You are on page 1of 155

FREQUENCY ANALYSIS OF ACCIDENTAL OIL RELEASES FROM FPSO OPERATIONS IN THE GULF OF MEXICO

PREPARED FOR ECOLOGY & ENVIRONMENT, INC. Tallahassee, Florida UNDER CONTRACT TO MINERALS MANAGEMENT SERVICE GULF OF MEXICO OCS REGION NEW ORLEANS, LOUISIANA MMS CONTRACT 1435-01-99-CT-30962

F INAL R EPORT JANUARY 2001

Det Norske Veritas, Inc.
Houston, Texas

January 2001

Frequency Analysis of Accidental Oil Releases from FPSO Operations in the Gulf of Mexico
prepared for:

ECOLOGY & ENVIRONMENT, INC. Tallahassee, Florida
under contract to:

MINERALS MANAGEMENT SERVICE GULF OF MEXICO OCS REGION NEW ORLEANS, LOUISIANA
MMS CONTRACT 1435-01-99-CT-30962
prepared by: Det Norske Veritas 16340 Park Ten Place, Suite 100 Houston, Texas 77084 (281) 721-6600

FINAL REPORT

Project Manager:____________________________ Jeremiah B. Spires

C:\WINDOWS\TEMP\022101_Risk Assessment_Final.doc

Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd

I

E&E MMS January 2001

MANAGEMENT SUMMARY The MMS is investigating the potential impact of the operation of Floating Production, Storage and Offloading installations (FPSOs) in the Gulf of Mexico. One of the concerns of the MMS is the potential negative effect on the environment from accidental oil releases, and in connection with this they have contracted Ecology and Environment to conduct an environmental impact study. Ecology and Environment will calculate the consequences of oil releases on the marine and coastal resources and combine these findings with estimated frequencies of accidental releases. The work to estimating the frequency of accidental oil releases from FPSO operations has been sub-contracted to DNV. This report presents DNV’s findings. Scope of Work DNV’s scope of work includes predicting the frequency of unique accidental releases from operation of a generic FPSO in the GoM. The specification for the FPSO is taken from the “Scenario Report, Environmental Impact Statement on Floating, Production, Storage, and Offloading Systems on the Gulf of Mexico Outer Continental Shelf” which provides an outline description of the FPSO and its operation. Where insufficient details are provided in the Scenario Report DNV has used judgement and experience of earlier FPSO risk analyses to supplement the information given. Good practice has been generally assumed. The scope of the study includes: • • • • All aspects of operation of the FPSO from the wellheads, through oil and gas production to export of the oil by shuttle tanker, and the gas by pipeline to shore. Shuttle tanker transit risks to a shore terminal. The various utilities provided by the FPSO required for operation and support of the people manning the installation. External and environmental risk factors are also assessed.

The study does not include construction, installation commissioning and decommissioning of the FPSO, nor does it include drilling or workover of the wells. These were specifically excluded from the scope of work by MMS. In addition to the basecase, the Scenario Report identifies options for the FPSO and its operation that may affect the environmental risk presented. These options have been qualitatively assessed to consider what impact, if any, they have on the overall risk. Also, DNV has identified a number of mitigation measures to reduce the risk due to accidental oil releases.

C:\WINDOWS\TEMP\022101_Risk Assessment_Final.doc

000 100.6 x 10-5 Frequency of Accidental Releases by Release Size 1.4 x 10-1 1.doc .0E-1 1.1 x 10-3 0 Frequency (per year) 2.0E-5 <10 10-100 100-1K 1K-10K 10K-50K 50K-100K 100K-500K >500K Release Size Category (Barrels of Oil) C:\WINDOWS\TEMP\022101_Risk Assessment_Final.2 x 10-1 2. Frequency of Oil Releases due to Unique FPSO Accidents Barrels of Oil Released less than 10 10-100 100-1.7 x 10-3 1.000-100.000 10.9 x 10-5 6.000-10.0E+0 1.3 x 10-2 9.1 x 10-4 5.000 1.5 x 10-2 2.9 x 10-5 6.0 x 10-2 9.9 x 10-4 1.000 50.6 x 10-5 Offloading 2.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd II E&E MMS January 2001 Results Summary The table and figure below presents a summary of the overall results for the basecase.000-50.7 x 10-4 6.4 x 10-1 1.0E-2 1.000-500.3 x 10-2 1.6 x 10-1 1.3 x 10-2 1.2 x 10-1 0 0 0 0 0 Shuttle Tankers 0 0 0 2.7 x 10-3 9.0E-4 1.7 x 10-2 7.5 x 10-2 2.000 More than 500.000 FPSO 1.0E-3 1.2 x 10-1 1.

but account for 1.6 percent of the volume of potential FPSO-unique spills is likely to be from shuttle tankers near port. This is particularly true for the significant fraction of shuttle tanker spills that occur closer to shore. the following points should be noted to put the study results in perspective. where there is a history of low spill frequency and small spill volumes. excluding offloading and shuttle tanker transport. as are measures that prevent or control process releases. Spill risk during offloading from the FPSO to the shuttle tanker is low. the dominant FPSO-unique risk is from accidents that escalate to the cargo area.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd III E&E MMS January 2001 The results show that for those risks unique to FPSO operation: • The frequency of FPSO-unique oil releases greater than 1000 barrels is 0. (The production rate is 150. 1.000 barrels of oil per day. Finally.4 percent of the volume of potential FPSO-unique spills is likely to be due to the transfer of oil from the FPSO to the shuttle tanker and from the shuttle tanker transit to shore. • FPSO-unique spill risk is low. For events on the FPSO. these are all smaller spill sizes. and 1. However.) Approximately 94. The remaining 95% of spills are non-unique and would be equally likely and have similar outcomes on a TLP or other deepwater alternative. The frequency of these events is of the order of 1 x 10-3 per year.8 percent of the volume of potential FPSO-unique spills is likely to be from the transfer from the FPSO to the shuttle tanker. • • • • • • • A conclusion that can be drawn from the results is that any effort to reduce the risk of oil spill from oil production on FPSOs should firstly concentrate on the operation of shuttle tankers. Of spill risk on the FPSO itself. 53. Measures that protect against escalation to the cargo area are likely to be the most beneficial means of reducing the risk of oil spills from the FPSO itself. Passing merchant vessel collisions are low frequency events. Measures that protect against passing merchant vessel collisions are also likely to be beneficial in reducing oil spill risk.037 per billion barrels produced for FPSO-related failures. where there is likely to be a greater threat of environmental damage. • C:\WINDOWS\TEMP\022101_Risk Assessment_Final. 39 percent of the volume of potential FPSO-unique spills is likely to be from shuttle tankers in transit to port.doc .2 per billion barrels for shuttle tanker-related failures. Process releases are the largest FPSO-unique risk for releases on the FPSO.2 percent of all the FPSO-unique oil released due to the potential for large volume spills. FPSO-unique spill risk makes up only 5% of the total. This risk is similar to that for lightering operations in the GoM.

C:\WINDOWS\TEMP\022101_Risk Assessment_Final.S. Based on analysis of MMS’s database of oil spills in US waters (ref. the location of a proposed FPSO and associated tanker routes would be more defined. Therefore. and for tanker transport there will be 1. However. the oil spill risk for shuttle tanker transport is comparable to and arguably better than pipeline transport. Therefore. The assessments of oil spill risk performed in this study should be regarded as generic to the concept of the use of FPSOs in deep water. the large range of years covered also means that recent regulatory and other risk-reducing measures are not well represented in the predicted risk of tanker transport spills. the risk of shuttle tanker transport spills predicted in this assessment may well be conservative (overstated). The risk of shuttle tanker transport spills used in this assessment was derived from a database of tanker spills in U. waters with incidents extending back to the 1970s. This incident database covers a large range of years and provides a wide experience base for determining what the historic risk of tanker transport spills has been. and the risk from transportation routes closer to shore would be evaluated.21 spills greater than 1000 bbls per billion bbls transported. It is expected that these corrective actions should result in improved tanker performance in the future over the performance predicted using this database as has been observed over the last eight years. 2) it is expected that for pipeline transport there will be 1. More detailed analysis would accompany the evaluation of specific FPSO permit applications. At that time.doc .32 spills greater than 1000 bbls per billion bbls transported.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd IV E&E MMS January 2001 • • • Shuttle tanker transport spills should be compared with pipeline spills.

................................................................................Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd i E&E MMS January 2001 TABLE OF CONTENTS 1 Page INTRODUCTION............................. 1...1 2 3 4 5 APPENDIX I APPENDIX II APPENDIX III SCENARIO ANALYSIS DETAILS CONDISERATION OF DESIGN OPTIONS SUGGESTED RISK MITIGATION OPTIONS C:\WINDOWS\TEMP\022101_Risk Assessment_Final........ 2................................... 3..................................................... 2....................................................................2 METHODOLOGY.................................................1 ACRONYMS AND ABBREVIATIONS........7 RESULTS..................................... 4...................................1 Scope of Work.2 Report Structure ................................ 5.......1 Hazard Identification.......... 2.................................................................. 1......................4 Consequence Calculation ..................1 2............1 1......2 Frequency Calculation..................1 REFERENCES.........................................................................doc ................5 2...............4 Data Sources..........................................2 2..................1 1............ 1. 2......................................... 2..

Shuttle tanker transit risks to a shore terminal. and in connection with this they have contracted Ecology and Environment to conduct an environmental impact study. Storage.000 barrels of oil more than 500.000 barrels of oil 10. through oil and gas production to export of the oil by shuttle tanker. DNV has used judgement and experience of earlier FPSO risk analyses to supplement the information given. nor does it include drilling or workover of the wells. The work to estimating the frequency of accidental oil releases from FPSO operations has been sub-contracted to DNV. 000 barrels of oil C:\WINDOWS\TEMP\022101_Risk Assessment_Final. 1. Ecology and Environment will calculate the consequences of oil releases on the marine and coastal resources and combine these findings with estimated frequencies of accidental releases.1 Scope of Work DNV’s scope of work includes predicting the frequency of accidental releases from operation of a generic FPSO in the GoM. installation commissioning and decommissioning of the FPSO. and Offloading Systems on the Gulf of Mexico Outer Continental Shelf” (Ref.000 barrels of oil 1000 to 10. The scope of the study includes: • • • • All aspects of operation of the FPSO from the wellheads. External and environmental risk factors are also assessed. 1) which provides an outline description of the FPSO and its operation. The releases are categorized according to the following ranges: • • • • • • • • less than 10 barrels of oil 10 to 100 barrels of oil 100 to 1. Environmental Impact Statement on Floating. The study does not include construction.000 barrels of oil 100.1 E&E MMS January 2001 1 INTRODUCTION The MMS is investigating the potential impact of the operation of Floating Production. Production.doc . These were specifically excluded from the scope of work by MMS. The specification for the FPSO is taken from “Scenario Report. Storage and Offloading installations (FPSOs) in the Gulf of Mexico. One of the concerns of the MMS is the potential negative effect on the environment from accidental oil releases. and the gas by pipeline to shore.000 to 50.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd 1. The various utilities provided by the FPSO required for operation and support of the people manning the installation. This report presents DNV’s findings.000 to 500. Good practice has been generally assumed. Where insufficient details are provided in the Scenario Report.000 barrels of oil 50000 to 100.

The risks of accidental releases for each hazard have been calculated to provide the overall risk of oil spill.2 Report Structure DNV has identified a broad range of hazards associated with the FPSO with the potential to cause an accidental release of oil to the environment. if any. The MMS is particularly concerned that the study calculates the differences in environmental risk from FPSOs compared to production technologies for deepwater currently accepted and operating in the GoM.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd 1. In addition to the basecase. they have on the overall risk. Appendix I gives the detailed risk analyses for each of the hazards identified. Section 2 of the report describes the methodology used to calculate the oil spill risks.2 E&E MMS January 2001 These ranges were chosen to correspond to the oil spill sizes considered by Ecology and Environment in their assessment of the impact on the environment from oil accidentally released. 1. Appendix II is a qualitative assessment of the impact of the proposed design options on the oil spill risks calculated.doc . DNV has identified a number of mitigation measures to reduce the environmental risk. Appendix III is a qualitative assessment of potential risk mitigation measures C:\WINDOWS\TEMP\022101_Risk Assessment_Final. either directly or through escalation. the Scenario Report identifies options for the FPSO and its operation that may affect the environmental risk presented. Section 3 of the report presents the results including overall results for all accidents and a summary of the results for each of the identified hazards. These options have been qualitatively assessed to consider what impact.

The methodology is shown graphically in Figure 2.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd 2.1.doc .1: Risk Analysis Methodology Hazard Identification Frequency Estimation Consequence Modelling Risk Quantification Identify Mitigation Measures Is risk acceptable? No Yes End C:\WINDOWS\TEMP\022101_Risk Assessment_Final.1 E&E MMS January 2001 2 METHODOLOGY DNV has applied a standard approach to risk analysis to quantify the risk of accidental releases of oil from the FPSO. Each of the steps in the analysis methodology is described below. Figure 2.

Figure 2.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd 2. detect.2: Risks Quantified 2.) The Hazard Identification seeks to identify all those potential sources of an accidental release of oil to the environment and characterize them in terms of the accident causes and those measures that help to prevent. control or mitigate the potential accident scenarios. but has not quantified the common risks (yellow area) or the unique TLP risks (red area). the hazard identification assesses the direct consequences of accidents and the potential for escalation.2. This comparison is shown graphically in Figure 2. In addition. From the figure.doc .2 E&E MMS January 2001 The risks from FPSO operation have been compared to accepted solutions for oil extraction in order to identify risk factors unique to FPSO operation. The identified FPSO risk factors have been compared against those known for tension leg platform (TLP). this study has quantified unique FPSO risks (blue area). taken to be representative of accepted deep water technology for the GOM OCS.1 Hazard Identification Unique FPSO risks Common risks Unique TLP risks (Areas displayed are not intended to be representative of relative risk magnitude. C:\WINDOWS\TEMP\022101_Risk Assessment_Final.

Offloading Accidents 8.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd 2. Tanker Transport 9. A specific hazard identification workshop would be unlikely to provide consideration beyond those already identified by DNV. The hazard identification has considered a total of 11 different hazard categories that will be present during the production phase of the development. such a workshop is not appropriate to this project. The hazards considered were categorized as listed below. sub- C:\WINDOWS\TEMP\022101_Risk Assessment_Final.3 E&E MMS January 2001 Hazard identification is a formal activity to examine all aspects of the operation under consideration using a pro-forma approach. Riser and Pipeline Leaks 3. Each of the 11 hazard categories has been sub-divided into a number of more specific hazards characteristic of FPSO operation. Typically. Transportation (supply vessels and helicopters) In most categories. Blowout 2. Non-Process Fire and Explosions 5. divisions of hazards were identified and examined. Ship Collisions 11. these studies included formal “hazard identification” workshops carried out with project engineers and operators and so the combination of these data sources represents actual experience and is the most appropriate source for this project available to DNV. Due to the conceptual nature of the design the generic FPSO addressed in the project.doc . Non-Process Spills 10. It depends on the quality of the input data available and is typically performed as a table-top exercise lead by an experienced facilitator and with participation by representatives covering the full range of design and operational expertise for the system under consideration. Marine Accidents on the FPSO 7. the level of detail is not available to perform this level of hazard identification. This is a process that relies to a large extent on past experience and so it is important to consult as broad a range of expert sources as possible. Process Leak 4. Hazard Categories 1. Instead this project has extracted the combined experience from several previous studies carried out by DNV for similar developments. Therefore. Cargo Storage Events 6.

C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Accident causes include those that are present continuously (e. 2. An example fault tree is shown below. the data quality for the frequency of contributing undesirable events. The contribution of accident causes and preventative measures for each of the hazards are represented in “fault trees”. To be effective.g.2 Frequency Calculation Accident event frequencies were calculated for each of the identified hazards.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd 2. fatigue loading).doc . The fault trees have been evaluated where appropriate. The undesirable events represent each of the accident causes and failures of preventative measures identified by the hazard identification exercise. dropped objects). A fault tree is a graphical technique for showing the combinations of undesirable events that result in the specified accident (denoted the “top event”). Evaluation of the fault trees involves the analytic combination of the likelihood that each of the undesirable events occurs. and the effectiveness of the appropriate preventative measures. However for this project there are many instances where the quality of the available data for the frequency of the top events is as good as. or better than. a preventative measure must address the specific hazard and be reliable (in an operable condition when required). and those that arise spuriously (e. In such cases the top event frequencies are taken directly from the available data sources and the fault trees used to present the contributors to the accident and for the assessment of further risk reducing measures. The accident frequencies were determined by a combination of the presence of accident causes.g. This indicates the likelihood (per year) that a hazard will be realized calculated from a statistical analysis of available experience based data.4 E&E MMS January 2001 Each of the hazard sub-divisions were qualitatively described according to the following characteristics: Consequences Escalation potential Escalation consequences Accident causes Accident prevention Accident detection Accident control Mitigation measures direct impact of an accident routes to escalation of the event impact of the escalated events human or hardware failures that would realize the accident features of the development that will prevent an accident from occurring measures to detect an accident measures to limit the extent of an accident measures to prevent escalation from occurring or to limit the extent of escalation This information collected was tabulated and has been used to develop the frequency and consequence calculations.

to control it once detected. U.S. Ballast tank explosion And 1 flammable atmosphere in ballast tank ignition source Or 1 cargo ingress through bulkhead cracks hotwork in ballast tank static discharge during ballasting operation Undev 3 Undev 1 Undev 2 2. and the event tree is developed using a succession of branches. each representing success or failure of a specific detect. and C:\WINDOWS\TEMP\022101_Risk Assessment_Final. The various combinations of successful detection. Each end event represents a possible development of the accident. The calculations also consider the likelihood of escalation if mitigation is unsuccessful.5 E&E MMS January 2001 Figure 2.3: Fault Tree Example CARA Fault Tree version 4. and escalation result in several possible different outcomes. control. all the end events are representative of all possible accident outcomes.3 Consequence Calculation Consequence calculations are used to quantify how each of the accidents can develop and so result in the loss of oil into the sea.1 (c) SINTEF 1997 Licenced to: DNV. For each accident event. control. The initiating event forms the root of the tree. the consequence calculations will take credit for the effectiveness and reliability of measures to detect the accident. This is a graphical form of binary tree which allows the development of an accident to be shown and quantified. mitigation. The likely oil spill has been predicted for each outcome using judgement. The likelihood of each of the possible outcomes were calculated using event trees.doc . The initiating event is assigned a frequency and each branch node is assigned a value denoting the probability of successful operation of the response represented. and to mitigate against escalation. and escalation response.A. Progression along each of the various branches to the “end events” thus represents a unique combination of such responses. Huston. Together. mitigation.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd 2.

The risk for each end event is quantified by assigning the end event frequency to the specific consequences.0). The size of oil release represented by each branch outcome were calculated on the basis of rulesets. End events are assigned specific consequences. Branch probability data for each event tree has been taken from data sources available to DNV.doc . assessed by consideration of the potential route that oil may be released to the marine environment. Initiating event frequencies are taken from the results of the fault tree evaluation (see above).Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd 2. In this project this is the volume of oil spilled.4: Event Tree Example Initiating Event Frequency Detection Failure? (probability) Control Failure? (probability) Escalation? (probability) Y Y N Y Y N N (per year) Y Y N N Y N N No Cargo Release Spill from Cargo No Cargo Release Spill from Cargo No Cargo Release Spill from Cargo No Cargo Release Spill from Cargo Outcome C:\WINDOWS\TEMP\022101_Risk Assessment_Final.6 E&E MMS January 2001 conversely the probability of failure in that operation (The sum of the probabilities of success and failure equals 1. Event trees have been produced and evaluated for each of the significant undesirable events produced by the hazard identification. The total risk for that accident is calculated by summing the contribution from all end events. Figure 2. All end event frequencies are evaluated in this way. Evaluation of an event tree involves multiplication of the initiating event frequency and the probabilities assigned to the decision branches to give a frequency for each end event. The rule sets are fully traceable and are based on DNV’s experience of consequence calculations. An example event tree is shown below.

DNV proprietary information has been used as input data to the risk assessment.4 Data Sources The analysis is greatly dependent on the quality of the input data. as well as a deep water Gulf of Mexico development project. and addresses all major aspects of this subject. and forms part of DNV’s documented management system. The high level description of its systems means that specific details required for the analysis have been drawn from DNV’s experience of similar developments. The proprietary nature of these information sources prevents full references to the data from being included here. and is a proprietary commercial asset to DNV. Due to the conceptual nature of the design of the generic FPSO addressed in the project. The specification for the FPSO and its operation is provided in the Scenario Report (Reference 1). Additionally. Use of this information has provided additional detail and efficiency to this analysis than would otherwise have been possible. The ARF manual describes good modern practice in offshore QRA.doc .Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd 2. Input data for the offshore offloading operation from the FPSO to the shuttle tanker is taken from the Marine Board’s tanker lightering study commissioned by Coast Guard (Reference 4) and from MMS’ lease sale EISs (i. The ARF manual requires a significant effort on DNV’s part to update and maintain. operation. This section describes the data sources used. which is a key internal reference document for risk assessment in DNV. including comprehensive assessments for 6 specific FPSO development projects in the North Sea and North Atlantic. All data used in the fault trees and event trees are described in the data sheets in the appendix to this report which presents the analysis of individual events. The ARF manual is used within DNV both as a reference book and as a training manual.. The ARF manual includes a selection of recommended data as well as recommended analytical techniques and data sources. their configuration.7 E&E MMS January 2001 2. information on FPSOs. These previous analyses include confidential proprietary information belonging to other clients of DNV. These assessments include confidential proprietary information.e. DNV’s ARF manual is a constantly updated compendium of DNV’s offshore risk assessment experience. MMS 1997b and MMS 1998a) as well as from a client-confidential DNV study conducted for an existing FPSO operating in the North Sea. Input data for the risk analysis of FPSO operations is taken from DNV’s ARF manual (Reference 5). As a general rule. hazards and risks has been taken from DNV’s experience from previous analyses. and therefore the data used is considered applicable to this study. C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Input data for FPSO operations has also been taken from DNV’s experience on FPSO projects for other clients. which prevents full referencing of the data. Input data for the risk analysis of shuttle tanker transport operations is extracted from an analysis of the MMS’s tanker oil spill database for tankers operating in US waters by Anderson and LaBelle (Reference 2) as well as DNV’s ARF Technical Note 14 (Reference 3). This is a concept level description of a generic FPSO for deepwater operation. these FPSO developments are considered by DNV to represent good practice amongst the industry.

