can
potentially last for such a long time that no feasible protection for the platform can be devised.
Overall Approach
The overall approach adopted in the analysis is described as follows:
1.
System description,
2.
Hazard identification,
3.
Definition of relevant accidental events,
4.
Evaluation of consequences relative to the main safety functions,
5.
Division into Design Accidental Events (DAEs) and Residual Accidental Events (RAEs),
6.
Evaluation of RAE frequencies,
7.
Comparison with cut-off limit,
8.
Design load specification.
The classification into DAEs and RAEs depends on an assessment of the event and its consequences
for the platform. This process often involves an element of iteration, in order to arrive at RAEs that fall
below the chosen cut-off limit.
Accidental events which do not impair any of the safety functions are considered to be DAEs, and are
events on which the design is based. All other events are considered to be RAEs. They have such
severe consequences that they may impair one or more of the safety functions. During the RABL study
frequencies of occurrence of RAEs were compared with the cut-off criterion for each hazard and safety
function separately. Further details of this procedure are described in the above summary of RABL
report no. 8 [8].
65
Design Accidental Events
The Norwegian Petroleum Act of 1985 defines three aspects of ‘total safety’:
•
Personnel safety,
•
Environmental safety,
•
Safety related to investment/ production.
The NPD requires that: ‘The platform design must be such that a design accidental event related to
complete or partial (progressive) loss of buoyancy does not cause harm to personnel outside the area of
the initial accident, or (for the partial loss) a danger to the platform integrity.’
The safety criteria and functions considered during the RABL programme were based on the ‘total
safety’ concept, but with primary emphasis on personnel safety. Protection of the platform as an
investment was considered to be a secondary priority. Environmental pollution risks were not
considered in relation to loss of buoyancy.
The main objective of the safety criteria is to limit the consequences for personnel. The design
therefore has to ensure that rapid sinking or capsizing does not occur. Critical design conditions are
defined by the DAEs, in which the platform has to remain intact with no more than local damage.
A necessary survival period is needed to protect personnel as well as the installation itself, and a
number of safety functions were defined for this purpose. The following safety functions were limited
to the effects of buoyancy loss, in line with the concerns of the RABL project:
SF1:
the platform shall remain in a floating condition for a period until external salvage assistance
is possible (‘floatability’ function);
SF2:
the platform shall remain in a condition with limited inclination so as to allow a safe
evacuation, taking into consideration the accidental conditions that will exist on the platform
(‘evacuation’ function);
SF3:
at least one escape route should be usable from central positions to a usable muster station for
at least one hour after the accident (‘escape ways’ function);
SF4:
the shelter area should not be flooded until a safe evacuation has been completed (‘shelter
area’ function);
SF5:
safety control of marine and drilling operations should not be lost until a safe evacuation has
been completed (‘marine controls’ function).
Impairment of these safety functions was considered in relation to the heel angle of the vessel over a
period of time.
Residual Accidental Events
RAEs are accidental conditions that are beyond the capabilities of the platform. The cut-off limit for
RAEs was based on the inherent safety level of second generation rigs, and was chosen to be in the
range 5×10-5 to 5×10-4 per platform year, around a central value of 1×10-4 per platform year.
RABL suggested that a reduction in the frequency of occurrence of a particular hazard should be
imperative if that frequency is greater than 5×10-4 per year, and must be considered if greater than
5×10-5 per year. The same cut-off frequency is also defined by NPD for production installations, and
means that the same value may be used regardless of whether the semi-submersible is used for drilling
operations, floating production or accommodation.
Risk Overview
The report presented results from a case study on a ‘second generation’ (post Alexander L. Kielland,
NMD regulations after about 1982) rig. The highest frequencies of events were found to be in the range
0.5 to 1×10-3 per platform year. Results were shown separately for the ‘floatability’ and ‘escape ways’
66
safety functions. Impairment of ‘escape ways’ means that the platform has inclined to more than 15
degrees in less than one hour, which is a hazardous situation for personnel but not for the rig itself.
The report commented that it was not surprising that these frequencies were high.
Impairment of ‘floatability’ included all events causing capsize within a couple of days. The platform
will have been evacuated long before capsize occurs, and residual risks to personnel are much lower.
It was found that the residual risk levels for ‘floatability’ corresponded approximately with the actual
frequency of total loss.
