1 Methods in Chemical Process Safety - Vol 2 Offshore Process Safety

Academic Press is an imprint of Elsevier
50 Hampshire Street, 5th Floor, Cambridge, MA 02139, United States

525 B Street, Suite 1650, San Diego, CA 92101, United States
The Boulevard, Langford Lane, Kidlington, Oxford OX5 1GB, United Kingdom
125 London Wall, London, EC2Y 5AS, United Kingdom
First edition 2018
Copyright © 2018 Elsevier Inc. All rights reserved.
No part of this publication may be reproduced or transmitted in any form or by any means,
electronic or mechanical, including photocopying, recording, or any information storage and
retrieval system, without permission in writing from the publisher. Details on how to seek
permission, further information about the Publisher’s permissions policies and our
arrangements with organizations such as the Copyright Clearance Center and the Copyright
Licensing Agency, can be found at our website: www.elsevier.com/permissions.
This book and the individual contributions contained in it are protected under copyright by
the Publisher (other than as may be noted herein).
Notices
Knowledge and best practice in this field are constantly changing. As new research and
experience broaden our understanding, changes in research methods, professional practices,
or medical treatment may become necessary.
Practitioners and researchers must always rely on their own experience and knowledge in
evaluating and using any information, methods, compounds, or experiments described
herein. In using such information or methods they should be mindful of their own safety and
the safety of others, including parties for whom they have a professional responsibility.
To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors,
assume any liability for any injury and/or damage to persons or property as a matter of
products liability, negligence or otherwise, or from any use or operation of any methods,
products, instructions, or ideas contained in the material herein.
ISBN: 978-0-12-814027-7
ISSN: 2468-6514
For information on all Academic Press publications

visit our website at https://www.elsevier.com/books-and-journals
Publisher: Zoe Kruze

Acquisition Editor: Jason Mitchell
Editorial Project Manager: Teresa Pons-Ferrer
Production Project Manager: Vignesh Tamil
Cover Designer: Miles Hitchen
Typeset by SPi Global, India
CONTRIBUTORS
Rouzbeh Abbassi
School of Engineering, Faculty of Science and Engineering, Macquarie University, Sydney,
NSW, Australia
Khaled ALNabhani
Centre for Risk, Integrity and Safety Engineering (C-RISE), Faculty of Engineering and
Applied Science, Memorial University, St. John’s, NL, Canada
Til Baalisampang
Australian Maritime College, University of Tasmania, Launceston, TAS, Australia
Vikram Garaniya
National Centre for Maritime Engineering and Hydrodynamics, Australian Maritime
College, University of Tasmania, Launceston, TAS, Australia
Stein Haugen
Department of Marine Technology, Norwegian University of Science and Technology
(NTNU), Trondheim, Norway
Rabiul Islam
National Centre for Ports and Shipping, Australian Maritime College, University of
Tasmania, Launceston, TAS, Australia
Shawn Kenny
Department of Civil and Environmental Engineering, Faculty of Engineering and Design,
Carleton University, Ottawa, ON, Canada
Nima Khakzad
Faculty of Technology, Policy, and Management, Delft University of Technology, Delft,
The Netherlands
Faisal Khan
Australian Maritime College, University of Tasmania, Launceston, TAS, Australia; Process
Engineering Department, Centre for Risk, Integrity and Safety Engineering (C-RISE),
Memorial University of Newfoundland, St. John’s, NL, Canada
Pedram Kooshandehfar
Sankaramoorthy Narayanasamy
Natalia Nikolova
ix
x Contributors
Howard Pike
Centre for Risk, Integrity and Safety Engineering (C-RISE), Faculty of Engineering,
Memorial University, St. John’s, NL, Canada
Genserik Reniers
Faculty of Technology, Policy, and Management, Delft University of Technology, Delft,
The Netherlands
Abdullah Sardar
Fan Yang
Institute of Ship Power and Engineering, Marine Engineering College, Dalian Maritime
University, Dalian City, China
Hongyang Yu
School of Chemistry, Physics, and Mechanical Engineering, Queensland University of
Technology, Brisbane, QLD, Australia
EDITORS’ BIOGRAPHY
Dr. Faisal Khan is Professor and Canada Research Chair (Senior) of Safety
and Risk Engineering. He is a founder of Centre for Risk Integrity and
Safety and Engineering (C-RISE), which have over research 50 research
members. His areas of research interest include offshore safety and risk
engineering, inherent safety, risk management, and risk-based integrity
assessment and management. He is actively involved with multinational
oil and gas industries on the issue of safety and asset integrity. In 2006, he
has spent 8 months as risk and integrity expert with Lloyd’s Register
(UK) a risk management organization. He also served as a Safety and Risk
Advisor to Government of Newfoundland, Canada. He continues to serve
as a subject matter expert to many organizations that include Llyod’s
Register EMEA, SBM Modco, Intecsea, Technip, and Qatargas. In
2008–10, he visited Qatar University and Qatargas LNG Company as
Process Safety and Risk Management Research Chair. In 2012–14, he
served as a Visiting Professor of Offshore and Marine Engineering at
Australian Maritime College (AMC), University of Tasmania, Australia,
where he led development of offshore safety and risk-engineering group
and an initiative of global engagement with many international institutions.
He is a recipient of President Outstanding Research Award of 2012–13,
CSChE National Award on Process Safety Management of 2014, President
Outstanding Research Supervision Award of 2013–14, and recently Society
of Petroleum Engineer award for his contribution in Health, Safety and Risk
Engineering. He has authored over 400 research articles in peer-reviewed
journals and conferences on safety, risk, and reliability engineering. He
has authored five books on the subject area. He is an Editor to Journal of
Process Safety and Environmental Protection, Process Safety Progress,
and ASME Part A (Risk and Uncertainty Analysis). He regularly offers
training program/workshop on safety and risk engineering in different
places including St John’s, Chennai, Dubai, Beijing, Aberdeen, Cape Town,
Doha, and Kuala Lumpur.
Dr. Abbassi has a Bachelor of Civil Engineering and a Master and PhD of
Environmental Engineering. Upon completion of his PhD, he undertook
2 years postdoctoral research experience in the Faculty of Engineering
and Applied Science at Memorial University and 2 years postdoctoral
xiii
xiv Editors’ Biography
research experience in the Department of Civil and Environmental

Engineering at Princeton University. He served as a Senior Lecturer at
the Australian Maritime College (AMC) at the University of Tasmania prior
to joining the School of Engineering at Macquarie University. He is a reg-
istered professional engineer (P. Eng) in Newfoundland and Labrador (NL).
His research interests lie in two interrelated fields: first, modeling the fate
and transport of contaminants within different environmental media, and
second, developing the methodologies, models, and software tools for
integrated risk and safety and environmental management of large-scale
infrastructures. He has authored over 80 research articles in peer-reviewed
journals and conferences on environmental, safety, and risk-engineering
subjects. He is a member of the editorial boards of the Journal of Loss
Prevention in the Process Industries and the Journal of Integrated Security
Science.
PREFACE
Offshore oil and gas operations have many inherent safety-related risks. To
best manage, the industry needs to have a good understanding of potential
hazards and risk associated with the different stages of offshore operations.
The increasing complexity of the offshore systems together with growing
public awareness to ensure higher levels of safety has put enormous pressure
on industries to develop innovative solutions for safe and economical oper-
ations. Analysis of past accidents occurred in offshore oil and gas industry
helps better understanding of what went wrong, and how to avoid, control,
and mitigate such event at various stages of operation. Learning from
past accident is useful but not the best strategy. Industry must adopt proactive
approaches to foresee risk and develop safety management strategies at
different stages of offshore operations including drilling, transportation,
and processing.
This book is the second volume of the Methods in Chemical Process Safety
book series. This book series intends to be a one-stop resource for both
academic researchers and professional practitioners. It aims to publish fun-
damentals of process safety science leading state-of-the-art advances occur-
ring in the field while maintaining a practical approach for their application
to the industries. An international editorial board and authorship ensures that
this book series depicts the latest research developments from around the
globe. Each volume will cover fully commissioned methods across the field
of process safety, risk assessment and management, and loss prevention.
This, second, volume devotes to different methods, models, and case stud-
ies to assist in better understanding and enhancement of offshore process
safety. This volume presents eight chapters. Chapter 1 provides an overview
of marine and offshore safety. It presents analyses of the past significant acci-
dents and their consequences forcing the development of safety regulations
and environmental protection policies. It also includes the methods available
for safety analysis of marine and offshore operations. Chapter 2 discusses the
safety in offshore platforms and provides an overview of how safety is being
managed particularly in Norwegian offshore industry. Chapter 3 discusses the
role of the human factor in marine and offshore safety and includes some of
the current techniques developed for human reliability assessment and man-
agement in marine operations. Evaluation of the safety in oil and gas transfer
and transport considering the current safety practices employed by different
xi
xii Preface
industries is discussed in Chapter 4. Chapter 5 provides an overview of the

safety in the offshore drilling operations from the operational and occupational
aspects. It explains the potential risks arising from process incidents concen-
trating on the offshore drilling operations. Chapter 6 points out safety
challenges during offshore processing (top side) and particularly safety issues
faced by the Floating Production Storage & Offloading and Floating
Liquefied Natural Gas facilities. Chapter 7 explains the risk associated with
offshore pipelines. It presents the history of offshore pipeline engineering
and the relationship between asset and risk management principles. Finally,
Chapter 8 evaluates the regulatory context and discusses the complexity
and challenges faced by regulators to respond to most legal inquiries in
the offshore environment.
We are indebted to the authors for making a valuable contribution to
this volume; this book could not have been published without their com-
mitment of time and willingness to share the wealth of experience and
knowledge. On behalf of everyone who contributed to this volume, we
hope that this book contributes to a safer future by serving as a source
of knowledge in the field of offshore process safety. It is a great pleasure
for us to bring together experts and to compile their contribution.
The field of marine and offshore safety is complex and challenging. We are
imperfect and still learning and improving every day. So, we sincerely apol-
ogize in advance for potential errors and misses in this volume. We encourage
readers to share them with us for our self-learning and also to serve the com-
munity better. We look forward to learning from your feedback.
FAISAL KHAN
Centre for Risk, Integrity and Safety Engineering (C-RISE),
Faculty of Engineering & Applied Science,
ROUZBEH ABBASSI
Macquarie University, Sydney, NSW, Australia
ARTICLE IN PRESS
Overview of Marine and Offshore

Safety
Til Baalisampang*, Rouzbeh Abbassi†,1, Faisal Khan*,‡
*Australian Maritime College, University of Tasmania, Launceston, TAS, Australia
†
School of Engineering, Faculty of Science and Engineering, Macquarie University, Sydney, NSW, Australia
‡
Process Engineering Department, Centre for Risk, Integrity and Safety Engineering (C-RISE),
Memorial University of Newfoundland, St. John’s, NL, Canada
1
Corresponding author: e-mail address: rouzbeh.abbassi@mq.edu.au
Contents
1. Background and Historical Perspective of Marine Safety 1
2. Background and Historical Perspective of Offshore Safety 8
3. Past Major Accidents: Marine and Offshore 19
3.1 Major Marine Accidents 22
3.2 Major Offshore Accidents 22
4. Data Availability From Past Accidents 28
5. Analysis of Past Accidents 38
5.1 Analysis of Marine Accidents 38
5.2 Analysis of Offshore Accidents 44
6. Lesson Learned From Past Accidents to Control Offshore Major Hazards 57
6.1 Recent Accidents and Lessons to be Learned 60
7. HI in Marine and Offshore Operations 66
8. Review of Techniques Available for Safety Analysis of Marine and Offshore
Operations 78
9. Purpose and Organization of This Volume 87
References 88
1. BACKGROUND AND HISTORICAL PERSPECTIVE

OF MARINE SAFETY
In ancient times, safety was not considered to be a matter of great
concern because accidents were regarded as the will of the gods or the fate
of people (Wang, 2003). There is no exact record of the first marine acci-
dent, and it is believed that marine accidents have been occurring ever since
people started to sail or learned to float (Corovic & Djurovic, 2013).
#
Methods in Chemical Process Safety 2018 Elsevier Inc. 1
ISSN 2468-6514 All rights reserved.
https://doi.org/10.1016/bs.mcps.2018.04.001
ARTICLE IN PRESS
2 Til Baalisampang et al.
The first record of maritime accidents goes back to the First Punic War
between the Roman Republic and Carthage which lasted from 264
to 241 BC (Lazenby, 2016). During this war, Rome lost 700 ships and
Carthage 500. Since then, fatal maritime accidents have continued to
occur because of increase in maritime transportation and activities such
as fishing and sailing. In some countries, various means for safety at sea
were adopted and included binding ship with ropes fore and aft to prevent
splitting, jettisoning objects (loads) overboard to prevent sinking, ban-
ning sailing in winter, and implementation of a policy similar to Roman
sailing permit (Boisson, 1999). Evidence of progress in maritime safety
was reflected in the Middle Ages with the adoption of first preventive rules
on loading as mentioned in Lex Rhodia (Duhaime, 2010).
Toward the end of the 18th century various policies relating to naviga-
tion were adopted. The increase in seaborne trade, the number of ships, and
their capability and value of cargo carried provided an incentive to develop
policing methods among the major maritime nations. Instances of the adopted
policies that related to inspection, maintenance, loading, and unloading were
Spanish Ordinance of 1563, Venetian law of June 8, 1569, the Marine
Ordinance of August 1681, recesses of the Diet of the Hanseatic League of
1412, 1417, and 1447, the Low Countries Ordinance of 1549 and Act of
August 9, 1791 (France) (Harvey, 2012). During this period, Britain and
France displayed considerable transformation in adopting preventive regula-
tions, navigation, and ship survey procedures.
Despite all efforts and policies adopted, maritime accidents continued
to occur and some countries such as Britain and France began to adopt
intervention policies in the 19th century (Boisson, 1999). France generated
declaration of the 1808 Commercial Code (relating to survey of departing
ships), Decree of July 4, 1853 (relating to fishing craft and vessels engaged
in home-trade navigation), Decree of September 2, 1874 (relating to carriage
of dangerous goods, loading, and unloading), and merchant shipping law
(adopted on January 29, 1881 and January 30, 1893, relating to reinforced
inspection procedures) and the Decree of June 26, 1903 (relating to life-saving
equipment) (Boisson, 1999). The entire lot of adopted policies underwent
massive changes under the Act of April 17, 1907, followed by two Decrees
on September 20 and 21, 1908. These measures introduced safety rules and
public health on navigation. They included every aspect of ship safety, build-
ing and preservation conditions, departure surveys, equipment and installa-
tions, and conditions of loading and operation.
ARTICLE IN PRESS
Overview of Marine and Offshore Safety 3
Because of continued recurrence of maritime accidents and public

concern, British legislators sought to strengthen safety at sea and in the
1836 Parliamentary Select Committee, was formed to examine the causes
of shipwrecks (Boisson, 1999). This Committee found 10 determining
factors responsible for ship losses including defective construction, inade-
quate equipment, imperfect state of repair, improper and excessive loading,
incompetent masters, drunkenness among officers and crew, and marine
insurance which inclined ship owners to disregard safety. In 1839, transport
of timber deck cargoes was restricted in the North Atlantic and the first rules
on lights and traffic at sea were adopted in 1840 (Boisson, 1999).
The real birth of State’s action came into effect after adopting the
Merchant Shipping Act of 1850 under the auspices of the Board of Trade,
assigned with the task of monitoring, regulating, and controlling all issues
relating to merchant shipping (Bull, 1966). Subsequently, a Bill passed in
1854 strengthened the powers of the Board and all technical provisions con-
cerning safety equipment on wooden ships and iron ships were implemented
(Harvey, 2012). However, these measures made very little improvement in
accident prevention and mitigation. In 1867 alone, 1313 shipwrecks occurred
causing the death of 2340 British sailors and 137 passengers (Bull, 1966). As a
consequence of this, in 1873, a Royal Commission was set up to investigate
the seaworthiness of British vessels and a Member of Parliament, Samuel
Plimsoll, presented the manifesto to the British Parliament (Harvey, 2012).
The Parliament adopted the Merchant Shipping Act of 1876, known as
the “Plimsoll Act” (Hare, 1996). Despite this, in 1882, more than 1120 ship-
ping accidents occurred in British vessels resulting in casualties of more than
3000 crew and 360 passengers (Bull, 1966).
In order to end such horrendous accidents, another Royal Commission
was set up in 1884 which made several recommendations and improvements
to the safety of steamships. Thereafter, Merchant Shipping Load Line Act
1890, 1894 Merchant Shipping Act, and its amendment on December 21,
1906 were adopted in order to increase the seaworthiness and safety of ships,
and health provisions of boarded crew and passengers (Boisson, 1999). Other
major maritime nations such as Denmark, Sweden, Norway, Germany,
United States, Spain, and the Netherlands began to follow the British model.
In the 19th century, France and Britain signed several agreements for setting
up uniform navigation rules or maritime traffic policing force (Boisson, 1999).
For example, an 1856 agreement covered a series of rules on maritime signals,
communication guidelines, and standards for navigation in fog.
ARTICLE IN PRESS
Because of consistent problems at sea, diversity of regulations among dif-

ferent ports and international competition undermined the effective results
of maritime safety management. This intensified a need for uniformity of
national rules and regulations regarding safety at sea throughout the 20th
century (Harvey, 2012). In an effort to set up universal laws, maritime
nations involved in uniformity of regulations through bilateral treaties
and agreements encouraged all stakeholders to employ international instru-
ments for regulating safety at sea and protection of the marine environment
(Harvey, 2012). For instance, in November 1889, the first international
maritime conference held in Washington, DC defined 13 groups of regula-
tory principles regarding a proper code of the sea, covering rules on steering
and sailing, lights and signals, and distress signals (Vaughn, 1960).
In order to enhance maritime safety practices collectively at international
level, some international organizations, such as the Comite Maritime Inter-
national (CMI), formed in 1897, started to evolve. The CMI contributed to
organize several diplomatic conferences by bringing together maritime law
associations and also played a vital role in the establishment of several texts
regarding to safety, including “Collision” in the 1910 Brussels Convention,
and “Assistance e and Salvage at Sea” in 1910 (Berlingieri, 1982).
There was no significant international effort nor public concern for
mitigation and prevention of maritime accidents despite the occurrence
of numerous maritime accidents until the tragic Titanic disaster in 1912.
The Titanic accident made the world realize that maritime safety cannot
be achieved without joint effort and cooperation at international level
(Singh, 1973; as cited in Li & Wonham, 2001). This resulted in the signing
of the Convention for the Safety of Life at Sea (SOLAS) on January 20, 1914
followed by the first International Conference on Safety at Sea and the first
International Convention on Maritime Safety (Li & Wonham, 2001). The
adoption of SOLAS was a clear sign that human life at sea outweighed any
property and this date was considered as the birth of the maritime safety sys-
tem (MSS) (Kopacz, Morgas, & Urba nski, 2001). Moreover, the tragedy
brought the issue of maritime safety to the forefront of public consciousness
and global pressure was created for the establishment of a permanent inter-
national authority to boost maritime safety more effectively (Transport
Canada, 2016). Moreover, the International Labour Organization (ILO)
nurtured the introduction of specific regulations regarding working condi-
tions at sea after the First World War. The League of Nations set up the
Temporary Transport and Communication Commission which played an
important role in harmonizing standards and was responsible for the 1923
ARTICLE IN PRESS
Geneva Convention on maritime port regimes (Boisson, 1999). As a result,

the United Nations adopted a resolution in 1948 for the establishment of the
International Maritime Organization (IMO) with a mandate to develop
international regulations and to promote safety at sea (Simmonds, 1994).
Since the 1950s, there has been an increase in the number of inter-
national organizations and various commissions which have the task of
improving safety at sea (Harvey, 2012). In this way, the age of organizations
began, the importance and influence of which are growing steadily up to the
present day (Boisson, 1999).
The history of marine safety is marked by various regulations and new
requirements or amendments of existing regulations adopted in response
to major ship accidents. A good example in this respect is the introduction
of new regulations and improved crew training programs brought as a result
of the aftermath of the terrible marine pollution accident of the Exxon
Valdez1 tanker in Alaska in 1989 (Eleftheria, Apostolos, & Markos, 2016;
Morris & Loughlin, 2013). It is found that the safety codes contributed in
the improvement of tanker operations after 1990 with drastic reduction
in the frequency of accidents (Eliopoulou & Papanikolaou, 2007).
Kopacz et al. (2001) has defined safety at sea as “such desirable conditions
of human activity at sea that do not endanger human life and property,
and are not harmful to the maritime environment.” It is composed of four
components namely technological and operational ships’ safety, safety of
navigation, safety of person in distress, and prevention of pollution of
environment from ships as shown in Fig. 1.
The MSS is the set of particular institutions, standards, and procedures
focused on, to ensure safety at sea including marine environment protection
from pollution from ship (Kopacz et al., 2001). The complex interactions of
various components of a MSS are depicted in Fig. 2. This shows that mar-
itime safety depends on the chain of various institutions (listed in Fig. 2),
Safety at sea
Technological Safety of Safety of Prevention of

and operational navigation persons in pollution of the
ships’ safety distress maritime
environment
from ships
Fig. 1 Four major components of safety at sea. Adapted from Kopacz, Z., Morgas, W., &
Urbanski, J. (2001). The maritime safety system, its main components and elements.
The Journal of Navigation, 54, 199–211.
ARTICLE IN PRESS
Cooperating international The International Maritime Conferences and International

organizations Maritime Organization (IMO) and its organs
Marine
environment
The International Maritime Conventions and other legal protection
from pollution
instruments appertaining to all domains of safety at sea
Institutions Maritime Global Prevention of

responsible Navigation Maritime Search and pollution of
enforcement of Safety Distress Rescue Maritime
the regulations System’s Safety System’s Environment
and requirement institutions System’s institutions from Ship’s
of safety at sea institution System’s
institutions
= Cooperating institutions
= Direct influence
= Indirect influence
= Cooperation and coordination
Fig. 2 The main components of the maritime safety system. Adapted from Kopacz, Z.,
Morgas, W., & Urban
ski, J. (2001). The maritime safety system, its main components and
elements. The Journal of Navigation, 54, 199–211.
organizations, ship owners and operators, and conventions and legal instru-
ments and their interconnected stakeholders. The legal instruments of
maritime safety are directly related to the fundamental domain of safety of
sea as given in Table 1.
Hauptmanns (1998) stated that safety is the outcome of an integration of
good technical design, qualified operation, and organization. This shows that
safety incorporates the effective technical standards of a vessel and its equip-
ment as specified by the international conventions and the Standards of
Training, Certification, and Watchkeeping (STCW) Convention (Yabuki,
2011), and adequate education and training to all workforce levels (Veiga, 2002).
Akten (2006) stated that “shipping is and always will be full of risks despite
high and ever increasing safety standards”. Celik, Lavasani, and Wang(2010)
stated that the system complexity and automation, human error, human-
centered system design, and potential design-based failures are different
perspectives for continued shipping accidents. There are still a high number
ARTICLE IN PRESS
Table 1 The Basic Domain of Safety at Sea