3 x 10-2 9.2 x 10-1 2. including: • • • definition of the hazards from the hazard identification.000-500.7 x 10-3 1.9 x 10-4 6.doc .000 1.000 More than 500.0 x 10-2 9.1 presents a summary of the overall results for the basecase.1 x 10-3 0 Frequency (per year) 2. Results Summary Table 3.000-100.9 x 10-4 1.7 x 10-3 9. the fault trees representing the accident frequencies and causes.6 x 10-1 1.000 10.000 Oil Releases due to Unique FPSO Accidents FPSO 1.3 x 10-4 5.000 100. and the event trees showing the development of each event through to the calculation of the accidental risk of oil release to the marine environment Appendix 1 also identifies those events that were considered but not evaluated because they were judged to pose only a negligible risk of accidental oil spill.6 x 10-5 Offloading 2.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd 3.4 x 10-1 1.000-50.1 E&E MMS January 2001 3 RESULTS This section presents the overall results of the analysis for the basecase as defined in the Scenario Report.2 x 10-1 1.9 x 10-5 6.7 x 10-2 7. Appendix 1 contains details of the analysis for all the events considered.3 x 10-2 1.1: Barrels of Oil Released Less than 10 10-100 100-1.000-10.3 x 10-2 1.6 x 10-5 C:\WINDOWS\TEMP\022101_Risk Assessment_Final.4 x 10-1 1.2 x 10-1 0 0 0 0 0 Shuttle Tankers 0 0 0 2.5 x 10-2 2.000 50.5 x 10-2 2.9 x 10-5 6. Table 3.

In the table. This is a conservative approach.1 shows these results graphically.doc . C:\WINDOWS\TEMP\022101_Risk Assessment_Final. the column labeled “Vol. The column labeled “Cum.0E-1 1.0E-5 <10 10-100 100-1K 1K-10K 10K-50K 50K-100K 100K-500K >500K Release Size Category (Barrels of Oil) The results have been further analyzed to obtain a better understanding of the main issues driving the risks. DNV has assigned the upper end of each range as the representative release size for each category and used this to calculate the statistical volume of oil released annually for each accident type.2 E&E MMS January 2001 Figure 3. with the worst case events at the top.1: Frequency of Accidental Releases by Release Size for Unique FPSO Accidents 1.0E+0 1.” shows the cumulative fraction for that accident plus the accidents above it in the table.2 does not include those risks common to both FPSO and TLP technology.0E-4 1.2 shows the risk of oil spill according to accidental event. Table 3.0E-2 1.0E-3 1.2 has been ranked according to release volume.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd 3. Figure 3. Table 3.” shows the annual volume released for that accident type as a fraction of the total released. Table 3.

3 x 10-7 8.0% 100.9% 100.0 x 10 -5 4.0% 0.9 x 10-9 3.2% 0.8% 99.3 x 10-7 1.6 x 10 -3 100K500K 5.5 x 10 -6 4.2 x 10-1 3.1 x 10 -7 -7 -7 -7 -7 1.0 x 10-2 0 0 0 0 9.6 x 10 -6 1.4 x 10-4 4.9 x 10-5 0 0 0 0 0 0 0 0 0 0 0 0 0 1.2 x 10-10 2.4 x 10-7 4.1% 0.0% 0.8% 97.0% 0.2% 0.4 x 10-5 4.4 x 10 0 0 0 0 1.3 x 10-2 -1 100-1K 0 0 0 1. % > 500K -3 Scenario <10 Shuttle Tanker Leak Near Port Shuttle Tanker Leak at Sea Process Leak Transfer Hose Leak Passing Merchant Vessel Production Riser Leak Foundering Cargo Tank Explosion Swivel Leak Cargo Piping Leak on Deck Process Gas Blow-by Flowline Leak Mooring Failure Explosion in Turret Ballast Tank Explosion Gas Export Riser Leak Gas Export Pipeline Leak Visiting Shuttle Tanker Methanol Fire Drifting Vessel Blowout Wellhead or Manifold Leak Cargo Tank Overfill 0 0 0 2.3 x 10-7 2.0 x 10 0 0 0 0 0 0 0 0 0 0 -6 53.2 x 10-3 4.8 x 10 -2 1.2 x 10 0 0 0 0 1.5 x 10 -6 3.5 x 10-3 4.0 x 10-7 2.5 x 10-8 5.2% 0.2 x 10 0 0 0 0 0 -1 1K-10K 10K-50K 1.1 x 10-6 9.0 x 10-3 1.6 x 10 1.4 x 10-1 0 0 0 0 0 0 0 0 0 0 0 0 0 1.0% 100.3 E&E MMS January 2001 Table 3. % Cum.0% 0.0 x 10-4 1.6 x 10 -5 3.4 x 10 -2 50K100K 5.0 x 10-2 9.8 x 10 -7 1.2 x 10-2 0 0 0 0 0 0 0 0 0 0 0 0 0 2.4 x 10 -7 3.0 x 10-5 2.3 x 10-4 7.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd 3.0% 0.3 x 10 -6 8.8 x 10-5 3.1 x 10-3 3.6 x 10-5 8.2 x 10-6 2.2% 1.0% 100.6% 92.3 x 10 1.3 x 10-9 0 0 0 0 2.3 x 10 -2 0 0 0 0 1.5 x 10-2 3.0% 100.0% 100.9 x 10 -1 3.0% 6.0% 0.0 x 10-9 3.1 x 10-5 1.0% 100.0 x 10-5 3.2 x 10 -6 3.3 x 10-8 9.0% 100.3 x 10-8 0 0 0 0 0 2.0% 100.0% 0.8 x 10-7 1.4 x 10-5 5.3 x 10-5 1.3 x 10-6 6.1 x 10-5 0 5.9 x 10-5 1.doc .3 x 10-5 2.8% 1.3 x 10-5 2.6% 98.4 x 10-3 7.8 x 10-9 5.6 x 10-6 2.0 x 10-9 2.5 x 10 3.6 x 10-1 -1 10-100 0 0 0 1.0% 0.0% 100.6% 53.4 x 10-4 3.3 x 10-9 0 0 0 0 5.5% 99.6 x 10 1.4 x 10-2 1.0% 0.6% 95.7% 99.0% 1.4% 0.0% 1.0% 100.3 x 10-2 0 0 0 0 1.1 x 10-7 8.0% 100.2: Oil Spill Frequencies per year by Accidental Event Category for Unique FPSO Risks Number of Spills Per Year Vol.3 x 10-5 1.0 x 10-9 7.3% 0.8 x 10-6 3.8 x 10-2 39.2 x 10-4 0 0 0 0 0 0 0 0 0 0 0 0 5.5 x 10-9 5.4 x 10 -7 1.0% 0.3 x 10-5 4.6 x 10-6 3.9 x 10-1 C:\WINDOWS\TEMP\022101_Risk Assessment_Final.0% 0.3 x 10-7 7.0% 0.0% 100.6 x 10-2 9.3 x 10 Total 3.4 x 10-4 0 0 0 2.8 x 10-9 3.3 x 10 -6 2.5 x 10-4 5.7 x 10-3 0 0 0 0 0 1.2% 99.1 x 10-6 1.0% 100.3 x 10-8 1.8 x 10-3 0 0 4.

these are all smaller spill sizes. as are measures that prevent or control process releases. (The production rate is 150. Finally.4 E&E MMS January 2001 The results show that for those risks unique to FPSO operation: • The frequency of FPSO-unique oil releases greater than 1000 barrels is 0. 1.000 barrels of oil per day. This risk is similar to that for lightering operations in the GoM. This is particularly true for the significant fraction of shuttle tanker spills that occur closer to shore. the dominant FPSO-unique risk is from accidents that escalate to the cargo area.2 is that any effort to reduce the risk of oil spill from oil production on FPSOs should firstly concentrate on the operation of shuttle tankers.) Approximately 94. • FPSO-unique spill risk is low.doc . where there is a history of low spill frequency and small spill volumes. Spill risk during offloading from the FPSO to the shuttle tanker is low. the following points should be noted to put the study results in perspective.8 percent of the volume of potential FPSO-unique spills is likely to be from the transfer from the FPSO to the shuttle tanker. • C:\WINDOWS\TEMP\022101_Risk Assessment_Final.6 percent of the volume of potential FPSO-unique spills is likely to be from shuttle tankers near port. where there is likely to be a greater threat of environmental damage. The frequency of these events is of the order of 1 x 103 per year.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd 3. The remaining 95% of spills are non-unique and would be equally likely and have similar outcomes on a TLP or other deepwater alternative. but account for 1. Measures that protect against passing merchant vessel collisions are also likely to be beneficial in reducing oil spill risk. However.037 per billion barrels produced for FPSO-related failures.4 percent of the volume of potential FPSO-unique spills is likely to be due to the transfer of oil from the FPSO to the shuttle tanker and from the shuttle tanker transit to shore. 53. For events on the FPSO. excluding offloading and shuttle tanker transport. Process releases are the largest FPSO-unique risk for releases on the FPSO.2 per billion barrels for shuttle tanker-related failures. Measures that protect against escalation to the cargo area are likely to be the most beneficial means of reducing the risk of oil spills from the FPSO itself. FPSO-unique spill risk makes up only 5% of the total.0 percent of the volume of potential FPSO-unique spills is likely to be from shuttle tankers in transit to port. Passing merchant vessel collisions are low frequency events. • • • • • • • A conclusion that can be drawn from Table 3. Of spill risk on the FPSO itself. and 1.2 percent of all the FPSO-unique oil released due to the potential for large volume spills. 39.

More detailed analysis would accompany the evaluation of specific FPSO permit applications. the oil spill risk for shuttle tanker transport is comparable to and arguably better than pipeline transport. The assessments of oil spill risk performed in this study should be regarded as generic to the concept of the use of FPSOs in deep water. C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Based on analysis of MMS’s database of oil spills in US waters (ref. the location of a proposed FPSO and associated tanker routes would be more defined. Therefore. Therefore. and the risk from transportation routes closer to shore would be evaluated.doc . waters with incidents extending back to the 1970s.32 spills greater than 1000 bbls per billion bbls transported.21 spills greater than 1000 bbls per billion bbls transported.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd 3. The risk of shuttle tanker transport spills used in this assessment was derived from a database of tanker spills in U. and for tanker transport there will be 1. This incident database covers a large range of years and provides a wide experience base for determining what the historic risk of tanker transport spills has been. the risk of shuttle tanker transport spills predicted in this assessment may well be conservative (overstated).S. the large range of years covered also means that recent regulatory and other risk-reducing measures are not well represented in the predicted risk of tanker transport spills. At that time.5 E&E MMS January 2001 • • • Shuttle tanker transport spills should be compared with pipeline spills. However. 2) it is expected that for pipeline transport there will be 1. It is expected that these corrective actions should result in improved tanker performance in the future over the performance predicted using this database as has been observed over the last eight years.

Shuttle Tanker Tension Leg Platform BOPD – DNV – DP dwt – – ESDV – FPSO – GoM – HC – LOOP – MMS – MJ OCS PFP – – – MODU – PLEM – ROV – SBM – ST TLP – – C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Offloading unit Gulf of Mexico Hydrocarbons Louisiana Offshore Oil Port Minerals Management Services MegaJoules Mobile Offshore Drilling Unit Outer Continental Shelf Personal Fire Protection Pipeline End Manifold Remote Operated Vehicle Single Buoy Mooring.1 E&E MMS January 2001 4 ACRONYMS AND ABBREVIATIONS bbls – Barrels Barrels of Oil Per Day Det Norske Veritas Dynamic Positioning Deadweight (tons) Emergency Shutdown Valve Floating Production.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd 4. Storage. Inc.doc .

Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd 5. Confidential internal document. Marine Board (1998): “Oil Spill Risks from Tank Vessel Lightering”. Confidential internal document. Anderson and LaBelle. September 1999. 1998 C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Environmental Impact Statement on Floating. Storage. and Offloading Systems on the Gulf of Mexico Outer Continental Shelf” Working Copy. Ecology and Environment Inc. DNV ARF C1 Rev 1 . Spill Science and Technology Bulletin 1(2). “Comparative Occurrence Rates for Offshore Oil Spills”. DNV ARF T14 Rev 1 – “ Process Equipment Failure Frequencies. January 1999 4.1 E&E MMS January 2001 5 REFERENCES 1. National Academy Press."Guide to QRA of Offshore Installations". 2. Washington DC 5. Section 21 – Ships”.. Production.doc . “Scenario Report. 1994 3.

doc .Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd E&E MMS January 2001 APPENDIX I SCENARIO ANALYSIS DETAILS C:\WINDOWS\TEMP\022101_Risk Assessment_Final.

HAZARDS Blowout • • • • • • • • • • • • • • • • • • • • • • • Blowout Wellhead or Manifold Leak Production Riser Leak Flowline Leak Gas Export Riser Leak Gas Export Pipeline Leak Swivel leak Explosion in turret Process Leak Explosion below process deck Liquid carryover from flare Methanol Fire Helifuel Fire Generator Explosion Cargo Heating Fire/Explosion Diesel Fire Accommodation Fire Cargo Tank Explosion Ballast Tank Explosion Cargo Tank Overfill Cargo Piping Leak on Deck Process Gas Blow-by Foundering Riser and Pipeline Leaks Hydrocarbon Release on FPSO Non-Process Fires and Explosions Cargo Storage Events Marine Accidents on the FPSO C:\WINDOWS\TEMP\022101_Risk Assessment_Final.doc .

• • • • • • • • • • • Mooring Failure Shuttle Tanker Collision During Offloading Transfer Hose Leak Shuttle Tanker Leak at Port Shuttle Tanker Leak at Sea No events beyond those on existing platforms in the OCS No events beyond those on existing platforms in the OCS Passing Merchant Vessel Drifting Vessel Visiting Supply Vessel Visiting Shuttle Tanker Offloading Accidents Shuttle Tanker Accidents Non-Process Spills Transportation (supply vessels and helicopters) Ship Collisions C:\WINDOWS\TEMP\022101_Risk Assessment_Final.doc .

doc .Blowout C:\WINDOWS\TEMP\022101_Risk Assessment_Final.

Subsea layout Tree mounted instruments. Trenching operations. Well intervention.HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : FPSO Release Frequency Analysis Blowout Blowout Major release of oil to the sea Not applicable Major release of oil to the sea 1 November 1999 Revision: 0 Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: Earthquake. Material failure. Oil spill response Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Visual detection. Fishing exclusion. Process upset. Downhole instrumentation. Impact protection. Human error. Flowline trenching. Intervention well.doc . Dropped object. Good design. Anchoring. Periodic inspection Blowouts will not be controlled FPSO is far enough away that cargo is not at risk. Trawler damage. Trawler damage Hydrocarbon boundary integrity. Seabed compaction.

doc .000 – 10.9 % 6.9% 50.9% 1.000 : 13.000 : 28.2% 100.000 : 18.4% > 500.8 % Based on this distribution and the assumption that a blowout will have a release rate 5 times that of the normal flow rate (ref. the following distribution among the release ranges is assumed for this study: 100 – 1.39 x 10-3 (ref.9 % 6. Fault tree base events: 1.000 : 10. 3: < 10 min 10 – 40 min 40 min – 2 hr 2 – 12 hr 12 hr – 5 days > 5 days 10.Activity: FPSO Release Frequency Analysis Hazard: Blowout 18 October 1999 Revision: 0 Subcategory: Blowout Scenario description: A blowout releases oil from the reservoir directly to the sea.9 % 42. 3) Event tree branch probabilities: Release volumes: The following distribution of blowout duration times is presented in ref.9 % 13.000 : 14.8% 10. as they can also occur on any other existing OCS platforms.8% Prepared by : Client approval: Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.000 – 500. The FPSO is far enough away from the subsea wells that the cargo is not at risk.000 – 50.6 % 18.000 – 100.000 : 13. Blowouts are not unique spills to FPSOs. 3).

Trawler damage Hydrocarbon boundary integrity. Impact protection. Flowline trenching. Dropped object. Seabed compaction. Anchoring. Trenching operations. Well intervention. or short duration large leak Blowout Major release of oil to the sea Earthquake. Visual detection. Material failure. Trawler damage.doc . Downhole instrumentation. Periodic inspection Emergency shutdown FPSO is far enough away that cargo is not at risk. Fishing exclusion. Good design. Subsea layout Tree mounted instruments. Intervention well. Oil spill response Sign: Sign: Date : Date: Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : FPSO Release Frequency Analysis Blowout 1 November 1999 Revision: 0 Wellhead or manifold leak Long duration small leak. Process upset. Human error.

6 x 10-2 leaks/year) (ref. Successful isolation of all three wells results in shut-in of wells within 3 minutes of release.000 BOPD (i. This figure is conservatively in that it assumes there are 2 only fail-safe valves (subsea wellhead X-mas tree valves) for isolating any well from the risers each with individual failure probabilities of 0. In reality there are most likely 4 or 5 fail-safe valves counting sub-surface and manifold valves.000 BOPD / 6 flowlines).8 x 10-3 (per year) Leak frequency is assumed to be equivalent to surface oil manifold (1. estimated. Fault tree base events: 4. 3) Control failure: 0. Escalation: 0 it is assumed that the gas cloud will be too far away to affect the FPSO Release volumes: Subsea release from flowline. 14 days for ROV. depends on wind and current direction as well as distance from PLEM to FPSO. 3) of which 3% are large leaks. It is assumed that 100% of the volume spilled subsea forms a pool at the surface. Event tree branch probabilities: Probability release is directed towards FPSO: 0. Prepared by : Client approval: Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. 150. each well has 2 or more fail safe valves taken as reliability of ESD valve 0. (ref.0012 shut in all three wells on connected subsea manifold. Detection failure: 0.doc .01 for large leak (ref. 1).e. Ignition: 0 assumed not to ignite due to lack of ignition sources. Releases are assumed to be too far away from FPSO to cause escalation.02. The representative release rate for a large leak or rupture of a single manifold is assumed to be equivalent to a rupture of a single flowline or 25.Activity: FPSO Release Frequency Analysis Hazard: Blowout 18 October 1999 Revision: 0 Subcategory: Large (>30 kg/s) wellhead leak or manifold leak Scenario description : Large leak or rupture of manifold.02 so. Failure to isolate a well results in the release continuing until an alternate means of isolation is available.125.02^2)^3. P=(1-0.

Failure to isolate a well results in the release continuing until an alternate means of isolation is available. This figure is conservatively in that it assumes there are 2 only fail-safe valves (subsea wellhead X-mas tree valves) for isolating any well from the risers each with individual failure probabilities of 0.02.Activity: FPSO Release Frequency Analysis Hazard: Blowout 18 October 1999 Revision: 0 Subcategory: Medium (3. 3) Control failure: 0.125. Release volumes: Subsea release from manifold. It is assumed that 100% of the volume spilled subsea forms a pool at the surface. In reality there are most likely 4 or 5 fail-safe valves counting sub-surface and manifold valves. (ref. Release of oil and gas mixture. Detection failure: 0. depends on wind and current direction as well as distance from PLEM to FPSO.0 – 30 kg/s) wellhead leak or manifold leak Scenario description : Medium leak from manifold. Ignition: 0 assumed not to ignite due to lack of ignition sources.0012 shut in all three wells on connected subsea manifold. Potential fire or explosion resulting in escalation to cargo tanks or FPSO. each well has 2 or more fail safe valves taken as reliability of ESD valve 0.01 for medium leak (ref.6 x 10-2 leaks/year) (ref. Event tree branch probabilities: Probability release is directed towards FPSO: 0. P=(1-0. 14 days for ROV. Fault tree base events: 1. Prepared by : Client approval: Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. 3) of which 11% are medium leaks.doc . Successful isolation of all three wells results in shut-in of wells within 3 minutes of release. 1).02^2)^3. Escalation: 0 it is assumed that the gas cloud will be too far away to affect the FPSO.8 x 10-3 (per year) Leak frequency is assumed to be equivalent to surface oil manifold (1.09 barrels/sec). The representative release rate for medium leaks is 10 kg/s (~0. estimated.02 so.

Release of oil and gas mixture.009 barrels/sec). It is assumed that 100% of the volume spilled subsea forms a pool at the surface. estimated.4 x 10-2 (per year) Leak frequency is assumed to be equivalent to surface oil manifold (1. Fault tree base events: 1.Activity: FPSO Release Frequency Analysis Hazard: Blowout 18 October 1999 Revision: 0 Subcategory: Small (0.02. Detection failure: 0.3 – 3. In reality there are most likely 4 or 5 fail-safe valves counting sub-surface and manifold valves.125.02^2)^3. 3) Control failure: 0.6 x 10-2 leaks/year) (ref. Potential fire or explosion resulting in escalation to cargo tanks or FPSO.0012 shut in all three wells on connected subsea manifold. The representative release rate for small leaks is 1 kg/s (~0.02 so.doc . Event tree branch probabilities: Probability release is directed towards FPSO: 0. 3) of which 86% are small leaks. Ignition: 0 assumed not to ignite due to lack of ignition sources. 14 days for ROV.0 kg/s) wellhead leak or manifold leak Scenario description : Small leak from manifold.02 for small leak (ref. P=(1-0. depends on wind and current direction as well as distance from PLEM to FPSO. Successful isolation of all three wells results in shut-in of wells within 3 minutes of release. each well has 2 or more fail safe valves taken as reliability of ESD valve 0. Release volumes: Subsea release from manifold. Prepared by : Client approval: Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. 1). (ref. Escalation: 0 it is assumed that the gas cloud will be too far away to affect the FPSO. This figure is conservatively in that it assumes there are 2 only fail-safe valves (subsea wellhead X-mas tree valves) for isolating any well from the risers each with individual failure probabilities of 0. Failure to isolate a well results in the release continuing until an alternate means of isolation is available .

doc .Riser and Pipeline Leaks C:\WINDOWS\TEMP\022101_Risk Assessment_Final.

HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : FPSO Release Frequency Analysis Riser and pipeline leaks Production riser leak 1 November 1999 Revision: 0 Pipeline and riser contents releases to the sea Unisolated release may result in blowout. Riser on riser impact. Periodic inspection Emergency shutdown Procedures. Process shutdown. Gas detection on vessel. Trawler damage. Single mooring line fails and damages riser Hydrocarbon boundary integrity. Oil spill contingency. Ignited riser release may escalate to shuttle tanker Uncontrolled wellfluid release or possible loss of FPSO due to long duration ignited leak Earthquake. Over-bending. Extreme vessel motion.doc . Turret lock-up. Flowline trenching. Subsea layout. Cargo tank integrity. Operation outside design conditions. Visual detection. Redundancy in the riser buoyancy system. Human error. Seabed disturbance. Fishing exclusion. Mooring failure. Impact protection. Inspection. Cyclic loading. Double hull (FPSO and shuttle tanker. Material failure. Anchoring. Riser on riser impact. Deluge cooling of process and cargo decks Sign: Sign: Date : Date: Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Anchor exclusion corridor. Cathodic protection. Dropped object. Seabed compaction. Well intervention. Trenching operations. Bending restrictors Process upset. Good design.