A burning blowout and collision were shown to be major hazards to both ‘escape ways’ and
‘floatability’. Ballast failure was a significant hazard for ‘escape ways’, and mooring-induced heel a
lesser hazard for ‘floatability’. All other risks were considered to be low.
The main thrust of RABL was directed towards semi-submersibles used as mobile drilling units, and
full case studies were performed on mobile drilling units only. The programme was extended,
however, to cover accommodation and floating production units.
Risk levels for a floating production or accommodation platform were similar to those assessed for a
mobile drilling unit. Collision risks were much reduced, however, where platforms were marked on
sea charts. This was seen as a significant factor in collision avoidance. Long-lasting fires or
explosions may be a significant risk for a floating production unit.
Collision risks for a flotel drifting into its fixed platform were found to be low provided the flotel has
significant thruster capacity (as do most modern platforms). The collision risk was higher for a
platform with little thruster capacity.
Hazards considered during the RABL project are summarised in Table 2.
Table 2: Applicability of hazards to different types of units
Hazard
Mobile Drilling
Unit
Accommodation
Unit
Production
Unit
Falling objects
Yes
Yes
Yes
Collision with a passing vessel
Yes
Yes
Yes
Collision between a flotel & a fixed
platform
No
Yes
No
Inherent structural failure
Yes
Yes
Yes
Burning blowout
Yes
No
Yes
Utility systems fire and explosion
Yes
Yes
Yes
Subsea gas blowout
Yes
No
Yes
Tripping due to anchor failure
Yes
Yes
Yes
Abnormal weight condition
Yes
No
Yes
Ballast system failure
Yes
Yes
Yes
Structural failure
Yes
Yes
Yes
Accidental effects from fixed platform
No
Yes
No
Subsea gas leak from a riser/ pipeline
No
No
Yes
Fire and explosion due to process/ riser
system leaks
No
No
Yes
67
Collision Hazards
The ‘second generation’ platforms considered in the case studies had reserve buoyancy in the deck, in
accordance with NMD regulations at that time. The principle is that the platform should survive loss of
buoyancy of a column without capsizing. It is likely, however, that failure of connections between the
deck and column will cause the same event to flood the deck and also destroy the column. Reserve
buoyancy should therefore be seen as a last defence. A severe collision with a passing vessel (e.g. a
5000 DWT vessel travelling at full speed) represents an event of this type, and (according to estimates
made during the RABL programme) such events are not particularly rare.
For the particular platform considered, upper deck reserve buoyancy was ineffective if the column
failed structurally. With such ineffective reserve buoyancy, the difference in risk levels between first
and second generation platforms turned out to be marginal. Minor design changes, at little or no cost,
could make reserve buoyancy much more effective, however, possibly reducing the risk level by a
factor of five.
Collision hazards varied significantly between different fields, and between different locations within a
field, depending on the density of merchant vessel traffic. The risks of collision with fixed production
platforms were significantly lower than risks to mobile platforms, because the former are marked on
navigational charts. Risks to accommodation platforms were also considered to be lower, because
charts show the fixed installations to which they are connected.
An accommodation unit may also drift onto the nearby fixed platform, but this only presents a
moderate hazard for most modern units, because most have sufficient thruster capacity to counteract
the effects of mooring line failure. This might be a more significant hazard in cases where the unit
does not have adequate thruster capacity, but the risk of collision from a passing vessel was considered
to be dominating.
It was noted that design requirements were normally based on a 14 MJ collision with a 5000 tonne
vessel travelling at 2 m/s. Case studies during the RABL programme indicated that the ultimate
structural capacity of a column would be of the order of 50 MJ before complete failure occurs. Some
energy may be absorbed by deflecting the vessel, and transforming the energy into rotation. A semi­
submersible platform may therefore survive a 70 MJ to 80 MJ impact, provided the reserve buoyancy
of the deck is unimpaired by structural failure of a column.
Ballast Failure Hazard
The second main contributor to risk was ballast system failure. A comparison was made between risks
to ‘first’ (late 1970s), ‘second’ (1982/1983) and ‘third generation’ (1985/1986) platforms, only the last
of which have a ballast pump room at each corner, together with considerable flexibility and
redundancy in the system. The total RAE risk was estimated to be above 1×10-3 per platform year for
the ‘first generation’ unit, with a slightly lower risk for the ‘second generation’ platform. This risk was
almost eliminated, however, for the ‘third generation’ platform.