No. Substance of the Domain
1 Safety of navigation
2 Radio communication
3 Life-saving appliances and search and rescue (SAR)
4 Standards of seafarers’ training, certification, and watchkeeping
5 Ships’ design and equipment
6 Ships’ fire protection
7 Ships’ stability and load lines
8 Carriage of container goods and dangerous goods
9 Carriage of chemical bulk, liquids, and gases
10 Fishing vessel safety
11 Prevention of pollution of maritime environment from ships
Adapted from Kopacz, Z., Morgas, W., & Urba nski, J. (2001). The maritime safety
system, its main components and elements. The Journal of Navigation, 54, 199–211.
of shipping accidents reported in recently published statistical reports (Baltic

Sea Maritime Incidence Response Group (MIRG), 2017; Darbra & Casal,
2004; Eleftheria et al., 2016; Roberts, Marlow, & Jaremin, 2012).
Broadly, human error, technical and mechanical failure, and environmental
factors are common causes leading to shipping accidents but with different
percentages (Karahalios, 2015; Uğurlu, K€
ose, Yıldırım, & Y€uksekyıldız, 2015).
The Major Hazard Incident Data Service (MHIDAS) (2002) database, consid-
ered eight types of possible causes of maritime accident, namely mechanical
failure, impact failure, human error, instrumental failure, services failure,
violent reaction, external events, and upset process conditions.
In response to continued shipping accidents, international maritime
authorities and ship owners have made significant contributions to promote
and maintain safety at sea (Hetherington, Flin, & Mearns, 2006; O’Neil,
2003). According to a report prepared by Fields (2012) based on Lloyd’s
Register Casualty Statistics in the period 1910–2010, the global pattern of
ship losses has been declining as shown in Fig. 3. This shows that one ship
in every 100 was lost in 1910 and the rate reduced to around one loss in every
670 ships in 2010. A recent report prepared by Allianz Global Corporate and
Specialty (2017) also supports the decreasing trend of total shipping losses as
shown in Fig. 6. This increasing safety trend in the shipping industry was
ARTICLE IN PRESS
1 0.97%
0.8
0.69%
Rate of ship losses
0.6
0.47%
0.40%
0.4
0.2 0.15%
0
1910 1935 1960 1985 2010
Year
Fig. 3 Total ship loss percentage. Adapted from Fields, C. (2012). Safety and shipping
1912–2012: From Titanic to Costa Concordia.
achieved through a culmination of improved technologies and regulations,

cultural and training improvements, and new construction and design tech-
niques. On the other hand, the shipping industry is still facing emerging
challenges due to increasing vessel sizes and on-board people, complex
regulations, piracy in some regions, cost pressure, and new routes in harsh
environmental conditions.
Considering most accounts of safety regulation development, it is found
that major maritime accidents have been the source of lessons and catalysts
to improve or adopt new regulations. The major shipping accidents after 1980
and subsequent changes in maritime safety regulations are given in Table 2.
Additionally, major accidents have been key drivers for improvements in
maritime safety culture by increasingly adopting a proactive approach to
ship operation. Every lesson learnt from an accident may have come through
the tragic death of many people, adverse environmental impacts, and signif-
icant consequences. Improving and maintaining much safer shipping opera-
tions, by proactive approaches would be true/heartfelt homage to all those
who died in these tragic incidents.
2. BACKGROUND AND HISTORICAL PERSPECTIVE

OF OFFSHORE SAFETY
In the quest for oil and gas reserves, oil and gas industries expanded
their exploration and production activities to the US coastline and Outer
Continental Shelf (OCS) in the 1890s and the first oil wells were drilled from
ARTICLE IN PRESS
Table 2 Major Shipping Accidents and Subsequent Changes in Maritime Safety

Regulations Since 1980
Safety Regulations Year Accidents
SOLAS Ch VI 1980 MV Derbyshire—loss of life
International Grain Code 1987 Herald of Free Enterprise—loss of life
MARPOL Annex 1 1989 Exxon Valdez—oil spill
Double hull amendments 1990
1992
STCW 95 1994 MS Estonia—loss of life
MARPOL Protocol 1997
ISM Code 1 1998
SOLAS Ch XII
Bulk Code amendments 1999 Erika—oil spill
ISM Code II 2000
PAL Protocol 2001
FUND Protocol 2002 Prestige—oil spill
Creation of EMSA 2003
Erika I (EU)
SOLAS Ch VI 2004
Bulk Code revision
Erika II (EU) 2005
Erika III 2006 Star Princess—loss of life
STCW 95 Manilla amendments 2008
HNS Protocol 2009
International Maritime 2010
Solid Bulk Code 2011
SOLAS regulation III/19 2012 Costa Concordia—loss of life
2013
2015
Adapted from Butt, N., Johnson, D., Pike, K., Pryce-Roberts, N., & Vigar, N. (2013). 15 years of
shipping accidents: A review for WWF. Southampton Solent University, Southampton.
ARTICLE IN PRESS
wooden piers attached to the shore (National Academies of Sciences

Engineering, Medicine, 2016). By 1897, Henry L. Williams and his associ-
ates started to produce oil from the first offshore well built with a 300 ft pier
mounted on a standard cable tool rig in California’s prolific Summerland
oilfield and 22 companies followed this oil production constructing 14 more
piers (American Oil and Gas Historical Society (AOGHS), n.d.). Drilling
from piers became difficult and impossible in deepwater and moveable bar-
ges were built in the 1930s followed by the first free standing structure by
1938 in the Gulf of Mexico (GOM) (Pratt, Priest, & Castaneda, 1997). With
the gradual increase in the demand for oil and gas, these free standing struc-
tures were operated in deeper waters during and after World War II in the
GOM. For instance, the first well out of sight of shore was built 12 miles
from the coast of Louisiana (Priest, 2008a) and by 1949, 11 oil and gas fields
with 44 exploratory wells were placed in the GOM (Acha & Finch, 2005;
National Ocean Industries Association (NOIA), 2005).
In early offshore exploration, companies faced several operational chal-
lenges and safety issues such as complexities of deploying land-based tech-
nologies untested for offshore environments, handling of dangerous
equipment and flammable materials, heavy object lifting and fitting in high
winds and waves, and pressure to reduce operational cost by finishing jobs in
the shortest possible time (Priest, 2008a). The main reasons of these chal-
lenges were lack of regulation and standards, new hazards and workplace
complexities in a hostile environment. Additionally, before the introduction
of the Vibroseis pulsing system, the use of dynamite explosion to generate
sound necessary to determine geological structures in the seabed resulted
several problems, ranging from headaches, to deaths and injuries, specifically
when crews tried to accelerate operations (Priest, 2008b). It was identified that
safety was not always emphasized, specifically during deployment of untested
equipment or when pressure mounted to speed up operations (National
Academies of Sciences Engineering, Medicine, 2016). Though crews nor-
mally received some training regarding safe operating practices, they were
not inevitably trained for managing safety or to handle change safely because
safety programs were basic and simple (Donhaiser, 1954). Companies used
to learn safety from their own and others’ mishaps and accidents and worked
to improve technologies for drilling, blowout prevention, and production
(Priest, 2008b).
Owing to the lack of safety regulations, offshore activities were prone to
safety hazards which led to several accidents resulting in deaths, injuries, and
damage to assets and environment. A number of accidents occurred during
ARTICLE IN PRESS
the early phase of offshore production of oil and gas. For example, during
1955–57, 4 drilling vessels overturned, resulting in the loss of 13 lives and
when the Golden Meadow Drilling Company’s Mister K capsized in the
Mississippi River in April 1957, 9 people died (Priest, 2008b).
During the late 1940s and the mid-1950s, personnel transfer from crew
boats to platforms was acknowledged as one of the biggest safety issues. Exam-
ples of transferring methods were swinging-rope boarding method (Donhaiser,
1954; as cited in Priest, 2008b) and in another method, employees throw their
gear into a cargo net and hung on to the outside (Priest, 2008b). These methods
caused numerous accidents and health problems to personnel. By the mid-
1950s, the introduction of helicopters to transfer personnel contributed greater
economies of speed and safety (Pratt et al., 1997).
Until the late 1950s, safety practices remained mostly unchanged because
government regulations and concerns were minimal. However, in 1958–60
the US Geological Survey (USGS) issued two OCS orders, specifying pro-
cedures for drilling, plugging and abandoning wells, determining well pro-
duction rates, and installing subsurface safety devices (Priest, 2008b). In July
1959, the USGS issued an order for facility inspectors, to make a report of
the facility they had inspected specifying noted deficiencies and action taken.
This effort became occasional because most facilities were inspected only
annually or less frequently due to inadequate funding and staffing (Priest,
2008b). Several accidents could have occurred in offshore platforms during
this period which were not adequately reported or publicized due to anom-
alies in the reporting requirements for mishaps, incident, and accidents
(National Academies of Sciences Engineering, Medicine, 2016).
In the early phase of offshore operations, the integrity of design and
operational safety was mainly the responsibility of the owner and operators
who used to apply various industry and in-house standards (Visser, 2011).
Industrial structural design standards were first introduced following the
destruction of 23 platforms by Hurricanes Hilda and Betsy in 1964 and 1965
(Visser, 1992). According to Howe (1968) (as cited in Priest, 2008b), 30 major
rig mishaps and an equal number of minor accidents occurred out of roughly
150 working mobile units worldwide during 1950–68. Another remarkable
offshore disaster occurred on June 30, 1964 in the C.P. Baker Drilling Barge
resulting in the death of 21 people and injuring 22 due to fires and explosion
accident (Austin et al., 2008; Qi & Ershaghi, 2013). There was not much public
concern regarding offshore risks and accidents at that time. However, in
December 1967, the catastrophic loss of the Sea Gem jack-up drilling vessel
in the North Sea, killed 13 people and brought US government attention
ARTICLE IN PRESS
and interest to the safety of offshore units (Priest, 2008b). After the occurrence
of the Santa Barbara oil spill in 1969 (Foster, Charters, & Neushul, 1971), public
attention to the real and perceived hazards of offshore oil and gas production
largely increased. The Santa Barbara Channel incident spilled 50,000–70,000
barrels of oil which catalyzed the national environmental movement and set
in motion the adoption of the National Environmental Policy Act (NEPA)
(Smythe, 1997). More importantly, offshore operators, whose practices in the
past had rarely been scrutinized or challenged, suddenly started to face a poten-
tially bitter political and regulatory climate (Priest, 2008b). This is considered
as the big wake-up call for governments and the offshore oil and gas companies
and made them serious about safety. The Santa Barbara oil spill and the Sea
Gem jack-up drilling vessel loss were partly blamed on human error; however,
design flaws and equipment layouts, inadequate training and supervision were
also found to be equally contributing factors (Shappell & Wiegmann, 2001).
The trend of occurrence of offshore accidents did not stop even after
the big wake-up call. In 1970, Biewer and Wallin (1970) highlighted the
existence of inadequacy and inconsistency of standards in the design, construc-
tion, operation, and maintenance of offshore installations. The American
Bureau of Shipping (ABS) and Lloyd’s Register then produced schemes for
classifying offshore vessels. Industries were required to set up certification
criteria, standardize operating procedures, and introduce inspections by pro-
fessionals such as naval architects and marine engineers (Priest, 2008b).
In order to make oil and gas companies accountable of their operations,
they started to face legal challenges. In February 1970, Chevron’s Platform
C blew out and caught fire and the company was fined $1 million for failing
to maintain storm chokes and other required safety features (Priest, 2008b).
Similarly, the Shell Oil Company lost millions of dollars when a platform in
the Bay Marchand area suffered a major blowout killing 4 crews and injuring
37 people in December 1970 (Nelson, 1972). These increasing number
of accident lawsuits, increased media scrutiny, and public anger brought
crew and environmental safety to the forefront of discussion which in turn
compelled industry and governments to improve safety regulations, tech-
nologies, work practices, and designs (National Academies of Sciences
Engineering, Medicine, 2016).
The existing regulations were updated with stricter safety requirements
such as the new OCS orders which required installation of extra safety
features on platforms and pipelines and installation of subsurface safety
valves which were made mandatory for all producing wells for the first time
in 1973 (National Academies of Sciences Engineering, Medicine, 2016).
ARTICLE IN PRESS
In addition to this, new requirements related to process safety were enforced.

These included the testing of safety devices prior to and when in use, use
of defined processes for the control of drilling and casing operations, use
of preapproved plans, and revised practices and procedures for platform
installation and operation (National Academies of Sciences Engineering,
Medicine, 2016).
However, the immediate causes of accidents were found to be faulty
material, process failure, material–design failure, human factors, lack of effec-
tive safety management systems, and a working environment that failed to
maintain safe work practices and behaviors (National Academies of Sciences
Engineering, Medicine, 2016). Most companies focused more on personal
safety and safe use of equipment, rather than enhancing process safety, how-
ever, in the late 1960s some companies began adopting safety practices
such as use of shut-in valves and high-pressure sensors, and emergency shut-
down systems, meanwhile some started keeping records of lost-time accidents
and recordable incidents (National Academies of Sciences Engineering,
Medicine, 2016).
In the early 1970s, the industry began to collaborate with other
institutions such as the Offshore Operators Committee, the American
Petroleum Institute’s (API), Offshore Safety and Anti-Pollution Equip-
ment Committee. This resulted in a new set of API recommended prac-
tices for the selection, installation, and testing of various types of safety
devices (Arnold, Koszela, & Viles, 1989). Additionally, with the help of
API, consultants, academics and suppliers, offshore operators brought
changes in the existing training requirement programs for offshore crews,
which improved worker retention and contributed to the improvement of
offshore safety records (Pace & Turner, 1974).
Meanwhile, after the catastrophic accidents of 1969 and 1970, a series of
major researches by the National Research Council’s Marine Board and
USGS was launched, which resulted in more changes to the OCS regulatory
programs (National Academies of Sciences Engineering, Medicine, 2016).
In addition to these, other activities were focused on for bringing the
industry’s attention on safety. For instance, the US Coast Guard (USCG)
and USGS started enforcing new regulations in order to address issues
related to crew occupational safety. In 1972, Lloyd’s Register of Shipping
published its first Rules for the Construction and Classification of Mobile
Offshore Units and the ABS revised its Rules for Building and Classing
Offshore Mobile Drilling Units in 1973 (National Academies of Sciences
Engineering, Medicine, 2016). In 1985, the Congressional Office of Office
ARTICLE IN PRESS
of Technology Assessment (OTA) (1985) presented a report on Arctic

and deepwater drilling emphasizing the safety risks of operating in harsh envi-
ronments and remote locations. The report identified the need for new
approaches to deal with and adapt to the hazards of the Arctic and deepwater
environments. Moreover, the report pointed out existing weaknesses in reg-
ulations and safety performance evaluation and accident report data collection.
The offshore industry reviewed causes of major accidents and realized
that majority of the major accidents had been neither caused by technolog-
ical problems nor failure to comply with safety standards but by human error
resulting from ineffective training and supervision, rote reliance on regula-
tions, and unsafe working practices (Priest, 2008b). The main contributing
factor for human error was found to be resulted from stressful work in
adverse working conditions and the long shifts work schedule at offshore
locations. When people are tired and stressed, they often become inattentive
or irrational which may make them vulnerable to accidents and injury.
Other factors for human error were the growing turnover rate in the off-
shore labor market, the increasing use of contract personnel, and the emer-
gence of smaller and independent operators without adequate organizational
structure to manage safety (Priest, 2008b).
The use of contractors and subcontractors posed an additional safety
concern because it increased the number of players in a given location with
differing understandings and experiences of the elements of safety culture,
safety practices, and decision-making responsibilities (National Academies
of Sciences Engineering, Medicine, 2016). The industry and regulators started
to expand their perspectives, focusing on the management systems and safety
processes of installations. They focused on the interrelationships among the
elements of whole systems such as workers, supervisors, training, equipment,
safety procedures, and work rules with measures to monitor systems, track
progress, and provide early warning of potentially dangerous situations
(Priest, 2008b). Industry agreed to bring changes in safety with revised com-
mitment to better training, supervision, and overseeing at work places, less
reliance on simply regulatory compliances to obtain safe working conditions,
and more focus on improved operating practices and procedures. This in-
cluded assigning safety technicians to installations in the late 1970s which
contributed to reducing accidents involving personnel safety (National
Academies of Sciences Engineering, Medicine, 2016).
Despite all aforementioned efforts in safety management, offshore indus-
try, and concerned agencies were shocked by the Piper Alpha disaster
in 1988 which killed 167 people and which provoked soul-searching
ARTICLE IN PRESS
concern about offshore safety (Pate-Cornell MEL, 1993). The resulting

investigation conducted by Lord Cullen was highly critical of a number
of areas, including safety management within the company, living accom-
modation layout, safety case philosophy, temporary safe refuge, the platform
design, and work permit policy (Miller, 1991).
In order to tackle these emerging issues, the Minerals Management Service
(MMS) developed a “performance-based approach” to regulate safety that
emphasized corporate and human responsibility (Priest, 2008b). In 1991,
the Safety and Environment Management Program (SEMP) was developed to
promote public safety and environmental protection objectives by changing
the compliance mentality to a proactive approach that makes offshore safety
an integral part of corporate culture (Velez, Liles, & Satterlee, 1995).
To address accident underreporting and data inadequacies, the OCS Perfor-
mance Measures Program was developed to monitor the industry’s OCS wide
operating performance by summing the performance data reported by all oper-
ating companies to produce an annual safety and environmental performance
profile (National Academies of Sciences Engineering, Medicine, 2016). This
profile allowed a company to weigh its individual performance against
industry-wide performance and helped stakeholders to assess offshore perfor-
mance trends (Beittel & Atkins, 2000).
The expanding exploration of oil and gas continued to push the produc-
tion of oil and natural gas to deeper water and more remote locations in the
early 2000s. While moving to deepwater operations, industry continued
to face several new challenges such as the need for advanced equipment
and technologies that would help to survey at depths of up to 10,000 ft
and the need for higher strength materials for blowout preventers (BOPs)
(National Commission on the BP Deepwater Horizon Oil Spill, 2011).
In other offshore regions tragic accidents also occurred. For instances, in
1980, fatigue crack led to the collapse of the Alexander L. Kielland platform
which killed 123 people in the Norwegian Continental Shelf (NCS)
(Almar-Naess, Haagensen, Lian, Moan, & Simonsen, 1984). In 1989, the
Seacrest Drillship disaster occurred in the South China Sea killing 91 people
and severe weather condition was considered as the likely cause of that acci-
dent (Vinnem, 2014a). On July 27, 2005, the Mumbai High North disaster
killed 22 people due to fire that resulted from a gas leakage after collision
(Qi & Ershaghi, 2013). On October 23, 2007, the Usumacinta Jack-up
rig disaster occurred in the Gulf of Mexico after a collision with the
PEMEX-operated Kab-101 platform in the Bay of Campeche and claimed
22 lives (Vinnem, 2014a).
ARTICLE IN PRESS
Along the US coastline and OCS, no major accident was reported

from late 1980s to 2009. On April 20, 2010, a blowout occurred that led
to an explosion and fire on the BP Deepwater Horizon drilling rig killing
11 people and having an adverse environmental impact due to an oil
spill (Bratspies, 2011). The National Commission on the BP Deepwater
Horizon Oil Spill and Offshore Drilling released a report drawing several
conclusions about safety, of which the need for change in safety culture
was highly emphasized (National Commission on the BP Deepwater
Horizon Oil Spill, 2011). The report highlighted several important recom-
mendations regarding safety such as need of a sound and cohesive safety cul-
ture, need to change focus from regulatory compliance to adoption and
execution of a comprehensive safety system and the role regulatory agencies
need to play in achieving this objective.
After the BP Deepwater Horizon accident, there was shift in regulatory
application to offshore facilities (Maher, Long, Cromartie, Sutton, &
Steinhilber, 2016). For instance, the Bureau of Safety and Environmental
Enforcement (BSEE) revised the original workplace safety rule (SEMS rule)
as a way to improve the safety of offshore operations and this became effec-
tive on June 2013. As part of BSEE’s commitment to promote offshore
safety, in 2013, it released its final Safety Culture Policy Statement. The
Statement includes BSEE’s definition of safety culture which consists of nine
elements of a strong safety culture. The Policy Statement also describes
BSEE’s regulatory approach in order to lead the industries beyond checklist
inspection toward a systemic and comprehensive program for achieving
compliance (National Academies of Sciences Engineering, Medicine,
2016). In 2011, the Center for Offshore Safety (COS), an industry-
sponsored organization, was formed through API to focus solely on offshore
safety on the US OCS (Weaver, 2014).
Offshore accidents are persistently occurring in offshore facilities
(Moura, Beer, Patelli, Lewis, & Knoll, 2016; OPG, 2010). Some lessons
are learned after each accident and safety regulations and system safety
designs are upgraded (Kletz, 2001; Le Coze, 2013). Despite upgrading
designs, regulations, safety culture and management, operating and emer-
gency procedures, statistics of accidents demonstrate that the offshore oil
and gas industry is still vulnerable (U.S. Department of the Interior
Bureau of Safety and Environmental Enforcement (BSEE), 2016). An over-
view of key offshore milestones, accidents, and subsequent regulations gen-
erated for offshore safety is given in Fig. 4.
DOI assumes oversight Deepwater horizon tragedy
OCS Lands Act gives the US Department of the Interior The drilling rig deepwater horizon experiences
jurisdiction authority over lands extending to 200 nautical catastrophic explosion and fire, killing 11 workers,
miles offshore – oversight during the next three decades injuring scores more, and creating an 87-day spill that
was assigned to US Department of the Interior agencies resulted in over 4 million barrels of oil entering the
including USGS and Bureau of Land Management Gulf of Mexico
Moving offshore Production continues to rise