02 so. It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500. C:\WINDOWS\TEMP\022101_Risk Assessment_Final.000 bbls due to circumstances such as waiting on shuttle tanker or bad weather.5 estimated based on failure to isolate at least one well and continued large fire. 4) Escalation due to fire. Release rate is assumed to the production rate of one well. 75% of volume is lost in burning).63 x 10-3 x 26% x 6 production risers (ref. 12) Impacts: <500m: 1.e.9 x 10-7 x 1. 16. and the remaining 10% of the time it is operates between 500.0012 shut in all three wells on connected subsea manifold. Escalation due to fire. It is assumed that FPSO operates in this cycle 90% of the time.9 x 10-4 x 2. of which 1. Release volume based on estimated volume of cargo on FPSO.700 barrels/day. 100% of the volume of oil released subsea is assumed to form a pool at the surface. 3) Escalation due to major explosion: 0.075 probability of major explosion due to gas dispersing from sea surface to deck of FPSO and igniting in confined/congested area.000.16 + 1. If there is escalation to the FPSO.16 km. control works: 0.03 km is outside of 500 m. the entire cargo of would be lost in an ignited release.doc .000 bbls (50% of capacity) before offloading to shuttle tanker.Activity: FPSO Release Frequency Analysis Hazard: Riser and Pipeline Leaks 18 October 1999 Revision: 0 Subcategory: Large production riser leak Scenario description : Large leak or rupture of production riser.13 km is within 500 m of FPSO and 1. Corrosion: 6. the spill size distribution is derived as. (ref.9 x 10-4/km-yr Total: 1 x (6.e.63 x 10-3/yr Hole Size Distribution: Small: 58% (<20 mm) Medium: 16% (20-80 mm) Large: 26% (>80 mm) Event tree branch probabilities: Detection failure: 0.2 x 10-4/km-yr >500m: 5.5 x 10-3 (per year) – 1. 13) calculated as 0. Using these figures. Release of oil and gas mixture.9 x 10-7/km-yr Total riser length is estimated to be 2. P=(1-0. it is assumed that the spill volume is reduced to 25% (i. 1750 x 2 (piggable loop) = 3500 barrels Duration: isolation subsea occurs within 3 minutes unless there is an isolation failure. 3) Control failure: 0.02^2)^3 Ignition: 0. control fails: 0.003 Release volumes: Release of inventory in production riser and flowline. As this event is an escalation due to fire.03) = 1. Fault tree base events: 2.2 x 10-4 x 1. the volume is reduced to 25% (i.3 for large gas leak (ref.6 x 0. in which case it may take as long as 14 days (ROV) to isolate the release.13 + 5. 75% of the volume is lost in burning).01 for large leak (ref.0018 (ref.000 and 1. each well has 2 or more fail safe valves taken as reliability of ESD valve 0. Potential fire or explosion resulting in escalation to cargo tanks or FPSO. If the release is ignited.

000 100.000-50.36 0.000-100.00 1.Volume (bbls) 10.000 >500.28 0.36 0.000-500.00 Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.000 50.000 Total Prepared by : Client approval: Probability 0.doc .

003 C:\WINDOWS\TEMP\022101_Risk Assessment_Final. and continued medium fire.02^2)^3 Ignition: 0.0012 shut in all three wells on connected subsea manifold. 4) Escalation due to fire. P=(1-0. Escalation due to fire.02 so.01 for medium leak (ref. each well has 2 or more fail safe valves taken as reliability of ESD valve 0.63 x 10-3 x 16% x 6 production risers (ref.Activity: FPSO Release Frequency Analysis Hazard: Riser and Pipeline Leaks 18 October 1999 Revision: 0 Subcategory: Medium production riser leak Scenario description : Medium leak from production riser. control works: 0.6 x 10-3 (per year) – 1. 12) (see large production riser leak) Event tree branch probabilities: Detection failure: 0.0018 (ref. control fails: 0. 13) calculated as 0. Release of oil and gas mixture. Fault tree base events: 1. 3) Control failure: 0.doc .6 x 0. 3) Escalation due to major explosion: 0 (ref.25 estimated based on failure to isolate release from one or more wells. Potential fire or explosion resulting in escalation to cargo tanks or FPSO.1 for medium gas leak 5-25 kg/s (ref.

75% of volume is lost in burning). the entire cargo of would be lost in an ignited release. If there is escalation to the FPSO.000 Total Prepared by : Client approval: Probability 0.00 Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.e. 100% of the volume of oil released subsea is assumed to form a pool at the surface.000 and 1.000.000-100. in which case it may take as long as 14 days (ROV) to isolate the release. Volume (bbls) 10. It is assumed that FPSO operates in this cycle 90% of the time.000-50. 75% of the volume is lost in burning). the volume is reduced to 25% (i. The representative release rate for a medium leak is 10 kg/second. If the release is ignited.000 bbls due to circumstances such as waiting on shuttle tanker or bad weather. Using these figures.00 1. It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500.000 50.doc . 1750 x 2 (piggable loop) = 3500 barrels Duration: isolation subsea occurs within 3 minutes unless there is an isolation failure.e.28 0.000 bbls (50% of capacity) before offloading to shuttle tanker.000 >500. it is assumed that the spill volume is reduced to 25% (i. and the remaining 10% of the time it is operates between 500.Release volumes: Release of inventory in production riser and flowline.000-500.36 0.36 0.000 100. Release volume based on estimated volume of cargo on FPSO. As this event is an escalation due to fire. the spill size distribution is derived as.

02 so. in which case it may take as long as 14 days (ROV) to isolate the release. Escalation due to fire. 12) (see large production riser leak) Event tree branch probabilities: Detection failure: 0.Activity: FPSO Release Frequency Analysis Hazard: Riser and Pipeline Leaks 18 October 1999 Revision: 0 Subcategory: Small production riser leak Scenario description : Small leak from production riser. Escalation due to major explosion: 0 Release is assumed to be too small to disperse from the sea surface onto the deck of the FPSO and explode.doc . each well has 2 or more fail safe valves taken as reliability of ESD valve 0. Release of oil and gas mixture.7 x 10-3 (per year) – 1. Release volumes: Release of inventory in production riser and flowline. Escalation due to fire. 100% of the volume of oil released subsea is assumed to form a pool at the surface. Potential fire or explosion resulting in escalation to cargo tanks or FPSO.0012 shut in all three wells on connected subsea manifold. Prepared by : Client approval: Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. control fails: 0 Release is assumed to be too small to disperse from the sea surface onto the deck of the FPSO and explode or otherwise escalate to the FPSO or cargo tanks. The representative release rate for a small leak is 1 kg/second.63 x 10-3 x 58% x 6 production risers (ref. 3) Control failure: 0. Fault tree base events: 5.02^2)^3 Ignition: 0 Release is assumed to be too small to disperse from the sea surface onto the deck of the FPSO and ignite. P=(1-0.02 for small leak (ref. control works: 0 Release is assumed to be too small to disperse from the sea surface onto the deck of the FPSO and explode or otherwise escalate to the FPSO or cargo tanks. 1750 x 2 (piggable loop) = 3500 barrels Duration: isolation subsea occurs within 3 minutes unless there is an isolation failure.

Over-bending. Fishing exclusion. Visual detection. Subsea layout. Human error. Double hull (FPSO and shuttle tanker. Anchor exclusion corridor. Seabed disturbance. Operation outside design conditions.HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : FPSO Release Frequency Analysis Riser and pipeline leaks Flowline leak 1 November 1999 Revision: 0 Pipeline and riser contents releases to the sea Unisolated release may result in blowout. Riser on riser impact. Impact protection.doc . Anchoring. Periodic inspection Emergency shutdown Procedures. Inspection. Flowline trenching. Trenching operations. Dropped object. Riser on riser impact. Turret lock-up. Cathodic protection. Ignited riser release may escalate to shuttle tanker Uncontrolled wellfluid release or possible loss of FPSO due to long duration ignited leak Earthquake. Trawler damage. Material failure. Bending restrictors Process upset. Process shutdown. Cargo tank integrity. Deluge cooling of process and cargo decks Sign: Sign: Date : Date: Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Good design. Well intervention. Seabed compaction. Cyclic loading. Oil spill contingency. Gas detection on vessel. Redundancy in the riser buoyancy system. Single mooring line fails and damages riser Hydrocarbon boundary integrity. Extreme vessel motion. Mooring failure.

0018 (ref. 3) Control failure: 0. and continued large release.125.003 C:\WINDOWS\TEMP\022101_Risk Assessment_Final.0012 shut in all three wells on connected subsea manifold. each well has 2 or more fail safe valves taken as reliability of ESD valve 0. estimated.5 estimated based on failure to isolate release from one or more wells. directed towards FPSO: 0. control fails: 0. control works: 0. depends on wind and current direction as well as distance from PLEM to FPSO.Activity: FPSO Release Frequency Analysis Hazard: Riser and Pipeline Leaks 18 October 1999 Revision: 0 Subcategory: Large flowline leak Scenario description : Large leak or rupture of flowline.075 probability of major explosion due to gas dispersing from sea surface to deck of FPSO and igniting in confined/congested area. Releases past the first kilometer are assumed to be too far away from FPSO to cause escalation.9 x 10-7 x 1) Hole Size Distribution: Small: 58% (<20 mm) Medium: 16% (20-80 mm) Large: 26% (>80 mm) Event tree branch probabilities: Probability release is directed towards FPSO: 0. Fault tree base events: 1.91 x 10-4 x 26% x 6 flowlines (ref. 4) Escalation due to fire.9 x 10-4/km-yr Total Frequency: 6.3 for large gas leak 25-200 kg/s (ref. Detection failure: 0.doc . Analysis considers first kilometer of flow-line only.01 for large leak (ref. 12) Impact Failures: 5. 3) Ignition.9 x 10-7/km-yr Corrosion Failures: 6. Escalation due to fire. P=(1-0.02 so.02^2)^3 Ignition. Escalation due to major explosion: 0.6 x 0.91 x 10-4/yr = 1 x (6. Potential fire or explosion resulting in escalation to cargo tanks or FPSO. 13) calculated as 0.1 x 10-3/year – 6. (ref. directed away from FPSO: 0 assumed not to ignite due to lack of ignition sources.9 x 10-4 x 1 + 5.

the entire cargo of would be lost in an ignited release. the volume spilled is reduced to 25% (i.000 BOPD (i. Volume (bbls) 10.000 Total Prepared by : Client approval: Probability 0.000 bbls due to circumstances such as waiting on shuttle tanker or bad weather. Release volume based on estimated volume of cargo on FPSO.000 bbls (50% of capacity) before offloading to shuttle tanker. 75% is lost in burning).28 0.e.000 50.doc .000 >500.00 Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.000-500. It is assumed that 100% of the volume spilled subsea forms a pool at the surface. It is assumed that FPSO operates in this cycle 90% of the time.000 BOPD / 6 flowlines).Release volumes: Subsea release from flowline.000-100.000 and 1. it is assumed that the spill volume is reduced to 25% (i. and the remaining 10% of the time it is operates between 500. If there is escalation to the FPSO. As this event is an escalation due to fire.000. The representative release rate for a large leak or rupture of a single flowline is 25.00 1. the spill size distribution is derived as. 75% of volume is lost in burning). Using these figures. It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500.e.e.36 0.36 0. If the release is ignited. 150.000 100.000-50.

Release volumes: Subsea release from flowline. Prepared by : Client approval: Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Detection failure: 0. depends on wind and current direction as well as distance from PLEM to FPSO.91 x 10-4 x 0. Escalation due to fire.09 barrels/sec). Potential fire or explosion resulting in escalation to cargo tanks or FPSO. Escalation due to major explosion: 0 Release originating at 5000’ subsea is assumed to be too small to disperse from the sea surface onto the deck of the FPSO and explode. Fault tree base events: 6.doc .0012 shut in all three wells on connected subsea manifold. Release of oil and gas mixture. Escalation due to fire. estimated.6.02 so. control fails: 0 Release originating at 5000’ subsea is assumed to be too small to disperse from the sea surface onto the deck of the FPSO and escalate. P=(1-0.02^2)^3 Ignition: 0 Release originating at 5000’ subsea is assumed to be too small to disperse from the sea surface onto the deck of the FPSO and ignite.Activity: FPSO Release Frequency Analysis Hazard: Riser and Pipeline Leaks 18 October 1999 Revision: 0 Subcategory: Medium flowline leak Scenario description : Medium leak from flowline. each well has 2 or more fail safe valves taken as reliability of ESD valve 0. The representative release rate for medium leaks is 10 kg/s (~0. It is assumed that 100% of the volume spilled subsea forms a pool at the surface.16 x 6 production flowlines (see large flowline leak) Event tree branch probabilities: Probability release is directed towards FPSO: 0.6 x 10-4 (per year) . 3) Control failure: 0.01 for medium leak (ref.125. control works: 0 Release originating at 5000’ subsea is assumed to be too small to disperse from the sea surface onto the deck of the FPSO and escalate.

Potential fire or explosion resulting in escalation to cargo tanks or FPSO.91 x 10-4 x 0. 3) Control failure: 0.02 so.0012 shut in all three wells on connected subsea manifold.Activity: FPSO Release Frequency Analysis Hazard: Riser and Pipeline Leaks 18 October 1999 Revision: 0 Subcategory: Small flowline leak Scenario description : Small leak from flowline. Escalation due to fire. The representative release rate for small leaks is 1 kg/s (~0.125. Escalation due to fire. Release volumes: Subsea release from flowline. P=(1-0. each well has 2 or more fail safe valves taken as reliability of ESD valve 0.6. estimated. Prepared by : Client approval: Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.009 barrels/sec). Release of oil and gas mixture. Detection failure: 0.02^2)^3 Ignition: 0 Release originating at 5000’ subsea is assumed to be too small to disperse from the sea surface onto the deck of the FPSO and ignite. It is assumed that 100% of the volume spilled subsea forms a pool at the surface. control works: 0 Release originating at 5000’ subsea is assumed to be too small to disperse from the sea surface onto the deck of the FPSO and explode or otherwise escalate to the FPSO or cargo tanks.doc . control fails: 0 Release originating at 5000’ subsea is assumed to be too small to disperse from the sea surface onto the deck of the FPSO and explode or otherwise escalate to the FPSO or cargo tanks. Escalation due to major explosion: 0 Release originating at 5000’ subsea is assumed to be too small to disperse from the sea surface onto the deck of the FPSO and explode.58 x 6 production flowlines (see large flowline leak) Event tree branch probabilities: Probability release is directed towards FPSO: 0.4 x 10-3 (per year) . depends on wind and current direction as well as distance from PLEM to FPSO.02 for small leak (ref. Fault tree base events: 2.

Fishing exclusion. Cargo tank integrity. Seabed compaction. Trawler damage. Single mooring line fails and damages riser Hydrocarbon boundary integrity. Riser on riser impact. Mooring failure. Subsea layout. Trenching operations. Seabed disturbance. Extreme vessel motion. Redundancy in the riser buoyancy system. Turret lock-up. Bending restrictors Process upset. Dropped object. Over-bending. Periodic inspection Emergency shutdown Procedures. Process shutdown. Human error.HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : FPSO Release Frequency Analysis Riser and pipeline leaks Gas export riser leak Gas releases are outside of this scope Ignited riser release may escalate to FPSO Potential loss of cargo to the environment 1 November 1999 Revision: 0 Earthquake. Gas detection on vessel. Anchoring. Visual detection. Anchor exclusion corridor. Material failure. Good design. Impact protection. Cathodic protection. Riser on riser impact. Well intervention. Double hull (FPSO and shuttle tanker. Cyclic loading.doc . Inspection. Oil spill contingency. Deluge cooling of process and cargo decks Sign: Sign: Date : Date: Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Operation outside design conditions. Flowline trenching.

16 km.3 for large gas leak 25-200 kg/s (ref. 13) calculated as 0.2 x 10-4/km-yr >500m from FPSO: 5. 4) Escalation due to fire. (ref. 3) Escalation due to major explosion: 0. 3) Control failure results in failure to isolate leaking gas export riser from pipeline to shore and prolonged release duration.6 x 0.2x10-4x1.075 probability of major explosion due to gas dispersing from sea surface to deck of FPSO and igniting in confined/congested area. control fails: 0.3 x 10-5/km-yr Total Leak Frequency: 2. of which 1.29 x 10-4/yr = 1x(4. Corrosion Failures: 4. Ignition: 0.16+1.0 x 10-5 (per year) – 2.01 for large leak (ref.9 x 10-7/km-yr Total riser length is estimated to be 2.13 km is within 500 m (horizontal distance) of FPSO and 1.0018 (ref. Fault tree base events: 6.13+5.03 km is outside of 500 m.3 x 10-5x2.5 estimated based on failure to isolate release from gas export pipeline to shore and continued large fire. 12) Impact Failures: <500m from FPSO: 1.29 x 10-5 x 26% x 1 gas export riser (ref. 3) Control failure: 0. Escalation due to fire. control works: 0.03) Hole Size Distribution: Small: 58% (<20 mm) Medium: 16% (20-80 mm) Large: 26% (>80 mm) Event tree branch probabilities: Detection failure: 0. Potential fire or explosion resulting in escalation to cargo tanks or FPSO.003 C:\WINDOWS\TEMP\022101_Risk Assessment_Final.02 (for ESD failure of single isolatable section) (ref.Activity: FPSO Release Frequency Analysis Hazard: Riser and Pipeline Leaks 18 October 1999 Revision: 0 Subcategory: Large gas export riser leak Scenario description : Large leak or rupture of gas export riser.doc .9x10-7x1.

Release volume based on estimated volume of cargo on FPSO. It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500.000 50. and the remaining 10% of the time it is operates between 500.000 bbls due to circumstances such as waiting on shuttle tanker or bad weather. Using these figures.36 0. 75% of volume is lost in burning).00 Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.Release volumes: In the event of escalation due to fire. It is assumed that FPSO operates in this cycle 90% of the time.000-500.000 and 1.00 1.36 0.000 100.000 Total Prepared by : Client approval: Probability 0.000-100. Volume (bbls) 10. it is assumed that the spill volume is reduced to 25% (i.000 bbls (50% of capacity) before offloading to shuttle tanker. loss of FPSO in an ignited release.doc .28 0.e. the spill size distribution is derived as.000-50. As this event is an escalation due to fire.000.000 >500.

and the remaining 10% of the time it is operates between 500. Fault tree base events: 3.36 0.7 x 10-5 (per year) – 2.000 >500.02 (for ESD failure of single isolatable section) (ref.01 for medium gas leak (ref. 3) Control failure: 0.000. control works: 0. 3) Control failure results in failure to isolate leaking gas export riser from pipeline to shore and prolonged release duration.29 x 10-4 x 16% x 1 gas export riser (ref.25 estimated based on failure to isolate riser leak from gas export pipeline and continued medium fire.6 x 0.e. As this event is an escalation due to fire. 12) (see large gas riser leak) Event tree branch probabilities: Detection failure: 0.doc .00 Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.000 bbls due to circumstances such as waiting on shuttle tanker or bad weather.28 0.000 and 1.000 Total Prepared by : Client approval: Probability 0. It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500. the spill size distribution is derived as.Activity: FPSO Release Frequency Analysis Hazard: Riser and Pipeline Leaks 18 October 1999 Revision: 0 Subcategory: Medium gas export riser leak Scenario description :Medium leak from gas export riser.000-50.000-500. Release volume based on estimated volume of cargo on FPSO. 13) calculated as 0. it is assumed that the spill volume is reduced to 25% (i.0018 (ref. Potential fire or explosion resulting in escalation to cargo tanks or FPSO. Using these figures. control fails: 0. Ignition: 0.000 50.00 1.1 for medium gas leak 5-25 kg/s (ref. 4) Escalation due to fire.36 0. It is assumed that FPSO operates in this cycle 90% of the time.003 Release volumes: In the event of escalation due to fire. loss of FPSO in an ignited release. Volume (bbls) 10. Escalation due to fire.000-100. 75% of volume is lost in burning).000 bbls (50% of capacity) before offloading to shuttle tanker. 3) Escalation due to major explosion: 0 (ref.000 100.

control fails: 0 (as for explosions) Escalation due to fire. 4) Escalation due to fire. 3) Control failure results in failure to isolate leaking gas export riser from pipeline to shore and prolonged release duration. Escalation due to explosion is not likely (ref. 3) Control failure: 0.5-5 kg/s (ref. 12) (see large gas export riser leak) Event tree branch probabilities: Detection failure: 0.02 for small gas leak (ref.29 x 10-4 x 58% x 1 gas export riser (ref. Ignition: 0. Fault tree base events: 1.3 x 10-4 (per year) – 2.doc .04 for small gas leak 0. but no oil spill Prepared by : Client approval: Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Potential fire or explosion resulting in escalation to cargo tanks or FPSO. 3) Escalation due to major explosion: 0 Leak would be too small to disperse from sea-surface and collect in any confined areas on the deck of the FPSO.02 (for ESD failure of single isolatable section) (ref. control works: 0 (as for explosions) Release volumes: Gas release.Activity: FPSO Release Frequency Analysis Hazard: Riser and Pipeline Leaks 18 October 1999 Revision: 0 Subcategory: Small gas export riser leak Scenario description: Small from gas export riser.

Seabed compaction. Visual detection. Riser on riser impact. Extreme vessel motion. Dropped object.HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : FPSO Release Frequency Analysis Riser and pipeline leaks Gas export pipeline leak Gas releases are outside of this scope Ignited riser release may escalate to FPSO Potential loss of cargo to the environment 1 November 1999 Revision: 0 Earthquake. Flowline trenching. Riser on riser impact. Periodic inspection Emergency shutdown Procedures. Single mooring line fails and damages riser Hydrocarbon boundary integrity. Cathodic protection. Seabed disturbance. Inspection. Redundancy in the riser buoyancy system. Deluge cooling of process and cargo decks Sign: Sign: Date : Date: Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Process shutdown. Over-bending. Subsea layout. Impact protection. Gas detection on vessel. Double hull (FPSO and shuttle tanker. Cyclic loading. Cargo tank integrity. Trawler damage. Anchor exclusion corridor. Oil spill contingency. Operation outside design conditions. Anchoring. Good design. Mooring failure. Material failure. Trenching operations.doc . Turret lock-up. Fishing exclusion. Human error. Bending restrictors Process upset. Well intervention.

control fails: 0. Detection failure: 0. Ignition.125.doc .1 x 10-5 /year – 4. (ref. 3) Ignition. 12) Impact Failures: 5. 3) Control failure: 0.3 x 10-5 x 1 + 5. Release past first kilometer are assumed to be too far away to escalate to FPSO. 4) Escalation due to fire. estimated.Activity: FPSO Release Frequency Analysis Hazard: Riser and Pipeline Leak 18 October 1999 Revision: 0 Subcategory: Large gas export pipeline leak Scenario description: Large leak or rupture of from gas export pipeline. Potential fire or explosion resulting in escalation to cargo tanks or FPSO.36 x 10-5/yr = 1 x (4. 01 for large leak (ref.9 x 10-7/km-yr Corrosion Failures: 4.36 x 10-5 x 26% x 1 gas export pipeline (ref. Release of gas.3 x 10-5/km-yr Total Leak Frequency: 4.003 C:\WINDOWS\TEMP\022101_Risk Assessment_Final.9 x 10-7 x 1) Hole Size Distribution: Small: 58% (<20 mm) Medium: 16% (20-80 mm) Large: 26% (>80 mm) Event tree branch probabilities: Probability release is directed towards FPSO: 0. depends on wind and current direction as well as distance from PLEM to FPSO. Fault tree base events: 1. control works: 0.6 x 0. Analysis only considers the first kilometer of pipeline. 13) calculated as 0.075 probability of major explosion due to gas dispersing from sea surface to deck of FPSO and igniting in confined/congested area.5 estimated based on control failure and continued fire Escalation due to fire.3 for large gas leak (ref. Escalation due to major explosion: 0. 3) Control failure results in failure to isolate leaking gas export riser from pipeline to shore and prolonged release duration.0018 (ref. directed towards FPSO: 0.02 (for ESD failure of single isolatable section) (ref. directed away from FPSO: 0 assumed not to ignite due to lack of ignition sources.

and the remaining 10% of the time it is operates between 500.000-500.36 0.Release volumes: In the event of escalation due to fire. It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500.000 bbls due to circumstances such as waiting on shuttle tanker or bad weather.000-50.000-100.doc . Release volume based on estimated volume of cargo on FPSO.000 and 1. the spill size distribution is derived as. Using these figures.36 0.00 1.000 bbls (50% of capacity) before offloading to shuttle tanker. It is assumed that FPSO operates in this cycle 90% of the time.e.000 Total Prepared by : Client approval: Probability 0.000 100. Volume (bbls) 10.000. it is assumed that the spill volume is reduced to 25% (i. loss of FPSO in an ignited release.000 50. As this event is an escalation due to fire.00 Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.000 >500.28 0. 75% of volume is lost in burning).