The report noted that ballast failure frequencies were almost constant, irrespective of the platform’s
mode of operation. The results were therefore regarded as valid for mobile drilling units,
accommodation and production units.
Blowout Hazard
Blowouts (with attendant hazards of explosion, fire and loss of buoyancy) were the third main
contributor to risk. Blowouts have a relatively high frequency of occurrence, and are characterised by
consequences that cannot be designed against. The only effective way to reduce the risk to the
platform is therefore to reduce the frequency of blowouts, or else the probability that the platform will
be exposed to consequences of blowout.
The prevention of blowouts was considered to be the more crucial aspect. Statistics showed that there
is a relatively high risk of blowout during exploration drilling in both American and North European
68
waters. Blowout risks are somewhat lower during production, but still present a significant hazard to a
floating production unit. Blowout risks are not relevant to accommodation units.
The other important aspect is the ability of the platform to re-locate following a blowout. This is an
important advantage of a mobile platform over a fixed platform. Rapid re-location should be possible
in almost any accidental condition. Reliable re-location may be a problem, however, blowout statistics
showing that the probability of success was only about 0.4.
Buoyancy effects from the gas plume were not considered to be a threat.
The main risk associated with a blowout is that of gas or oil ignition, creating a long-lasting fire,
possibly combined with an explosion. These hazards depend strongly on reservoir and field
characteristics.
Other Hazards
Other hazards only contributed about 2% to the total risk, and were of minor importance. These
hazards included falling loads, mooring-induced heel (tripping), inherent structural failures and
extreme environmental loads. The report noted, however, that some of these hazards might become
more significant when risks associated with ballast and collision events are reduced.
An additional hazard for a production unit is fire or explosion following a leak from the process
system, a riser or a pipeline. Leaks generally have limited significance, because they generally occur
on the upper deck, with limited potential to cause major structural damage. Riser leaks were
considered to be a more significant hazard, especially where flexible risers are used without subsea
isolation systems. A gas leak without subsea isolation could cause a long-lasting fire, threatening
platform integrity.
Recommendations
The analysis methodology and procedure were considered to be robust and sensitive to differences
between concepts, provided all important aspects are considered.
It was therefore recommended that the new analysis methodology should be used to assess safety levels
for new platform designs, or for existing platforms subject to changes in operational premises.
The report nonetheless recognised the vulnerability of any risk assessment procedure to lack of
statistical data and to lack of insight into what are relevant and important failure modes.
Technical recommendations included the following:
•
Collision risk requires the greatest attention, particularly focussing on collision prevention
measures. These might include warning systems and extended exclusion zones in specific cases.
The report also recommended further studies to define true collision risk levels.
•
The reserve buoyancy function should be made as effective as possible, to withstand moderate
collisions with, for example, a small vessel travelling at full speed. The design should also prevent,
as far as possible, loss of reserve deck buoyancy following structural failure of a column. The
report suggested that such failures might be avoided quite simply and cheaply.
•
Having ballast rooms at all four corners significantly reduced risk levels. Such systems also
provide important benefits in terms of redundancy and flexibility. It was also considered
important to arrange the system so that human failure cannot easily lead to a critical condition.
•
Risk assessment was recommended, in addition to FMEA studies on ballast systems, because
FMEA studies are not capable of assessing failure combinations adequately.
69
•
The most effective risk reducing measure associated with blowouts was to reduce the occurrence
of blowouts themselves. Risks associated with fire and explosion can be reduced by maximising
the probability of relocating the platform quickly following a blowout.
•
Risks associated with semi-submersibles used as accommodation units were found to be similar to
those associated with mobile drilling units, and the same recommendations applied.
The main additional recommendation for a floating production unit was to prevent long-lasting gas
fires caused by pipeline or riser leaks, especially where flexible gas export risers are used. Subsea
isolation of the leak was considered to be particularly useful.
Appendices to the report summarise the background to the RABL programme, the hazards considered,
and the analysis methodology adopted, together with summary and contents pages from each of the
earlier RABL reports.
70
Printed and published by the Health and Safety Executive
C30 1/98
Printed and published by the Health and Safety Executive
C0.06 11/03
ISBN 0-7176-2729-2
RR 143
£15.00
9 78071 7 627295