Kierr-McGee well is 1st Offshore production reaches to BSEE created on Oct. 1, 2011
ARTICLE IN PRESS
1st major BSEE is established with the
beyond sight of land 1.7 million barrel per day
offshore spill focused mission of ensuring
Santa Barbara Oil worker safety, environmental
Court spill results in the Federal
confirmation Lands act updated reorganization protection, and conservation of
passage of several OCS lands act of 1978 resources on the US OCS
2nd Supreme acts designed to begins
Court ruling amends and expands on the MMS dissolved
improve regulatory principles of the 1953 act
upholding authority offshore
federal
jurisdiction
1896 | 1947 | 1950 | 1953 | 1954 | 1969 | 1971 | 1978 | 1982 | 1988 | 2010 | 2011 | | 2016
Production spikes MMS established Modern safety
Offshore production is at Establishment of minerals culture era begins
1st well
133,000 barrels per day management service SEMS becomes
1st offshore oil well,
(MMS) to oversee offshore finalized
Summerfield, CA
States given control of nearshore waters operations
Passage of submerged land act gives states Deepwater reforms finalised
jurisdiction over offshore lands closer to shore Piper alpha disaster BSEE publishes final well control rule, which
Piper alpha disaster in North puts in place many of the reforms called for
Federal jurisdiction following the deepwater horizon tragedy
Sea claims 167 lives. Lack of
Supreme Court upholds
proper safety practices is
federal jurisdiction over OCS
blamed as the cause
Fig. 4 An overview of key milestones in offshore oil and gas industry (U.S. Department of the Interior Bureau of Safety and Environmental
Enforcement (BSEE), 2016).
ARTICLE IN PRESS
Fig. 5 Frequency of major accidents and major accident fatalities in the NCS. Adapted
from Vinnem, J.-E. (2014c). Offshore risk assessment, Vol. 2. Springer.
Some statistical reports show that number of accidents, injuries, asset

losses, and casualties are gradually decreasing every year. According to
Vinnem (2014c), the number of major accident fatalities per 100 million
working hours in the NCS had decreased gradually since 1989 as shown
in Fig. 5. Similar trend of safety improvement has been reflected by other
studies in other offshore regions. However, industries and regulatory bodies
are more concerned with safety management of high impact low-frequency
(HILF) accidents such as Piper Alpha disaster and BP deepwater horizon
explosion because such events occur very rarely and it may be difficult to
develop trend lines in the same manner (Sutton, 2013).
By going through the historical development of the safety concept in off-
shore industry, it is found that most early offshore regulatory programs
placed most importance on detailed operating procedures, layout and permit
approvals, and compliance inspections. However, over the past 3 decades
(after the release of Cullen’s report), the views of offshore safety regulators
and offshore industries have changed significantly. These include the super-
seding of prescriptive requirements by performance objectives and shifting
of the regulatory focus from compliance management to systematic safety
management. The Cullen Report (Cullen, 1990) recommended focus on
safety management systems which consist of setting up safety objectives,
the means of achieving those objectives, a system to meet the performance
standards, and the means to monitor the adherence to those standards. Cur-
rently, offshore regulatory bodies of Norway, Australia, the United
ARTICLE IN PRESS
Kingdom, New Zealand, and the Netherlands focus on operator safety man-
agement systems rather than prescriptive regulations compliance. In addition
to this, safety culture has become a key theme for regulators in those coun-
tries. The Petroleum Safety Authority (PSA) Norway became the first off-
shore regulator in 2002 to specify that industries must have a reliable health,
safety, and environment (HSE) culture (Hoivik, 2005; National Academies
of Sciences Engineering, Medicine, 2016). Most countries have adopted this
approach while maintaining their prescriptive regulations. Implementation
of regulations with robust safety culture has been becoming a critical priority
for safety management and loss prevention. Therefore, safety in offshore
operations has become a pivotal concern that needs to be achieved along
with costs, human resources, operations, technological progress, and, socio-
political and regulatory changes.
3. PAST MAJOR ACCIDENTS: MARINE AND OFFSHORE

Several accidents have occurred in the past in marine and offshore sec-
tors. Since the purpose of this section is to list past major accidents, it is
important to explore the concept of “major accident.” It does not have uni-
versally accepted definition (Okoh & Haugen, 2013). Key elements found in
its definitions by various organizations are given in Table 3. The categori-
zation of accidents into minor or major may be not straightforward because
of varied subjective analysis associated with definition. For instances, the
PSA Norway (Petroleum Safety Authority (PSA), 2017) defined major acci-
dent as “an acute incident, such as a major discharge/emission or a fire/
explosion, which immediately or subsequently causes several serious injuries
and/or loss of human life, serious harm to the environment and/or loss of
substantial material assets.” In the SEVESO Directive I, major accident is
defined as “an occurrence such as a major emission, fire or explosion
resulting from uncontrolled developments in the course of an industrial
activity, leading to a serious danger to man, immediate or delayed, inside
or outside the establishment, and/or to the environment, and involving
one or more dangerous substances” (European Council, 1982). The
SEVESO II Directive (European Council, 1997), strengthened the defini-
tion with what constitutes a major accident based on precise quantitative
threshold criteria and lowered an overall criteria for notification. OPG
International Association of Oil and Gas Producers (2008) defined it as
“an unplanned event with escalation potential for multiple fatalities and/
or serious damage, possibly beyond the asset itself. Typically these are
Table 3 Elements of Major Accidents Definitions
Mode or
Magnitude Timing of Impact
Authority of Event Event Types Impact Impact Location
Seveso/COMAH, EU/UK Adverse Major emission, fire, or explosion Serious danger to human health or Immediate Inside or
(European Council, 1997; occurrence the environment or delayed outside
MacDonald & Varney, 1999)
PSA, Norway (Petroleum Acute Major discharge/emission or a Several serious injuries and/or loss of Immediate
Safety Authority (PSA), 2017) incident fire/explosion human life, serious harm to the or delayed
environment, and/or loss of
ARTICLE IN PRESS
substantial material assets
HSE, UK (HSE, 1992) Fire, explosion, dangerous release, (a) Death or serious personal injury to Vicinity of
loss of structural integrity and persons in the vicinity of the installation
helicopter, diving and other installation, (b) major damage to the
work-related events structure of the installation,
(c) collision of a helicopter with the
installation, (d) critical failure of
diving operations in connection to
the installation, and (e) death or
serious personal injuries to five or
more persons in the vicinity of the
installation arising from other events,
excluding hazards such as slips, trips,
and falls
NOPSA, Australia (Australia An event connected with a facility, Potential to cause multiple fatalities of At or near
Government Federal Register including a natural event persons the facility
of Legislation, 2010)
OSHA/USEPA, USA Major chemical accident or release At least one of the following: (1) Immediate On-site or
(Environmental Protection results in one or more human fatality, or delayed off-site
Agency-Occupational Safety (2) results in the hospitalization of
and Health Administration & three or more workers or members of
ARTICLE IN PRESS
Environmental Protection the public, (3) causes property
Agency, 1996) damage (on- and/or off-site) initially
estimated at $500,000 or more in
total, (4) presents a serious threat to
worker health or safety, public health,
property, or the environment, (5) has
significant off-site consequences, such
as large-scale evacuations or
protection in place actions, closing of
major transportation routes,
substantial environmental
contamination, or substantial effects
(e.g., injury and death) on wildlife or
domesticated animals, or (6) is an
event of significant public concern
OGP (OPG International Unplanned Hazardous releases and major Escalation potential for multiple Possibly
Association of Oil and Gas event structural failure or loss of stability fatalities and/or serious damage beyond the
Producers, 2008) that could put the whole asset at risk asset itself
ARTICLE IN PRESS
hazardous releases, but also include major structural failure or loss of stability
that could put the whole asset at risk.”
Consequence is the main aspect of any accidents which make it “major.”
Consequences resulting from a major accident are often associated with
injuries, deaths, environmental impacts, and asset damage and loss. In order
to be a major accident some definitions require an actual consequence to
have occurred (“Death or serious injury,” “One or more human fatalities”).
However, in some cases, a potential for a serious consequence (“Serious
danger to human health,” “Escalation potential for multiple fatalities”) is suf-
ficient to be a major accident. No one can be certain that the cause of an
event with actual consequence is the same as event with potential conse-
quence. Considering these key components of major accident definitions
and incorporating actual consequence, past accidents are listed based on
publicly available information.
3.1 Major Marine Accidents

Since the advent of maritime operations, several accidents have occurred
resulting in very minor to major consequences. Advancements and progress
in maritime safety operations are usually marked by major accidents such as
the Titanic and Costa Concordia disasters, however, many other accidents
occurred in the past which are of equal importance for safety management
systems and lessons learned. It is found that development of safety regulations
and the safety systems are mainly influenced by lessons learned from past
incidents. The past major marine accidents, event type, main cause, and con-
sequences are given in Table 4. An accident often has several contributory
causes such as the direct and indirect or underlying causes. Some factors
directly cause the incident to take place while other factors do not directly
cause the occurrence of the incident but contribute to the incident. Owing
to this, marine accidents listed in Table 4 are categorized into different
groups based on event type and this indicates that more than 50% of the listed
accidents are considered to result from foundering. The Institute of Shipping
Economics and Logistics (ISL) (Arendt, Haasis, & Lemper, 2010) defined
foundering as “sinking due to rough weather, leaks, breaking in two,
etc., but not due to other categories such as collision [and so on].”
3.2 Major Offshore Accidents

In search of new opportunities for oil and gas production, companies
expanded their capabilities to offshore regions with simple drilling
ARTICLE IN PRESS
Table 4 Major Marine Accidents

Year Name of Vessel Event Type Consequences
2015 Pura Vida Princess Foundering 3 deaths (Pittman III et al., 2016)
2014 Shoko Maru Explosion 1 death, 4 injuries (Jones, 2015)
2013 Carnival Triumph Fire 3143 people adrift (Mileski,
Wang, & Beacham, 2014)
2012 Costa Concordia Wrecked/ 32 deaths (Dickerson, 2013)
stranded
2012 MSC Flaminia Explosion and 1 death, 2 injuries (BSU, 2014)
fire
2012 Alliance Norfolk Fire 3 minor injuries, damage cost $1.3
million (NTSB, 2013)
2010 MV Hong Wei Foundering 10 deaths (Roberts, Pettit, &
Marlow, 2013)
2010 Enisey Explosion 10 death, several injuries
(International Maritime Rescue
Federation, 2016)
2010 Charlotte Maersk Fire About 160 containers were damaged
(DMAIB, 2012)
2010 Carnival Splendor Fire 3300 passengers stranded at sea for
72 h (Cramer, DeLamos, Divel, &
O’Rourke, 2011)
2010 Eagle Otome Collision Spilled 450,000 gallons of oil
(National transportation Safety
Board (NTSB), 2011)
2010 MV Nasco Diamond Foundering 22 deaths (Roberts et al., 2013)
2010 MV Jian Fu Star Foundering 13 deaths (Roberts et al., 2013)
2009 MV Chang Ying Foundering 22 deaths (Roberts et al., 2013)
2008 Friendship gas Explosion 8 fatalities and 4 injuries (Burgherr,
Eckle, Hirschberg, & Cazzoli, 2011)
2007 Bourbon Dolphin Foundering 8 deaths (Chen, 2013)
2007 MV Orchid Sun Foundering 12 deaths (Roberts et al., 2013)
2007 Hebei Spirit Collision Spilled 10,900 tons oil (Yim, Kim,
Ha, Kim, & Shim, 2012)
2007 Zim Haifa Fire/explosion Over 100 containers damaged (Ellis,
2010; Stuart, 2007)
Continued
ARTICLE IN PRESS
Table 4 Major Marine Accidents—cont’d

2007 Cosco Busan Collision Spilled 54,000 gallons oil (Incardona
et al., 2012)
2006 Star Princess Fire 1 dead, 13 injuries (Marine Accident
Investigation, 2006)
2006 Kometik Fire 1 death, 1 injury (Critch, Loucks-
Atkinson, Parsons, & MacKinnon,
2010; TSB, 2008)
2006 Solar 1 Foundering Spilled of 500,000 L oil (Yender,
Stanzel, & Lloyd, 2008)
2006 Hyundai Fortune Fire and 1 injury, constructive total loss
explosion (Ellis, 2011; Sam, 2012)
2004 Bow Mariner Fire and 21 casualties, (US Coast Guard,
explosion 2004)
2004 Ythan Explosion 6 casualties, total loss of the vessel
(Foster, 2007)
2003 Sea Elegance Fire and 1 fatality, extensive vessel (Ellis,
explosion 2010; South African Maritime Safety
Authority, 2004)
2002 Hanjin Pennsylvania Fire and 2 casualties (Ellis, 2011)
explosion
2002 Prestige Hull breach Spilled 77,000 tons oil (Albaiges
et al., 2015)
2001 Windoc Fire Constructive total loss (TSB, 2002)
2001 Christoper Foundering 27 deaths (Roberts et al., 2013)
2001 Kamikawa Foundering 10 deaths (Roberts et al., 2013)
2001 Nego Kim Explosion 5 casualties, 3 missing (ATSB, 2002)
2000 Thor Emilie Explosion 6 casualties (Foster, 2007)
2000 MV Leader L Foundering 18 deaths (Roberts et al., 2013)
2000 MV Christopher Foundering 27 deaths (Roberts et al., 2012)
1999 CMA Djakarta Fire and Total loss (Purnell, 2009)
explosion
1999 Mighty Servant 2 Wrecked/ 5 deaths (Crichton, Lauche, & Flin,
stranded 2008)
ARTICLE IN PRESS

1999 Erika Foundering Spilled 8000 tons oil (Talley, Jin, &
Kite-Powell, 2001)
1998 MV Flare Foundering 21 deaths (Roberts et al., 2012)
1998 Champion Trader Explosion Palm oil spill (Bucas & Saliot, 2002)
1998 Sea-Land Mariner Fire and 2 casualties, 2 injuries (Maritime
explosion Administrator, 1999)
1998 MV Golden Harvest Foundering 24 deaths (Roberts et al., 2012)
1998 DG Harmony Fire US$ 16 m (Tamburello, 2011)
1998 Aconagua Explosion and Estimated damage loss between $15
fire and 18 m (Tamburello, 2011)
1997 Ming Mercy Fire 1 injury, major damage to bridge
deck (Marine Incident Investigation
Unit, 1998)
1997 Petrolab Explosion and 2 deaths, 7 injuries (Childs &
fire Sipkema, 2006; TSB, 1999)
1997 MV Albion Two Foundering 25 deaths (Roberts et al., 2012)
1997 Contship France Explosion Severe damage to hull and cargo
(Ren, 2009)
1997 MV Leros Strength Foundering 20 deaths (Roberts et al., 2012)
1996 MV Anna Spiratou Collision 26 deaths (Roberts et al., 2012)
1996 Lolcos Victory Foundering 5 deaths (Roberts et al., 2013)
1996 MV Sea Empress Wrecked/ Spilled 72,000 tons oil (Harris, 1997)
stranded
1996 MV Seafaith Foundering 19 deaths (Roberts et al., 2013)
1995 MV AlKashem Foundering 24 deaths (Roberts et al., 2012)
1995 MV Paris Foundering 27 deaths (Roberts et al., 2012)
1995 MV You Xiu Foundering 27 deaths (Roberts et al., 2012)
1995 MV Link Star Foundering 23 deaths (Roberts et al., 2012)
1994 Apollo Sea Foundering 36 deaths (Roberts et al., 2013)
1994 MV Christinaki Foundering 27 deaths (Roberts et al., 2012)
1994 MV Marika Foundering 36 deaths (Roberts et al., 2013)
Continued
ARTICLE IN PRESS

1994 Shipbroker Fire 25 deaths (Birpınar, Talu, &
G€onençgil, 2008; Roberts et al.,
2012)
1994 Stolidi—Oil tanker Explosion and 20 deaths (Roberts et al., 2012)
fire
1994 OMI Charger Explosion and 2 deaths (NTSB, 1995a)
fire
1994 Seal Island Fire 3 deaths, 6 injuries (NTSB, 1995b)
1994 MS Estonia Foundering 852 deaths (Shahriari & Aydin, 2017)
1994 MV Iron Antonis Foundering 24 deaths (Roberts et al., 2013)
1993 MV Braer Wrecked/ Spilled 85,000 tons of oil (George,
stranded Wright, & Conroy, 1995)
1993 MV Nagos Foundering 17 deaths (Roberts et al., 2013)
1993 MV Xian Ren Foundering 29 deaths (Roberts et al., 2012)
1993 Kapitan Sakharov Explosion 2 casualties (Foster, 2007)
1993 MV Anderson Foundering 24 deaths (Roberts et al., 2012)
1992 MV Daeyang Honey Foundering 28 deaths (Roberts et al., 2013)
1991 MV Blue River Foundering 28 deaths (Roberts et al., 2012)
1991 MV Protektor Foundering 33 deaths (Roberts et al., 2013)
1991 Haven Explosion and 6 casualties (Turbini, Fresi, &
fire Bambacigno, 1993)
1991 MV Melete Foundering 25 deaths (Roberts et al., 2013)
1991 MV Continental Foundering 38 deaths (Roberts et al., 2013)
Lotus
1991 Minerald Diamond Foundering 26 deaths (Roberts et al., 2013)
1990 Surf City Explosion 1 death, $31.53 million loss
(NTSB, 1992)
1990 MV Pasithea Foundering 31 deaths (Roberts et al., 2013)
1990 MV Alexandre P Foundering 25 deaths (Roberts et al., 2013)
1990 MV Charlie Foundering 27 deaths (Roberts et al., 2012)
1990 Jupiter Fire and 1 death, several injuries (NTSB,
explosion 1991)
ARTICLE IN PRESS

1990 MV Algarrobo Foundering 32 deaths (Roberts et al., 2013)
1989 MV Capitaine Foundering 23 deaths (Roberts et al., 2012)
Torres
1989 Exxon Valdez1 Wrecked/ Spilled 37,000 tons oil (Morris &
stranded Loughlin, 2013)
1989 MV Kronos Foundering 20 deaths (Roberts et al., 2012)
1989 MV Rahim3 Foundering 20 deaths (Roberts et al., 2012)
1988 MV Anthenian Explosion and 29 deaths (Roberts et al., 2012)
Venture fire
1988 Korean Star Wrecked/ Constructive total loss (Lipscombe,
stranded 2000)
1987 MV Testarossa Foundering 30 deaths (Roberts et al., 2013)
1987 MV Cathay Seatrade Foundering 27 deaths (Roberts et al., 2013)
1987 Herald of Free Foundering 188 deaths (Vandevelde, 2006)
Enterprise
1987 MV Topkapi-S Foundering 16 deaths (Roberts et al., 2013)
1985 MV Arctic Career Foundering 27 deaths (Roberts et al., 2013)
1981 MV Deifovos Foundering 9 deaths (Roberts et al., 2013)
1981 MV Marinha Di Foundering 30 deaths (Roberts et al., 2013)
Equa
1980 MV Hae Dang Wha Foundering 29 deaths (Roberts et al., 2013)
1980 Derbyshire Foundering 44 deaths (Roberts et al., 2013)
1979 MV Milli Foundering 24 deaths (Roberts et al., 2012)
1979 MV Master Michael Explosion 31 deaths (Roberts et al., 2012)
1978 Amoco Cadiz Wrecked/ Spilled 250,000 tons of oil (Teal &
stranded Howarth, 1984)
1977 Tanker Tsesis Wrecked/ Spilled 1100 tons oil (Teal &
1977 MV Eurobulker Foundering 29 deaths (Roberts et al., 2012)
1976 Argo Merchant Wrecked/ Spilled 28,000 tons oil (Teal &
Continued
ARTICLE IN PRESS

1972 SS Royston Grange Fire and 64 deaths (Roberts et al., 2012)
explosion
1971 SS Fatshan Collision 83 deaths (Roberts et al., 2012)
1970 Tanker Arrow Wrecked/ Spilled 15,000 tons oil (Teal &
1969 Florida Wrecked/ Spilled 630 tons oil (Teal &
1967 SS Torrey Canyon Wrecked/ Spilled 50,000–100,000 tons oil
stranded (Utton, 1967)
operations at the beginning of the latest Floating Liquefied Natural Gas

(FLNG) processing facility at the current phase. Technological advance-
ments and new regulations have helped offshore operations extensively,
but as the industry continues to expand, new risks continue to appear. From
the beginning, offshore operations are susceptible to various types of inci-
dents which have resulted in catastrophic events such as Piper Alpha disaster
and BP Deepwater Horizon explosion. For understanding safety, past major
accidents reported in the oil and gas industries are key sources of information
(Chandrasekaran, 2016). Thus, some major accidents that have occurred in
offshore oil and gas industries are given in Table 5 including their direct
cause and consequence. This shows that the majority of the accidents is cau-
sed by failure of BOP leading to different events such as fires/explosions, oil
releases, and sinking of the facility.
4. DATA AVAILABILITY FROM PAST ACCIDENTS

Experimentation and past accident analysis (PAA) are the two main
sources on which the efficacy of process safety researches and developments
stand today (Abdolhamidzadeh, Abbasi, Rashtchian, & Abbasi, 2011).
Reproducible experiments lay the base for developing, testing, and refining
theoretical frameworks, but have very limited scope for accident forecasting
and prevention (Tauseef, Abbasi, & Abbasi, 2011). Owing to this limitation,
PAA plays a significant role by helping to identify not only what went wrong
but in identifying evolving hazards and knowledge gap and to model
ARTICLE IN PRESS
foreseeable accident scenario for accident prevention. By careful recon-