Fault tree base events: 7.16 x 1 export pipeline (see large gas export pipeline leak) Event tree branch probabilities: Probability release is directed towards FPSO: 0.01 for medium leak (ref. Escalation due to fire. control works: 0 Release originating at 5000’ subsea is assumed to be too small to disperse onto the deck of the FPSO.02 (for ESD failure of single isolatable section) (ref. Release of gas. depends on wind and current direction as well as distance from PLEM to FPSO.doc . ignite. Ignition: 0 Release originating at 5000’ subsea is assumed to be too small to disperse onto the deck of the FPSO and ignite. Prepared by : Client approval: Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. estimated. ignite and cause escalation. control fails: 0 Release originating at 5000’ subsea is assumed to be too small to disperse onto the deck of the FPSO. 3) Control failure: 0. Escalation due to major explosion: 0 Release originating at 5000’ subsea is assumed to be too small to disperse onto the deck of the FPSO and explode.Activity: FPSO Release Frequency Analysis Hazard: Riser and Pipeline Leaks 18 October 1999 Revision: 0 Subcategory: Medium gas export pipeline leak Scenario description : Medium leak from gas export pipeline.36 x 10-5 x 0.125. and cause escalation. Detection failure: 0. Escalation due to fire.0 x 10-6/ year – 4. Potential fire or explosion resulting in escalation to cargo tanks or FPSO. Release volumes: Gas release from pipeline. but no oil spill anticipated. 3) Control failure results in failure to isolate leaking gas export riser from pipeline to shore and prolonged release duration.

3) Control failure results in failure to isolate leaking gas export riser from pipeline to shore and prolonged release duration. but no oil spill anticipated.02 (for ESD failure of single isolatable section) (ref.125. Ignition: 0 Release originating at 5000’ subsea is assumed to be too small to disperse from the sea surface onto the deck of the FPSO and ignite. depends on wind and current direction as well as distance from PLEM to FPSO. Escalation due to fire.02 for small leak (ref. Escalation due to major explosion: 0 (ref. Detection failure: 0.Activity: FPSO Release Frequency Analysis Hazard: Riser and Pipeline Leaks 18 October 1999 Revision: 0 Subcategory: Small gas export pipeline leak Scenario description : Small leak from gas export pipeline. 3) Control failure: 0. control works: 0 Release originating at 5000’ subsea is assumed to be too small to disperse from the sea surface onto the deck of the FPSO and explode or otherwise escalate to the FPSO or cargo tanks. Escalation due to fire.doc .5 x 10-5/year – 4. Release of gas. Potential fire or explosion resulting in escalation to cargo tanks or FPSO.58 x 1 gas export pipeline (see large gas export pipeline leak) Event tree branch probabilities: Probability release is directed towards FPSO: 0. estimated.36 x 10-5 x 0. control fails: 0 Release originating at 5000’ subsea is assumed to be too small to disperse from the sea surface onto the deck of the FPSO and explode or otherwise escalate to the FPSO or cargo tanks. Prepared by : Client approval: Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. 4) Release originating at 5000’ subsea is assumed to be too small to disperse from the sea surface onto the deck of the FPSO and explode. Release volumes: Gas release from pipeline. Fault tree base events: 2.

Hydrocarbon Release on FPSO

C:\WINDOWS\TEMP\022101_Risk Assessment_Final.doc

HAZARD IDENTIFICATION

Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes :

FPSO Release Frequency Analysis Hydrocarbon Release on FPSO Swivel leak

1 November 1999 Revision: 0

Direct release of spilled oil to the sea, Fire at the swivel, Explosion at swivel. Damage to cargo area Loss of some or all cargo to the sea Swivel seizure, Material defects, Human error, Dropped object, Tall structure collapse, Helicopter crash, Rotating equipment failure, Structural support failure, Excessive vessel motion, Green water, Hydrates, Process upset, Various ignition sources, Poor maintenance, Maintenance induced failure, Gas weepage from cargo area Hydrocarbon boundary integrity, Impact protection, Good design, Process layout, Natural ventilation, inspection and maintenance, Operator competency, Passive fire protection, Corrosion protection, Dropped object protection, Protection against greenwater, Process control, Pressure relief, Ignition control Minimal hydrocarbon equipment, Helideck well clear from process area Process upset, Process control and instrumentation, Manual detection, Fire and gas detection Emergency shutdown, blowdown, process segregation Deluge and foam, PFP, Limited ignition sources, open ventilation, full flow drainage, Main deck plate strength, Deck camber, Sealed deck penetrations, fire and blast walls, Electrical isolation, Inert gas in cargo tanks, Sign: Sign: Date : Date:

Prevention :

Accident Detection : Control : Mitigation :

Prepared by : Client approval:

C:\WINDOWS\TEMP\022101_Risk Assessment_Final.doc

Activity: FPSO Release Frequency Analysis Hazard: Hydrocarbon Release on FPSO

18 October 1999 Revision: 0

Subcategory: Large (>30 kg/s) swivel leak Scenario description : Production fluid or export gas release at swivel with potential results including spill to sea, fire or explosion, and escalation to cargo tanks or FPSO. Fault tree base events: 0.01 large swivel leak per year. Overall leak frequency for swivel is 0.1 leak per year with hole size distribution as follows suggested by Turret Manufacturer SBM (based on their past experience); Small: 0.90 Medium: 0.09 Large: 0.01 Event tree branch probabilities: Detection failure: 0.01 for HC gas detection (ref. 3) Control failure: 0.02 for ESD (ref. 3). The probability of isolation failure assumes a typical section of pipework using 2 ESDVs. Ignition: 0.3 for large gas/oil release (ref. 3) Probability of escalation due to explosion: 0.075 (ref. 4) Escalation due to fire, control works: 0.0102 (ref. 13) calculated as 0.6 x 0.017 Escalation due to fire control fails: 0.0315 (ref. 13) calculated as 0.9 x 0.035 Probability of spill to sea: 0.9 Release is assumed to have a high potential to overflow the containment area due to high pressure and high release rate. Release volumes: Potential for hydrocarbon release off deck and directly to sea. If the release overflows the containment area it is assumed that 50% of the spill volume is released to sea. If the spill is ignited it is assumed that the spill volume is reduced to 25% (i.e. 75% of volume is lost in burning). Representative release rate for large leak is 45 kg/second. Duration: Detection is assumed to occur in 1 minute, otherwise the release is assumed to be detected after 10 minutes. Control (i.e. ESD) is assumed to occur rapidly. The leak is then assumed to continue for 5 minutes until it deinventories the isolatable section. If control fails, the release is extended by 5 minutes relieving inventory from additional equipment. In the event of escalation due to fire, loss of FPSO in an ignited release. Release volume based on estimated volume of cargo on FPSO. It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500,000 bbls (50% of capacity) before offloading to shuttle tanker. It is assumed that FPSO operates in this cycle 90% of the time, and the remaining 10% of the time it is operates between 500,000 and 1,000,000 bbls due to

C:\WINDOWS\TEMP\022101_Risk Assessment_Final.doc

000 0.000-500. Volume (bbls) Probability 10.000 0.000-100.28 >500.36 50. it is assumed that the spill volume is reduced to 25% (i. As this event is an escalation due to fire.doc .e.36 100. 75% of volume is lost in burning).000 0. Using these figures.000 0.000-50. the spill size distribution is derived as.00 Total 1.circumstances such as waiting on shuttle tanker or bad weather.00 Prepared by : Client approval: Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.

Overall leak frequency for swivel is 0.3). 13) calculated as 0. 3) Control failure: 0.1 leak per year with size distribution as follows suggested by Turret Manufacturer SBM small: 0.01 for HC gas detection (ref.1 for medium gas/oil release (ref.9 x 0.09 large: 0. 3) Probability of escalation due to explosion: 0 (ref. control works: 0.009 medium swivel leak per year.017 Escalation due to fire control fails: 0.01 Event tree branch probabilities: Detection failure: 0. fire or explosion. Fault tree base events: 0.0315 (ref.6 x 0.Activity: FPSO Release Frequency Analysis Hazard: Hydrocarbon Release on FPSO 18 October 1999 Revision: 0 Subcategory: Medium (3. Ignition: 0.5 C:\WINDOWS\TEMP\022101_Risk Assessment_Final. 4) Escalation due to fire.90 medium: 0.02 for ESD (ref.0 – 30 kg/s) swivel leak Scenario description : Hydrocarbon release at swivel with potential results including spill to sea.doc .0102 (ref. The probability of isolation failure assumes a typical section of pipework using 2 ESDVs. 13) calculated as 0.035 Probability of spill to sea: 0. and escalation to cargo tanks or FPSO.

Release volumes: Potential for hydrocarbon release off deck and directly to sea.000-50.36 100. If the release overflows the containment area it is assumed that 50% of the spill volume is released to sea. the release is extended by an additional 15 minutes relieving inventory from additional equipment.000 0.000 bbls (50% of capacity) before offloading to shuttle tanker. If the spill is ignited it is assumed that the spill volume is reduced to 25% (i. otherwise the release is assumed to be detected after 10 minutes. Duration: Detection is assumed to occur in 1 minute.000 bbls due to circumstances such as waiting on shuttle tanker or bad weather. Representative release rate for medium leak is 10 kg/second. 75% of volume is lost in burning).e. The leak is then assumed to continue for 15 minutes until it deinventories the isolatable section.00 Prepared by : Client approval: Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.000 and 1. It is assumed that FPSO operates in this cycle 90% of the time.00 Total 1.e.36 50. loss of FPSO in an ignited release. Using these figures. In the event of escalation due to fire.000. 75% of volume is lost in burning). Control (i. Volume (bbls) Probability 10. the spill size distribution is derived as. As this event is an escalation due to fire.000 0.e. it is assumed that the spill volume is reduced to 25% (i.000 0.doc . Release volume based on estimated volume of cargo on FPSO. ESD) is assumed to occur rapidly.000-500. It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500.28 >500.000-100. If control fails.000 0. and the remaining 10% of the time it is operates between 500.

control works: 0.7 x 0. 13) calculated as 0.02 for ESD (ref. 3). 3) Probability of escalation due to explosion: 0 (ref. The probability of isolation failure assumes a typical section of pipework using 2 ESDVs. Fault tree base events: 0. Overall leak frequency for swivel is 0.1 C:\WINDOWS\TEMP\022101_Risk Assessment_Final.90 medium: 0.04 for small gas/oil release (ref.017 Escalation due to fire control fails: 0. 4) Escalation due to fire.01 Event tree branch probabilities: Detection failure: 0.0 kg/s) swivel leak Scenario description : Hydrocarbon release at swivel with potential results including spill to sea. 3) Control failure: 0.035 Probability of spill to sea: 0.02 for HC gas detection (ref.09 large: 0. fire or explosion. and escalation to cargo tanks or FPSO.45 x 0.3 – 3. 13) calculated as 0.0245 (ref.0077 (ref.doc .09 small swivel leak per year.1 leak per year with size distribution as follows suggested by Turret Manufacturer SBM small: 0. Ignition: 0.Activity: FPSO Release Frequency Analysis Hazard: Hydrocarbon Release on FPSO 18 October 1999 Revision: 0 Subcategory: Small (0.

otherwise the release is assumed to be detected after 10 minutes. loss of FPSO in an ignited release.e. Representative release rate for small leak is 1 kg/second.36 50.000 bbls due to circumstances such as waiting on shuttle tanker or bad weather. If control fails. the release is extended by an additional 15 minutes relieving inventory from additional equipment.000 0.e. it is assumed that the spill volume is reduced to 25% (i.000 0.000 0.000-500. Duration: Detection is assumed to occur in 1 minute. Using these figures. Volume (bbls) Probability 10. Control (i.36 100. It is assumed that FPSO operates in this cycle 90% of the time.Release volumes: Potential for hydrocarbon release off deck and directly to sea.28 >500. the spill size distribution is derived as. ESD) is assumed to occur rapidly. If the spill is ignited it is assumed that the spill volume is reduced to 25% (i. The leak is then assumed to continue for 15 minutes until it deinventories the isolatable section. 75% of volume is lost in burning).000 bbls (50% of capacity) before offloading to shuttle tanker. 75% of volume is lost in burning).000 0. If the release overflows the containment area it is assumed that 50% of the spill volume is released to sea.000 and 1. In the event of escalation due to fire.000-50. Release volume based on estimated volume of cargo on FPSO.000-100. It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500.e. and the remaining 10% of the time it is operates between 500. As this event is an escalation due to fire.000.doc .00 Total 1.00 Prepared by : Client approval: Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.

HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : FPSO Release Frequency Analysis Hydrocarbon Release on FPSO Explosion in turret Damage to the hull Release from cargo area Loss of some or all cargo to the sea 1 November 1999 Revision: 0 Prevention : Accident Detection : Control : Mitigation : Material defects. Process control. Gas weepage from cargo area Hydrocarbon boundary integrity. Dropped object. Manual detection. Protection against greenwater. Green water. Poor maintenance. Process upset. Tall structure collapse. Rotating equipment failure. Structural support failure. Sealed deck penetrations. Sign: Sign: Date : Date: Prepared by : Client approval: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Hydrates. blowdown. Dropped object protection. Electrical isolation. Maintenance induced failure. Fire and gas detection Emergency shutdown. PFP. open ventilation. Natural ventilation. Impact protection. Operator competency. Human error. Process layout. Ignition control Minimal hydrocarbon equipment. Inert gas in cargo tanks. Excessive vessel motion. Main deck plate strength.doc . Corrosion protection. Good design. inspection and maintenance. Helideck well clear from process area Process upset. process segregation Deluge and foam. fire and blast walls. Various ignition sources. Pressure relief. Process control and instrumentation. Helicopter crash. Passive fire protection.

75% of volume is lost in burning).36 0. Because of the multiple barriers between the turret and the cargo tanks and the fact that the turret should be designed to withstand any explosions within it.00 1. Fault tree base events: 1 x 10-5 (per year) – ref.0644. Release volumes: If there is escalation to the FPSO.44% probability of cargo tank escalation is assumed for this study (ref.doc . Probability of escalation to process equipment (i.000. the entire cargo of would be lost in an ignited release.000 Total Prepared by : Client approval: Probability 0. It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500.000 bbls due to circumstances such as waiting on shuttle tanker or bad weather. and the remaining 10% of the time it is operates between 500. 6 Event tree branch probabilities: Probability of failure to detect explosion: 0. As this event is an escalation due to fire. Probability of explosion causing a leak in the cargo tank: 0. a 0% probability is assumed for the breaching of a cargo tank (engineering judgement). A 6. the spill size distribution is derived as. riser): 0.000 50. It is assumed that FPSO operates in this cycle 90% of the time.000 100. For this study.e.000-100.000 bbls (50% of capacity) before offloading to shuttle tanker. Release volume based on estimated volume of cargo on FPSO.36 0.000-500.000 >500. Volume (bbls) 10.000-50. it is assumed that the spill volume is reduced to 25% (i. Using these figures.e.Activity: FPSO Release Frequency Analysis Hazard: Hydrocarbon Release on FPSO 18 October 1999 Revision: 0 Subcategory: Explosion in turret Scenario description: An explosion in the turret may lead to a leak in the cargo tank or could escalate to the process area and the cargo tanks.00 Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. The probability of detection of an explosion in the turret is assumed to be 100% (engineering judgement).000 and 1. the escalation probability of explosions in the turret is assumed to be the same as a referenced FPSO.28 0. 1).

Human error. open ventilation. Helideck well clear from process area Process upset. PFP. Electrical isolation. Corrosion protection. process segregation Deluge and foam. Sealed deck penetrations.doc . Escalation to other process equipment. Various ignition sources. Plated process deck Sign: Sign: Date : Date: Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Helicopter crash. full flow drainage. Natural ventilation. Manual detection. Process layout. Green water. Structural support failure. Poor maintenance. Loss of some or all cargo to the sea Material defects. Process control and instrumentation. Dropped object protection. Inert gas in cargo tanks.HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : FPSO Release Frequency Analysis Hydrocarbon Release on FPSO Process leak (pool fire or jet fire) 1 November 1999 Revision: 0 Limited fire. Main deck plate strength. Passive fire protection. blowdown. Protection against greenwater. Tall structure collapse. Hydrates. Process upset. process deck collapse. Pressure relief. Dropped object. Excessive vessel motion. Limited ignition sources. inspection and maintenance. Process control. Operator competency. Deck camber. Fire and gas detection Emergency shutdown. Rotating equipment failure (generator explosion). Good design. Maintenance induced failure. Impact protection. Gas weepage from cargo area Hydrocarbon boundary integrity. Ignition control Minimal hydrocarbon equipment. fire and blast walls. Release from cargo area .

Process layout. Operator competency. Helideck well clear from process area Process upset. Main deck plate strength. open ventilation. Process control. fire and blast walls. Gas weepage from cargo area Hydrocarbon boundary integrity. Ignition control Minimal hydrocarbon equipment. Process upset. Human error. Various ignition sources. Green water. Passive fire protection. Deck camber. PFP. Loss of some or all cargo to the sea Material defects. Structural support failure. Fire and gas detection Emergency shutdown. Poor maintenance. Natural ventilation. process segregation Deluge and foam. Escalation to other process equipment. Dropped object. full flow drainage. Inert gas in cargo tanks. Manual detection. Electrical isolation. Protection against greenwater. Corrosion protection. Hydrates. Probably followed by process fire. Helicopter crash. Impact protection. Limited ignition sources. Tall structure collapse.HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : FPSO Release Frequency Analysis Hydrocarbon Release on FPSO Process leak (explosion) 1 November 1999 Revision: 0 Over-pressure and missiles. Excessive vessel motion. Pressure relief. Dropped object protection. blowdown. Good design. Process control and instrumentation. Plated process deck Sign: Sign: Date : Date: Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Release from cargo area . Sealed deck penetrations. Maintenance induced failure. Rotating equipment failure (generator explosion). process deck collapse. inspection and maintenance.doc .

Release is assumed to end within 5 minutes with isolation and in 10 minutes in the case of control failure due to double the inventory (i.doc .9 C:\WINDOWS\TEMP\022101_Risk Assessment_Final.045 large process leaks per year.3 per large gas release (ref.Activity: FPSO Release Frequency Analysis Hazard: Marine Accident on FPSO 18 October 1999 Revision: 0 Subcategory: Large (> 30 kg/s) Process Leak Scenario description : Large process leak and subsequent ignition results in escalation to cargo tanks or otherwise causes loss of FPSO. control fails: 0. control works: 0. 3).9 x 0. Control failure: Process ESD reliability 0. 4) Escalation due to fire. 13) calculated as 0.07 Escalation due to fire. Based on 1. 13) calculated as 0. Detection assumed to occur within 1 minute or within 10 minutes for detection failure. Fault tree base events: 0.01 (ref. This is the probability that the isolatable section where the release is originating will be isolated from the rest of the process.02 (ref. Event tree branch probabilities: Detection failure: HC gas detection system reliability for large leak 0. releasing contents of two isolatable sections rather than one) or delayed closure of valves. assuming a typical section of pipework using 2 ESDVs.003 Spill to sea: 0. A leak from this location will be production fluid. Ignition: 0. 3) Escalation due to major explosion: 0.e.063 (ref. which will consist of both gas and oil. 3).5 process leaks per year of which 3% are large.6 x 0.075 (ref.0018 (ref.

it is assumed that the spill volume is reduced to 25% (i. It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500.000. If the release overflows the containment area it is assumed that 50% of the spill volume is released to sea. and the remaining 10% of the time it is operates between 500. If there is escalation to the FPSO.doc .000 bbls due to circumstances such as waiting on shuttle tanker or bad weather. As this event is an escalation due to fire.000 bbls (50% of capacity) before offloading to shuttle tanker.000 50. Volume (bbls) 10.28 0. If the spill is ignited it is assumed that the spill volume is reduced to 25% (i. the spill size distribution is derived as.000 >500. 75% of volume is lost in burning).e.000 100.000-500.00 Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. It is assumed that FPSO operates in this cycle 90% of the time. Duration: Detection is assumed to occur in 1 minute. ESD) is assumed to occur rapidly. The leak is then assumed to continue for 5 minutes until it deinventories the isolatable section.Release volumes: Potential for hydrocarbon release off deck and directly to sea.e. the release is extended by an additional 5 minutes relieving inventory from additional equipment. the entire cargo of would be lost in an ignited release.36 0.e. Representative release rate for large leak is 45 kg/second.000-100. Control (i. Release volume based on estimated volume of cargo on FPSO.36 0.000-50. otherwise the release is assumed to be detected after 10 minutes. Using these figures.000 and 1. If control fails.00 1. 75% of volume is lost in burning).000 Total Prepared by : Client approval: Probability 0.

Event tree branch probabilities: Detection failure: HC gas detection system reliability for medium leak 0. 13) calculated as 0. which will consist of both gas and oil. Fault tree base events: 0.5 C:\WINDOWS\TEMP\022101_Risk Assessment_Final.165 medium process leaks per year.01 (ref.063 (ref. 13) calculated as 0.9 x 0. 4) Escalation due to fire.1 per medium gas release (ref.6 x 0. A leak from this location will be production fluid. Based on 1. Detection assumed to occur within 1 minute or within 10 minutes for detection failure.doc .07 Escalation due to fire.003 Spill to sea: 0. 3). control fails: 0.e. Release is assumed to end within 15 minutes with isolation and in 30 minutes in the case of control failure due to double the inventory (i.02 (ref. 3) Escalation due to major explosion: 0 (ref. 3). releasing contents of two isolatable sections rather than one) or delayed closure of valves. Control failure: Process ESD reliability 0. control works: 0. This is the probability that the isolatable section where the release is originating will be isolated from the rest of the process.5 process leaks per year of which 11% are medium.Activity: FPSO Release Frequency Analysis Hazard: Hydrocarbon Release on FPSO 18 October 1999 Revision: 0 Area concerned: Medium (3.0 – 30 kg/s) Process Leak Scenario description: Medium process leak and subsequent ignition results in escalation to cargo tanks or otherwise causes loss of FPSO. Ignition: 0.0018 (ref. assuming a typical section of pipework using 2 ESDVs.

00 Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. otherwise the release is assumed to be detected after 10 minutes. The leak is then assumed to continue for 15 minutes until it deinventories the isolatable section. Release volume based on estimated volume of cargo on FPSO.28 0. If the release overflows the containment area it is assumed that 50% of the spill volume is released to sea. Volume (bbls) 10.36 0. If there is escalation to the FPSO. the spill size distribution is derived as. If control fails.000 bbls due to circumstances such as waiting on shuttle tanker or bad weather.000-50.000-500.e.e. It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500.000 bbls (50% of capacity) before offloading to shuttle tanker. As this event is an escalation due to fire.e. ESD) is assumed to occur rapidly. the release is extended by an additional 15 minutes relieving inventory from additional equipment. Using these figures.000 100. and the remaining 10% of the time it is operates between 500.000-100. Control (i.00 1.000 50.36 0.000 Total Prepared by : Client approval: Probability 0. it is assumed that the spill volume is reduced to 25% (i.Release volumes: Potential for hydrocarbon release off deck and directly to sea. Duration: Detection is assumed to occur in 1 minute.000 >500. 75% of volume is lost in burning).doc . the entire cargo of would be lost in an ignited release.000. If the spill is ignited it is assumed that the spill volume is reduced to 25% (i. It is assumed that FPSO operates in this cycle 90% of the time. Representative release rate for medium leak is 10 kg/second. 75% of volume is lost in burning).000 and 1.

1 C:\WINDOWS\TEMP\022101_Risk Assessment_Final. which will consist of both gas and oil.45 x 0. Fault tree base events: 1.003 Spill to sea: 0.02 (ref. 3). 3). control fails: 0.07 Escalation due to fire. This is the probability that the isolatable section where the release is originating will be isolated from the rest of the process. 3) Escalation due to major explosion: 0 Release is assumed to be too small to result in escalation to cargo tanks.04 per small gas release (ref. Detection assumed to occur within 1 minute or within 10 minutes for detection failure. 13) calculated as 0. assuming a typical section of pipework using 2 ESDVs.00135 (ref. 13) calculated as 0. Release is assumed to end within 15 minutes with isolation and in 30 minutes in the case of control failure due to double the inventory (i. Ignition: 0. Based on 1. 4) Escalation due to fire. releasing contents of two isolatable sections rather than one) or delayed closure of valves.049 (ref.0 kg/s) Process Leak Scenario description: Small process leak and subsequent ignition results in escalation to cargo tanks or otherwise causes loss of FPSO. (ref.02 (ref. control works: 0.5 process leaks per year of which 86% are small.e.doc .7 x 0. A leak from this location will be production fluid.Activity: FPSO Release Frequency Analysis Hazard: Hydrocarbon Release on FPSO 18 October 1999 Revision: 0 Area concerned: Small (0.3 – 3. Event tree branch probabilities: Detection failure: HC gas detection system reliability for small leak 0.3 small process leaks per year. Control failure: Process ESD reliability 0.

Release volumes: Potential for hydrocarbon release off deck and directly to sea. If the release overflows the containment area it is assumed that 50% of the spill volume is released to sea. If the spill is ignited it is assumed that the spill volume is reduced to 25% (i.e. 75% of volume is lost in burning). Representative release rate for small leak is 1 kg/second. Duration: Detection is assumed to occur in 1 minute, otherwise the release is assumed to be detected after 10 minutes. Control (i.e. ESD) is assumed to occur rapidly. The leak is then assumed to continue for 15 minutes until it deinventories the isolatable section. If control fails, the release is extended by 15 minutes relieving inventory from additional equipment. If there is escalation to the FPSO, the entire cargo of would be lost in an ignited release. Release volume based on estimated volume of cargo on FPSO. It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500,000 bbls (50% of capacity) before offloading to shuttle tanker. It is assumed that FPSO operates in this cycle 90% of the time, and the remaining 10% of the time it is operates between 500,000 and 1,000,000 bbls due to circumstances such as waiting on shuttle tanker or bad weather. As this event is an escalation due to fire, it is assumed that the spill volume is reduced to 25% (i.e. 75% of volume is lost in burning). Using these figures, the spill size distribution is derived as; Volume (bbls) 10,000-50,000 50,000-100,000 100,000-500,000 >500,000 Total Prepared by : Client approval: Probability 0.36 0.36 0.28 0.00 1.00 Sign: Sign: Date : Date:

C:\WINDOWS\TEMP\022101_Risk Assessment_Final.doc

HAZARD IDENTIFICATION

Activity : Hazard : Sub category : Consequences :

FPSO Release Frequency Analysis Hydrocarbon Release on FPSO Explosion below process deck

1 November 1999 Revision: 0

Over-pressure and missiles. Probably followed by process fire. Structural damage to main and process deck. An explosion under the process deck is one of the possible outcomes of a process leak. To avoid double counting, it is addressed under the process leak subcategory and is not analyzed separately. Escalation to other process equipment, process deck collapse, Release from cargo area , loss of some or all cargo to the sea Material defects, Human error, Dropped object, Tall structure collapse, Helicopter crash, Rotating equipment failure, Structural support failure, Excessive vessel motion, Green water, Hydrates, Process upset, Various ignition sources, Poor maintenance, Maintenance induced failure, Gas weepage from cargo area Hydrocarbon boundary integrity, Impact protection, Good design, Process layout, Natural ventilation, inspection and maintenance, Operator competency, Passive fire protection, Corrosion protection, Dropped object protection, Protection against greenwater, Process control, Pressure relief, Ignition control Minimal hydrocarbon equipment, Helideck well clear from process area Process upset, Process control and instrumentation, Manual detection, Fire and gas detection Emergency shutdown, blowdown, process segregation Deluge and foam, PFP, Limited ignition sources, open ventilation, full flow drainage, Main deck plate strength, Deck camber, Sealed deck penetrations, fire and blast walls, Electrical isolation, Inert gas in cargo tanks, Plated process deck Sign: Sign: Date : Date:

Escalation : Consequences of Escalation : Accident Causes :

Prevention :

Accident Detection : Control : Mitigation :

Prepared by : Client approval:

C:\WINDOWS\TEMP\022101_Risk Assessment_Final.doc

HAZARD IDENTIFICATION

Activity : Hazard : Sub category : Consequences :

FPSO Release Frequency Analysis Hydrocarbon Release on FPSO Liquid carry over from flare

1 November 1999 Revision: 0

Small amount of oil released directly to the sea. Liquid carry over from the flare could occur on other existing OCS platforms, and would not cause an oil spill unique to an FPSO, and is not analyzed further. None

Escalation : Consequences of Escalation : Accident Causes : Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval:

Sign: Sign:

Date : Date:

C:\WINDOWS\TEMP\022101_Risk Assessment_Final.doc

Non-Process Fires and Explosions C:\WINDOWS\TEMP\022101_Risk Assessment_Final.doc .

fire and blast walls. Green water. full flow drainage.doc . Good design. Main deck plate strength. Protection against greenwater. Rotating equipment failure. Dropped object protection. Process control and instrumentation. Ignition control Minimal hydrocarbon equipment. Manual detection. Loss of some or all cargo to the sea Material defects. Operator competency. Plated process deck Sign: Sign: Date : Date: Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Gas weepage from cargo area Hydrocarbon boundary integrity. Pressure relief. blowdown. Corrosion protection.HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : FPSO Release Frequency Analysis Non-process fires and explosions Methanol fire 1 November 1999 Revision: 0 Limited fire. Hydrates. Process control. process segregation Deluge and foam. Sealed deck penetrations. Deck camber. Fire and gas detection Emergency shutdown. Limited ignition sources. Tall structure collapse. Natural ventilation. Release from cargo area . Escalation to other process equipment. Dropped object. Passive fire protection. open ventilation. Helicopter crash. Process layout. PFP. Various ignition sources. Human error. Structural support failure. Poor maintenance. inspection and maintenance. Maintenance induced failure. process deck collapse. Impact protection. Excessive vessel motion. Process upset. Inert gas in cargo tanks. Helideck well clear from process area Process upset. Electrical isolation.

011.28 0.1% (ref. Fault tree base events: 1.36 0. the escalation probability is assumed to be the same for methanol leaks as large uncontrolled process leaks. For this study. it is assumed that the methanol will be diluted and drained. As this event is an escalation due to fire. 3) Probability of escalation to process area: 0.Activity: FPSO Release Frequency Analysis Hazard: Non-Process Fires and Explosions 18 October 1999 Revision: 0 Subcategory: Methanol spill Scenario description : A methanol spill from the storage tank ignites and escalates to the process equipment and cargo tanks. Volume (bbls) 10. 3).000 bbls (50% of capacity) before offloading to shuttle tanker.000 50. (ref.000-50. 13).000 Total Prepared by : Client approval: Probability 0.000-500. it is assumed that the spill volume is reduced to 25% (i. A detection failure probability of 1% is used for this scenario (ref. 3. If the deluge system for the methanol area is effective.000 bbls due to circumstances such as waiting on shuttle tanker or bad weather.3% probability of cargo tank escalation is assumed for this study (ref. The methanol spill is assumed the same detection probability as a medium sized hydrocarbon release.e.00 Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. 3). Using these figures. It is assumed that FPSO operates in this cycle 90% of the time.000-100. It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500. Event tree branch probabilities: Failure to detect: 0.000 and 1. A 6. and the remaining 10% of the time it is operates between 500. Release volumes: If there is escalation to the FPSO. thus not posing a hazard. Methanol is used for well injection purposes and the environmental risk posed by the methanol itself is not a hazard unique to an FPSO. The reliability of the deluge system for this study is assumed to be 1. the spill size distribution is derived as. ref.063.doc .01.000 100.000 >500. Failure to deluge: 0. 75% of volume is lost in burning). Ignition probability: 0. Release volume based on estimated volume of cargo on FPSO.00 1.5 x 10-4 (per year).000.36 0. the entire cargo of would be lost in an ignited release.08.

PFP.HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : FPSO Release Frequency Analysis Non-process fires and explosions Helifuel fire Limited fire. Drainage.doc . and is not further analyzed. handling errors Material failure. impact damage. handling errors Visual limited inventory. deluge. None None Material failure. 1 November 1999 Revision: 0 Escalation : Consequences of Escalation : Accident Causes : Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: A helifuel fire could occur on other existing OCS platforms. and would not cause a spill that is unique to an FPSO. pressure relief on tanks Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. bunding. isolation. impact damage.

Tall structure collapse. A generator explosion is one of the initiating events for a process leak and fire and explosion. process deck collapse. Corrosion protection. Helicopter crash. Various ignition sources. Protection against greenwater. Limited ignition sources. To avoid double counting. blowdown. Passive fire protection. Escalation to other process equipment. inspection and maintenance. Gas weepage from cargo area Hydrocarbon boundary integrity. Fire and gas detection Emergency shutdown. Excessive vessel motion. Process layout. Dropped object protection.HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : FPSO Release Frequency Analysis Non-process fires and explosions Generator explosion 1 November 1999 Revision: 0 Over-pressure and missiles. Main deck plate strength. Probably followed by process fire. Manual detection. open ventilation. Inert gas in cargo tanks. Rotating equipment failure. Sealed deck penetrations. Process control and instrumentation. Operator competency. Helideck well clear from process area Process upset. PFP. full flow drainage. Structural support failure. fire and blast walls. Process control. Hydrates. generator explosion is addressed under process leaks and is not analyzed separately. Maintenance induced failure.doc . Impact protection. Plated process deck Sign: Sign: Date : Date: Escalation : Consequences of Escalation : Accident Causes : Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Natural ventilation. Pressure relief. Dropped object. Deck camber. Green water. Human error. Process upset. Loss of some or all cargo to the sea Material defects. Release from cargo area . Good design. Ignition control Minimal hydrocarbon equipment. Poor maintenance. Electrical isolation. process segregation Deluge and foam.

doc .HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : FPSO Release Frequency Analysis Non-process fires and explosions Cargo heating (e. boiler) fire / explosion Potential fire and explosion. Therefore. Escalation : Consequences of Escalation : Accident Causes : Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. the potential for oil spills associated with cargo heating are not analyzed further. It is not clear that cargo heating would be required.g. 1 November 1999 Revision: 0 Cargo heating equipment is not specified in the scenario report.

HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : FPSO Release Frequency Analysis Non-process fires and explosions Diesel fire 1 November 1999 Revision: 0 Localized fire. diesel fires are not analyzed further. A diesel fire could occur on other OCS platforms. and would not cause an oil spill unique to an FPSO. large amount of smoke generated. Therefore.doc . Escalation : Consequences of Escalation : Accident Causes : Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.

Therefore. 1 November 1999 Revision: 0 Escalation : Consequences of Escalation : Accident Causes : Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: An accommodations fire could occur on other existing OCS platforms an would not cause and oil spill unique to an FPSO.doc . accommodations fire are not analyzed further. None None Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : FPSO Release Frequency Analysis Non-process fires and explosions Accommodation fire Localized fire.

Cargo Storage Events C:\WINDOWS\TEMP\022101_Risk Assessment_Final.doc .

submerged pumps running in empty tank whilst O2 present Inert gas. hot work. IG failure. procedures.HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : FPSO Release Frequency Analysis Cargo Storage Events Cargo tank explosion 1 November 1999 Revision: 0 Structural damage. there may be a major cargo fire Major spill into the sea Poor maintenance. human error. control of ignition sources. fire-fighting Sign: Sign: Date : Date: Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.doc . oxygen detectors. other ignition sources. Vessel strength. Possible loss of vessel Even if the vessel is not lost. double hull.

It is assumed that there is a 4% probability of structural collapse following an explosion in a ballast tank (ref.Activity: FPSO Release Frequency Analysis Hazard: Cargo Storage Events 18 October 1999 Revision: 0 Subcategory: Cargo tank explosion Scenario description : An explosion in the cargo tank ruptures the hull sinking the ship or damages the top deck to an extent that will split the FPSO in two.000-500.000 and 1.000 100.00 Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.000 Total Prepared by : Client approval: Probability 0.doc . It is assumed that FPSO operates in this cycle 90% of the time.000-100. Event tree branch probabilities: Probability of ruptured tanks leading to loss of FPSO stability: 0.36 0. 75% of volume is lost in burning).28 0. Release volumes: If there is escalation to the FPSO. it is assumed that the spill volume is reduced to 25% (i. the spill size distribution is derived as. Release volume based on estimated volume of cargo on FPSO.000 bbls due to circumstances such as waiting on shuttle tanker or bad weather.000 >500.000 50.000 bbls (50% of capacity) before offloading to shuttle tanker. As this event is an escalation due to fire.00 1. Probability of loss of structural integrity due to top deck damage: 0. Fault tree base events: 2. Using these figures. If the explosion does not immediately cause a structural collapse of the FPSO. 4).02 x 10-3 (per year) – ref. Volume (bbls) 10.36 0.000.000-50. the entire cargo of would be lost in an ignited release.04. the explosion may cause enough damage to the top deck of the FPSO that might cause a delayed collapse. It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500.e. and the remaining 10% of the time it is operates between 500. 3.001.1% is assumed for this study (engineering judgement). A probability of 0.

double hull. submerged pumps running in empty tank whilst O2 present Inert gas. hot work. there may be a major cargo fire Major spill into the sea Poor maintenance. fire-fighting Sign: Sign: Date : Date: Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. control of ignition sources. gas detectors.doc . human error. procedures. IG failure. Vessel strength. Possible loss of vessel Even if the vessel is not lost. other ignition sources.HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : FPSO Release Frequency Analysis Cargo Storage Events Ballast tank explosion 1 November 1999 Revision: 0 Structural damage.

000 Total Prepared by : Client approval: Probability 0.000 50. As this event is an escalation due to fire. 4).doc .000 100. Fault tree base events: 1. Release volume based on estimated volume of cargo on FPSO.00 Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. It is assumed that there is a 4% probability of structural collapse following an explosion in a ballast tank (ref.000-500.1 x 10-5 (per year) – ref.04. Volume (bbls) 10. and the remaining 10% of the time it is operates between 500.28 0. A probability of 0. It is assumed that FPSO operates in this cycle 90% of the time. it is assumed that the spill volume is reduced to 25% (i.000.e.00 1. Release volumes: If there is escalation to the FPSO. the entire cargo of would be lost in an ignited release. 3.000 and 1.1% is assumed for this study (engineering judgement).000-50. If the explosion does not immediately cause a structural collapse of the FPSO. Event tree branch probabilities: Probability of ruptured tanks leading to loss of FPSO stability: 0.Activity: FPSO Release Frequency Analysis Hazard: Cargo Storage Events 18 October 1999 Revision: 0 Subcategory: Ballast tank explosion Scenario description : An explosion in the ballast tank ruptures the hull sinking the ship or damages the top deck to an extent that will split the FPSO in two. It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500.000-100.000 bbls (50% of capacity) before offloading to shuttle tanker. the spill size distribution is derived as. Using these figures.36 0. the explosion may cause enough damage to the top deck of the FPSO that might cause a delayed collapse.000 bbls due to circumstances such as waiting on shuttle tanker or bad weather.36 0.000 >500. Probability of loss of structural integrity due to top deck damage: 0. 75% of volume is lost in burning).001.

procedures. fire-fighting Sign: Sign: Date : Date: Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Process shutdown Vessel strength. may ignite Major spill into the sea Procedural error. High level alarm. instrumentation failure Crew competency. double hull.HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : FPSO Release Frequency Analysis Cargo Storage Events Cargo tank overfill 1 November 1999 Revision: 0 Structural damage Oil spill on deck over-flowing to the sea (200 kg/s). tank radar.doc . control valve failure.

The probability of spilling to sea in the event of an unignited leak from cargo tanks is assumed to be 0% (engineering judgement). 3). τ is the test interval). The ignition probability of 4% is assumed for a generic oil leak (ref. Effective isolation generally requires the closure of two isolation valves (i.998.Activity: FPSO Release Frequency Analysis Hazard: Cargo Storage Events 18 October 1999 Revision: 0 Subcategory: Cargo tank overfill Scenario description: The cargo tank overfills.doc .88 failures per 106 hours) from a pressure reduction valve in ref 5. Fault tree base events: 0. Release volumes: It is assumed that the maximum flow rate from the wells is being loaded into the cargo tank (150.74 barrels/sec). It is assumed that there will be pressure and pump failure indicators upstream that will alarm if any cargo tank becomes overfilled. Ignition probability: 0. allowing oil to flow to the deck and possibly spill over to the sea. Computed from the failure rates of “failed to open” (1. A value of 1% detection probability for a cargo tank overfill is based on the detection failure probability of a medium leak (ref.5 x 2160 hours x 2.000 BPD or 1. then the cargo tank will just become pressurized and may cause damage to the tank. The failure probability is thus 0.34 failures per 106 hours) and “plugged” (0. Prepared by : Client approval: Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Any oil that does spill through the breather valve is assumed to be < 10 barrels and it is assumed that this oil will be drained and will not pose an environmental hazard. Probability of detection failing within 1 minute: 0.03 (per year) – ref. 3 Event tree branch probabilities: Probability of breather valve opening: 0.22 x 10-6 failures/hr).01. These failure modes are hidden failure modes. 3). The breather valve is for venting gas out of the cargo tank and if oil is overfilled in the tank.2% (0. Thus this event will not pose any environmental hazard. It is assumed that there is a 3-month test interval for the breather valves.e. one at each end of the isolated volume). 3). so the probability of valve failing to open is computed from the following equation: ½λτ (λ is the failure rate. the probability of failure to isolate a typical section of pipework using 2 ESDVs is approximately 2% (ref. Probability of spilling to sea: 0.04. Thus. The cargo tank spill is assumed the same detection probability as a large hydrocarbon release. Probability of control failure: 0.

human error. procedures Gas detection. inspection. may ignite. explosion under process deck Oil spill into the sea Piping failure. dropped object Material selection.doc .HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : FPSO Release Frequency Analysis Cargo Storage Events Cargo piping leak on deck 1 November 1999 Revision: 0 Crude oil spill on deck Oil spill on deck. visual Shutdown Drainage. vessel strength Sign: Sign: Date : Date: Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.

0 kg/s): 0. Event tree branch probabilities: Large leak (> 30 kg/s): 0. Cargo tank piping is estimated as 1500 meters of <11” steel piping (5. Release volumes: See below.0 – 30 kg/s): 0.1 x 10-5 leaks/meter-year) in addition to an oil manifold (1.3 – 3. then ignites and escalates to the process area and cargo tanks.03 Medium leak (3.doc . The cargo from the piping could also leak to the sea. Prepared by : Client approval: Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Fault tree base events: 9. 3).86 Leak size probabilities were determined from analysis of a release rate versus probability chart in ref.Activity: FPSO Release Frequency Analysis Hazard: Cargo Storage Events 18 October 1999 Revision: 0 Subcategory: Cargo piping leak distribution Scenario description: Piping from the cargo tanks leaks.11 Small leak (0. 3.3 x 10-2 (per year).6 x 10-2 leaks/year) (ref.

3). 0. The data were taken from cargo tanks escalation probabilities from large releases in the process area of an FPSO (ref. Effective isolation generally requires the closure of two isolation valves (i. one at each end of the isolated volume).Activity: FPSO Release Frequency Analysis Hazard: Cargo Storage Events 18 October 1999 Revision: 0 Subcategory: Large cargo piping leak Scenario description : Piping from the cargo tanks leaks. 3).01 this value for a large leak is conservatively estimated based on failure to detect medium hydrocarbon leaks (ref. C:\WINDOWS\TEMP\022101_Risk Assessment_Final.08. the probability of failure to isolate a typical section of pipework using 2 ESDVs is approximately 2% (ref. The cargo from the piping could also leak to the sea. Fault tree base events: 2.9. The crude oil can also be stopped by shutting off the pumps. 13).doc . Thus. Escalation probabilities based on whether the ESD control fails or not.063 if not controlled. Escalation probability: 0. 3).8 x 10-3 (per year) Event tree branch probabilities: Failure to detect: 0. Ignition probability: 0. Probability of spilling to sea: 0.0018 if controlled. then ignites and escalates to the process area and cargo tanks.02.e. The probability of spilling to sea in the event of an unignited large leak from cargo piping is assumed to be 90% (engineering judgement). Ignition probability taken from the generic ignition probabilities for pool fires (ref. Failure to control leak: 0.