struction of past accidents and incidents, and identifying their causes, the
sequence of events, and their consequences provide a valuable hindsight
for developing accident prevention strategies (Khan & Abbasi, 1999). In
order to perform this effectively and appropriately, data or information of
the particular accident is necessary. Learning lessons from past accidents
are crucial for prevention of future accidents. The information obtained
from past accidents helps to identify potential hazards, human factor issues,
and likely failure modes they may not have recognized. Particularly, it may
allow organizations to question whether their own safety system would
have avoided the incident or mitigated its consequences. Therefore, knowl-
edge of past accidents is a vital input to risk assessment with respect to hazard
identification (HI), consequence evaluations, decision making, and identi-
fication of vulnerable areas in their facility.
There have been claims that several maritime accidents go unreported
(Devanney, 2008). According to the findings of Thomas and Skjong
(2009), only about 30% of fire and explosion accidents that occurred in
chemical tankers were reported to Lloyd’s Register Fairplay (LRF). Another
study found that upper bound reporting performance, representing the
maximum possible database coverage, were 30% for LRF and 41% for the
Norwegian Maritime Directorate (NMD) (Psarros, Skjong, & Eide, 2010).
A study conducted by Hassel, Asbjørnslett, and Hole (2011) found that
on average the number of unreported accidents makes up roughly 50%
of all occurring accidents based on comparison of casualty records during
January 1, 2005–December 31, 2009. The study argued that even in a best
case scenario, only a few flag states’ accident reporting came close to 94%.
There may be a variety of causes for this issue such as mistake, deliberate
suppressing of information, unawareness of local reporting procedures, or
company policy. According to Asbjørnslett, Hassel, and Hole (2010), some
maritime casualty databases are not optimal and inadequate. In such cases,
researchers and stakeholders often simply accept available statistics as facts
and are not concerned with possible inaccuracies or inadequacy of datasets.
Statistics driven policies and safety management systems will have an adverse
impact due to the inaccurate and inadequate reporting systems because the
choice of risk analysis methods often depends on data availability and quality
(Wang & Foinikis, 2001). Thus, inaccurate and underreporting of past acci-
dents pose a significant issue to not only maritime authorities who try to
improve safety through regulations but also to companies and other entities
who use the statistics in risk and accident analysis (Hassel et al., 2011).
ARTICLE IN PRESS
Table 5 Some Major Accidents Occurred in Offshore Oil and Gas Industries
Type of Cause of
Year Name of Facility Accident Accident Consequences
1956 Qatar I, Arabian Sinking Human error 20 deaths (Ismail et al.,
Gulf 2014)
1964 C.P. Baker Fire and Blowout 21 deaths and 22 injuries
Drilling Barge explosion preventer (Austin et al., 2008; Qi &
(BOP) failure Ershaghi, 2013)
1965 Sea Gem JU, UK Sinking Fatigue failure 13 deaths (Ismail et al.,
Continental Shelf 2014)
1966 Ubit Platform, Fire Explosion 18 deaths (Oil Rig
Nigeria Disasters, n.d.)
1968 Little Bob, US Fire BOP failure 7 deaths (Ismail et al., 2014)
1969 Santa Barbara oil Spill BOP failure Spilled 50,000–70,000
spill barrels of oil (Foster et al.,
1971)
1970 Bay Marchand Blowout Human error 4 deaths and 37 injuries
fire (Nelson, 1972)
1970 South Timbalier, Sinking BOP failure 4 deaths, total loss (Ismail
GOM et al., 2014)
1970 Chevron’s Fire BOP failure Spilled 20,000 barrels of oil
Platform (Murray, 1975)
MP-41C
1974 Gemini JU, West Sinking Fatigue failure 18 deaths (Ismail et al.,
Africa 2014)
1976 Deep Sea Driller, Sinking Severe 6 deaths (Oil Rig
NCS weather Disasters, n.d.)
1976 Ocean Express Sinking Severe 13 deaths (Ismail et al.,
JU, GOM weather 2014)
1977 Ekofisk Bravo Fire BOP failure 20,000 m3 oil spilled
(Vinnem, 2014a)
1979 Ranger I JU, Sinking Fatigue failure 8 deaths (Ismail et al., 2014)
GOM
1979 Bohai 2 Jack-Up Sinking Human error 72 deaths (Qi & Ershaghi,
Accident, Bohai 2013)
Bay, China
ARTICLE IN PRESS
Table 5 Some Major Accidents Occurred in Offshore Oil and Gas Industries—cont’d
Type of Cause of
1979 IXTOC I, Gulf Fire and oil BOP failure Spilled 3 million barrels oil
of Mexico spill (Myer, 1984)
1980 Alexander L. Sinking Fatigue failure 123 deaths (Almar-Naess
Kielland et al., 1984)
Accident
1980 Funiwa-5 Spill BOP failure Spilled 400,000 barrels oil
(Texaco) oil well (Aghalino & Eyinla, 2009)
blowout
1980 Bohai 3 Jack-Up Fire BOP failure 70 deaths (Ismail et al.,
Accident, China 2014)
1980 Hasbah platform Spill BOP failure 19 deaths, spilled 100,000
well 6, Persian barrels oil (Oil Rig
Gulf Disasters, n.d.)
1980 Ron Tappmeyer, Toxic gas BOP failure 19 deaths (Ismail et al.,
JU, Saudi Arabia release 2014)
1982 Ocean Ranger Sinking Severe 84 deaths (Heising &
Hibernia Field, weather Grenzebach, 1989)
North Atlantic
1983 Nowruz Fire Collision 20 deaths (Ismail et al.,
Platform, Persian 2014)
Gulf
1983 Glomar Java Sea Sinking Fatigue failure 81 deaths (National
Drillship Transportation Safety
Accident Board. (NTSB), 1984)
1983 Byford Dolphin Explosion Human error 5 deaths, 1 injury (Sherman,
diving accident, 2009)
Norwegian CS
1983 60 years of Sinking Fatigue failure 5 deaths (Oil Rig
Azerbaijan Disasters, n.d.)
1984 Enchova Field, Explosion Human error 42 deaths (Dhillon, 2010)
Brazil and fire
1988 Ocean Odyssey Fire BOP failure 1 death, major damage to
Burning vessel (Ireland, 1991)
Blowout, UK
Continued
ARTICLE IN PRESS
Type of Cause of
1988 Piper Alpha, Explosion Human error 167 deaths (Pate-Cornell
Block 15, UK and fire MEL, 1993)
Continental Shelf
1988 Viking Explorer Explosion BOP failure 4 deaths (Ismail et al., 2014)
drillship, Borneo and
sinking
1989 Seacrest Drillship Sinking Severe 91 deaths (Vinnem, 2014a)
accident, South weather
China Sea
1989 Al Baz, Nigeria Sinking BOP failure 5 deaths (Ismail et al., 2014)
1989 Sedco 252 JU, Fire BOP failure 3 deaths (Ismail et al., 2014)
Indian Coast
1991 DB29 Barge, Sinking Severe 22 deaths (Cheng et al.,
South China Sea weather 2013)
1991 Sleipner A Sinking Implosion/ Total loss (Ismail et al.,
collision 2014)
1998 Ocean energy C, Falling Human error 2 deaths (Chadwell,
GOM object Blundon, Anderson, &
Cacho, 2000)
1998 Sundowner Falling Human error 1 death, 3 injuries
XV/D, South object (Chadwell et al., 2000)
Marsh Island
1998 Ocean energy, Falling Human error 3 deaths, 11 injuries
Rig B, GOM object (Chadwell et al., 2000)
1998 Mobil’s Qua Spill Fatigue failure Spilled 40,000 barrels oil
Iboe, Nigeria (Aghalino & Eyinla, 2009)
1998 Union Pacific Fire Human error 1 death, 2 injuries
Resources (Chadwell et al., 2000)
Company Rig 3,
GOM
2000 Al Mariyah, Sinking Fatigue failure 4 deaths (Ismail et al., 2014)
Persian Gulf
2001 Ensco 51, Eugene Explosion Human error The substructure and
Island, GOM derrick were completely
destroyed (Officer of the
Watch, 2013)
ARTICLE IN PRESS
Type of Cause of
2001 Petrobas’ P-36 oil Explosion Fatigue failure 11 deaths (Videiro,
platform, Rio de Cyranka, Nunes, & Melo,
Janeiro, Brazil 2002)
2002 Arabdrill 19, Sinking BOP failure 3 deaths (Hunt & Marsh,
Persian Gulf 2004; Ismail et al., 2014)
2005 BHN Platform— Explosion Collision 22 deaths (Qi & Ershaghi,
Mumbai High and fire 2013)
North disaster
2007 Usumacinta Jack- Fire Collision 22 deaths (Vinnem, 2014a)
up accident,
GOM
2009 Montara oil spill, Spill BOP failure Oil spilled for 75 days
Seadrill’s West (Hayes, 2012)
Atlas rig
2010 Deepwater Explosion/ BOP failure 11 deaths, 16 injuries
horizon fire and (National Commission on
explosion spill the BP Deepwater Horizon
Oil Spill, 2011).
2012 K.S. Endeavor Fire BOP failure 2 deaths (Abowei & Ezekiel,
(Panama) Rig 2013)
2012 Elgin G4 Well, Spill Fatigue failure Major fluids leakage (Dale
North Sea of casing due et al., 2013)
to corrosion
2012 West Delta Block Fire and Human error 3 deaths, several injuries
32 Platform E, explosion (U.S. Department of the
Black Elk, GOM Interior Bureau of Safety
and Environmental
Enforcement (BSEE), 2013)
2015 Cidade de São Explosion Human error 9 deaths, 21 injuries
Mateus (FPSO (Brazilian National Agency
CDSM), Brazil of Petroleum, 2015)
2015 Abkatun Alfa Fire Blowout 4 deaths, 16 injuries
platform, GOM failure (Fattakhova & Barakhnina,
2015)
ARTICLE IN PRESS
In order to avoid and mitigate inaccurate and underreporting issues,

there have been some efforts launched by governments and relevant agen-
cies. The European Union Offshore Safety Directive and its Implementing
Regulation 1112/2014 (European Commission (EC), 2014) requires infor-
mation to be shared by the capable authority and operators or owner on
10 categories of accident events within the EU offshore industry. Instances
of such information are: unintended release of hydrocarbons, loss of well
control or failure of a well barrier, failure of a safety critical element, any fatal
accident, any serious injuries to five or more people in the same accident,
any major accident to the environment and significant loss of structural
integrity, or loss of protection against the effects of fire.
Past accident data on the subject of most accidents can be obtained from
their investigation reports and databases. Records of past accidents are found
in different databases operated and maintained by different organizations and
companies. The names of the databases widely available for maritime and
offshore accidents are listed below:
1. World Offshore Accident Database (WOAD)-DNV GL
2. Pondicherry University Process-Industry Accident Database (PUPAD)
3. Major Hazard Incident Data Service (MHIDAS)
4. Major Accident Reporting System (MARS)
5. Analysis, Research and Information on Accidents (ARIA) database
6. Failure and Accidents Technical Information Systems (FACTS) chem-
ical accident database
7. Awareness and Preparedness for Emergencies at Local Level (APELL)
database
8. Control of Major Accident Hazards (COMAH) database
9. Chemical Safety Board (CSB) database
10. HSE Hydrocarbon releases database, UK
11. International Association of Oil and Gas Producers (IOGP) database
(Fatal incident report)
12. Relational Information System for Chemical Accidents Database
(RISCAD)
13. Science and Technology Failure Knowledge Database
14. SINTEF Offshore Blowout Database
15. Accident statistics for fixed offshore units on the UK Continental Shelf
(UK HSE report)
16. Accident statistics for mobile offshore units on the UK Continental
Shelf (UK HSE report)
17. Ship/Platform Collision Incident Database (UK HSE report)
ARTICLE IN PRESS
18. NEDIES—Natural and Environmental Disaster Information Exchange

System (operated by the Joint Research Centre, Natural Risk Sector)
19. Process Safety Incident Database (PSID) (Operated by the Centre for
Chemical Process Safety (CCPS))
20. Reporting of Injuries, Diseases and Dangerous Occurrences Regula-
tions (RIDDOR)
21. Hazmat Incident Report Search Tool—Pipeline and Hazardous Mate-
rials Safety Administration (PHMSA)
Beside these databases, accident investigation reports, accident statistics, case
studies, and in-depth analysis regarding accident are found in the websites of
different regulatory bodies and agencies such as
1. United States Coast Guard National Response Center (NRC)
2. Mariners’ Alerting and Reporting Scheme (MARS), The Nautical
Institute
3. European Maritime Safety Agency (EMSA)
4. Marine Accident Investigation Branch (MAIB)
5. Marine Casualty Investigation Board (MCIB)
6. Danish Maritime Investigation Board (DMIB)
7. Federal Bureau of Maritime Casualty Investigation, Germany
8. Transportation Safety Board of Canada
9. Beamer France
10. Bob Couttie’s Maritime Accident Casebook
11. Australian Transport Safety Bureau (ATSB)
12. Hellenic Bureau for Marine Casualties Investigation (HBMCI)
13. Marine Casualty Investigation Branch of Panama Maritime Authority
14. Norwegian Accident Investigation Board (AIBN)
15. Japan Transport Safety Board (JTSB)
16. Dutch Transport Safety Board, the Netherlands
17. Swedish Accident Investigation Board (SHK), Sweden
18. Global Integrated Shipping Information System (GISIS), IMO
19. Fire and Blast Information Group (FABIG)
20. Allianz Global Corporate and Specialty
21. International Union of Marine Insurance
22. Information Handling Services (IHS) Fairplay Sea-WebTM (Lloyd’s
Register of Ships Online)
The European Commission Joint Research Centre (JRC) Scientific and
Policy Report (Christou & Konstantinidou, 2012) recognized that
occupational-related accidents are mainly reported based on national legis-
lative requirements focusing on accidents resulting in fatalities, injuries, or
ARTICLE IN PRESS
serious damage of the installation. However, near-misses are not a priority to

report as this may not be always a legal requirement. Additionally, the report
revealed that accident descriptions are not made accessible to public in most
of the EU member states.
The reporting format and storing of accident databases are not uniform.
This also contributes to the underreporting problem. In order to set up com-
mon formatting for the reporting of accidents, incidents, and mishaps among
different countries, international associations such as International Regula-
tors’ Forum (IRF) and NSOAF have introduced such projects (Christou &
Konstantinidou, 2012). The IRF is a group of 10 countries’ regulators of
health and safety in the offshore upstream oil and gas industry which had
set up the Performance Measurement Project aiming to measure and com-
pare offshore safety performance among IRF participants. It is formed with
an objective to improve health and safety through coordination on joint
programs and information sharing. Data include fatalities, injuries, gas
releases, collisions, fires, and losses of well control. Data are provided from
the members of the Forum which are:
1. The National Offshore Petroleum Safety and Environmental Manage-
ment Authority (NOPSEMA), Australia
2. The Petroleum Safety Authority (PSA), Norway
3. The Bureau of Safety and Environmental Enforcement (BSEE), USA
4. The Danish Energy Agency (DEA), Denmark
5. The National Hydrocarbons Commission (CNH), Mexico
6. The New Zealand Department of Labor (DOL), New Zealand
7. The Canada-Newfoundland and Labrador Offshore Petroleum Board
(C-NLOPB) and the Canada-Nova Scotia Offshore Petroleum Board
(CNSOPB)
8. The Brazilian National Petroleum Agency (ANP), Brazil
9. The Health and Safety Executive (HSE), Great Britain
10. The State Supervision of Mines (SSM), the Netherlands
The NSOAF had launched a project to adopt a common format for sharing
information about incidents, accidents, and near-misses among its members.
The members are listed following (Christou & Konstantinidou, 2012):
1. Petroleum Safety Authority (PSA), Norway
2. Danish Energy Agency, Denmark
3. Ministry of Petroleum, Faroe Islands
4. Landesamt f€ ur Bergbau, Energie und Geologie, Germany
5. Department of Communications, Marine and Natural Resources, Ireland
ARTICLE IN PRESS
6. State Supervision of Mines, the Netherlands

7. Svenska Geologiska Undersøkning, Sweden
8. Health and Safety Executive, UK
The reliability of an equipment often plays a vital role in maintaining
safety, production availability, and maintenance costs in any processing
plant. In order to ensure high technical integrity for safe and reliable oper-
ations by sharing learned lessons and reliability data, some organizations
have created their own reliability databases or handbook. For instance,
Offshore Reliability Data handbook (OREDA) collects data to determine
the causes, consequences, and the failure likelihood and help to optimize
life cycle costs and minimize maintenance costs (OREDA, 2015). The
European Safety, Reliability and Data Association (ESReDA) provides
a platform for the exchange of information, data, and current research into
Safety and Reliability. The Association focuses on supporting with meth-
odological and organizational tools the preparation, conduct of the event,
and accident investigation and to dissemination of the lessons learned
(Dechy et al., 2012). After the exploration of accident data sources, the
European Commission JRC Scientific and Policy Report (Christou &
Konstantinidou, 2012) made the following conclusions on accident infor-
mation availability:
• There is a clear need for pooling of data in order to have a complete pic-
ture of the safety in the offshore sector.
• There is a clear need for common formatting in order to facilitate data
and experience sharing.
• There is a clear need for transparency of data.
• The inclusion of near-misses in accident databases is necessary, because
important lessons can be learned from them.
• Lessons learned from accidents and incidents should be available to all
stakeholders.
• There is a need to protect sensitive and confidential information.
• There is a need to avoid double reporting of accidents and incidents in
different organizations.
This shows that data aggregation with uniform reporting systems is vital for
effective lesson learning and spreading of acquired knowledge about past
accidents and to obtain a comprehensive picture of the risk of possible acci-
dent types. However, while using accident statistical data, a user may need to
consider a certain level of underreporting, and alter their analyses either by
using correction factors, or reliance on expert judgment.
ARTICLE IN PRESS
5. ANALYSIS OF PAST ACCIDENTS

The analysis of a specific accident conveys what went wrong and what
preventive measures should be applied to avoid such accidents in future.
Realization of both the causes of accidents and the preventive measures is
useful in improving the safety and efficiency of ships and facilities. According
to Casal and Darbra (2013), the study of accidents is very interesting due to
several reasons, such their source of experimental data and historical analysis
that can help to identify a number of valuable features relevant to performing
risk assessment and developing accident prevention strategies. Past accidents
are discussed separately for marine and for offshore accidents.
5.1 Analysis of Marine Accidents

The first historical records of maritime accidents go back to the First Punic
War between the Roman Republic and Carthage from 264 to 241 BC
(Lazenby, 2016). Since then, numerous maritime accidents have occurred
globally. However, due to unavailability of credible sources of dataset, acci-
dent analysis of major accidents before the RMS Titanic sinking is not avail-
able. Since that tragedy, the maritime industry and regulators have actively
tried to improve safety records and currently shipping has become a safer
form of transport for passengers, cargo, seafarers, and ships (Fields, 2012).
The occurrence of major accidents in shipping is not yet a thing of the past
and significant challenges still exist as proven by the recent Costa Concordia
and Rabaul Queen disasters in 2012 (Gehling, 2013).
According to a report prepared by Allianz Global Corporate and Specialty
(2017), the trend of total shipping losses is decreasing. It has declined by 50%
over the past decade as shown in Fig. 6. The decreasing trend of major mar-
itime accidents is observed when analyzing accidents between 1986 and 2015,
as listed in Table 4. The numbers of major accidents are 41, 30, and 24, respec-
tively, in 1986–95, 1996–2005, and 2006–15 as shown in Fig. 8. This strongly
supports the fact that maritime safety has been improving in recent years
influenced by improved regulations and the evolution of a more robust safety
culture. Moreover, it reflects that ship owners and regulators are now much
more proactive about safety than they were in the past. The recent downturn
in shipping industry is also a likely contributing factor which has led to fewer
voyages, slower steaming, and an growing number of vessels in lay-up (Allianz
Global Corporate and Specialty, 2017).
ARTICLE IN PRESS
200
171
160 151
130 127 124
112
Total losses
120 101
97
88 85
80
40
0
2007 2008 2009 2010 2011 2012 2013 2014 2015 2016
Year
Fig. 6 Trend of total shipping losses from 2007 to 2016.
The total number of ship losses in different regions from 2007 to 2016
and in 2016 alone is given in Fig. 7. This indicates that South China, Indo-
china, Indonesia, and the Philippines region have been the top loss hotspots
for a decade. Cargo (41%), fishery (17%), bulk (8.3%), passenger (5.7%), and
tug (5.5%) are the vessel types that have experienced high total losses over
the last decade as given in Table 6. The tanker industry has been excellent at
pursuing safety regulation and maintaining high standards. Passenger ship,
cargo, and fishing vessels could learn from tanker industry’s safety culture
and would benefit from adopting more proactive approaches in safety man-
agement systems.
Foundering (sunk and submerged) wrecked/stranded (grounded), fire/
explosion (Baalisampang, Abbassi, Garaniya, Khan, & Dadashzadeh,
2018), collision (involving vessels), machinery damage/failure, and hull
damage have been the most frequent causes of losses at sea over the past
decade as shown in Table 7. Foundering accounts for the highest percentage
of losses (50.42%), followed by wrecked/stranded with 20.57%, and the
third highest contributor is fire/explosion (9.95%).
According to the report prepared by Fields (2012), current maritime
operations are much safer than before. This has been achieved through a cul-
mination of technology, regulations, cultural and training improvements,
and new construction and design techniques. These improvements have
been driven by past major accidents, lesson learnt from them and researches.
For instance, the Herald of Free Enterprise (1987), the Exxon Valdez (1989),
and the Estonia (199) had been catalysts for the creation of Safety Manage-
ment Systems under the International Safety Management (ISM) Code.
ARTICLE IN PRESS
Fig. 7 Total ship losses in different regions. Adapted from Allianz Global Corporate and Specialty. (2017). Safety and shipping review 2017,
Munich, Germany.
ARTICLE IN PRESS
45 41
Number of major accidents

40
35
30
30
24
25
20
15
10
5
0
1986–1995 1996–2005 2006–2015
Period
Fig. 8 Number of major marine accidents that occurred in 1986–2015.
Table 6 Vessels Losses During 2007–16

2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 Total
Cargo 70 59 52 61 38 61 41 31 38 30 481
Fishery 34 36 29 21 14 12 13 15 15 9 198
Bulk 12 8 10 11 14 9 15 4 11 4 98
Passenger 8 5 5 3 7 7 8 10 7 8 68
Tug 11 7 5 7 2 6 7 7 6 7 65
Chemical/ 6 7 9 6 2 8 10 2 3 6 59
product
Ro-ro 5 8 6 1 3 5 2 5 6 8 49
Other 7 5 5 3 5 3 6 4 4 3 45
Container 3 2 4 5 3 6 4 4 5 3 39
Supply/ 5 1 3 2 2 3 2 3 3 2 26
offshore
Barge 6 3 1 3 1 2 16
Dredger 2 5 2 2 2 1 1 1 16
Tanker 1 3 2 3 4 1 1 15
Unknown 1 1 1 2 1 6
LPG 1 1 1 1 1 5
Total 171 151 130 127 97 124 112 88 101 85 1186
Adapted from Allianz Global Corporate and Specialty. (2017). Safety and shipping review 2017, Munich,
Germany.
Table 7 Different Causes of Ship Losses
2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 Grand Total
Foundered (Sunk, submerged) 69 73 61 64 45 55 70 50 65 46 598
Wrecked/stranded (grounded) 35 34 23 24 29 26 21 18 19 15 244
Fire/explosion 18 16 14 12 9 13 15 6 7 8 118
ARTICLE IN PRESS
Collision (involving vessels) 17 13 13 10 3 5 2 2 6 1 72
Machinery damage/failure 14 8 7 4 6 15 2 5 2 8 71
Hull damage (holed, cracks, etc.) 11 4 8 4 3 7 1 4 2 4 48
Miscellaneous 3 1 2 6 1 1 1 2 1 18
Contact (e.g., harbor wall) 2 1 1 2 1 7
Missing/overdue 1 1 1 2 5
Piracy 1 1 2 1 5
Grand total 171 151 130 127 97 124 112 88 101 85 1186
Adapted from Allianz Global Corporate and Specialty. (2017). Safety and shipping review 2017, Munich, Germany.
ARTICLE IN PRESS
In response to the Costa Concordia incident, the Maritime Safety Commit-

tee (MSC) adopted SOLAS regulation III/19 in June 2013 and has entered
into force on January 1, 2015 (Maritime Safety Committee (MSC), 2014).
Technological progress has been an important driver for safety improve-
ment. For instance, the move from the use of gyrocompasses to the Elec-
tronic Chart Display and Information Systems (ECDIS), radar and
wireless communication to Automatic Radar Plotting Aid (ARPA), Global
Positioning Systems (GPS), and Automatic Identification System (AIS) have
significantly enhanced safety through enhancing situational awareness via
increased access to real time information (Fields, 2012). Moreover, there
are great improvements in shipbuilding processes such as development of
computer-aided design, improved prefabrication, and welding techniques.
Currently, the maritime industry is highly regulated and several organi-
zations are responsible for different aspects of safety. Moreover, the industry
itself has been playing an active role in self-regulating to improve standards
and safety. For instance, Cruise Lines International Association (CLIA) had
agreed to standardize safety procedures and regulations in the aftermath of
Costa Concordia with policy to adopt the new regulations that CLIA
implemented in 2013. Training of crews and safety culture has gradually
emerged on a global footing and with international scrutiny due to the intro-
duction of the STCW regulation in 1978 and Safety Management Systems
code in 1993 (Fields, 2012).
Other factors behind the improvement in maritime safety are due to rig-
orous quality control measures and standard enforcement by concerned
authorities such as the Port state control (PSC) system. Likewise, classifica-
tion societies are helping to maintain safety standards by developing and
applying technical standards to ship design and construction.
There is no doubt that the safer marine operation has resulted from the
combination of several initiatives, researches, regulations, and innovations
brought about by tragic deaths, injuries, and asset losses. Despite the
improved safety trend, the shipping industry is still facing emerging chal-
lenges (Fields, 2012) such as:
• Increasing vessel sizes which pose design challenges for structural integ-
rity and evacuation and rescue in ultra large cruise ships.
• Increasing cost pressure which may stipulate hiring incompetence and
inexperience crews despite IMO training and certification requirement.
Additionally, the cost pressure has direct impact on the crewing levels
resulting in more working hours. These may compromise margins of
safety because human factor is one of the major causes of accidents.
ARTICLE IN PRESS
• Ineffective risk management has been identified as a key challenge.