000 >500. If the ESD fails.doc .000. Using these figures.00 Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. If the pool ignites. Volume (bbls) 10. it is assumed that a manual shutoff valve will be closed 10 minutes after the start of the event (240 barrels released). Release volume based on estimated volume of cargo on FPSO. it is assumed that the event will be detected after 5 minutes (120 barrels released). it is assumed that 100% of the available liquid spill to sea.000 Total Prepared by : Client approval: Probability 0. 75% of volume is lost in burning). it is assumed that 25% of the available pool will still be liquid when spilled to sea.00 1.000-500. the spill size distribution is derived as. As this event is an escalation due to fire.28 0. If the pool spills to sea. isolation is assumed to occur 1 minute after the start of the leak (60 barrels released).Release volumes: The representative release rate for a large release is 45 kg/s (~0. It is assumed that FPSO operates in this cycle 90% of the time. and the remaining 10% of the time it is operates between 500.e. the entire cargo of would be lost in an ignited release.36 0.000-50. If there is escalation to the FPSO.000 bbls (50% of capacity) before offloading to shuttle tanker.000 bbls due to circumstances such as waiting on shuttle tanker or bad weather.000 and 1.000 100.000-100. It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500. If there is an initial failure to detect.40 barrels/sec).36 0.000 50. If the release is detected and controlled. it is assumed that the spill volume is reduced to 25% (i.

0 x 10-2 (per year) Event tree branch probabilities: Failure to detect: 0. then ignites and escalates to the process area and cargo tanks. Escalation probability: 0.063 if not controlled. Failure to control leak: 0. Ignition probability: 0. 3).0018 if controlled.01.06.Activity: FPSO Release Frequency Analysis Hazard: Cargo Storage Events 18 October 1999 Revision: 0 Subcategory: Medium cargo piping leak Scenario description : Piping from the cargo tanks leaks. Effective isolation generally requires the closure of two isolation valves (i. The flow can also be stopped by shutting off the pumps. 13). The cargo from the piping could also leak to the sea. Fault tree base events: 1. C:\WINDOWS\TEMP\022101_Risk Assessment_Final.5. Probability of spilling to sea: 0. 3). one at each end of the isolated volume). Ignition probability taken from the generic ignition probabilities for pool fires (ref. The data were taken from cargo tanks escalation probabilities from medium releases in the process area of an FPSO (ref. 3).doc . Thus.02. Escalation probabilities based on whether the ESD control fails or not.e. 0. the probability of failure to isolate a typical section of pipework using 2 ESDVs is approximately 2% (ref. A value of 1% detection failure probability for a medium cargo piping leak is assumed for this study (ref. The probability of spilling to sea in the event of an unignited medium leak from cargo piping is assumed to be 50% (engineering judgement).

it is assumed that the event will be detected after 5 minutes (27 barrels released). Release volume based on estimated volume of cargo on FPSO. If there is an initial failure to detect. It is assumed that FPSO operates in this cycle 90% of the time. As this event is an escalation due to fire. Using these figures.000-500.000 >500.doc .e.00 Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. and the remaining 10% of the time it is operates between 500. Volume (bbls) 10.000 100. the spill size distribution is derived as. the entire cargo of would be lost in an ignited release. If the pool spills to sea. it is assumed that the spill volume is reduced to 25% (i. If the pool ignites.000 and 1. If the ESD fails.000-100. It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500.36 0. it is assumed that 100% of the available liquid spill to sea.000-50.09 barrels/sec).36 0. it is assumed that 25% of the available pool will still be liquid when spilled to sea.28 0.000 Total Prepared by : Client approval: Probability 0.000 bbls due to circumstances such as waiting on shuttle tanker or bad weather.000 bbls (50% of capacity) before offloading to shuttle tanker.000. isolation is assumed to occur 1 minute after the start of the leak (5 barrels released). it is assumed that a manual shutoff valve will be closed 10 minutes after the start of the event (54 barrels released). If the release is detected and controlled. If there is escalation to the FPSO. 75% of volume is lost in burning).000 50.00 1.Release volumes: The representative release rate for a medium release is 10 kg/s (~0.

Escalation probability: 0. 3). 3). Probability of spilling to sea: 0. 3). A value of 2% detection failure probability for a small cargo piping leak is assumed for this study (ref. Thus. then ignites and escalates to the process area and cargo tanks.0 x 10-2 (per year) Event tree branch probabilities: Failure to detect leak: 0. 0. Failure to control leak: 0.e.00135 if controlled.1.02. one at each end of the isolated volume). Effective isolation generally requires the closure of two isolation valves (i. The cargo from the piping could also leak to the sea.Activity: FPSO Release Frequency Analysis Hazard: Cargo Storage Events 18 October 1999 Revision: 0 Subcategory: Small cargo piping leak Scenario description : Piping from the cargo tanks leaks. the probability of failure to isolate a typical section of pipework using 2 ESDVs is approximately 2% (ref. C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Escalation probabilities based on whether the ESD control fails or not.02. The probability of spilling to sea in the event of an unignited small leak from cargo piping is assumed to be 10% (engineering judgement).049 if not controlled. Fault tree base events: 8. Ignition probability taken from the generic ignition probabilities for pool fires (ref. The cargo flow can also be stopped by shutting off the pumps.04. Ignition probability: 0. The data were taken from cargo tanks escalation probabilities from medium releases in the process area of an FPSO (ref.doc . 13).

It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500. If the pool ignites. As this event is an escalation due to fire.000-50. 75% of volume is lost in burning). it is assumed that a manual shutoff valve will be closed 10 minutes after the start of the event (5 barrels released). it is assumed that 25% of the available pool will still be liquid when spilled to sea. If there is escalation to the FPSO.e.000-100.000 >500.00 1.000 50.doc . It is assumed that FPSO operates in this cycle 90% of the time. If the release is detected and controlled.Release volumes: The representative release rate for a small release is 1 kg/s (~0. isolation is assumed to occur 1 minute after the start of the leak (1 barrel released).000 bbls (50% of capacity) before offloading to shuttle tanker.000 100.000 Total Prepared by : Client approval: Probability 0. the entire cargo of would be lost in an ignited release. it is assumed that 100% of the available liquid spill to sea.009 barrels/sec).36 0.36 0.000 bbls due to circumstances such as waiting on shuttle tanker or bad weather. it is assumed that the spill volume is reduced to 25% (i. If there is an initial failure to detect. Release volume based on estimated volume of cargo on FPSO. If the ESD fails. If the pool spills to sea.000-500. the spill size distribution is derived as. and the remaining 10% of the time it is operates between 500. Volume (bbls) 10.000 and 1. Using these figures.000. it is assumed that the event will be detected after 5 minutes (3 barrels released).00 Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.28 0.

may ignite or gas release beneath process deck Structural damage to vessel Failure in control of process Process control. fire-fighting Sign: Sign: Date : Date: Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. excessive venting Oil spill on deck.doc .HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : FPSO Release Frequency Analysis Cargo Storage Events Process gas blow-by 1 November 1999 Revision: 0 Structural damage. alarms Manual detection Process shutdown Vessel strength. double hull.

Activity: FPSO Release Frequency Analysis Hazard: Cargo Storage Events

18 October 1999 Revision: 0

Subcategory: Process gas blow-by Scenario description : Blow-by of process gas to the cargo tanks resulting in excessive venting and potential fire/explosion from tank vent. Fault tree base events: 0.01 Event tree branch probabilities: Detection failure: 0.02 (ref. 3, small release HC gas detection) Control failure: 0.02 (ref. 3, ESD – process shutdown to isolate cargo tanks from process and stop gas blowby) Ignition: 0.04 (ref. 3, small gas release, 0.5 – 5.0 kg/s) Probability of escalation, control fails: 0.049 (ref. 13, as for small process leak) Probability of escalation, control works: 0.00135 (ref. 13) as for small process leak) Release volumes: Potential to overpressure and damage cargo tanks. This would be a significant capital loss but would not result in an environmental spill as structural failure of the FPSO is not anticipated. In the event of escalation due to fire, loss of FPSO in an ignited release. Release volume based on estimated volume of cargo on FPSO. It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500,000 bbls (50% of capacity) before offloading to shuttle tanker. It is assumed that FPSO operates in this cycle 90% of the time, and the remaining 10% of the time it is operates between 500,000 and 1,000,000 bbls due to circumstances such as waiting on shuttle tanker or bad weather. As this event is an escalation due to fire, it is assumed that the spill volume is reduced to 25% (i.e. 75% of volume is lost in burning). Using these figures, the following spill size distribution is derived; Volume (bbls) 10,000-50,000 50,000-100,000 100,000-500,000 >500,000 Total Prepared by : Client approval: Probability 0.36 0.36 0.28 0.00 1.00 Sign: Sign: Date : Date:

C:\WINDOWS\TEMP\022101_Risk Assessment_Final.doc

Marine Accidents on the FPSO

C:\WINDOWS\TEMP\022101_Risk Assessment_Final.doc

HAZARD IDENTIFICATION

Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : Prevention :

FPSO Release Frequency Analysis Marine accidents on FPSO Foundering (structural failure) Major damage to vessel vessel loss major oil spill

1 November 1999 Revision: 0

Severe weather, ballasting errors, poor cargo distribution Vessel strength and design, Procedures, ballast, cargo distribution, inspection Manual detection Remove cargo to shuttle tanker, ballast control, remove vessel to dock Shutdown, oil spill response Sign: Sign: Date : Date:

Accident Detection : Control : Mitigation : Prepared by : Client approval:

C:\WINDOWS\TEMP\022101_Risk Assessment_Final.doc

major oil spill n/a 1 November 1999 Revision: 0 Severe weather. poor cargo distribution Vessel strength and design.HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : FPSO Release Frequency Analysis Marine accidents on FPSO Foundering (capsize) Loss of vessel. Manual detection oil spill response Sign: Sign: Date : Date: Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. ballasting errors.doc . Procedures. ballast. cargo distribution.

Volume (bbls) 10. and the remaining 10% of the time it is operates between 500.10 1.72 0.Activity: FPSO Release Frequency Analysis Hazard: Marine Accidents on FPSO 18 October 1999 Revision: 0 Subcategory: Foundering Scenario description: FPSO founders due to structural failure or capsize (severe weather.09 0.000-500.000 bbls due to circumstances such as waiting on shuttle tanker or bad weather.000 50. Using these figures.000 and 1. ballasting error). Event tree branch probabilities: Release volumes: Release volume based on estimated volume of cargo on FPSO.000 >500.doc . It is assumed that FPSO operates in this cycle 90% of the time.000.09 0.00 Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.000-100. the following spill size distribution is derived. Fault tree base events: 5 x 10-5 per year – ref.000 Total Prepared by : Client approval: Probability 0.000 bbls (50% of capacity) before offloading to shuttle tanker. It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500. 10.000-50.000 100.

corrosion protection.doc . fouling of anchor lines. redundancy in design. material failure.HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : Prevention : FPSO Release Frequency Analysis Marine accidents on FPSO Mooring failure 1 November 1999 Revision: 0 Critical failure of two or more mooring lines resulting in vessel drifting off station riser damage Release from risers Poor design. severe weather. inspection Turret sensor or visual inspection from turret Take vessel under tow Shutdown. turret seizure Material selection. oil spill response Sign: Sign: Date : Date: Accident Detection : Control : Mitigation : Prepared by : Client approval: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.

0018 (ref. This figure is conservatively in that it assumes there are 2 only fail-safe valves (subsea wellhead X-mas tree valves) for isolating any well from the risers each with individual failure probabilities of 0. 14 days for ROV. as large release in process area) Escalation due to fire. The release rate for a single well is assumed to be one ninth of this value until isolated.0036 Probability of failing to isolate at least one of the nine subsea wells is calculated to be 0. Prepared by : Client approval: Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.Activity: FPSO Release Frequency Analysis Hazard: Marine Accident on FPSO 18 October 1999 Revision: 0 Subcategory: Mooring failure Scenario description : Critical failure of 2 or more mooring lines resulting in loss of station keeping and damage to risers. Fault tree base events: 1.02^2)^9.5 estimated based on failure to isolate one or more well from release and continued large fire. control fails: 0. Ignition: 0.000 bbls/day) until isolation. 4. 13) as large process leak Release volumes: Release volumes are for ignited and unignited oil releases from the risers as well as ignited releases from the cargo tanks in the event of escalation to the FPSO.0036 = (1-0. Event tree branch probabilities: Detection failures: 0 Mooring failure and loss of station keeping resulting in riser failure would be evident.3 (large gas release 25-200 kg/s) Escalation due to major explosion: 0.0 x 10-4 – ref. 1). Failure to isolate a well results in the release continuing until an alternate means of isolation is available . In reality there are most likely 4 or 5 fail-safe valves counting sub-surface and manifold valves. control works: 0. Successful isolation of all wells results in shut-in of wells within 3 minutes of release. The release rate for the 6 production risers is assumed to be the production rate of 104 bbls/min (150.02. 11. (ref.075 for major explosions escalating to cargo tanks (ref. Escalation due to fire. Control failures: 0.doc . Potential fire and explosion hazard to FPSO and cargo tanks. The total volume of oil in the risers is 6*1750=10500 bbls.

doc .Offloading Accidents C:\WINDOWS\TEMP\022101_Risk Assessment_Final.

Leakage from transfer hose Refer to leakage from transfer hose event Bad weather.HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : FPSO Release Frequency Analysis 1 November 1999 Offloading Accidents Revision: 0 Shuttle tanker collision during offloading Material damage. radar Shuttle tanker maneuvering Radar. shuttle tanker engine & steering reliability Manual.doc . thruster drive on failure Procedures. oil spill response Sign: Sign: Date : Date: Escalation : Consequences of Escalation : Accident Causes : Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. and the cargo tanks would not be expected to be impacted on either the FPSO or the shuttle tanker. fishtailing. damage to FPSO hull. Therefore. a collision would be bow to stern. a oil spill would not be expected to occur as a direct result of the collision. human error. FPSO changes heading. Damage to shuttle tanker hull. Because of the orientation of the shuttle tanker and FPSO during tandem offloading. Telemetry. shuttle tanker power failure.

procedures. Manual. human error. drift off. telemetry.doc . hawser failure. control failure Equipment design. hose failure.HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : FPSO Release Frequency Analysis Offloading Accidents Transfer hose leak Oil spill into the sea Spill ignites Risk to people 1 November 1999 Revision: 0 Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: Drive off. Shutdown cargo transfer Oil spill response Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. control instrumentation.

88 x 10-1 (per year) Based on ref. 1998). This compares well with ref. which is a similar operation conducted offshore between supertankers offloading to shuttle tankers. Spill of oil directly to sea.5 10 – 100 barrels : 0. 4 spills will occur per 1000 offloading transfers. In ref. Fault tree base events: 4. 15 (Marine Board. 4. Prepared by : Client approval: Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. 2 (MMS. it is noted that the average spill size during transfer to the shuttle tanker is approximately 3 barrels.doc .Activity: FPSO Release Frequency Analysis Hazard: Offloading Accidents 18 October 1999 Revision: 0 Subcategory: Transfer hose leak Scenario description: Leak or rupture during transfer from FPSO to shuttle tanker. the Marine Board’s study (ref. 4: < 10 barrels : 0.2 spills per 1000 transfers. the release distribution from reference 4 should be considered reasonably conservative. Comparing this transfer to lightering. which cites 3-4 spills per 1000 transfers. Event tree branch probabilities: Release volumes: The following release volume distribution is based on ref.25 100 – 1000 barrels : 0. Based on these figures. 15) cites 1. 2. the average spill size for lightering spills in the GoM were 150 barrels.25 In ref. 1998). which is also in reasonable agreement with the figure cited in reference 4.

Shuttle Tanker Accidents C:\WINDOWS\TEMP\022101_Risk Assessment_Final.doc .

shutdown cargo transfer Harbor contingency plans Sign: Sign: Date : Date: Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. manual error. Double hull. coupling failure. Fire in harbor area Major accident in harbor 1 November 1999 Revision: 0 Transfer hose leak.doc .HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : FPSO Release Frequency Analysis Shuttle Tanker Accidents Shuttle tanker leak at port (harbor) Oil released in harbor. Manual. control instrumentation. control failure Procedures. transfer hose testing and inspection.

hose failure. Double hull. telemetry. Drive off.HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : FPSO Release Frequency Analysis Shuttle Tanker Accidents Shuttle tanker leak near port (LOOP) Oil released into the sea Damage to offshore port Major oil release 1 November 1999 Revision: 0 Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: Ship collision. control failure Procedures. severe weather. human error. hawser failure. Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. shutdown cargo transfer Oil spill response. drift off. control instrumentation.doc . shuttle tanker engine & steering reliability Manual.

000 barrels.83 x 10-2 – 0. in the ship-shore pipeline. etc. The vessel may be either under-power or drifting when it grounds. but not another ship or the sea bottom.where the hull/ equipment damage is not due to other cause such as collision etc.000 barrels per day x 365 days (ref.doc . This frequency refers to spills larger than 1. Fault tree base events: 3. This data takes into account spills in US coastal and offshore waters from 1974 to 1992. grounding.83 x 10-2 spills / year derived from Anderson and LaBelle is conservatively used in this analysis. including underwater wrecks. Foundering – loss of the vessel due to severe weather. this figure may be optimistic based on possible under-reporting of spills in the database. whether under tow or fixed. which cites COE 1994 and the MMS worldwide tanker spill database as sources. excluding collision. grounding. leaks oil while at port.0 x 10-3 spills / year by shuttle tankers at port. anchored or moored. Transfer spills – leaks of cargo during loading and unloading. By comparison. As cited in that study. whether they occur at the transfer hose/arm.Activity: FPSO Release Frequency Analysis Hazard: Shuttle Tanker Accidents 18 October 1999 Revision: 0 Subcategory: Shuttle tanker leak near port Scenario description: The shuttle tanker. structural failure. ballasting error or other cause. It includes striking offshore rigs/platforms. the above figure of 3. whether under way.striking either the sea bed or shore. contact. Event tree branch probabilities: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. 14). A review of incidents in the tanker spill databases reveals that the leading causes of tanker oil spills are. This is sometimes termed “impact” Grounding . Fire/explosion . an internal DNV study cites a release frequency of 2.striking or being struck by another ship. etc. Therefore. This excludes underwater wrecks Contact striking or being struck by an external object.where fire and/or explosion occurs for reasons other than collision.70 spills per 109 barrels of oil produced x 150. having loaded the cargo from the FPSO. Collision . or on the ship. Hull/equipment damage . This frequency is taken from an MMS report authored by Anderson and LaBelle.

hazardous cargo bulletins. Because of these reasons.doc .5% 34. It does report an average release size. but the report does not specifically report the data is this fashion. Volume (bbls) 1.000: Prepared by : Client approval: Probability 37.000 – 500.Release volumes: It would be preferable to use the Anderson/LaBelle MMS report to calculate release volumes.000 – 50.000: 10. in restricted waters. This data cites oil spills from tankers at sea. IOPC fund annual reports. LMIS database.000 barrels for the DNV source and 49.000: 100.1% 14. The distribution used for this study is listed below. The data from the DNV study is comparable to the MMS source. ITOPF database. and at port from 1992 to 1994. the release distribution is based on an internal DNV study which compiled data from the following sources: Lloyd’s Casualty Reports.7% 13.000: 50.7% Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. as the average spill size >1000 barrels is approximately 55.000 barrels for the MMS source. and oil company data. but it is unclear of the sizes of the vessels from which the spills occurred. Cutter database.000 – 100.000 – 10. accident investigation reports.

HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : FPSO Release Frequency Analysis Shuttle Tanker Accidents Shuttle tanker leak at sea Oil released to sea. unintended discharge.doc . Procedures. collision avoidance measures. collision. and inspection. Double hull Oil spill contingency plans Sign: Sign: Date : Date: Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Fire on sea surface Smokey fire 1 November 1999 Revision: 0 Fatigue failure. control instrumentation. Manual.

but not another ship or the sea bottom. It includes striking offshore rigs/platforms. Foundering – loss of the vessel due to severe weather. whether under tow or fixed. Collision . This is sometimes termed “impact” Grounding . grounding. The vessel may be either under-power or drifting when it grounds.000 barrels. an internal DNV study cites a release frequency of 2. This data takes into account spills in US coastal and offshore waters from 1974 to 1992.2 x 10-3 spills / year by shuttle tankers at sea. Hull/equipment damage . this figure may be optimistic based on possible under-reporting of spills in the database. 14). whether they occur at the transfer hose/arm. A review of incidents in the tanker spill databases reveals that the leading causes of tanker oil spills are. grounding. including underwater wrecks.striking or being struck by another ship. This excludes underwater wrecks Contact striking or being struck by an external object.where the hull/ equipment damage is not due to other cause such as collision etc.Activity: FPSO Release Frequency Analysis Hazard: Shuttle Tanker Accidents 18 October 1999 Revision: 0 Subcategory: Shuttle tanker leak at sea Scenario description: The shuttle tanker receives the cargo from the FPSO and leaks oil while en route to port.doc . Event tree branch probabilities: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.striking either the sea bed or shore. whether under way.51 spills per 109 barrels of oil produced x 150. structural failure.79 x 10-2 spills / year derived from Anderson and LaBelle is conservatively used in this analysis. etc. Fire/explosion . the above figure of 2. which cites COE 1994 and the MMS worldwide tanker spill database as sources.79 x 10-2 spills / year – 0. in the ship-shore pipeline. ballasting error or other cause. etc. As cited in that study. or on the ship. excluding collision. By comparison. Transfer spills – leaks of cargo during loading and unloading.where fire and/or explosion occurs for reasons other than collision. anchored or moored. Fault tree base events: 2. This frequency is taken from an MMS report authored by Anderson and LaBelle. This frequency refers to spills larger than 1. Therefore.000 barrels per day x 365 days (ref. contact.

hazardous cargo bulletins.000 barrels for the MMS source. accident investigation reports. This data cites oil spills from tankers at sea. Cutter database.doc .000: 10. in restricted waters. It does report an average release size. but the report does not specifically report the data is this fashion.000 – 10. as the average spill size >1000 barrels is approximately 55.000 – 50. LMIS database.7% Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. The distribution used for this study is listed below. and oil company data.000: 50. The data from the DNV study is comparable to the MMS source.000 – 100. Volume (bbls) 1.000: 100. IOPC fund annual reports. Because of these reasons.000 – 500.000 barrels for the DNV source and 49. ITOPF database. and at port from 1992 to 1994.7% 13. the release distribution is based on an internal DNV study which compiled data from the following sources: Lloyd’s Casualty Reports.5% 34.000: Prepared by : Client approval: Probability 37. but it is unclear of the sizes of the vessels from which the spills occurred.1% 14.Release volumes: It would be preferable to use the Anderson/LaBelle MMS report to calculate release volumes.

doc .Non-Process Spills C:\WINDOWS\TEMP\022101_Risk Assessment_Final.

HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : FPSO Release Frequency Analysis 1 November 1999 Non-process spills Revision: 0 No events beyond those on existing platforms on the OCS. Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.doc .

doc .Transportation Accidents C:\WINDOWS\TEMP\022101_Risk Assessment_Final.

However. Therefore. the frequency of helicopter transport and the likelihood of helicopter crashes are not dependent on the type of deepwater installation. Escalation : Consequences of Escalation : Accident Causes : Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. and as a minor point. supply boat spill are not FPSO-unique and are not further analyzed here. Helicopter accidents are one of the major hazards to personnel on offshore installations. Helicopter crashes impacting the FPSO are not expected to breach the cargo tanks directly. the potential for small oil spills associated with helicopter crashes is not FPSO-unique and it is not further analyzed here. The frequency of supply boat visits and probabilities of spills from the supply boats are assumed to be the same for FPSOs as for other deepwater installations. since the probability of a helicopter crashing into the process area is small relative to the probability of a process release do to other causes. Therefore. Therefore. such as TLPs. However. could also result in small release due to fuel carried on board.doc . helicopter crashes as an initiating event for process releases are not analyzed separately. barring hurricane abandonment which is infrequent. however they could potentially impact the process area causing a fire that then escalates to the cargo tanks. it is assumed that this possibility is already factored into the failure rate data.HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : FPSO Release Frequency Analysis 1 November 1999 Transportation Accidents (helicopters Revision: 0 and supply vessels) No events beyond those on existing platforms on the OCS.

doc .Ship Collisions C:\WINDOWS\TEMP\022101_Risk Assessment_Final.

transfer cargo from damaged tanks to undamaged tanks. double hull. re-ballasting.HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : FPSO Release Frequency Analysis Ship Collisions Passing merchant vessel 1 November 1999 Revision: 0 Major structural damage. visual Radio contact with the errant vessel. major oil spill. Rupture of cargo tank or loss of vessel depending on severity of collision Single cargo tank lost to sea or all cargo lost to the sea Navigational error on errant vessel Good separation from shipping lanes. marked on charts Radar. shutdown production Vessel strength.doc . oil spill response Sign: Sign: Date : Date: Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.

Activity: FPSO Release Frequency Analysis Hazard: Ship Collisions

18 October 1999 Revision: 0

Subcategory: Passing merchant vessel Scenario description: A powered passing merchant vessel does not see the FPSO due to bad weather, lack of trained personnel, etc. and collides with the FPSO potentially penetrating the double hull. Fault tree base events: 3.88 x 10-3/year. The FPSO location is not specified. Therefore, the FPSO is assumed to be exposed to an average passing merchant vessel traffic risk. This figure is based on the average shipping traffic density for the Gulf of Mexico, and a typical distribution of vessel displacements. The powered passing vessel collision model is based on a model from ref. 7. The powered collision risk is determined from the following parameters: # of ships in the area, the probability of being on a collision course, and the probability of failing to divert from the collision course (i.e. watchkeeping failure, etc.). The number of ships in the area is assumed to be 2.4 x 10-3 ships / nm2 (ref. 3). The probability of being on a collision course is calculated from the equation L/RΠ, where L is the equivalent diameter of the FPSO and R is the distance to a basis circle surrounding the FPSO. The probability is calculated to be 0.0011 (369 ft / Π 20 mi). The probability of the vessel failing to be diverted from the collision course is assumed to be 3 x 10-4(ref. 7). With all the factors accounted for, for this study the probability that a powered merchant vessel will collide with the FPSO is 3.88 x 10-3 per year. Event tree branch probabilities: Cargo tank impact: 0.64. Based on an analysis on the placement of the cargo tanks around the ship’s hull. Direct impact: 0.4. ref. 3. Foundering: 0.141 for direct hits, 0.025 for glancing blows. Based on the distribution of sizes of merchant ships (ref. 3), there is a 14.1% probability that the original impact energy will be greater than 1000 MJ and a 2.5% probability that the original impact energy will be greater than 2500 MJ. Rupture of one cargo tank: 0.0768 for direct hits, 0.0359 for glancing blows. Based on the distribution of sizes of merchant ships (ref. 3), there is a 7.68% probability that the original impact energy will be between 680 and 1000 MJ and a 3.59% probability that the original impact energy will be between 1700 and 2500 MJ. Ignition: 0.58. ref. 8.

C:\WINDOWS\TEMP\022101_Risk Assessment_Final.doc

Release volumes: The following release volume for an unignited release is based on estimated volume of cargo on FPSO. It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500,000 bbls (50% of capacity) before offloading to shuttle tanker. It is assumed that FPSO operates in this cycle 90% of the time, and the remaining 10% of the time it is operates between 500,000 and 1,000,000 bbls due to circumstances such as waiting on shuttle tanker or bad weather. Using these figures, the following spill size distribution is derived for the loss of the entire FPSO and the loss of one tank; Volume (bbls) 1,000-10,000 10,000-50,000 50,000-100,000 100,000-500,000 >500,000 Total Probability (loss of FPSO) 0.00 0.09 0.09 0.72 0.10 1.00 Probability (loss of 1 tank) 0.18 0.72 0.10 0.00 0.00 1.00

In the event of escalation due to fire, the release volume is based on estimated volume of cargo on FPSO. As this event is an escalation due to fire, it is assumed that the spill volume is reduced to 25% (i.e. 75% of volume is lost in burning). Using these figures, the following spill size distribution is derived for the loss of the entire FPSO and the loss of one tank; Volume (bbls) 1,000-10,000 10,000-50,000 50,000-100,000 100,000-500,000 >500,000 Total Prepared by : Client approval: Probability (loss of FPSO) 0.00 0.36 0.36 0.28 0.00 1.00 Sign: Sign: Probability (loss of 1 tank) 0.72 0.28 0.00 0.00 0.00 1.00 Date : Date:

C:\WINDOWS\TEMP\022101_Risk Assessment_Final.doc

HAZARD IDENTIFICATION

Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes :

FPSO Release Frequency Analysis

1 November 1999

Ship Collisions Revision: 0 Drifting vessel (attendant or passing vessel) Low speed collision, minor structural damage None None Mechanical failure on nearby vessel (attendant or passing) Good maintenance of attendant vessels Radio shutdown production Vessel strength, double hull Sign: Sign: Date : Date:

Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval:

C:\WINDOWS\TEMP\022101_Risk Assessment_Final.doc

double hull Sign: Sign: Date : Date: Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. minor structural damage. None None MODU starts far from FPSO reducing the chance of collision Power failure on nearby MODU Radio contact shutdown production Vessel strength.doc .HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : FPSO Release Frequency Analysis Ship Collisions Drifting vessel (MODU) 1 November 1999 Revision: 0 Low speed collision.

64. the probability of a drifting collision is roughly calculated to be 1. and the probability that the vessel will be deflected off course (e.Activity: FPSO Release Frequency Analysis Hazard: Ship Collisions 18 October 1999 Revision: 0 Subcategory: Drifting vessel Scenario description: An attendant or passing vessel or a MODU loses power close to the FPSO and drifts into it. the FPSO is assumed to be exposed to an average drifting vessel risk. Event tree branch probabilities: Cargo tank impact: 0. ref. The probability is calculated to be 0.6 kilometers away) and the respective widths of the FPSO and the MODU and the probability that the MODU will have a stationkeeping failure (1. ref. 8.95.). etc. and the remaining 10% of the time it is operates between 500. 3. The probability of being on a collision course after engine failure is calculated from the equation L/RΠ.000 and 1.35 x 10-4. Foundering of FPSO: 0.4 x 10-3 ships / nm2 (ref. It is assumed that there is not a ship of this size in the Gulf of Mexico. the probability of being on a collision course with the FPSO. the probability that a merchant vessel will drift into the FPSO is 3. It is assumed that FPSO operates in this cycle 90% of the time. 3).000 bbls (50% of capacity) before offloading to shuttle tanker. The probability of the vessel failing to be deflected off course is assumed to be 0. with a tug boat. This figure is calculated using the probability (9 x 10-3) that the MODU will be in a position to drift into the FPSO from where the wells are located (2. Direct impact: 0. (see rupture of cargo tank below) Rupture of Cargo Tank: 0.6 x 10-4 (per year).4. For MODUs. potentially rupturing the hull.8 mi). the drifting vessels would have to have a weight of over 1. Release volumes: The following release volume for an unignited release is based on estimated volume of cargo on FPSO.8 knots. The drifting collision risk is determined from the following parameters: # of ships in the area. The drifting vessel risk model is based on a model created in ref 7. The frequency of engine failure is assumed to be 2 x 10-5 failures / hours. This figure is based on the average shipping traffic density for the Gulf of Mexico. the probability of having an engine failure. Ignition: 0. The number of ships in the area is assumed to be 2.5 x 10-2).400.22 x 10-4. The FPSO location is not specified.000.6 x 10-4. Based on a drifting speed of 1. and a typical distribution of vessel displacements.doc . Based on an analysis on the placement of the cargo tanks around the ship’s hull. where L is the equivalent diameter of the FPSO and R is the average distance between the FPSO and a vessel. With all the factors accounted for. Fault tree base events: 4.000 dwt to rupture the double hull (680 MJ impact energy). It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500.58. The overall probability (merchant vessels plus MODUs) of a drifting collision is 4. Therefore.g.000 bbls due to circumstances such as waiting on shuttle tanker or C:\WINDOWS\TEMP\022101_Risk Assessment_Final.0038 (369 ft / Π 5.

the release volume is based on estimated volume of cargo on FPSO.00 0.000 >500.00 0.28 0.000-50. Using these figures.00 1.000-500.000 50.000 Total Prepared by : Client approval: Probability (loss of FPSO) 0.09 0.00 Probability (loss of 1 tank) 0.000 100. the following spill size distribution is derived for the loss of the entire FPSO and the loss of one tank.000 50.bad weather.00 Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final.00 0.10 0.09 0.72 0.e.000-10.00 Sign: Sign: Probability (loss of 1 tank) 0.72 0.000-100. Volume (bbls) 1.doc .000 10.000 >500.00 1.000-50.36 0.000-500.000 100.28 0.00 In the event of escalation due to fire.000-100.00 1.10 1.00 0.72 0. Volume (bbls) 1. 75% of volume is lost in burning). As this event is an escalation due to fire.000 10.00 0. Using these figures.18 0. the following spill size distribution is derived for the loss of the entire FPSO and the loss of one tank.000-10.36 0. it is assumed that the spill volume is reduced to 25% (i.000 Total Probability (loss of FPSO) 0.

However. double hull Sign: Sign: Date : Date: Escalation : Consequences of Escalation : Accident Causes : Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. bad seamanship Supply vessel procedures (no high speed collisions) Radar. such a collision and sinking of the supply boat is not unique to an FPSO. and no oil spill from the FPSO is expected to occur. and there may be some fuel or other oil spilled from the supply boat as a result. Therefore. DP on supply vessel Vessel strength. since no FPSO-unique spill risks area foreseen. Thruster pitch failure. supply vessel collisions are not analyzed further. Severe weather. None None Navigational error by supply vessel. procedures. visual Double hull. minor structural damage.HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : FPSO Release Frequency Analysis Ship Collisions Visiting supply vessel 1 November 1999 Revision: 0 Low speed collision. and could similarly happen with another type of deepwater structure such as an TLP. There is the potential for the supply vessel to sink if there is a high impact collision. A supply vessel collision is not expected to have enough energy to rupture the double hull.doc . power failure on supply vessel.

HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : FPSO Release Frequency Analysis Ship Collisions Visiting shuttle tanker (low speed) 1 November 1999 Revision: 0 Escalation : Consequences of Escalation : Accident Causes : Prevention : Accident Detection : Control : Mitigation : Prepared by : Client approval: Low speed collision. Thruster pitch failure. No oil spill expected to occur (see Offloading Accidents . double hull. visual Cargo area is not exposed to collision. bad seamanship ST procedures.doc . minor structural damage. structural strength Repair in dock Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. tandem offloading. None None Severe weather. Radar. power failure on ST.Shuttle Tanker Collision During Offloading). navigational error.

re-ballasting. double hull. communication between FPSO and ST Radar. oil spill response Sign: Sign: Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. shuttle tanker should not plot course directly at FPSO ST selection and operating procedures. Rupture of single cargo tanker or loss of vessel depending on the severity of collision Single cargo tank lost to sea or loss of entire cargo to sea depending on severity of collision. visual Radio contact with the ST Vessel strength. Navigational error. transfer cargo from damaged tanks to undamaged tanks.doc .HAZARD IDENTIFICATION Activity : Hazard : Sub category : Consequences : Escalation : Consequences of Escalation : Accident Causes : Prevention : FPSO Release Frequency Analysis Ship Collisions Visiting shuttle tanker (high speed) 1 November 1999 Revision: 0 Accident Detection : Control : Mitigation : Prepared by : Client approval: Major structural damage. steering failure on the ST. major oil spill.

0. For the glancing blows that do not end in a foundering. A glancing blow does not exceed the foundering limit (2500 MJ). C:\WINDOWS\TEMP\022101_Risk Assessment_Final. A direct hit will exceed the foundering limit for the FPSO (1000 MJ). 7).4. Rupture of one cargo tank: 1 for glancing blows. 3. Ignition: 0. 8. Fault tree base events: 3. but there is a possibility that the vessel will be traveling at a greater speed (13 knots will exceed the limit).000 dwt shuttle tanker will have an impact energy of 2100 MJ at 12 knots. ref.0 for direct hit.54 x 10-9 (ref. It is assumed that there is a 25% probability that the shuttle tanker will be travelling at a speed greater than 13 knots in a full speed collision.25 for glancing blow. Event tree branch probabilities: Cargo tank impact: 0. Ten percent of low-speed on arrival tanker collisions – 3.54 x 10-8 (per year).64. Based on an analysis on the placement of the cargo tanks around the ship’s hull. A 100.Activity: FPSO Release Frequency Analysis Hazard: Ship Collisions 18 October 1999 Revision: 0 Subcategory: Visiting shuttle tanker (high speed) Scenario description: A visiting shuttle tanker loses track of position and collides with the FPSO at high speeds potentially causing a cargo tank rupture. ref.58. there is a 100% probability that the impact energy will exceed 1700 MJ (the impact energy required for a glancing blow to rupture one cargo tank).doc . Foundering of FPSO: 1. Direct impact: 0.

00 1.Release volumes: The following release volume for an unignited release is based on estimated volume of cargo on FPSO.000 and 1.00 Probability (loss of 1 tank) 0.000-50.00 0.10 1.00 1. Volume (bbls) 1.000 10. 75% of volume is lost in burning).00 0.000 >500.000 Total Probability (loss of FPSO) 0.72 0.000 bbls due to circumstances such as waiting on shuttle tanker or bad weather.28 0.00 0.000 50.00 Sign: Sign: Probability (loss of 1 tank) 0.000 >500.000 50.00 In the event of escalation due to fire.000 bbls (50% of capacity) before offloading to shuttle tanker. the following spill size distribution is derived for the loss of the entire FPSO and the loss of one tank.000-100.000-10.000-50.72 0.000-100.000 10. As this event is an escalation due to fire. the following spill size distribution is derived for the loss of the entire FPSO and the loss of one tank.36 0.000 100.000-500.00 1.00 Date : Date: C:\WINDOWS\TEMP\022101_Risk Assessment_Final. It is assumed that FPSO operates in this cycle 90% of the time. Volume (bbls) 1.09 0.18 0.72 0.10 0.e.36 0.00 0.000-10.000 Total Prepared by : Client approval: Probability (loss of FPSO) 0. and the remaining 10% of the time it is operates between 500.000-500.000.28 0. Using these figures.doc . It is assumed that FPSO is operated in a cycle starting out largely empty and filling to up to 500. the release volume is based on estimated volume of cargo on FPSO. Using these figures.000 100.09 0. it is assumed that the spill volume is reduced to 25% (i.00 0.

1998. Storage. Risk Assessment of a Marine Terminal located in the Middle East. and 180”. “Comparative Occurrence Rates for Offshore Oil Spills”."Guide to QRA of Offshore Installations". QRA of a TLP located in the Gulf of Mexico. Department of Energy Offshore Technology Information Report ITI 88 535. 1994 Marine Board (1998): “Oil Spill Risks from Tank Vessel Lightering”. Confidential internal document. Safety and Emergency Preparedness Study (SEPA) on an FPSO located in the North Sea. Anderson and LaBelle. and Offloading Systems on the Gulf of Mexico Outer Continental Shelf”.REFERENCES /1/ E&E (1999): “Scenario Report. Washington DC /2/ /3/ /4/ /5/ /6/ /7/ /8/ /9/ /10/ /11/ /12/ /13/ /14/ /15/ C:\WINDOWS\TEMP\022101_Risk Assessment_Final. DNV (1999) Report 2828 – Cost Benefit Analysis involving FPSO’s. Environmental Impact Statement on Floating Production. J P Kenny (1988): “Study on Offshore Installations Protection Against Impact”. 177. Spill Science and Technology Bulletin 1(2). Environmental Impact Statement 98-0008.doc . National Academy Press. Bechtel (1998): “JIP on Risk Assessment and Reliability of a FPSO System in the Gulf of Mexico”. QRA on an FPSO located in the UK Sector of the Central North Sea. QRA on an FPSO located in the North Sea. MMS (1998): “Gulf of Mexico OCS Oil and Gas Lease Sales 171. OREDA (1997): “Offshore Reliability Database”. Concept Safety Evaluation of a Floating Production System in the North Sea. 174. Third Edition. DNV ARF C1 Rev 1 .

doc .Det Norske Veritas 440-2771-0/JBS/RAM/CKS:sd E&E MMS January 2001 APPENDIX II CONSIDERATION OF DESIGN OPTIONS C:\WINDOWS\TEMP\022101_Risk Assessment_Final.

For greater water depths. and this has to be considered in fatigue loading design calculations. Location dependent risks include ship collisions. TableII. The passing merchant vessel collision risk (1. For this analysis we have assumed an average location based on the vessel traffic in the Gulf of Mexico. and a vessel exclusion zone around the FPSO. Environmental impact of releases is location dependent 2. if the FPSO is located far from shipping lanes the risk could drop by an order of magnitude or more. thrusters. these risks would be expected to increase. This appendix contains a qualitative assessment of how each option may affect the risk of oil release. Proximity to other installations or shore may increase the availability of spill response equipment.0 Component Water Depth Basecase 5. Conversely. Means of reducing collision risk include collision avoidance radar. It should be noted that as yet there are no floating production systems in place extending to 12. The amount of operational experience and failure rate data decrease with increasing water depth. Some hazards (e.1 E&E MMS January 2001 II. Operating production facilities in these water depths may require the use of new technologies.g.. shuttle tanker operations. if the FPSO is located adjacent to high traffic shipping lanes the collision risk could increase by a factor of four. riser and mooring failures) increase with water depth.2% of potential basecase spills by volume) is directly impacted by the proximity of the FPSO to shipping lanes. Based on previous analyses.0 Location To be determined C:\WINDOWS\TEMP\022101_Risk Assessment_Final.500 ft Impact Subsea technology is currently better proven for shallower water. CONSIDERATION OF DESIGN OPTIONS The scenario report includes 3 tables of design options.500-foot water depths.doc . attendant vessel. and greatly increase the uncertainties in estimating the risk.1: FPSO Location Number 1. these risks would be expected to decrease somewhat. export pipeline risks.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd II.000 ft Option 600 – 12. For shallower water depths. Increased water depth results in different wave characteristics.

but are otherwise not expected to impact the spill rate. constructed. but are otherwise not expected to impact the spill rate. it is assumed that provided they are properly designed. installed and maintained. A passive manifold would reduce the number of barriers for isolation between a riser release or flowline release and the wellhead. provided they are properly designed.2 Configuration Caternary Taut Semi-taut C:\WINDOWS\TEMP\022101_Risk Assessment_Final. 3. Use of semi-taut moorings may result in a reduction in the potential for mooring line/ riser interaction. constructed.1 Vessel mooring Number of moorings Clustered (3 groups of 3 mooring lines) Equally spaced 3. a passive manifold would reduce the number of potential subsea manifold leak sources. Conversely. provided they are properly designed. Therefore. installed and maintained. Use of taut moorings may result in a reduction in the potential for mooring line/ riser interaction. provided there are properly designed. constructed. Equally spaced mooring lines reduces the available spacing for risers and so increases the likelihood of riser to riser collisions. installed and maintained. No impact. Therefore.0 Risers Steel wave risers Flexible risers Steel caternary risers Hybrid risers Reduced accessibility for intervention may increase the likelihood of blowout during intervention.0 1. The current data for deepwater risers is not sufficient to differentiate amongst the options for this study.2 E&E MMS January 2001 TableII.3 Component Subsea System Well count and drill centers Subsea Trees Flowlines Basecase 3 drill centers each with 3 wells Horizontal Dual insulated steel Option No options Conventional Flexible Steel 1. constructed.4 Subsea Manifold Type Umbilicals Active Passive FPSO System Components Impact 1. and as such there is a limited track record for the various types of deepwater riser systems in terms of numbers of riser failures.0 3. installed and maintained for the service.5 Single multiplex Dual 2. constructed.2: Number 1. installed and maintained. There is no clear disadvantage from clustered moorings as long as they are sized for the foreseeable environmental loads. constructed. the type of umbilicals used should not significantly impact the risk of oil spill.doc . installed and maintained for the service.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd II. it is assumed that provided they are properly designed. Risk of major oil spills would thus be greater No impact. There is insufficient data to suggest that use of dual subsea controls umbilicals is more reliable than use of single multiplex umbilicals. provided there are properly designed. Riser technology for deepwater applications is relatively new. the type of deepwater riser used should not significantly impact the risk of oilspill.1 1.2 1.

1% of basecase spills by volume).4 4. Passive 4. Additional power generation requirements and possible vulnerability to failures in the drive mechanism may partially offset the benefits.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd II. Improved station keeping during offloading.2 Type Permanent Passive with assist Disconnectable C:\WINDOWS\TEMP\022101_Risk Assessment_Final. constructed. constructed. reducing the potential for “fishtailing” and leak during transfer to shuttle tanker (1. installed and maintained FPSO could be brought about or moved somewhat off-station to avoid a collision or minimize damage. Structural failure (foundering) accounts for 0.0 4.doc . collisions while in congested waters). installed.8% of potential basecase spills by volume). which may result in a major reduction in the potential for collision by passing merchant vessels (1. No impact.3 E&E MMS January 2001 Number 3.4% of potential basecase spills by volume) during connection and disconnection operations. provided they are properly designed.3% of potential basecase spills by volume.3 3.2% of potential basecase spills by volume).1 Component Material Anchor type Turret system Weathervaning Basecase Wire rope / chain Drag Option Polyester / chain Suction pile Driven pile Active Impact Polyester moorings are not expected to affect release rate provided they are properly designed. and maintained. Reduced risks due to foundering caused by severe weather (but this would typically be counteracted by a reduction in specification). The FPSO is more vulnerable to marine hazards when disconnected (running aground. Possibility of reduced loads on the mooring system. Reduced fatigue loading on process equipment and tall structures potentially resulting in a minor reduction in process releases (3.2% of potential basecase spills by volume). Similar impact as for active option Increased risk of riser release (0. Disconnection is not likely to be rapid enough to protect the FPSO against ship collision or riser releases. which may have a minor effect in reducing the likelihood of mooring failures (<0.

thus reducing the frequency of offloading spills. but the magnitude of shuttle spills would increase (for bigger shuttle tankers).doc .0 6. Increasing the storage on the FPSO will also tend to increase the size of FPSO spills.3 Component Location Basecase Internal Option External Impact Internal turrets are universal for FPSOs in harsh environments.3 MM bbls Cargo storage should be consistent with shuttle tanker size with a contingency to allow for shuttle tanker delays. respectively).4 5. The size of the shuttle tanker depends on destination port. resulting in a major reduction in probability of escalation from swivel and turret releases (0.0 Bearing system Fluid Transfer System Roller Multi-pass Bogeys / sliding Drag chain 6. Not clear that this can significantly affect environmental risks.2 Ballast capacity Segregated None C:\WINDOWS\TEMP\022101_Risk Assessment_Final.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd II.0% of potential basecase spills by volume. Using drag chain would require that the FPSO have some means of propulsion. 4. Maintenance of turret and swivel components is much harder.4 E&E MMS January 2001 Number 4. See Weathervaning above. 6. either active or passive with an assist. The turret and swivel are located farther away from the process area and the cargo tanks. Not clear that this can significantly affect environmental risks. and so release frequency (smaller releases) would increase.2% and <0. Larger shuttle tankers will require fewer offloading operations.1 Hull Cargo storage 1 MM bbls 2.

accommodations. we have assumed that a new-build FPSO and a conversion FPSO would be built to the same rules and specifications. By optimizing the layout on a new-build FPSO. the following potential differences have been identified: • Fatigue History: The uncertainty in fatigue life prediction is the same on both new-build and conversion FPSOs. Also. the fatigue assessment procedure for the conversion of oil tankers for FPSO service is generally conservative and it can be assumed that the frequency of fatigue failure for a conversion FPSO is similar to that of a new-build. and cargo piping to minimize the possibility of spills to sea). However. there is the potential to increase personnel safety (e. and exactly how much fatigue life there is remaining.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd II. upwind of the process area) and to increase the protection against environmental spills (e.g. machinery spaces. etc) are somewhat constrained compared to a new-build FPSO. In the case of a conversion FPSO there is some uncertainty as to what the fatigue history of the vessel is.g.doc .5 E&E MMS January 2001 Number 6. Connection Details: To account for the load of the process unit and other equipment on the main deck. by relocating the accommodations from the stern to the bow. manifold. process equipment. not all fatigue damages will result in cargo leakage if inspections occur on a regular basis. In comparing a new-build FPSO with a conversion FPSO relating to the risk of oil spills. Layout Options: For a conversion FPSO the layout options (locations of process. in both cases the large equipment support loads are distributed to transverse bulkheads and locally strengthened as required. For the purpose of the risk of oil spills there is likely to be little or no difference between the design options. This is due to the accommodations. and that both would be double-hulled (the design option of having a single-hulled FPSO is being addressed independent of the new-build/conversion design option). However.3 Component Type Basecase New build Option Conversion Impact As a basis of comparison. • • C:\WINDOWS\TEMP\022101_Risk Assessment_Final. and other features already being in place on a conversion. by relocating manifolds. Even so they both need to satisfy the same minimum requirements. the connection details of a new-build FPSO may be different than on a conversion FPSO.

it is believed that as long as both the new-build FPSO and the conversion FPSO are built properly and to the same rules and specifications. The shape of the hull.8% of potential spills by volume. etc) would have greater effects on the risk of oil spills than would use of a conversion FPSO. Widening the double hull width to 5 meters would increase the impact energy required to breach a cargo tank by 24%. accommodations. The main factor determining the FPSO’s resistance to cargo tank breach from a vessel collision is the width of the double hull. however. This would result in the passing merchant vessel releases decreasing to 0.4 Configuration Double hull (4 m) 2 m – 5 m double hull C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Other design options considered in this Risk Assessment (single hull FPSO. A conversion FPSO may potentially have a higher risk of oil spills than a newbuild FPSO. it is difficult to quantify the difference in risk between a new-build FPSO and a conversion FPSO. the frequency of hull cracks may be higher than a new-build FPSO. etc all affect the risk of oil spill.doc . double hull width. If the original vessel was a single hull tanker. Passing merchant vessel collisions result in 1. Non-ship shaped 6. if the original vessel was a double hull tanker.5% of potential spills by volume. cargo storage area. However. different location of FPSO. Narrowing the double hull width to 2 meters would reduce the impact energy required to cause cargo tank breach by 50% (i. Qualitatively. higher production rate. the frequency of hull cracks may be the same order of magnitude as for a new-build FPSO. the layout of equipment including risers. Specifications of a proposed design would be needed in order to evaluate the effect on the risk of oil spill.2% of potential basecase spills by volume. Based on the current amount of historic data for FPSOs.6 E&E MMS January 2001 Number Component Basecase Option Impact • Frequency of Hull Cracks: The frequency of hull cracks (number of cracks per year) in tankers built after 1993 (double hull tankers) is significantly lower than for older (single hull) tankers built before 1993. turret system (if present).e. This would result in the passing merchant vessel releases increasing to 2.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd II. 50% lower vessel displacement required to cause a cargo release for a given collision speed). the increased risk of oil spill for the conversion FPSO would be small. the process area.

2% of potential basecase spills by volume. Increased vulnerability to ship collision damage. Changed risk of oil spill following cargo tank explosion due to change in plate thickness. Much more difficult to inspect hull. See weathervaning.2% of potential basecase spills by volume. Passing merchant vessel collisions result in 1.8% for a single sided FPSO. Process leaks escalating to cargo area result in 3. and would be expected to increase to 2. Process leaks escalating to cargo area result in 3.5 7. above Single sided double bottom Double side.2% of potential basecase spills by volume. and would be expected to increase to 2. Passing merchant vessel collisions result in 1. Increased main deck plate thickness would reduce risk of escalation to cargo area from process leaks and other fires impacting the deck.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd II. Much more difficult to inspect hull.8% for a single sided FPSO. Increased main deck plate thickness would reduce risk of escalation to cargo area from process leaks and other fires impacting the deck. Much more difficult to inspect ship’s bottom. Changed risk of oil spill following cargo tank explosion due to change in plate thickness. Changed risk of oil spill following cargo tank explosion due to change in plate thickness. Process leaks escalating to cargo area result in 3. above See weathervaning. single bottom 6.0 Propulsion Production No propulsion Propulsion DP C:\WINDOWS\TEMP\022101_Risk Assessment_Final.2% of potential basecase spills by volume.doc .7 E&E MMS January 2001 Number Component Basecase Option Single sided single bottom Impact Increased vulnerability to ship collision damage.2% of potential basecase spills by volume. Increased main deck plate thickness would reduce risk of escalation to cargo area from process leaks and other fires impacting the deck.

000 BWPD 100. No direct increase in the risk of accidental oil spills. There would be an increase in the process risks as a result of the additional compression.6% and 39.doc . Process events account for 3. The increase in gas throughput is likely to increase the risk of process fires. 7. Therefore. the risk is liable to increase. which are one of the larger contributors to the overall risk.2 Gas production rate Water production rate Trains 200 MMSCFD 300 MMSCFD 7. Releases linked to production (excluding transport and offloading) are 5. Releases during transfer from FPSO to shuttle tanker are 1.1 Component Oil production rate Basecase 150. Process events account for 3. These are negligible in the basecase. or additional separation equipment.4 Single train Dual train 7.8 E&E MMS January 2001 Number 7. if this required additional production risers.3 70. Releases from transport by shuttle tanker at sea and in port are 53.000 BWPD 7. this may reduce or remove the risk benefit for process events.2% of potential basecase spills by volume.0% of potential basecase spills by volume. respectively.5% of basecase spills by volume. the risk from process events is also likely to approximately double. The risk per barrel offloaded or transported would remain about the same.8% of potential basecase spills by volume.000 bopd Impact The risks per barrel produced are likely to reduce as production rates increase.2% of potential basecase spills by volume. However. MMS has indicated that gas reinjection may be an approvable option under the condition that the operator demonstrates a solid commitment and plan to eventually produce the gas.2% of potential basecase spills by volume.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd II. Shorter gas pipeline at higher pressure means that the gas pipeline risks would be affected.000 bopd Option 300. the risk is likely to increase. Process events account for 3.6 Pipeline export Injection C:\WINDOWS\TEMP\022101_Risk Assessment_Final. The risk of process accidents would approximately double due to the increase in equipment.5 Separators 3 stage 2 stage 7. As the inventory in each stage is liable to be much greater than that necessary for escalation. if this means there is a need to increase the number of compression stages. Reduced risk from separators due to the reduction in vessels. However.

Side by side offloading would be largely similar to current lightering practice between oil tankers and shuttle tankers. Therefore. Flaring is not likely to be acceptable. which has a good safety record in the GoM.7 7. the potential for damage to either the shuttle tanker or FPSO. Additional process plant required for conversion is likely to increase process risks. Process events account for 3. Reduced potential for low speed maneuvering collision between shuttle tanker and FPSO.8 8. However. 7. However. Because of the low maneuvering speeds and the fact that both shuttle tanker and FPSO have double hulls it is not anticipated that a cargo spill could result from a low speed collision. C:\WINDOWS\TEMP\022101_Risk Assessment_Final. conversion could potentially pose unforeseen risks. potentially requiring drydock repair.doc . Increased risk of oil spill from additional riser / pipeline from FPSO to buoy.2% of potential basecase spills by volume. resulting in reduced process risks. long term.0 8.2% of potential basecase spills by volume. low speed collisions are not expected to result in a cargo spill because of the low maneuvering speeds and the fact that the shuttle tanker and the FPSO are both double hulled.9 E&E MMS January 2001 Number Component Basecase Option Conversion Flaring / venting Impact Not a proven offshore technology. The potential for maneuvering collisions between the shuttle tanker and the FPSO are a concern with side by side offloading. could pose a significant concern. Process events account for 3.1 Flare Produced water disposal Offloading system Offloading configuration Emergency flare only Discharge overboard None None Tandem Side by side Buoy based offloading system Not clear whether risks would be affected significantly.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd II. The reduction in potential for low speed maneuvering collisions would lessen the potential for damage and possible dry dock repair for the shuttle tanker or FPSO. Gas compression risks eliminated (except fuel gas).

Therefore. lower top speed than tankers and some sea-state limitations on the tub-barge coupling. however the fashion is to assume that submerged pumps are lower risk than a pump room. These data indicate that the oil spill frequency for barges is approximately four times higher than for oil tankers.4 9.10 E&E MMS January 2001 Number 8. however. and subsequent damage to the offloading hose and release during transfer to shuttle tanker.3 Capacity Station-keeping 500.2% of potential basecase spills by volume. 8. These are three of the leading causes of shuttle tanker spills and shuttle tanker spills near and at sea already account for 53.000 BPH 8.6% and 39. Cargo tank explosions account for 0. Increased vulnerability to hawser failure. The relative scarcity of experience with submerged pumps means that the risks from their operation and maintenance are not so well understood. which make up the majority of the vessels in the barge data quoted.000 bbls Hawser with thruster assist No options Hawser C:\WINDOWS\TEMP\022101_Risk Assessment_Final.2 Component Cargo pumps Basecase Submerged pumps Option pump room Impact A pump room introduces an additional and significant risk of cargo area explosions.3 Offload rate 50. the single hull shuttle tanker option would represent a major increase in oil spill risk over the basecase. and the average barge spill size is about eight times smaller than for oil tankers. the volume of potential spills would likely decrease due to the lower flow rate. Therefore. There are oil spill frequency data for tankers and barges. Transfer hose leaks account for 1.0 9.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd II. Increased consequences in the event of grounding. which would tend to increase the potential for offloading spills.doc . ATBs are not very similar to inland barges. contact or collision. The main functional differences are that ATBs have a lower crew size. ATBs are more similar in design and operation to tankers.000 BPH 30. Not clear that this will affect the risks measured. it is expected that the oil spill frequency for ATBs is best estimated using oil spill rate tanker data rather than barge data.8% of potential basecase spills by volume. However.0% of potential basecase spills by volume.1 Offloading hose Shuttle tanker Hull configuration Retractable Double hull Floating Single hull ATB 9. The time required for offloading would be increased. Therefore. Use of ATBs (articulated tug barges) is a relatively new development and there are little data on frequency of oil spills from ATBs. it is not clear how this would affect the risk of oil spill.2 9.

Passing merchant vessel collisions account for 1. and subsequent damage to the offloading hose and release during transfer to shuttle tanker. Since there is no attendant vessel to act as a guard vessel.2% of basecase spills by volume.3 10.8% of potential basecase spills by volume. With a reliable DP system it would be expected that loss of station-keeping and damage to the offloading hose would be much reduced.doc . If the flare is sufficiently high. Whether using a DP system would increase or decrease the potential for oil spills would depend on the reliability of the DP system. 3). and to prepare for collision. 10 10. 10.11 E&E MMS January 2001 Number Component Basecase Option DP Impact Vulnerability to DP failures.1 General Layout Quarters/flare location Quarters stern/ flare bow Quarters bow / flare stern It is not clear that there will be a significant difference in the risk of oil spill between these two configurations. as is assumed in this figure.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd II.2 10. Passing merchant vessel collisions account for 1.4 10.2% of basecase spills by volume. Increased risk of ship collision by passing merchant vessel. Use of a continuously manned radar watch with supervision of passing vessels has been estimated to reduce collision frequency by 50-80% (ref.5 Living quarters capacity Life Boat Arrangements Bow/stern Escape Tunnels Collision Avoidance Warning System 70 per USCG requirements Not required Monitor / Alarm No Options No options No options Continuously manned radar watch Reduced risk of ship collision by passing merchant vessel. this 50-80% reduction is probably too high for the basecase because there is no attendant vessel. it is unlikely that it will ignite a gas release. However. Transfer hose leaks account for 1. The flare should be well clear / upwind of any potential gas release sources. the actions of the FPSO personnel would be largely limited to trying to raise the oncoming vessel on the radio and otherwise alert them. No CAWS C:\WINDOWS\TEMP\022101_Risk Assessment_Final.

1 and 6. Option 2.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd II. An FPSO should be so designed and constructed to ensure it is habitable and safe during all foreseeable weather conditions. More frequent offloading operations increases the risk of small leaks due to offloading.3: Number 1. Evacuating personnel by helicopter for hurricane abandonment is not a risk free operation. minimizing the distance traveled reduces risk.doc . See 4. and increases the risk of shuttle tanker failures. Helicopter accidents are one of the major fatality risks of offshore operations.0 Component Shuttle tanker destination Basecase Various FPSO Operations Impact Transit routes avoiding busy shipping lanes or difficult navigation passages are likely to have lower risks. The benefit of hurricane abandonment is reduced potential for loss of life in the event of a failure during a hurricane. Thereafter.0 FPSO Thruster Assist Shuttle tanker tug assist No thrusters No tug Thrusters Tug 5.0 Offloading frequency Every 3 days Every day to once per ten days 3. Conversely less frequent offloading has the opposite effect. rather than any reduction in oil spill risk. and would also be on hand to prevent collisions by other drifting vessels in the vicinity (drifting vessels are a negligible risk) Reduced possibility for manual mitigation of an accident were it to occur during a hurricane.0 4.5 in above table A tug would reduce the risk of shuttle tanker collision with the FPSO.0 Hurricane abandonment No Yes C:\WINDOWS\TEMP\022101_Risk Assessment_Final.12 E&E MMS January 2001 TableII.

Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd E&E MMS January 2001 APPENDIX III SUGGESTED RISK MITIGATION OPTIONS C:\WINDOWS\TEMP\022101_Risk Assessment_Final.doc .

• • Establish selection standards and inspections to ensure that shuttle tanker meets requirements for vessel safety. a dedicated shuttle tanker and crew could be used. Alternatively.doc .1 E&E MMS January 2001 III SUGGESTED RISK MITIGATION OPTIONS HAZARD BASE CASE • • Double hull vessel Compliant with Coast Guard regulations and Jones Act • • • • • MITIGATIONS Inert Gas System Firewater and foam systems Oil spill contingency plans Continuously manned radar watch • • • MITIGATION EFFECT To minimize the potential for damage due to fires and explosions To minimize impacts of potential oil spills To minimize the potential for collisions To minimize the potential for groundings Shuttle Tanker Leak Near Port • Tankers of opportunity will be used Shuttle Tanker Leak at Sea (items listed under Shuttle Tanker Leak Near Port above also apply) • Contingency plans in case of loss of propulsion including availability of tug assistance and possibility of using anchor to stop drifting vessel. and emergency response preparedness. crew training. (mitigation measures and effects listed under Shuttle Tanker Near Port also apply) To minimize potential for oil spills impacts C:\WINDOWS\TEMP\022101_Risk Assessment_Final.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd III.

Equipment arrangement to segregate ignition and fuel sources. Designate crane landing area.doc . Piping system to conform with API-RP14E.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd III.2 E&E MMS January 2001 HAZARD Process Leaks • • • • • BASE CASE Fire and gas detection system to shutdown and blowdown. Optimized equipment and piping layout to reduce congestion and in turn reduce potential explosion overpressure. • • • • • Lowers the consequences of a potential fire or explosion. API-RP-14J Electrical system to conform with APIRP-14F Two levels of process upset protection per API-RP-14C. Deck drainage system to divert hydrocarbon spill and deluge water to the adequately sized drain/slop tank • MITIGATION EFFECT Current area classification practice emphasizes equipment coverage and does not cover catastrophic failure. C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Limit containment of pressurized hydrocarbon and provide automatic isolation between vessels. Open type process area with individual equipment area classification. Firewater deluge and foam protection to prevent escalation. Process deck elevated above the storage tanks to prevent fire impingement onto the storage tank. Require work permit for lifting equipment to or from process area. By designating the whole process area together to comply with both API-RP14F & 14J the potential for ignition would be minimized. As per MMS. Restrict crane operations over process area. • To control the consequence of liquid spill. Coast Guard and USEPA regulatory requirements. Lowers probability of loss of containment. • • • • • • MITIGATIONS Designated process area to be classified area.

valves and couplings and other offloading equipment and regular of inspection of equipment for defects. Independent low pressure sensors to be provided at each pump discharge upstream of check valve preferably located at the tie in point of the manifold to shutdown the pump and/or the automatic isolation valve. MITIGATIONS Use of high integrity hoses. C:\WINDOWS\TEMP\022101_Risk Assessment_Final. Attendant vessel. • MITIGATION EFFECT To reduce potential for oil spills during offloading • • To minimize spill size in the event of hose rupture or breakage during offloading. Establish vessel exclusion zone around FPSO operation. • Collision avoidance radar. • • To detect and shut down pump in order to minimize spill size. • • To minimize pollution to the environment. FPSO with thrusters. Isolation valve to be provided at each pump • discharge line to the common manifold. Reduce collision risk by excluding from the area vessels unrelated to FPSO operation. Provide advance warning for potential collision situation. and sound signal in compliance with Coast Guard Navigational Aid regulations.3 E&E MMS January 2001 HAZARD Transfer Hose Leak • BASE CASE • Tandem cargo offloading system.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd III. Automated shutdown valve to be provided upstream of the hose tie-in station complete with low-pressure sensor or equivalent sensor to detect leak. Offloading hose to be equipment with a marine breakaway coupling complete with shut-off valve. Navigation aids in the form of lights.doc . • • • • • • Exclusion of FPSO operations from in or • near high traffic shipping lanes. Provides “active” intervention for drifting vessel or other potential collision. Reduce collision risk by avoiding high traffic areas. Oil spill control procedure. • Vessel Collision • • • FPSO location to be determined Monitor/Alarm. shapes.

To localize potential failure. • Exhaust and air intake from/to the tank to be equipped with devices to prevent fire flash back. Pressure sensor may not effectively detect leakage especially for small leaks. • MITIGATION EFFECT To minimize potential for explosion within the storage tank.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd III. providing piggable loops. Swivel leaks (0. • • Pressure monitoring system will be used for • detection of main leaks as per API RP 14C.doc .4% of spills by volume). Production Riser Leak • • 3 subsea well manifolds connected to the FPSO through 6 flowlines and 6 production risers. • Double hull vessel • MITIGATIONS Continuous monitoring of cargo tank O2 • level to ensure it is maintained below 5%. Reduces the probability of undetected sub-sea leak C:\WINDOWS\TEMP\022101_Risk Assessment_Final. • Individual venting system and a relief/vacuum valve are to be provided to each cargo tank. especially if the sensor is located subsea where the external pressure may be about that of the riser or pipeline pressure. All subsea wells tied into one manifold with a single production riser and one alternative riser to provide a pigging loop. To minimize potential for explosion within the storage tank. Reducing the number of production risers from 6 to 2 will approximately cut in one third the potential for production riser leaks (1. Device to detect and alarm on no flow or • loss of flow in order to indicate potential leakage.6% of spills by volume) would be reduced due a simpler design with less possible leak points.4 E&E MMS January 2001 HAZARD Cargo Tank Explosion • • BASE CASE The cargo tanks will be provided with Inert • Gas System (IGS) and crude oil washing (COW) system.

Therefore. The additional coffer dam or ballast tank would reduce the risk of escalation from the fire or explosion in the turret/swivel area. and foam system.e. • • MITIGATION EFFECT To reduce the potential for human error in ballasting operation. To reduce the probability for piping leaks to spill to sea. Firewater. Div 2 Area Classification. Design for 100 year current with associated wave and wind. Design for 100 years wave with associated • wind and current. Provide spill containment system similar • to process area. the FPSO could be “overdesigned” to withstand more extreme conditions (i. An FPSO is unlike other oil production facilities. C:\WINDOWS\TEMP\022101_Risk Assessment_Final. where insignificant amount of oil is stored or if it is stored it can be pump into the pipeline prior to the storm.doc . including heel and trim monitoring. events greater than a 100-year storm). For example. a much higher safety factor should be considered. Consider classification of FPSO including hull and mooring system. • • • To ensure integrity of the unit against structural failure and eliminate potential design and fabrication errors. Segregated ballast system.. MITIGATIONS Central ballast control station to control and monitor the ballast and bilge system. • • Swivel Leak • • • • Cargo Piping Leak on Deck • • Adequate Ventilation. Fire and gas detection to activate shutdown and blowdown. Reduces the risk to extreme weather conditions.Det Norske Veritas 440-2771-0/JBS/RAM/CSK:sd III. Real-time monitoring of loads on the hull of the FPSO.5 E&E MMS January 2001 HAZARD Foundering • • • • BASE CASE • To satisfy IMO and global strength requirement. Coffer or ballast tank to be provided between turret/swivel and storage tanks.