• In some regions such as off the coast of Somalia and the Horn of Africa,
insecurity due to piracy has become a significant threat.
• Owing to climate change, previously impassable seaways are opening
with the development of new shipping routes such as the North East
Passage. This poses some challenges regarding ice navigation, design and
construction, and emergency procedures in extremely harsh environ-
mental conditions.
• Owing to the complex regulatory environment, it is challenging to
maintain an effective enforcement and coordination in the event of an
incident.
• Fire is identified as a major on-board risk particularly in Ro-Ro ferries
and on passenger ships due to increased hotel services.
These emerging risks need to be tackled in order to continue improving
maritime operations. Adoption of an effective safety culture and employing
proactive approaches in accident modeling and assessment have contributed
in reducing maritime accidents. This incorporates formal risk assessment
with adequate safety management systems in place and potential risks to
be properly managed before triggering any accidents. In this way, potential
accident can be avoided by learning through proactive approaches and tak-
ing action accordingly such that people do not need to wait for another
tragic accident to learn a new safety lesson.
5.2 Analysis of Offshore Accidents

By nature offshore oil and gas exploration and production activities are
inherently unsafe because they involve complex activities requiring handling
of large amounts of pressurized hydrocarbons and other fluids and gases in a
dynamic offshore environment. Since the commencement of offshore oil
and gas exploration, major offshore accidents have occurred on all global
continental shelves, resulting deaths, injuries, and environmental pollution
and asset losses, as shown in Table 5. The broad causal factors of offshore
accidents are blowouts, hydrocarbon leaks from pipelines or risers, hydro-
carbon leaks on installations, and structural failures (Vinnem, 2014c). Con-
currently, enormous developments have taken place in this industry such as
new and improved technical solutions, operational systems, and regulations
to support a wide range of offshore activities. Despite these improvements,
major accidents, near-misses, and incidents continue to occur. One obvious
reason might be due to new hazards posed by deepwater operation and
ARTICLE IN PRESS
commissioning of a new facility. In order to meet growing energy demand

for increasing population, the offshore industry is moving into deeper
waters, more isolated and challenging reservoirs and harsher environments
(Bennett, Eriksen, & Madsen, 2014). This poses new risks that need to be
understood and managed for improving safety by investigating ways to pre-
vent and mitigate major accidents. Analysis of past accidents provides key
information about current safety requirements and emerging safety
challenges.
However, due to underreporting issues and lack of credible sources,
analysis of each major accident may not be feasible and accurate accident sta-
tistics may not be obtained from early offshore operations. But using the
information available in the public domain, trend of accidents, and their cau-
ses or fatalities can be generated. According to occupational safety trend
depicted by the United States Mineral Management Service (MMS) as
shown in Fig. 9, in a 16-year period only, the recordable injury rate declined
from 2.27 to 0.47 along the US coastline and OCS (Durand, 2016). Total
number of recordable incidents that occurred on the OCS from 2007 to
2016 is given in Table 8. This clearly indicates that the total number of
recordable incidents that have occurred in this region has been decreasing.
But the BSEE (U.S. Department of the Interior Bureau of Safety and
Fig. 9 Combined operations recordable and lost workday/DART (days away from work
or days of restricted work or job transfer (DART)) case incident rate (number of incidents
per 200,000 man–hours worked). Adapted from Durand, J.G. (2016). OCS performance
measures 2015 index charts. Bureau of Safety and Environmental Enforcement (BSEE).
ARTICLE IN PRESS
Table 8 Total Number of Recordable Incidents Occurred on the OCS From 2007 to 2016
Incident Type 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016
Fatalities 5 12 4 12 3 1 4 2 1 2
Injuries 322 263 260 253 221 280 276 285 206 151
Loss of well 6 7 7 4 5 3 8 5 3 2
control
Fire/explosions 145 141 148 134 113 132 116 135 105 86
Collisions 26 28 26 14 11 13 21 16 9 9
Spills (>50 bbls) 7 33 7 9 4 5 10 5 7 3
Lifting 180 185 243 118 110 167 197 210 161 155
Gas releases 14 22 33 20 17 27 21 21 21 17
Evacuation 33 43 55 31 36 48 68 52 70 50
musters
Total 738 734 783 595 520 676 721 731 583 475
Adapted from U.S. Department of the Interior Bureau of Safety and Environmental Enforcement
(BSEE). (2016). Bureau of safety and environmental enforcement annual report 2016.
Environmental Enforcement (BSEE), 2016) cautioned that these trends

were suggestive only, not definitive, with regard to the direction of industry
safety outcomes.
As a result of technological advancement such as satellite-controlled navi-
gation and position control, and real-time monitoring, the offshore oil and gas
industry has achieved greater precision and predictability (U.S. Department of
the Interior Bureau of Safety and Environmental Enforcement (BSEE), 2016).
Moreover, technology has reduced the significant amount of direct physical
labor in certain tasks. These advantages have helped to reduce the overall risk
of injury; however, the need for direct physical labor is likely to continue as
drilling extends into deeper water and goes further offshore.
According to the number of fatalities in OCS in 2007–16 as shown in
Fig. 10, there is no appearance of a particular trend but numbers have been
essentially static ranging from 1 to 4 since 2011. The total number of fatalities
that occurred in the region from 2011 to 2016 was much lower than those
occurring prior to 2011 due to the reduction in number of fatal incidents.
Fire and explosions hazards in offshore oil and gas facilities are common.
Owing to space constraints, multiple industrial functions such as oil and
gas extraction, processing, and flaring need to be done in close proximity.
ARTICLE IN PRESS
14
12 12
12
Number of fatalities
10
6 5
4 4
4 3
2 2
2 1 1
0
2007 2008 2009 2010 2011 2012 2013 2014 2015 2016
Fiscal year
Fig. 10 Number of fatalities in OCS from 2007 to 2016. Adapted from Wang, J., &
Foinikis, P. (2001). Formal safety assessment of containerships. Marine Policy, 25, 143–157.
Explosions/Fire
1 Lifting
1 1
19
Helicopter
5
Diving related
1
Construction fall
2
Personnel transfer
4 Man overboard
Electrocution
5
Support vessel-
7 anchor
Falling debris
Fig. 11 Causes of offshore fatalities for the fiscal year 2007–16.
This poses higher fire and explosion risk on the facility and there is the
potential to produce catastrophic consequences. Therefore, having adequate
preventive measures in place and learning lessons from prior fires and/or
explosions can reduce the chance of recurrence. The causes of offshore fatal-
ities in the OCS region for the fiscal period 2016–17 are given in Fig. 11,
showing that the greatest cause of fatality is explosion/fire.
The offshore occupational safety trends have been improving globally
according to reported incidents of various offshore industries as shown in
Fig. 12. According to DNV report (Bennett et al., 2014), occupational safety
ARTICLE IN PRESS
Fig. 12 Statistical trends on occupational safety, based on DNV’s analysis of data

extracted from companies’ annual reports and sustainability reports. Adapted from
Bennett, G., Eriksen, R., & Madsen, H.O. (2014). Enhancing offshore safety and environ-
mental performance–key learnings from major offshore accidents. World Petroleum
Congress.
has improved by a factor of 10 during the past 20–30 years. These improve-
ments were made as the industry has worked in ever more challenging
conditions such as very deepwater operations and harsh environmental
conditions. This has been achieved through an integration of good regulation,
senior management commitment, improved safety management systems, and
safety culture programs. This improvement in safety performance has shown a
positive trend, though unique logistical, operational, oceanographic, and eco-
nomic challenges are complicating deepwater exploration and production
(National Academies of Sciences Engineering, Medicine, 2016).
Nevertheless, improvement in occupational safety may not necessarily
improve the prevention of major accident hazards because offshore safety
depends on occupational safety and technical safety. Measures required
for preventing and mitigating occupational accidents can be very different
from that of the technical safety. Bennett et al. (2014) stated that applying
risk-based approaches to regulations and operations with practical tools,
would allow the offshore industry to achieve improvement in the avoidance
of accident hazards similar to occupational safety.
Using International Association of Oil and Gas Producers (IOGP) fatal
incident reports (International Association of Oil and Gas Producers
(IOGP), n.d.), global offshore fatal incidents and fatalities are generated as
shown in Figs. 13 and 14. The trendline in Fig. 13 suggests that the number
of reported fatal incidents in the database has been decreasing. If the
ARTICLE IN PRESS
23
21
19
17
15
13
11
9
7
5
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
Fig. 13 Number of fatal incidents in offshore industry.
40
35
30
25
20
15
10
5
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
Fig. 14 Number of fatalities in offshore industry.
reporting is accurate and optimal, this is a positive sign that global fatal inci-
dents have been reducing. Similar decreasing trend can be seen in the num-
ber of reported fatalities in Fig. 14.
Comparing gradients of trendlines in the number of fatal incidents and
fatalities, the decreasing rate of fatal incident is more than that of fatalities.
This indicates that the risk of major accidents has been reduced.
Using the IOGP fatal incident reports (International Association of
Oil and Gas Producers (IOGP), n.d.), the number of fatal incidents and fatal-
ities in 1991–2016 (inclusive) in seven offshore regions are compared as
shown in Fig. 15. This shows that the maximum number of fatalities is
in Europe and the minimum is in Russia/Central Asia region. Similarly,
during this period, the maximum number of fatal incidents is in the African
region and the minimum in the Russia/Central Asia region. This indicates
that the risk of major accidents has reduced in some regions, but not to the
same degree in all regions.
ARTICLE IN PRESS
124 127
119
107
90 89
70 74
43
31
20 20
4 5
Number of fatal incidents Number of fatalities

Fig. 15 Regional distribution of offshore fatal incidents and fatalities in 1991–2016.
118
Number of fatal
incidents
Number of
fatalities
64
60
48
23
15
10 10
2 2
Exploration Drilling Production Construction Unspecified

Fig. 16 Number of fatal incidents and fatalities during different function from 1991 to
2016.
Based on the IOGP fatal incident reports (International Association of

Oil and Gas Producers (IOGP), n.d.), the number of fatal incidents in dif-
ferent offshore activities (functions) during this period is compared in Fig. 16
which indicates that production has the highest fatality and the exploration
operation has the least fatality. Similarly, production contributed the highest
number of fatalities and exploration the least number of fatalities during this
period.
ARTICLE IN PRESS
500
450
400
350
300
250
200
150
100
50
2007
2004
2009
2006
2008
2005
2002
2001
1979
1991
1997
2003
2000
1971
1977
1986
1989
1996
1975
1978
1981
1984
1987
1990
1992
1995
1998
1970
1973
1976
1982
1985
1988
1994
1974
1983
1993
1999
1980
1972
Fig. 17 Chronological distribution of accidents in the WOAD database. Adapted from

Christou, M., & Konstantinidou, M. (2012). Safety of offshore oil and gas operations:
Lessons from past accident analysis. Joint Research Centre of the European Commission,
1–60.
Christou and Konstantinidou (2012) analyzed past major accidents using

dataset of 1970–2009 available in the WOAD database. According to this
database, the chronological distribution of accidents from 1970 to 2009 is
shown in Fig. 17. Owing to limited information (underreporting), there
were a smaller number of records in 1970s and high peaks were registered
in 1999 and 2005. In 1999, the large increase has been recorded due to
higher reporting in NCS, mainly because new regulations came into force
which required reporting of all events and it is not that the actual number of
incidents has increased. In 2005, another peak was recorded due to the
impact of hurricanes Katrina and Rita in the United States.
Christou and Konstantinidou (2012) studied the causes of WOAD data-
base accidents by categorizing into two main groups, namely human-related
and equipment-related causes. In the human-related cause group, the fol-
lowing categories are used:
1. Third party error
2. Act of war
3. Sabotage
4. Improper design
5. Unsafe act/no procedure
6. Unsafe procedure
7. Other
ARTICLE IN PRESS
Most accidents are caused by an unsafe act or lack of given procedures

(44%). Adoption of unsafe procedures contributed to 37% of accidents as
shown in Fig. 18. The following categories are used for equipment-related
causes:
1. Third party equipment failure
2. Earthquake, volcanic eruption
3. Equipment malfunction
4. Foundation and structural failure
5. Ignition
6. Safety system malfunction
7. Weather
8. Other
The distribution of events per type of equipment-related causes is presented
in Fig. 19. Equipment malfunction was the main attributed cause of acci-
dents (34%) followed by ignition (26%). Safety system malfunction was
the cause of least accident. According to Christou and Konstantinidou
(2012), in about 86% of events, no human-related causes were attributed
and in almost 55% events, no equipment-related causes were attributed.
According to the WOAD database during 1970–2009, capsizing, over-
turn, toppling is the main event that contributed the highest number of total
Act of
war/during
warsit/sabotage Other
1% 1%
Improper design
8%
Third party error

9%
Unsafe act/no
procedure
Unsafe 44%
procedure
37%
Fig. 18 Distribution of accidents per type of human-related causes for accidents.

Adapted from Christou, M., & Konstantinidou, M. (2012). Safety of offshore oil and gas
operations: Lessons from past accident analysis. Joint Research Centre of the European
Commission, 1–60.
ARTICLE IN PRESS
Safety system
Other malfunction
Earthquake,
2% 0.18%
volcanic eruption
Third party 0.18%
equipment failure
5%
Foundation and
structural failure
8% All equipment
malfunction
34%
Ignition
26%
Weather,
general
25%
Fig. 19 Distribution of accidents per type of equipment-related causes for accidents.
Adapted from Christou, M., & Konstantinidou, M. (2012). Safety of offshore oil and gas
operations: Lessons from past accident analysis. Joint Research Centre of the European
Commission, 1–60.
losses followed by loss of buoyancy or sinking as shown in Table 9. Similarly,

loss of buoyancy or sinking is the “event in chain” that contributed the max-
imum total number of losses followed by capsizing, overturn, toppling as
shown in Table 10.
The comparison of damage extent relating to blowouts as “Main events”
or “Event in Chain” for accidents in the WOAD database is given in Fig. 20.
Considering blowout as an event in chain, 48 total losses were reported
because it led to fires or explosion or other events. It is found that 359 blow-
outs were reported as events in chain which means that about 61% blowouts
were not considered as the main event, but led to other events, which may
have had very significant consequences. The percentage of blowouts con-
sidered as main event was about 3.67 and event in chain is about 3.93. This
shows that blowout events may be common.
According to the analyses of past accidents in US OCS, IOPG fatal inci-
dent reports and WOAD database, there is a positive trend in safety
improvement. In order to be able to draw definitive conclusions in several
aspects, authorities responsible for investigating and reporting accidents,
incidents and near-misses in the offshore sectors need to give adequate atten-
tion to all causes of incidents and to report them clearly. Through a detailed
analysis of all causes, valuable lessons can be achieved and disseminated to
enable better management of risks.
ARTICLE IN PRESS
Table 9 Extent of Damage in Relation to the Main Event

Insignificant/ Minor Severe Significant Total
Main Event No Damage Damage Damage Damage Loss Total
Anchor/mooring 37 45 0 37 0 119
failure
Blowout 138 54 6 27 2 227
Breakage or fatigue 21 54 96 197 12 380
Capsizing, overturn, 1 0 191 5 73 270
and toppling
Collision, not offshore 45 50 42 63 18 218
units
Collision, offshore 61 136 26 111 15 349
units
Crane accident 67 20 0 5 0 92
Explosion 46 34 10 28 0 118
Falling load/dropped 876 69 14 74 1 1034
object
Fire 592 132 86 100 41 951
Grounding 2 10 21 29 10 72
Helicopter accident 30 27 0 0 0 57
Leakage into hull 5 11 5 24 3 48
List, uncontrolled 9 9 14 28 4 64
inclination
Loss of buoyancy or 0 1 35 3 68 107
sinking
Machinery/ 13 9 0 1 0 23
propulsion failure
Other 192 36 41 13 81 363
Out of position, adrift 32 15 2 5 0 54
Release of fluid or gas 1047 132 125 40 1 1345
Towline failure/ 53 1 3 2 0 59
rupture
Well problem, no 211 14 0 8 0 233
blowout
Total 3478 859 717 800 329 6183
Adapted from Christou, M., & Konstantinidou, M. (2012). Safety of offshore oil and gas operations: Lessons
from past accident analysis. Joint Research Centre of the European Commission, 1–60.
ARTICLE IN PRESS
Table 10 Extent of Damage in Relation to the Event in Chain

Insignificant/ Minor Severe Significant Total
Event in Chain No Damage Damage Damage Damage Loss Total
Anchor/mooring 55 67 15 79 5 221
failure
Blowout 142 68 55 46 48 359
Breakage or fatigue 29 67 362 242 59 759
Capsizing, overturn, 1 0 201 5 78 285
and toppling
Collision, not offshore 49 54 56 70 22 251
units
Collision, offshore 62 136 34 118 28 378
units
Crane accident 502 77 9 62 0 650
Explosion 53 42 34 48 15 192
Falling load/dropped 907 82 29 85 9 1112
object
Fire 616 149 97 112 56 1030
Grounding 2 11 27 32 12 84
Helicopter accident 31 27 0 0 1 59
Leakage into hull 6 13 16 34 15 84
List, uncontrolled 9 11 36 38 23 117
inclination
Loss of buoyancy or 5 2 75 11 173 266
sinking
Machinery/ 13 10 0 3 7 33
propulsion failure
Other 213 41 49 20 123 446
Out of position, adrift 88 44 35 66 21 254
Release of fluid or gas 1285 239 208 139 22 1893
Towline failure/ 65 6 12 13 14 110
rupture
Well problem, no 360 71 41 47 37 556
blowout
Total 4493 1217 1391 1270 768 9139
ARTICLE IN PRESS
138 142
Blowout main event
Blowout event in chain
68
54 55
46 48
27
6 2
Insignificant/no Minor damage Severe damage Significant Total loss

damage damage
Fig. 20 Extent of damage relating to blowouts as “Main events” or “Event in Chain” for
accidents in the WOAD database. Adapted from Bennett, G., Eriksen, R., & Madsen, H.O.
(2014). Enhancing offshore safety and environmental performance–key learnings from
major offshore accidents. World Petroleum Congress.
In order to leverage overall safety performance in offshore sectors, DNV

proposed six interconnected performance levels (Bennett et al., 2014). They
are:
1. Performance-based regulations need to be adopted supplemented by
prescriptive regulations and standards.
2. Clear roles and responsibilities should be set in multiparty operations.
3. Holistic risk approach needs to be considered.
4. Advanced safety barrier management should be ensured such that failure
of one barrier may not escalate further.
5. When planning safe operations, interaction among man, technology and
the organization must be considered.
6. Multiparty operation needs to share common performance monitoring
such as same performance targets, monitoring the same barrier condi-
tions, and should have a common understanding of the operation status
and impacts of any deviations.
The offshore industry has achieved extensive operational experience, improve-
ment in safety, and technological development and has learned valuable lessons
about how to improve safety in every aspect. By adopting risk-based
approaches in all aspects, incorporating effective interaction of man, technol-
ogy, and organization, it is expected that the offshore industry would achieve
better improvement in the prevention of major hazard accidents. This would
help to overcome emerging challenges and hazards while operating in more
remote offshore locations or more challenging environments with new tech-
nologies such as FLNG and LNG carriers.
ARTICLE IN PRESS
6. LESSON LEARNED FROM PAST ACCIDENTS

TO CONTROL OFFSHORE MAJOR HAZARDS
Past accident investigation reports, enquiries, and historical records
of safety regulation developments have clearly shown that accidents often
provide a valuable lesson. Several major accidents have occurred in mari-
time operations and offshore sectors and several lessons have been learned
from them. Experiences from past major accidents are sources of informa-
tion to avoid the occurrence of similar accidents in the future. The impor-
tant experiences gained from accidents should not be forgotten because this
information would be useful for modeling risks and may provide back-
ground information to explain why some of the regulations came into
force. Reporting of accidents and sharing their information for the purposes
of lesson learning is valuable to all stakeholders and it is recognized that
for prevention of major accidents all stakeholders must be involved. For
this reason, it is highly preferred to be transparent as much as possible, all-
owing nonconfidential information to be open and analyzed by concerned
persons. After the Macondo disaster, it was highly recommended to share
near-misses information anonymously to disseminate lessons and to prevent
similar future accidents (Hopkins, 2012). The blowout of the Macondo
Well on April 20, 2010 in the Gulf of Mexico was preceded by three
near-misses, which unfortunately were not effectively shared, and also mis-
sed those opportunities to capture lessons (Murphy & Conner, 2014). It is
highlighted that should Transocean learned from the near-misses, the
Macondo accident would not have occurred. Vinnem (2014a) presented
lessons learned from 30 past major offshore accidents and near-misses
incidents, describing the main sequence of events and barriers that failed
and functioned. These accidents or incidents are listed in Table 11 and the
following groups of hazards were used for lesson learned analysis.
1. Blowouts,
2. Hydrocarbon leaks on facilities, leading to fire and or explosion,
3. Hydrocarbon leaks from pipelines or risers, leading to fire or explosion,
4. Marine and structural failures, possibly leading to total loss, and
5. Other accidents.
For preventing loss of containment (hydrocarbon), the following barrier
classification was used:
ARTICLE IN PRESS
Table 11 Major Offshore Accidents Considered in Vinnem (2014a) for Lesson Learned
Ekofisk A Riser Rupture, Norway, 1975

Deep Sea Driller Capsize, Norway, 1976
Ekofisk B Blowout, Norway, 1977
Ixtoc Blowout, US, 1979
Alexander L. Kielland Capsize, Norway, 1980
Ocean Ranger Capsize, Canada, 1982
Glomar Java Sea Capsize, South China Sea, 1983
Enchova Blowout, Brazil, 1984
West Vanguard Gas Blowout, Norway, 1985
Brent Alpha Explosion, UK, 1988
Piper Alpha Explosion and Fire, UK, 1988
Ocean Odyssey Burning Blowout, UK, 1989
Exxon Valdez Oil Spill, US, 1989
Seacrest Capsize, South China Sea, 1989
Treasure Saga 2/4–14 Underground Blowout, Norway, 1989
West Gamma Capsize, Norway, 1990
Norne Shuttle Tanker Collision, Norway, 2000
P-36 Capsize, Brazil, 2001
P-34 Listing, Brazil, 2004
Ocean Vanguard Anchor Line Failure, Norway, 2004
Temsah Burning Blowout, Egypt, 2004
Snorre Alpha Subsea Gas Blowout, Norway, 2004
Jotun Pipeline Rupture, Norway, 2004
Mumbai High North Riser Rupture, India, 2005
Usumacinta Blowout, US, 2007
Montara Blowout, Australia, 2009
Gullfaks C Well Incident, Norway, 2010
Macondo blowout, US, 2010
Frade Underground Blowout, Brazil, 2011
Gryphon Alpha FPSO Multiple Anchor Line Failure, UK, 2011
ARTICLE IN PRESS
1. HL1: Barrier function designed to maintain the integrity of the process

system.
2. HL2: Barrier function designed to prevent ignition.
3. HL3: Barrier function designed to reduce cloud and spill size.
4. HL4: Barrier function designed to prevent escalation.
5. HL5: Barrier function designed to prevent fatalities.
For prevention of loss of structural capability, following barrier classification
was used:
1. Barrier function designed to maintain structural integrity and marine
control (STR1).
2. Barrier function designed to prevent escalation of initiating failure
(STR2).
3. Barrier function designed to prevent total loss (STR3).
4. Barrier function designed to prevent fatalities (STR4).
More information on the analysis of past major accidents and lesson learned
can be found in Vinnem (2014a).
After the Deepwater Horizon disaster, the National Commission on the
BP Deepwater Horizon Oil Spill and Offshore Drilling Report to the Pres-
ident (National Commission on the BP Deepwater Horizon Oil Spill and
Offshore Drilling, 2011) highlighted several recommendations such as:
1. The need for a new approach to Risk Assessment and Management
(RAM).
2. The need for a new independent agency.
3. The need to strengthen oil spill response, planning, and capacity for
emergency response.
4. The need for increased research and development to improve spill response.
5. The need of authorization, review, and approval of the safety case and
performance of inspections.
6. The need for improved international safety standards.
7. The need for increased transparency, reporting of incidents and near-
misses for the purpose of lesson learning.
Aftermath of the Deepwater Horizon accident in 2010, the US Department
of Interior issued two new safety regulations known as the Drilling Safety
Rule and the Workplace Safety Rule, to promote the safety of drilling oper-
ations and the workplace (Deepwater Horizon Study Group (DHSG),
2011). Additionally, the BSEE and the Bureau of Ocean Energy Manage-
ment (BOEM) were formed to ensure worker safety, environmental protec-
tion, and conservation of resources in the US OCS.
The report by the Institute for Energy and Transport, Joint Research
Centre of the European Commission (Christou & Konstantinidou, 2012)
ARTICLE IN PRESS
states that “failures of the safety management system and a poor safety culture
are almost always the underlying cause of major accidents.” The analysis of
several offshore accidents supports this claim. For example, according to the
BSEE report (U.S. Department of the Interior Bureau of Safety and
Environmental Enforcement (BSEE), 2013), the root cause of the Black
Elk platform blast was failure to adopt an effective safety culture. This has
been noticeable either through flaws in design phase, failure to identify
hazards, unsafe acts or lack of effective response procedures.
Despite learning lessons and upgrading safety systems and regulations,
offshore operations are still vulnerable to hazards and major accidents are still
occurring. For instance, in 2012, a major gas or condensate leak occurred
from the Elgin G4 Well in the North Sea which continued for 51 days until
the leak was stopped on May 15, 2012 (Dale, Keown, & Wilson, 2013).
A fatal blowout and subsequent fire accident occurred in 2015 at Abkatun
Alfa platform operated by PEMEX, which killed 4 people and injured
16 people (Fattakhova & Barakhnina, 2015). The PEMEX blowout
occurred just a few days before the fifth anniversary of the BP Deepwater
Horizon disaster. According to reports of several such accidents and inci-
dents in recent years, it is evident that despite regulation updating, lessons
from previous major offshore accidents have not still been adequately
learned, disseminated, and effectively implemented across the world. On
the other hand, this indicates that new safety challenges exist and proactive
approaches, and the research is needed such that people and environment
anywhere should not have to face another tragic accident.
The report by the Institute for Energy and Transport, Joint Research
Centre of the European Commission (Christou & Konstantinidou, 2012)
summarized the failure analysis and lessons learned, and presented them
according to the usual risk management chain such as prevention, early
warning, mitigation, preparedness, emergency response, and aftermath/
recovery as shown in Tables 12–15.
6.1 Recent Accidents and Lessons to be Learned

6.1.1 Abkatun-A Permanente Platform Explosion
An explosion occurred on April 1, 2015, in Abkatun-A Permanente plat-
form causing a fire that engulfed much of the platform. The explosion
and fire started in the dehydration and pumping section of the platform.
At first, it was reported that four workers had been killed and that three
workers, initially reported missing, were presumed dead. The Mexican state
energy company (Pemex), reported that 45 workers had been injured.
ARTICLE IN PRESS
Table 12 Lessons Learned From Failure of Preventative Measures and Early Warning
Failure Lessons Learned
Prevention
Failure to identify Performance of adequate risk assessment
risks and address
them in risk • Identification of hazards under extreme conditions, during
assessment changes of procedures and boundary conditions and during
all phases of the life cycle of the oil and gas exploitation
activity
• Existence, application, and review of high levels standards
of HI
Failures of Appropriate cementing of the well:
cementing job in
well • Existence of high level well-integrity standards and practices
• Operator follows adequate procedures
• Operator/contractor recognizes early signals and reacts
promptly
• Operator maintains high safety culture level
• Appropriate oversight by regulatory authorities: control
conformity, review risk assessment, and check operator’s/
contractor’s capacity
Failure of BOP Installation of BOP with adequate features. Ensure
(secondary) performance as preventer and integrate in prevention system.
• Existence of high level technology standards (e.g., double

shear ram or able to cut through joints)
• Risk assessment ensures increased reliability of the overall
protection system
• Operator applies state-of-the-art technology and
recognized best practices
• Regulatory authority oversees risks, reviews management,
and perform inspections
Early warning
Failure to Better monitoring, early detection, and interpretation of early
recognize and react signals:
to early warning
signals of • Existence and application of good practices
hydrocarbons
entering the well
ARTICLE IN PRESS
Table 13 Lessons Learned From Failure of Mitigation and Aftermath/Restoration

Mitigation
Failure to Installation of diverter of appropriate design and with the
adequately use the adequate features. Ensure that in case of accident, it is used in
diverter, too the appropriate way to avoid escalation:
much reliance on
human response • Existence of high level technology standards with appropriate
balance between automatic or human intervention
• Risk assessment ensures increased reliability of the overall
system and appropriate protection level
• Operator applies state-of-the-art technology and recognized
best practices
• Regulatory authority oversees risks, reviews risk
management, and performs inspections
Failure to avoid Installation and functioning of gas detectors in appropriately
ignition of defined hazardous areas; avoid ignition sources in these areas:
released
hydrocarbons • Existence of good practices for the definition of hazardous
and high technology in gas detectors
• Operators install state-of-the-art gas detectors in appropriate
locations and extends the hazardous areas where necessary
• Regulatory authority checks adequacy of protection
measures and performs inspections
Failure to protect Use of materials and designs that withstand increased
vulnerable areas overpressure:
from the impact of
explosion • Existence of best technologies and good practices for the
protection of vulnerable areas
• Operator installs state-of-the-art protection measures
(balance with increased cost and other drawbacks)
• Regulatory authority checks adequacy of protection
measures
Aftermath/Restoration
Failure to restore Take measures to restore the quality of environment:
the environment
to the status prior • Existence of high level technology standards for cleanup
to the accident operations
• Operator applies state-of-the-art technology and recognized
best practices
• Regulatory authority oversees and monitors cleanup
operations
ARTICLE IN PRESS
Table 14 Lessons Learned From Failure of Emergency Response, and Preparedness and
Planning
Emergency response
Failure to adequately Application of highly sophisticated emergency response
respond to the technologies and application of efficient plans, mobilizing all
accident necessary capacities of the operator and the Member States:
• Existence of high level technology standards and best

available technologies for emergency response
• Existence of capacities
• Emergency plan (external) with the involvement of
various authorities from affected Member States
Preparedness and planning
Failure to be Be prepared and foresee the capacities needed to respond to
adequately prepared the accident. Develop a plan on how to respond:
to respond to the
accident • Existence of good practices
• Development of scenarios and assessment of capacities
necessary to efficiently respond to these scenarios
• Operator develops emergency plan (internal) based on
commonly acceptable scenarios and good practices. He has
to ensure that capacities are in place
• Regulatory authority has to review and inspect the
emergency plans and to confirm the existence of capacities.
It also has to ensure that other respond authorities
(e.g., coastal guard, civil protection, and maritime
pollution control) are informed
• Transboundary effects
According to Mexico’s Agencia de Seguridad, Energia y Ambiente (ASEA)

investigation report, the Abkatun-A Permanente platform explosion was
caused by a leak from a fuel gas line contributed to by an unusual kind of
accelerated corrosion due to the presence of microorganisms and sulfuric
acid within the gas (Offshore Post-Everything offshore energy, 2015). Con-
sideration of risk-based inspection of the pipeline could have identified the
corrosion attack and prevented the accident. The lesson learned from this
accident is that a small rupture leak can lead to a major accident and adequate
risk-based inspection is required.
ARTICLE IN PRESS
Table 15 Lessons Learned From Failure of Safety Management and Past Lessons
Failure Lesson Learned
Safety management
Failure to manage Put in place a Safety and Environmental Management System,
safety of operations addressing continuously and systematically the safety
adequately challenges of the operations:
• Existence of good practices

• Operator applies recognized best practices
• Operator takes actions to enhance and promote safety
culture, communication, targeted training, and safety
leadership inside his business
• Regulatory authority reviews safety management systems
and monitors the level of safety
Lessons learning
Failure to learn Put in place an appropriately designed system to investigate
from accidents and accidents, identify key lessons, and learn lessons from
from near-misses accidents, incidents, and near-misses. Communicate not only
internally but also for the key lessons externally to the wider
offshore risk management community:
• Existence of a common format for reporting accidents,

incidents, and near-misses
• Existence of agreed taxonomies of the causes, consequences
and critical issues related to them, including lessons learned
• Operator investigates accidents, incidents, and near-misses,
identifies lessons, and disseminates them not only to the
internal personnel but also shares lessons with other
operators, inspectors, and risk management community
• Regulatory authority collects data and forward it to the
Commission for further analysis
• Commission (or other independent body) analyses
accidents and disseminates lesson
6.1.2 Black Elk Explosion and Fire

On November 16, 2012, an explosion and fire occurred on a platform in the
Gulf of Mexico operated by Black Elk Energy Offshore Operations. The
explosion and fire occurred during welding work and resulted in three fatal-
ities with serious injuries to others. An investigation panel comprised of
professionals from BSEE and the United States Coast Guard (the Panel)
ARTICLE IN PRESS
(U.S. Department of the Interior Bureau of Safety and Environmental

Enforcement (BSEE), 2013) revealed that the explosion and fire occurred
when hydrocarbon vapors ignited while a GIS/DNR worker was welding
a pipe segment. The Panel identified a number of human errors by Black Elk
and its contractors that led to the incident such as
1. “Hot work” was conducted without taking proper safety precaution
2. Failure to communicate the hot work activity and potential hazards
among contractors
3. Failure to establish an effective safety culture
4. Failure to identify hazards and isolate hydrocarbons
5. No worker exercised his/her “stop work” authority despite apparent
inconsistencies.
The Panel made several recommendations aimed at improving the safety of
offshore operations such as improving communication, defining chain of
command, safe hot work practices, and exercising of stop work authority.
The lessons learned from this incident are:
1. An effective communication between the involved parties can be helpful to
ensure that everyone has the same mental model of a hazardous situation.
2. In order to define the chain of command, operators need to clearly state
the chain of command for all operations.
3. Safe hot work practices need to be effectively implemented.
4. Operators, contractors or subcontractors, and service companies need to
review methods of initiating a “stop work” authority to ensure its
effectiveness.
6.1.3 Cidade de São Mateus (FPSO CDSM) Explosion

On November 2, 2015 at approximately 11.30 a.m., condensed material was
leaked into the pumps room while attempting to drain the liquid waste from
the central cargo tank number 6 (6C) using the alternative pump (stripping
pump) of the FPSO of the Cidade de São Mateus (FPSO CDSM) (Brazilian
National Agency of Petroleum, 2015).
After the unsuccessful attempt to render absorbent blankets during the
repair of the connection and the local washing with the utilization of fire-
fighting hose, around 12.38p.m., a strong explosion occurred. A shock wave
broke the bulkhead between the pumps room and the engine room, causing
the death of 9 people and injuring 21 people. The investigation report
identified a number of causal factors such as:
1. Inadequate condensed material storage
2. Storage system degradation
ARTICLE IN PRESS
3. Marine team degradation of the FPSO CDSM

4. Operation of the stripping pump with offload closed
5. Loss containment flange at the offload of the stripping pump
6. Personnel exposure
7. Ignition of the explosive environment
The investigation report identified 28 root causes and 61 recommendations
were made with the intention of preventing the recurrence of similar acci-
dents. The important lesson to be learned from this is that people has not
adequately learned and implemented lessons from the past in mitigating
human and management failures. Additional information about this incident
can be found in Brazilian National Agency of Petroleum (2015).
It has been found that ineffective safety culture was clearly identified
as the principal underlying cause of recent offshore oil and gas accidents.
Additionally, it is noticeable that lessons learned from past accidents are
not adequately learned, disseminated, and adopted by companies which
have resulted recent in accidents with similar causes. Most recent accidents
could have been avoidable if lessons had been learned and regulations
implemented. Learning from past accidents is not the only way to learn les-
sons for accident prevention and safety management because accidents do
not often occur according to predefined or experienced sequences and sce-
narios and are caused in complex ways with a variety of root causes and
sequences. Owing to this, not all relevant risks may be identified nor known
during risk assessment and safety management. For that reason, in most cases
performance-based (risk-based) regulatory framework was recommended in
addition to prescriptive regulatory framework. Past accidents are sources of
lessons for upgrading safety regulations and several regulations were updated
in the aftermath of accidents around the world. Therefore, lessons learned from
major accidents and incidents, through detailed diagnosis and recommenda-
tions will be helpful in lessening the occurrence of such accidents in the future.
7. HI IN MARINE AND OFFSHORE OPERATIONS

Identification of hazards is a fundamental aspect of safety management
and loss prevention. What has not been identified cannot be analyzed and
assurance of appropriate safeguards cannot be made. Failure to identify,
eliminate, or control hazards can have catastrophic consequences. HI is
done based on physical and chemical properties of the materials, processing
conditions, environmental conditions, arrangements of equipment, and
operating and maintenance procedures. Risk management and safety costs
depend on identified hazards. However, HI is not straightforward in a
ARTICLE IN PRESS
rapidly changing workplace environment because of new technologies and

regulatory frameworks, complex interactions, and new operating condi-
tions. Hazards in a complex processing facility do not remain unchanged
and depend on specific scenarios. Moreover, as oil and gas production moves
to the deeper oceanic environment, the offshore industry needs to handle
new hazards. Safety management increasingly depends on the management
system and it is not always easy to identify its shortfalls (Lees, 2012). Addi-
tionally, the inherent properties of materials that make them hazardous are
often what make them valuable, such as flammability of oil and gas. As a
result, it may be impossible or not cost effective to eliminate all hazards
totally. In such situations, identifying potential hazards and applying ade-
quate safeguards are the key to hazard and safety management.
Currently, various HI methods are available and different methods are
applied at different stages of a project. An illustrative list of project stages
and their corresponding appropriate HI techniques are given in Table 16.
Owing to lack of a single ideal system of HI procedure, a technique specified
for one stage may also be applicable to other stages or may vary depending
upon the type of industry and processes.
Moreover, the purpose of hazard study also determines the choice of HI
techniques. For instance, hazard and operability (HAZOP) technique is suit-
able for identifying hazards and operating problems in plants, while for the
identification of release source hazards, it is necessary to perform a specific
review of such sources (Lees, 2012). The use of standards and codes, and past
experiences help in HI processes.
According to Vinnem (2014b), the purposes of HI are:
• To identify all the hazards associated with the planned operations or
activities.
• To create an overview of the risk picture for planning the further
analysis work.
• To provide an overview of the different types of accidents that may
occur and to document the range of events which give rise to risk.
• To provide assurance, as far as possible, that no significant hazard is
overlooked.
Generally, the following crucial aspects should be included in HI (Vinnem,
2014b):
1. An extensive review of potential hazards and sources of accidents should
be done in order to ensure that no relevant hazards are overlooked.
2. Critical hazards should be identified for subsequent analysis.
3. Explicit statement of the criteria used in the screening of the hazards.
4. Hazards classified as noncritical should be clearly documented.
ARTICLE IN PRESS
Table 16 HI Techniques Appropriate to Different Project Stages

Project Stage HI Technique
All stages Management and safety system audits
Checklists
Feedback from workforce
Research and Screening and testing for
development Chemicals (toxicity, reactivity, and explosiveness)
Reactions (explosiveness)
Impurities
Pilot plant
Predesign Hazard indices
Insurance assessments
Hazard studies (coarse scale)
Design Process design checks
Unit processes
Unit operations
Plant equipment
Pressure systems
Instrument systems
Hazard and operability studies
Safety integrity level (SIL) studies
Level of protection
Chemical interaction matrix
Failure modes and effects analysis
Fault trees and event trees
Hazard analysis
Risk and reliability assessments
Operator task analysis and operating instructions
Commissioning Checks against design, inspection, examination, and testing
Nondestructive testing, condition monitoring
Prestart-up safety review
Plant safety audits
Emergency planning
Operation Inspection, testing
Nondestructive testing, condition monitoring, and corrosion
Plant safety audits
Adapted from Lees, F. (2012). Lees’ loss prevention in the process industries: Hazard identification, assessment and
control. Butterworth-Heinemann.
For direct and indirect HI purposes (studies), different techniques and

approaches are available. An extensive list of HI approaches or techniques
commonly available are as follows (Lees, 2012; Sutton, 2010; Vinnem,
2014b):
ARTICLE IN PRESS
1. Safety audits
2. Checklists
3. Materials properties (physical and chemical properties, material safety
datasheets, etc.)
4. Pilot plants
5. Hazard indices (Dow’s Index, Mond Index, IFAL Index, Dow Chem-
ical Exposure Index, Mortality Index)
6. What-if? Analysis (WiA)
7. Event Tree Analysis (ETA) and Fault Tree Analysis (FTA)
8. Bowtie method (BTM)
9. Preliminary Hazard Analysis (PHA)
10. Screening analysis techniques
11. Hazard and Operability (HAZOP) studies
12. Failure Modes, Effect and Criticality Analysis (FMECA)
13. Sneak analysis
14. Computer HAZOP
15. Human Error Analysis (HEA)
16. Scenario Development (SD)
17. Consequence Analysis (CA)
18. Process Safety Review System (PSRS)
19. Hazard Warning Analysis (HWA)
20. Hazard Ranking Method (HRM)
21. Safety Review System (SRS)
22. Standards (PSM-OSHA, RMP, ARAMIS)
23. Monte Carlo Simulation and Markov Analysis
24. Comparison with detailed studies
25. Experience from previous similar projects, concepts, systems, equip-
ment, and operations
26. Accident and failure statistics
A single HI technique may not be applicable for all stages of a project because
not all HI techniques are applicable to identify all types of hazards. Based on
prime purpose(s), some principal HI methods, applicable to identify hazards
during loss of containment are given in Table 17.
In hazard management process, HI and hazard analysis (HAZAN) are
often intertwined and directly dependent on each other. The hazard man-
agement process mainly consists of four major stages such as HI, hazard eval-
uation, risk-based decision making, and mitigation of hazards and risks as
shown in Fig. 21.
Table 17 Application of Some Techniques for HI for Loss of Containment Events
Purpose
SD, CHS, FMECA, HEA,
Identification of: Checklist SRS WiF HI HRM PPA HAZOP AEA CCA FTA ETA CM HWA
Deviation from good practice Y Y
Hazards Y Y Y Y Y Y
Hazards liable to threaten project viability Y Y
Hazards with potential for large property Y
ARTICLE IN PRESS
damage loss
Hazards requiring priority Y
Worst case accidents Y Y Y
Initiating events Y Y Y Y
Prerelease accidents path Y Y Y Y
Measures to reduce probability of enabling Y Y Y Y
condition, frequency of initiating event
Postrelease escalation paths and outcomes Y
Measures to reduce frequency of consequences Y Y
Measures to mitigate effects of consequences Y
Precursors “warning” events Y
Adapted from Lees, F. (2012). Lees’ loss prevention in the process industries: Hazard identification, assessment and control. Butterworth-Heinemann.
ARTICLE IN PRESS
Fig. 21 Hazard management process. Adapted from Centre for Chemical Process Safety
(CCPS). (2010). A practical approach to hazard identification for operations and mainte-
nance workers. Wiley.
Detailed hazard management processes and various techniques involved

in it can be found in Vinnem (2014b), Lees (2012), Sutton (2010), and
Centre for Chemical Process Safety (CCPS) (2010).
Different types of hazards exist in an offshore installation such as explo-
sion, chemical, electrical, evacuation, asphyxiation, thermal, vibration,
mechanical failure, mechanical, corrosion, noise, radiation, impact, visibil-
ity, and weather-related hazards. Offshore hazards are diverse in nature and
can be identified in relation to any potential accident on an offshore instal-
lation. They include:
1. Loss of position keeping
2. Loss of structural integrity
3. Loss of stability
4. Loss of marine/utility systems
5. Collision
6. Accidents relating to hydrocarbon releases, fires, dropped objects, div-
ing, or other personal hazards.
ARTICLE IN PRESS
For offshore HI purposes, there does not exist a single method that can
be applied for all activity in all phases of a project because of the existence
of a wide range of hazards and limited capability of each technique.
Therefore, marine and offshore industries have been adopting different
methods dependent upon their project stage and operations or activities.
The techniques of hazard assessment used in the onshore chemical indus-
try are reviewed by Witter (1992). Spouge (1999) summarized HI tech-
niques that are commonly used for HI on offshore installations. They are:
1. Hazard review
2. Hazard checklist
3. HAZOP study
4. Procedural HAZOP
5. What-if Analysis
6. Hazard Identification Analysis (HAZID)
7. Failure Modes, Effects and Criticality Analysis (FMECA)
8. Emergency Systems Survivability Analysis
9. Safety inspections and audits
The strengths and weaknesses of these HI techniques are briefly given in
Table 18.
In offshore installations, individual hazard analysis is often carried out
separately according to the specific main hazard. According to Vinnem
(2014b), the widely used individual hazard analyses are:
1. Blowout hazard study
2. Riser/pipeline hazard study
3. Process hazard study
4. Fire and smoke analysis
5. Explosion analysis
6. Dropped object hazard study
7. Collision hazard study
8. Structural failure study
Despite the availability of different HI and analysis techniques, it is found that
HAZOP is widely used in offshore installations. According to Rushton,
Gowers, Edmondson, and Al-Hassan (1994), most companies have developed
their own customized versions of HI techniques and analysis based on the CIA
guidelines (Chemical Industries Association, 1992). More information about
HI and analysis or hazard management in offshore installations can be found in
Vinnem (2014b), HSE (1992), and Spouge (1999).
In a marine vessel, it is difficult to eliminate all on-board hazards because
control facilities, living and working areas, fuel, power generators, and
Table 18 Strengths and Weaknesses of HI Techniques Commonly Used on Offshore Installations
Strengths Weaknesses
Hazard reviews 1. It makes use of any existing experiences 1. Absence of specified structure makes it difficult to
2. A single analyst can perform this at low cost audit
3. It is suitable for concept design due to minimum 2. It has limited value for new novel installations due
information requirement to its dependency on previous experiences
3. A list of failure cases for a Quantitative Risk
ARTICLE IN PRESS
Assessment (QRA) cannot be produced from it
Hazard checklist 1. It is quick and simple to use 1. It does not encourage analysts to consider new or
2. It makes use of existing experience and knowledge unusual hazards
of previous problems 2. It may not be comprehensive, even for standard
3. It is easy to understand and is suitable for operating installations
personnel to carry out 3. It does not produce a list of possible failure cases for
4. It helps to check for compliance with standard a QRA
practice and design intentions
5. It ensures that known hazard areas are fully explored
HAZOP 1. It is well-understood and widely used 1. Its benefit depends on the experience and
2. It uses the experience of operating personnel knowledge of analysts
3. It is systematic and comprehensive and can identify 2. It can be optimized for process hazards and needs
all hazardous process deviations changes to cover other types of hazards
3. It does not produce a list of failure cases for a QRA
4. For complete recording documentation is either
lengthy or difficult to audit (for recording by
exception)
Continued
Table 18 Strengths and Weaknesses of HI Techniques Commonly Used on Offshore Installations—cont’d
Strengths Weaknesses
Procedural HAZOP 1. It is built on the well-understood HAZOP 1. Its benefit depends on the experience of the analysts
approach 2. It requires development of procedural descriptions
2. It uses the experience of operating personnel as part which are usually not available in appropriate detail
of the team 3. Its detailed attention to procedures is difficult to
3. It is systematic and comprehensive and should relate to a QRA, and it does not directly prepare a
identify all hazardous process deviations list of failure cases
4. The team approach is particularly appropriate to 4. For complete recording documentation is either
hazards in simultaneous operations requiring the lengthy or difficult to audit (for recording by
ARTICLE IN PRESS
interaction of several disciplines or organizations exception)
What-if Analysis 1. It is very flexible, and applicable to any type of 1. It is relatively unstructured, and hence may omit
installation, operation, or process hazards and is difficult to audit
2. It uses the experience of operating personnel as part 2. Adequate preparation of a checklist in advance is
of the team critical for the quality of the review
3. It is quick, because it avoids repetitive consideration 3. Its benefit depends on the experience of the leader
of deviations and the knowledge of the team
4. It focuses on consequences rather than causes, and
hence relates rather better to QRA than most hazard
assessment techniques
HAZID 1. It is flexible, and applicable to any type of 1. Guide words require development for each
installation, operation, or process installation, and may omit some hazards
2. It uses the experience of operating personnel 2. Its benefit depends on the experience of the analyst
3. It is quick, because it avoids repetitive consideration
of deviations
4. It is able to cover low-frequency events, and hence
relates better to QRA than most hazard assessment
techniques
FMECA 1. It is widely used and well understood 1. Its benefit depends on the experience of the analyst
2. It can be performed by a single analyst 2. It is optimized for mechanical and electrical
3. It is systematic and comprehensive and can identify equipment and does not apply to procedures or
all potential failures process equipment
4. It identifies safety critical equipment where a single 3. It is difficult for it to cover multiple failure cases and
failure would be critical for the system human errors.
4. It does not produce a list of failure cases for a QRA
5. FMECA is relatively standard for mechanical
ARTICLE IN PRESS
systems
6. It is not normally suitable for overall HI on a facility
Emergency Systems 1. It makes use of any existing experiences and past 1. It often places more emphasis on safety critical
Survivability lessons learned hazards
Analysis 2. It helps to avoid overoptimistic assumptions about 2. Its effectiveness depends on the experience of
the effectiveness of emergency systems analysts
Safety Inspections 1. It makes use of any existing experiences 1. Its benefit depends on the experience and
and Audits 2. A single analyst can perform this at low cost knowledge of analysts
3. It helps to check for compliance with standard 2. It has limited value for new novel installations due
practice and design intentions to its dependency on previous experiences
Adapted from Spouge, J. (1999). A guide to quantitative risk assessment for offshore installations. CMPT Aberdeen, SD.
ARTICLE IN PRESS
emergency systems are within the vessel (Bai, 2003). Additionally, the vessel
could experience different types of hazards at different phases of operation.
Marine vessels are of several types and each type has its own hazards. For any
ships, important hazard categories such as collision and grounding, fire,
explosion, loss of structural integrity, loss of power, hazardous material,
loading errors, and extreme environmental condition can be identified
(Bai, 2003). Each of these categories may have a complex set of hazards
resulting from different factors.
In marine operations, typically an HI is performed by a selected profes-
sional team with the objective of identifying all conceivable and relevant
hazards (Bai & Jin, 2016). The team may consist of several professionals
such as naval architects, surveyors, human factor engineers, structural engi-
neers, machinery engineers, marine officers, and a meeting moderator.
Moreover, the hazards can be identified using historical accident databases
and the expertise of the team. The identified hazardous scenarios can be
ranked by their risk levels, and critical hazards are given priority by detailed
analysis.
According DNV Recommended Practice no. DNV-RP-H101 (Det
Norske Veritas (DNV), 2003), the following HI techniques and methods
are recommended for marine operations:
1. HAZID
This is used to identify and evaluate hazards at an early phase of a pro-
ject and to determine the marine operations concept and methods. The
identification of hazards at an early stage helps in selection of the most
advantageous procedures or design. Additionally, it is used to identify
and evaluate hazards in existing operational procedures and it may be
a useful technique to reveal weaknesses in the design and operational
detail procedures. It may be conducted in conjunction with a pres-
creening study and is also used as a tool for assessing the potential risks
the operation initially represents.
2. Early procedure HAZOP (EPH)
EPH is an interdisciplinary, systematic approach to identify hazards
and operability problems for the planned marine operations procedure.
It is a simplified version of a procedure HAZOP performed at a prelim-
inary stage before design and procedures are finalized. It is commonly
used as a tool in the development of marine operations procedures
and is typically performed when a draft procedure is available. EPH
can be combined with design review (DR).
ARTICLE IN PRESS
3. DR
DR is a systematic approach to review a particular design solution. It
is used as a tool in the development of design solutions. Moreover, it is
used to reveal weaknesses in design of a system, structure, or component.
4. System HAZOP
It is applicable to marine systems critical to the successful execution of
marine operations such as hydraulics, ballast systems, and essential elec-
trical systems. This technique is a systematic step-by-step method where
the main principle is the definition of “design intent” and the use of suit-
able predetermined parameters and guide words in order to try to iden-
tify possible deviations from the “design intent.” Emphasis shall be put
on identification of contingencies.
5. FMEA/FMECA
It is a structured review technique to identify and analyze potential
failure modes and effects associated with a particular system under con-
sideration. This is used for critical and/or complex systems used during
marine operations (ballast systems). At first, this technique tries to iden-
tify all possible undesirable consequences that could occur and then
identify failure modes and hazards that would cause that consequence.
All reasonably foreseeable failure modes and hazards shall be included
in this approach.
6. Procedure HAZOP
It is an interdisciplinary, systematic approach to identify hazards and
operability problems for the planned marine operations procedure. It is
a tool used for avoiding accidents and incidents and thereby tries to fulfill
the zero incident target philosophy. It is applicable to all marine operations.
7. Semiquantitative Risk Analysis (SQRA)
It is a semiquantitative risk assessment, which may be used in com-
bination or part with other hazard review techniques (EPH, HAZID,
and/or HAZOP). The results of a SQRA are tabulated in predefined
forms, which may be used as input to, or part of the Hazards Register
(Risk Register) for the project. Its main purpose is to subjectively assess
the risk and criticality of operations in order to identify the most critical
activities. Risk or criticality is subjectively assessed normally by an eval-
uation team consisting of several qualified persons.
8. Safe Job Analysis (SJA)
It is used to identify measures to reduce hazards and risk for a partic-
ular work task or activity. It is particularly relevant for work tasks and
ARTICLE IN PRESS
activities not adequately covered by operational procedures and for work

involving several work groups, work tasks, or activities in the same area.
It shall be performed by the actual personnel involved in the tasks or
activity.
Depending upon vessel type, its function and operational modes, the suit-
ability of HI techniques can be determined. In order to have suitable and
sufficient hazard analysis, most companies use their own customized HI
techniques. Additional information about HI in marine vessels can be found
in Bai (2003) and Det Norske Veritas (DNV) (2003).
8. REVIEW OF TECHNIQUES AVAILABLE

FOR SAFETY ANALYSIS OF MARINE AND OFFSHORE
OPERATIONS
It is an indisputable truth that maritime and offshore industries have
achieved remarkable improvement in safety management. However, recent
major accidents have demonstrated that significant risks still prevail in these
industries. This is due to emerging risks resulting from new designs, new
facilities, or vessels and new operating conditions in a rapidly changing
global social, economic, and political atmosphere. Accidents continue to
occur without adequate and effective safety analysis. Safety analysis is a com-
plex activity involving rigorous HI process, risk analysis, and management.
The purposes of safety analysis are mainly assessment of risks in relation to
plant siting, that is the identification, elimination, or reduction, and control
of hazards in design of a new plant and the same for an existing plant (Lees,
2012). Alternatively, safety analysis is used for studying the risk of a system
considering the probability of occurrence of each hazard and its possible
consequences. The safety analysis identifies safety deficiencies which in most
cases will lead to incidents, but does not predict incidents (Lees, 2012).
Safety analysis can be generally divided into two broad categories,
namely, quantitative and qualitative analyses (Wang & Ruxton, 1997).
Choice of a quantitative or a qualitative safety analysis depends on the safety
data available to the analyst and the main purpose of analysis. However, in
most safety analyses, both qualitative and quantitative analyses are used
together to produce a fairly comprehensive safety analysis.
Qualitative safety analysis is a descriptive approach and depends upon the
judgment skills of analysts to determine the consequence and probability of
risk. Often qualitative analysis is performed before the quantitative analysis
ARTICLE IN PRESS
because it forms the base for the data analytical approach. This analysis is used
to identify possible hazards that affect the safety of a product, system, oper-
ation, or person and to determine proper precautions that may reduce the
frequencies or consequences of such hazards. This method heavily depends
on engineering judgment and past experience because this approach does
not need failure data as an input to the analysis.
Generally, in qualitative safety analysis, a risk matrix method is used. The
risk matrix method is prepared using two parameters, namely the occurrence
likelihood of the failure event and the severity of its possible consequences.
Each identified hazard is evaluated using these two parameters and the sever-
ity of all the failure events can be assessed in terms of four categories, namely,
negligible, marginal, critical, and catastrophic (Pillay & Wang, 2003). The
occurrence likelihood of an event is assessed qualitatively as frequent, prob-
able, occasional, remote, or improbable as given in Table 19, and each of
these categories can be represented quantitatively by a range of probabilities.
In this method, a high priority is given to hazard with catastrophic conse-
quence and high probability of occurrence or vice versa. According to this
logic, certain acceptable criteria are developed for all identified hazards.
These hazards can be prioritized corresponding to safety and reliability
objectives by appropriate hazard indices using the hazard severity and the
corresponding hazard probabilities as shown in Table 19. All the hazards
identified in the system can be evaluated in order to produce a risk ranking.
Table 19 Priority Matrix Based on Hazard Severity and Hazard Probability

Hazard Severity
Hazard Probability (1) Negligible (2) Marginal (3) Critical (4) Catastrophic
(A) Improbable 1A 2A 3A 4A
(x < 10 6)
(B) Remote 1B 2B 3B 4B
(10 3 > x > 10 6)
(C) Occasional 1C 2C 3C 4C
(10 2 > x > 10 3)
(D) Probable 1D 2D 3D 4D
(10 1 > x > 10 2)
(E) Frequent (x > 10 1) 1E 2E 3E 4E
Adapted from Military Standard. (1980). Procedures for performing a failure mode, effects and criticality analysis,
MIL-STD-1629. November, AMSC Number N3074.
ARTICLE IN PRESS
This method’s focus is less precise than quantitative because in this

analysis, a risk probability is described in accordance with the likelihood
criteria. It mainly verifies the correct interpretation and application of the
safety design criteria established by HI process.
According to Pillay and Wang (2003), quantitative safety analysis uses
known information and assumes the failure characteristics of each individual
component in order to build a mathematical model that is associated with
some, or all, of the following information:
1. Failure rates
2. Repair rates
3. Mission time
4. System logic
5. Maintenance schedules
6. Human error.
The occurrence probability of each system failure event and the magnitude
of potential consequences are to be obtained and quantified in this method.
Event probabilities can be calculated using either statistical, extrapolation, or
expert judgment and failure probability distributions can be calculated using
various methods such as beta, exponential, gamma, lognormal, normal, tri-
angular, uniform, and Weibull distributions. The likely consequence of a
system failure event is quantified in terms of the possible loss of lives and
property damage, and the environment degradation caused by the occur-
rence of the failure event (Wang, 2003). Using the severity of failure event
consequences, safety analysis of the considered system can be performed.
This method often produces a more developed safety model and more accu-
rate projections, depending on the quality of input data. Wang and Ruxton
(1997) reviewed various safety analysis techniques applied to the design
process and developed a possible interrelation of those methods as shown
in Fig. 22. In safety analysis, those methods can be applied individually or
in combination depending upon the safety system requirement.
The content of safety analysis is studied in terms of four main elements:
(1) HI, (2) quantitative risk assessment, (3) remedial measures, and (4)
resources (Pillay & Wang, 2003). Therefore, a robust safety analysis can only
be conducted with appropriate HI, risk assessment, corrective measures, and
adequate resources. An effective safety analysis depends on a number of
phases and their adequate consideration. Often potential deficiencies exist
in each phase and impact on the quality of the analysis. Some of these phases
and examples of possible deficiencies are listed in Table 20.
ARTICLE IN PRESS
Engineering product description
Preliminary hazard analysis
Fault tree analysis Event tree analysis Diagraph-based analysis
Cause-consequence analysis
Frequency–consequence representation
Simulation Subjective reasoning assessment

analysis
Decision table analysis

Failure mode, effect, and (Boolean Representation)
criticality analysis
HAZOP Qualitative
reasoning
Historical data
Event likelihood and
Failure data banks consequence
severity
Expert judgment
Fig. 22 Information flow diagram of safety analysis methods. Adapted from Wang, J., &
Ruxton, T. (1997). A review of safety analysis methods applied to the design process. Journal
of Engineering Design, 1997;8: 131–152.
In order to avoid possible deficiencies and quality assessment of the safety

analysis, a checklist can be used as shown in Table 21.
Besides these qualitative and quantitative approaches, there are several
techniques available for safety analysis. The most extensively used techniques
are Preliminary Hazard Analysis, Fault Tree Analysis, Failure Mode,
Effects and Criticality Analysis, Hazard and Operability Studies, Decision
Table Analysis, Event Tree Analysis, Cause-Consequence Analysis, Subjective
Reasoning Analysis, Diagraph-Based Analysis, and Simulation (Quantitative
simulation and Qualitative simulation).
Safety analysis is very important in marine vessels and offshore facilities as
they are inherently hazardous due to the large amount of flammable
chemicals, congested areas with complex piping and oceanic environmental
ARTICLE IN PRESS
Table 20 Some Potential Deficiencies in a Safety Analysis (Rouhiaiuen, 1990)

Phase of Analysis Examples of Possible Deficiencies
System definition Correlation between the plant and its
descriptions not checked
Important parts of the production system not
included in the analysis
Important production situations not taken into
account
HI Important hazard types omitted
Methods used do not cover all hazards
Accident modeling Important accident chains not modeled
Important contributing factors omitted
Estimation of accident The data used are inaccurate
Frequencies Incorrect subjective judgments used
Accuracy of the results not evaluated
Estimation of accident Simplification made is incorrect
Consequences Model used not suitable to the situation studied
Risk estimation More reliable toxicity data might be available
Emergency provisions overestimated or
underestimated
Documentation Description of the object is inadequate
Initial assumptions not presented
Measures after the analyses Measures presented not implemented
No plan for updating the analysis
conditions. Any malfunction and mishap on their safety critical units may
lead to catastrophic accidents. Safety of marine vessels and offshore facilities
depends on complex interaction of several factors and safety analysis may
not be straight forward nor easy. Currently, for safety analysis, various
approaches and techniques are in use and effectiveness of these methods is
not easy to assess. In order to manage safety and prevent accidents, various
approaches are being adopted in maritime and offshore industries such as for-
mal goal setting safety assessment (Cooper, 2000), safety case approach
(Bishop & Bloomfield, 2000; Wang, 2002), formal safety assessment (FSA)
(Hu, Fang, Xia, & Xi, 2007; Kontovas & Psaraftis, 2009; Wang, 2001), risk-
based assessment (Khan, Sadiq, & Husain, 2002; Papanikolaou, 2009; Wang
ARTICLE IN PRESS
Table 21 Checklist for Quality Assessment of a Safety Analysis
1. Preparation of the analysis

a. Selection of the object
b. Restriction and definition of the object
c. Definition of the goals
d. Organization of the safety analysis
2. Initiating the safety analysis
3. Selection of methods and performance of the analysis
a. Identification of hazards
i. General aspects
ii. Equipment
iii. Processes and materials
iv. Organization of the object
v. Human activities
b. Modeling of accidents
c. Estimation of accident frequencies
d. Estimation of consequences
i. Calculation of consequences
ii. Emergency preparedness
e. Estimation of risk
f. Planning of remedial measures
4. Report of the safety analysis
a. Description of the object
b. Description of the analysis
c. Results of the analysis
d. Description of the proposed measures
5. Measures after the analysis
a. Measures to be taken in the object under analysis
b. Information about analysis results
c. Plans for reviewing and updating the analysis
d. Follow-up
Adapted from Rouhiaiuen, V. (1990). The quality assessment of safety analysis, Sl.
et al., 2004), risk-based maintenance (Bhandari, Arzaghi, Abbassi, Garaniya, &

Khan, 2016; Khan & Haddara, 2004), and inherent safety approach
(Baalisampang, Khan, Garaniya, Chai, & Abbasi, 2016; Heikkil€a, 1999;
Tugnoli, Khan, Amyotte, & Cozzani, 2008).
Additionally, accident scenario modeling has been used extensively in
safety management and accident prevention because it not only provides
ARTICLE IN PRESS
lessons from past accidents but also provides measures that can be taken in
preventing the recurrence of such events in the future and in communicat-
ing risk more efficiently (Nivolianitou, Leopoulos, & Konstantinidou,
2004). Predictive accident modeling has been attractive in safety analysis using
probabilistic approaches such as Bayesian Networks (Baksh, Abbassi,
Garaniya, & Khan, 2016; Bhandari, Abbassi, Garaniya, & Khan, 2015; Yeo
et al., 2016), fuzzy logic using fault tree and event tree (Markowski, Mannan,
& Bigoszewska, 2009), bowtie (Abimbola, Khan, & Khakzad, 2014), Petri
Net (Leveson & Stolzy, 1987), and Markov Chain Monte Carlo (MCMC)
simulation (Abbassi, Khan, Khakzad, Veitch, & Ehlers, 2017; Faghih-
Roohi, Xie, & Ng, 2014), which may provide comprehensive safety
analysis and precise information in the process of decision making in risk
management. These approaches work effectively even under uncertainty
and data scarcity.
Conventional QRA approach does not have the ability to update risk
profile using accident precursor information during the life of a process
and cannot adequately model high impact low-frequency events. In order
to model the risk of such events, dynamic risk modeling and assessment
methods have been proposed based on advanced probabilistic methods
(Kalantarnia, Khan, & Hawboldt, 2009; Khakzad, Khan, & Amyotte,
2013). Adoption and application of those concepts from the design stage
of any processing facility may help build robust and cost-effective safety sys-
tems. In some particular circumstances, there are some safety analysis
methods that can be used such as Markov techniques (Billinton & Allan,
1992), network modeling techniques (Misra, 2012), and limit state reliability
analysis (Wang, Labrie, & Ruxton, 1993).
Currently, due to availability of high performance computers and
modeling software, computational fluid dynamics (CFD) approaches have
been used to model and assist in understanding complex accident scenarios.
For modeling different hazards such as fire, explosion, and toxic releases, dif-
ferent well validated and verified CFD codes are available. Baalisampang,
Abbassi, Garaniya, Khan, and Dadashzadeh (2017) assessed impact of fire
in a typical FLNG processing facility using Fire Dynamics Simulator.
Dadashzadeh, Abbassi, Khan, and Hawboldt (2013) modeled and analyzed
BP Deepwater Horizontal explosion using Flame Acceleration Simulator
(FLACS). Dadashzadeh, Khan, Abbassi, and Hawboldt (2014) assessed risk
due to combustion products toxicity in an offshore facility using FLACS.
Careful application of CFD codes enables understanding and prediction
of a potential accident and its consequences and may provide helpful insight
ARTICLE IN PRESS
into safety analysis. In this ways, the safety analysis scope has been broadened
by considering accident scenarios, CFD tools, and proactive approaches in
order to analyze likelihood of potential accidents and to take actions to
prevent them.
Human and organizational error has been considered as a major contrib-
uting factor for maritime and offshore accidents. Prevention of all underly-
ing causes of human and organization error is a crucial part of safety
management. Various studies have been considered focusing on human cen-
tered design (Boy, 2012), human error modeling (Whittingham, 2004;
Noroozi, Khakzad, Khan, MacKinnon, & Abbassi, 2013), human error
probability (Islam, Abbassi, Garaniya, & Khan, 2016, 2017), and
mitigation of human error in offshore operations (Deacon, Amyotte, &
Khan, 2010; Skogdalen & Vinnem, 2011). For human error likelihood
assessments, different approaches such as the Human Error Assessment
and Reduction Technique (HEART), the Technique for Human Error
Rate Prediction (THERP), and the Success Likelihood Index Method
(SLIM) are used (Abbassi et al., 2015; Islam, Khan, Abbassi, & Garaniya,
2017; Noroozi, Abbassi, Khan, & MacKinnon, 2010). In most cases, human
errors are caused by the growing imbalance between system reliability and
human reliability. In order to overcome this imbalance, the science of ergo-
nomics has been evolved which focuses on addressing how the design of the
interface between human and machine could take more account of human
capabilities and maximize human performance thereby reducing the prob-
ability of human error (Karwowski, 2012). This helps to prevent human
action becoming out-of-tolerance in terms of exceeding acceptable limit for
a desired system function (Whittingham, 2004). The American Bureau of
Shipping (ABS) (2014) proposed Human Factors Engineering or Ergonomics
Model that may influence the safety and efficiency in human performance.
There are several national and international regulations or standards
related to HI and safety management. For instance, the Occupational Safety
and Health Administration (OSHA) has issued the standards of Process
Safety Management (PSM) of highly hazardous chemicals, to make the
workplace safer (Lees, 2012). The standards provide a comprehensive frame-
work which combine technologies, procedures, and practices to manage the
hazards related to hazardous chemicals. The PSM investigates any threat
posed by the release of hazardous chemicals through reviewing what can
go wrong and what safeguards are needed to avoid such hazardous releases
(Lees, 2012). In Europe, Accidental Risk Assessment Methodology for
Industries (ARAMIS) are used to assess the risk level of industrial
ARTICLE IN PRESS
establishments by considering prevention methods (Delvosalle, Fievez,

Pipart, & Debray, 2006). The risk level is characterized by three factors
namely, consequence severity evaluation, prevention management effi-
ciency, and environment vulnerability estimation (Lees, 2012). The
ARAMIS aims to develop a novel risk assessment methodology by integrat-
ing strong points of various methods used in European countries to promote
safety in industry.
An offshore processing facility or a ship is a complex engineering struc-
ture consisted of several systems and can be unique with its own design or
operational features (Wang & Ruxton, 1997). There is the need to con-
stantly adopt new approaches and new technology and each new compo-
nent may present a new hazard in one form or another. Thus, safety
assessment needs to include all possible hazards. Depending on the degree
of uncertainty and the availability of failure data, appropriate methods need
to be applied individually or in combination to deal with all hazardous cases.
Absence of reliable safety data and lack of confidence in safety assessment
have been identified as the two major issues in safety analysis (Noauthor,
2003). In order to solve such problems, development of novel techniques
and flexible safety assessment approaches can be recommended in order
to adequately deal with uncertainty and also to apply decision-making tech-
niques on a rational basis.
Recent developments in computer technology and software have played
a positive role in controlling and managing jobs to mitigate human error and
to provide operators with a better working condition in facilities or ships.
However, on the other hand, the development of software intensive systems
and their utilization have introduced new failure modes and generated
problems in the development of safety critical systems (Wang, 2001).
Therefore, in FSA, every safety critical system should be included to make
sure that the use of software does not compromise safety of the system and
provides evidence that the risk associated with such software is acceptable
(Wang, 1997).
There is no single method or framework that can covers all aspects of
safety analysis in marine and offshore operations due to their diversity in
operations and designs. Most companies use their own customized inte-
grated safety analysis techniques in order to ensure suitable and sufficient
safety management. Despite consistent efforts, accident statistics in maritime
and offshore oil and gas productions indicate that safety management can be
challenging and a more robust safety analysis is required particularly for
deepwater operations and newly built vessels. To overcome such challenges
ARTICLE IN PRESS
and to improve marine and offshore safety analysis, it is recommended that

safety analysis in relation to human factors, software-driven controls, com-
puter simulation techniques, subjective safety assessment method, and
techno-economic modeling need further study.
9. PURPOSE AND ORGANIZATION OF THIS VOLUME

The purpose of this volume is to provide methods, models, and case
studies to assist better understanding and improvement in safety of marine
and offshore systems. The focus of the volume is on quantitative aspects
of safety of marine and offshore environments.
Marine mobile systems such as ships have existed forever. Their safety in
design, operations, and maintenance has been widely studied, whereas
marine systems such as drilling rigs and offshore production systems are rel-
atively new. Special attention is given to the offshore oil and gas develop-
ment system.
Special topic on the regulations of the offshore environment is also
covered to provide the reader with a deeper understanding and comparative
evaluation of different regulatory regimes. This chapter provides some
lessons learned through past accidents and the subsequent evolution of
safety.
Drilling operations are known to be one of the most hazardous opera-
tions in the marine environment and this is also looked into from safety
perspectives.
Owing to remote and prolonged isolation, human factor plays a critical
role in the safety of marine systems. A dedicated chapter is devoted in
this volume to study the human factor. It is considered through a quantita-
tive and objective qualitative approach to allow better understanding of
human interactions with machines in remote areas and the harsh prolonged
isolation.
In modern times, processing plants are moving offshore, Prelude, one of
the largest offshore LNG facilities, has just begun its operation. A chapter is
dedicated to better understanding of hazard potential and risk management
strategies for this operation.
Transportation through pipelines in the ocean environment is another
challenge for both safety and environment protection. A chapter explaining
details of modern pipeline design is also included in this volume, considering
safety as a central theme.
ARTICLE IN PRESS
REFERENCES
Abbassi, R., Khan, F., Garaniya, V., Chai, S., Chin, C., & Hossain, K. A. (2015). An inte-
grated method for human error probability assessment during the maintenance of off-
shore facilities. Process Safety and Environmental Protection, 94, 172–179.
Abbassi, R., Khan, F., Khakzad, N., Veitch, B., & Ehlers, S. (2017). Risk analysis of offshore
transportation accident in arctic waters. International Journal of Maritime Engineering, 159,
A213–A224.
Abdolhamidzadeh, B., Abbasi, T., Rashtchian, D., & Abbasi, S. A. (2011). Domino effect in
process-industry accidents—An inventory of past events and identification of some pat-
terns. Journal of Loss Prevention in the Process Industries, 24, 575–593.
Abimbola, M., Khan, F., & Khakzad, N. (2014). Dynamic safety risk analysis of offshore dril-
ling. Journal of Loss Prevention in the Process Industries, 30, 74–85.
Abowei, J., & Ezekiel, E. (2013). Effects of industrial activities on zooplankton species com-
position in Koluama area, Niger Delta area, Nigeria. Scientia, 2, 72–76.
Acha, V., & Finch, J. (2005). Paths to deepwater in the international upstream petroleum industry,
technology, knowledge, and the firm: Implications for strategy and industrial change. UK: Edward
Elgar Publishing Limited, (p. 73).
Aghalino, S., & Eyinla, B. (2009). Oil exploitation and marine pollution: Evidence from the
Niger Delta, Nigeria. Journal of Human Ecology, 28, 177–182.
Akten, N. (2006). Shipping accidents: A serious threat for marine environment. Journal of
Black Sea/Mediterranean Environment, 12, 269–304.
Albaiges, J., Bernabeu, A., Castanedo, S., Jimenez, N., Morales-Caselles, C., Puente, A.,
et al. (2015). The prestige oil spill. In Handbook of oil spill science and technology
(pp. 513–545). Wiley.
Allianz Global Corporate and Specialty. (2017). Safety and shipping review 2017. Munich,
Germany.
Almar-Naess, A., Haagensen, P., Lian, B., Moan, T., & Simonsen, T. (1984). Investigation of
the Alexander L. Kielland failure—Metallurgical and fracture analysis. Journal of Energy
Resources Technology, 106, 24–31.
American Bureau of Shipping (ABS). (2014). Guidance notes on the implementation of human
factors engineering into the design of offshore installations. Houston, TX 77060, USA.
American Oil and Gas Historical Society (AOGHS). (n.d.). Offshore petroleum history. Washington,
DC: American Oil and Gas Historical Society.
Arendt, F., Haasis, H., & Lemper, B. (2010). Shipping statistics yearbook 2010: Shipping market,
shipbuilding, ports and sea canals. Institute of Shipping Economics and Logistics (ISL):
Bremen.
Arnold KE, Koszela P, Viles J. Improving safety of production operations in the US OCS.
Offshore technology conference, 1989.
Asbjørnslett, B., Hassel, M., & Hole, L. (2010). A comparative study of vessel accident data-
bases from a risk management perspective. In Reliability risk and safety back to the future
(pp. 1167–1173). Taylor & Francis.
ATSB. (2002). Independent investigation into the ballast tank explosion and subsequent fatalities on
board the Hong Kong registered bulk carrier Nego Kim at Dampier WA on 18 November 2001.
Australian Transport Safety Bureau.
Austin, D., Carriker, B., McGuire, T., Pratt, J., Priest, T., & Pulsipher, A. (2008). History of
the offshore oil and gas industry in southern Louisiana, volume III: Morgan City’s history in the era
of oil and gas: Perspectives of those who were there. US Department of the Interior, Minerals Man-
agement Service, Gulf of Mexico OCS Region (p. 44). New Orleans, LA: OCS Study MMS.
Australia Government Federal Register of Legislation. (2010). Offshore petroleum and green-
house gas storage (safety) regulations 2009.
Baalisampang, T., Abbassi, R., Garaniya, V., Khan, F., & Dadashzadeh, M. (2017). Fire
impact assessment in FLNG processing facilities using computational fluid dynamics
(CFD). Fire Safety Journal, 92, 42–52.
ARTICLE IN PRESS
Baalisampang, T., Abbassi, R., Garaniya, V., Khan, F., & Dadashzadeh, M. (2018). Review
and analysis of fire and explosion accidents in maritime transportation. Ocean Engineering,
158, 350–366.
Baalisampang, T., Khan, F., Garaniya, V., Chai, S., & Abbasi, R. (2016). An inherently safer
layout design for the liquefaction process of an FLNG plant. International Journal of
Maritime Engineering, 158(Pt. A2), 91–102.
Bai, Y. (2003). Marine structural design. Elsevier.
Bai, Y., & Jin, W.-L. (2016). Chapter 41—Formal safety assessment applied to shipping industry
(pp. 765–780). Oxford: Butterworth-Heinemann.
Baksh, A. A., Abbassi, R., Garaniya, V., & Khan, F. (2016). A network based approach to
envisage potential accidents in offshore process facilities. Process Safety Progress, 36(2),
1–14.
Baltic Sea Maritime Incidence Response Group (MIRG). (2017). Baltic sea MIRG project
2014–2016 ship fire incident analysis. The Finnish Border Guard, Ministry for Foreign
Affairs of Finland.
Beittel, R., & Atkins, S. (2000). Measuring safety and environmental performance in the US offshore
oil and gas industry. Society of Petroleum Engineers.
Bennett, G., Eriksen, R., & Madsen, H. O. (2014). Enhancing offshore safety and environmental
performance–key learnings from major offshore accidents. World Petroleum Congress.
Berlingieri, F. (1982). Work of the Comite Maritime International: Past, present, and future.
57 Tulane L.R. 1260.
Bhandari, J., Abbassi, R., Garaniya, V., & Khan, F. (2015). Risk analysis of deepwater drilling
operations using Bayesian network. Journal of Loss Prevention in the Process Industries, 38,
11–23.
Bhandari, J., Arzaghi, E., Abbassi, R., Garaniya, V., & Khan, F. (2016). Dynamic risk-based
maintenance for offshore processing facility. Process Safety Progress, 35, 399–406.
Biewer FN, Wallin Jr HN. Minimizing the offshore risk. Offshore technology conference,
1970.
Billinton, R., & Allan, R. N. (1992). Reliability evaluation of engineering systems. Springer.
Birpınar, M. E., Talu, G. F., & G€ onençgil, B. (2008). Environmental effects of maritime traf-
fic on the İstanbul strait. Environmental Monitoring and Assessment, 152, 13.
Bishop, P., & Bloomfield, R. (2000). A methodology for safety case development (pp. 34–42).
Taylor & Francis.
Boisson, P. (1999). Safety at sea: Policies, regulations and international law (pp. 536). Paris, France:
Bureau Veritas.
Boy, G. A. (2012). Orchestrating human-centered design. London: Springer-Verlag.
Bratspies, R. M. (2011). A regulatory wake-up call: Lessons from BP’s Deepwater Horizon
Disaster. Golden Gate University Environmental Law Journal, 5(1), 7–54.
Brazilian National Agency of Petroleum. (2015). Investigation report of the explosion incident
occurred on 11/02/2015 in the FPSO CIDADE DE SÃO MATEUS.
BSU. (2014). Investigation report 255/12: Fire and explosion on board the MSC Flaminia on 14 July
2012 in the Atlantic and the ensuing events. Germany: Federal Bureau of Maritime Casualty
Investigation.
Bucas, G., & Saliot, A. (2002). Sea transport of animal and vegetable oils and its environmen-
tal consequences. Marine Pollution Bulletin, 44, 1388–1396.
Bull, J. W. (1966). An introduction to safety at sea. Brown, Son & Ferguson.
Burgherr, P., Eckle, P., Hirschberg, S., & Cazzoli, E. (2011). Final report on severe accident risks
including key indicators, secure deliverable. (p. 7.2).
Casal, J., & Darbra, R.-M. (2013). Analysis of past accidents and relevant case histories,
domino effects in the process industry: Modelling, prevention, and managing (pp. 12–29).
Amsterdam, The Netherlands: Elsevier.
Celik, M., Lavasani, S. M., & Wang, J. (2010). A risk-based modelling approach to enhance
shipping accident investigation. Safety Science, 48, 18–27.
ARTICLE IN PRESS
Centre for Chemical Process Safety (CCPS). (2010). A practical approach to hazard identification
for operations and maintenance workers. Wiley.
Chadwell, L. J., Blundon, C., Anderson, C., & Cacho, M. (2000). Incidents associated with oil
and gas operations: Outer continental shelf 1998. U.S. Department of the Interior Minerals
Management Service Engineering and Operations Division.
Chandrasekaran, S. (2016). Health, safety, and environmental management in offshore and petroleum
engineering. John Wiley & Sons.
Chemical Industries Association. (1992). A guide to hazard and operability studies. Chemical
Industries Association.
Chen, W. (2013). Design and operation of anchor handling tug supply vessels (AHTS). Norway:
University of Stavanger.
Cheng, R., Wang, H., Shi, L., Ge, Y., Sun, Z., & Tian, H. (2013). Drilling risk management in
offshore China: Insights and lessons learned from the deepwater horizon incident.
Childs, M., & Sipkema, A. W. (2006). Hydrocarbon gas storage tank blanketing for FPSOs to elim-
inate VOC emissions. Society of Petroleum Engineers.
Christou, M., & Konstantinidou, M. (2012). Safety of offshore oil and gas operations: Lessons from
past accident analysis (pp. 1–60). Joint Research Centre of the European Commission.
Cooper, M. D. (2000). Towards a model of safety culture. Safety Science, 36, 111–136.
Corovic, B. M., & Djurovic, P. (2013). Research of marine accidents through the prism of human
factors (pp. 25). Promet-Traffic & Transportation.
Cramer, R., DeLamos, S., Divel, L., & O’Rourke, J. S. (2011). Carnival cruise lines: Fire
aboard a stranded cruise ship. Journal of Organizational Behavior Education, 4, 65–78.
Crichton, M. T., Lauche, K., & Flin, R. (2008). Learning from experience: Incident man-
agement team leader training. Naturalistic Decision Making and Macrocognition, 103,
103–120.
Critch, L., Loucks-Atkinson, A., Parsons, J., & MacKinnon, S. (2010). In A human factors
approach to understanding the risk factors contributing to fatigue in the Atlantic Canada shipping
industry Proceedings of the company of master mariners of Canada.
Cullen, W. (1990). Report of the official inquiry into the Piper Alpha disaster. London: HMSO.
Dadashzadeh, M., Abbassi, R., Khan, F., & Hawboldt, K. (2013). Explosion modeling and
analysis of BP deepwater horizon accident. Safety Science, 57, 150–160.
Dadashzadeh, M., Khan, F., Abbassi, R., & Hawboldt, K. (2014). Combustion products tox-
icity risk assessment in an offshore installation. Process Safety and Environmental Protection,
92, 616–624.
Dale, M., Keown, R., & Wilson, G. (2013). Following the safe evacuation of all offshore person-
nel... the environmental response takes primacy: Learning from The Elgin G4 well major incident.
Society of Petroleum Engineers.
Darbra, R.-M., & Casal, J. (2004). Historical analysis of accidents in seaports. Safety Science,
42, 85–98.
Deacon, T., Amyotte, P. R., & Khan, F. I. (2010). Human error risk analysis in offshore
emergencies. Safety Science, 48, 803–818.
Dechy, N., Dien, Y., Funnemark, E., Roed-Larsen, S., Stoop, J., Valvisto, T., et al. (2012).
Results and lessons learned from the ESReDA’s accident investigation working group:
Introducing article to “safety science” special issue on “industrial events investigation”.
Safety Science, 50, 1380–1391.
Deepwater Horizon Study Group (DHSG). (2011). Final report on the investigation of the Mac-
ondo Well Blowout.
Delvosalle, C., Fievez, C., Pipart, A., & Debray, B. (2006). ARAMIS project:
A comprehensive methodology for the identification of reference accident scenarios
in process industries. Journal of Hazardous Materials, 130, 200–219.
Det Norske Veritas (DNV). (2003). Risk management in marine-and subsea operations.
Recommended Practice No. DNV-RP-H101 Det Norske Veritas.
ARTICLE IN PRESS
Devanney, J. (2008). Uses and abuses of ship casualty data. Center for Tankship Excellence. July.
Available at www.c4tx.org.
Dhillon, B. (2010). Safety in offshore industry, mine safety: A modern approach. Springer,
(pp. 123–133).
Dickerson, T. A. (2013). The cruise passenger’s rights and remedies 2014: The COSTA
CONCORDIA disaster: One year later, many more incidents both on board megaships
and during risky show excursions. Tulane Maritime Law Journal, 38, 515.
DMAIB. (2012). Marine accident report Charlotte Maersk Fire 7 July 2010. Danish Maritime
Accident Investigation Board.
Donhaiser, J. N. (1954). Offshore fire and safety protection. American Petroleum Institute.
Duhaime, L. (2010). Lex Rhodia: The ancient ancestor of maritime Law-800 BC. Law Museum–
Duhaim.org.
Durand, J. G. (2016). OCS performance measures 2015 index charts. Bureau of Safety and
Environmental Enforcement (BSEE).
Eleftheria, E., Apostolos, P., & Markos, V. (2016). Statistical analysis of ship accidents and
review of safety level. Safety Science, 85, 282–292.
Eliopoulou, E., & Papanikolaou, A. (2007). Casualty analysis of large tankers. Journal of Marine
Science and Technology, 12, 240–250.
Ellis, J. (2010). Undeclared dangerous goods—Risk implications for maritime transport.
WMU Journal of Maritime Affairs, 9, 5–27.
Ellis, J. (2011). Analysis of accidents and incidents occurring during transport of packaged
dangerous goods by sea. Safety Science, 49, 1231–1237.
Environmental Protection Agency-Occupational Safety and Health Administration, &
Environmental Protection Agency. (1996). MOU between the United States Environmental
Protection Agency, Office of Solid Waste and Emergency Response, Office of Enforcement and
Compliance Assurance and the United States Department of Labor, Occupational Safety and
Health Administration.
European Commission (EC), Commission implementing regulation (EU) No 1112/2014 of
13 October 2014 determining a common format for sharing of information on major
hazard indicators by the operators and owners of offshore oil and gas installations and
a common format for the publication of the information on major hazard indicators
by the member states, 2014, Official Journal of the European Union.
European Council, Council directive 82/501/EEC on the major accident hazards of
certain industrial activities (“SEVESO I”), 1982, Official Journal of the European
Communities.
European Council. (1997). Council Directive 96/82/EC of 9 December 1996 on the control of
major-accident hazards involving dangerous substances. Official Journal of the European
Communities.
Faghih-Roohi, S., Xie, M., & Ng, K. M. (2014). Accident risk assessment in marine trans-
portation via Markov modelling and Markov chain Monte Carlo simulation. Ocean Engi-
neering, 91, 363–370.
Fattakhova, E. Z., & Barakhnina, V. B. (2015). Accident rate analysis on the offshore oil and gas
production installations and platforms. International Journal of Applied and Fundamental
Research.
Fields, C. (2012). Safety and shipping 1912–2012: From Titanic to Costa Concordia. Allianz
Global Corporate & Specialty AG.
Foster, C. (2007). Misdeclared or undeclared dangerous goods cargoes: Ignorance, incom-
petence or deceit? The Swedish Club Letter, 1, 16–17.
Foster, M., Charters, A., & Neushul, M. (1971). The Santa Barbara oil spill part 1: Initial
quantities and distribution of pollutant crude oil. Environmental Pollution (1970), 2,
97–113.
Gehling, R. (2013). MV Rabaul Queen—A tragedy to learn from (pp. 292). Engineers Australia.
ARTICLE IN PRESS
George, S., Wright, J., & Conroy, J. (1995). Temporal studies of the impact of the Braer
oilspill on inshore feral fish from Shetland, Scotland. Archives of Environmental Contami-
nation and Toxicology, 29, 530–534.
Hare, J. (1996). Port state control: Strong medicine to cure a sick industry. Ga. J. Int. Comp.
Law, 26, 571.
Harris, C. (1997). The sea empress incident: Overview and response at sea (pp. 177–184). American
Petroleum Institute.
Harvey, M. (2012). The origins of IMO. London, UK: IMO.
Hassel, M., Asbjørnslett, B. E., & Hole, L. P. (2011). Underreporting of maritime accidents
to vessel accident databases. Accident Analysis & Prevention, 43, 2053–2063.
Hauptmanns, U. (1998). Computer-aided valuation of safety management. Process Safety and
Environmental Protection, 76, 286–290.
Hayes, J. (2012). Operator competence and capacity—Lessons from the Montara blowout.
Safety Science, 50, 563–574.
Heikkil€a, A.-M. (1999). Inherent safety in process plant design: An index-based approach. VTT
Technical Research Centre of Finland.
Heising, C. D., & Grenzebach, W. S. (1989). The ocean ranger oil rig disaster: A risk analysis.
Risk Analysis, 9, 55–62.
Hetherington, C., Flin, R., & Mearns, K. (2006). Safety in shipping: The human element.
Journal of Safety Research, 37, 401–411.
Hoivik, D. (2005). Health, safety and environment culture in the Norwegian petroleum industry.
Society of Petroleum Engineers.
Hopkins, A. (2012). Disastrous decisions: The human and organisational causes of the Gulf of Mexico
blowout. CCH Australia Ltd.
Howe, R. (1968). The history and current status of offshore mobile drilling units. Ocean
Industry, 3, 38–61.
HSE. (1992). Guide to the offshore installations (safety case) regulations 1992. London: Tech. Rep.
Health and Safety Executive.
Hu, S., Fang, Q., Xia, H., & Xi, Y. (2007). Formal safety assessment based on relative risks
model in ship navigation. Reliability Engineering & System Safety, 92, 369–377.
Hunt, R. J., & Marsh, P. D. (2004). Opportunities to improve the operational and technical
management of jack-up deployments. Marine Structures, 17, 261–273.
Incardona, J. P., Vines, C. A., Anulacion, B. F., Baldwin, D. H., Day, H. L., French, B. L.,
et al. (2012). Unexpectedly high mortality in Pacific herring embryos exposed to the
2007 Cosco Busan oil spill in San Francisco Bay. Proceedings of the National Academy of
Sciences, 109, E51–E58.
International Association of Oil and Gas Producers (IOGP). n.d. Safety zone IOGP fatal inci-
dent reports.
International Maritime Rescue Federation. (2016). Report finds ship fires pose a real threat to
maritime safety. Southampton SOLENT University.
Ireland, R.D. (1991). Determination by R.D. Ireland in fatal accident inquiry into the death
of Timothy John Williams on Board Ocean Odyssey, Sheriff Clerk.
Islam, R., Abbassi, R., Garaniya, V., & Khan, F. I. (2016). Determination of human error
probabilities for the maintenance operations of marine engines. Journal of Ship Production
and Design, 32, 226–234.
Islam, R., Abbassi, R., Garaniya, V., & Khan, F. (2017). Development of a human reliability
assessment technique for the maintenance procedures of marine and offshore operations.
Journal of Loss Prevention in the Process Industries, 50, 416–428.
Islam, R., Khan, F., Abbassi, R., & Garaniya, V. (2017). Human error probability assessment
during maintenance activities of marine systems, safety and health at work.
Ismail, Z., Kong, K. K., Othman, S. Z., Law, K. H., Khoo, S. Y., Ong, Z. C., et al. (2014).
Evaluating accidents in the offshore drilling of petroleum: Regional picture and reducing
impact. Measurement, 51, 18–33.
ARTICLE IN PRESS
Jones, J. C. (2015). Semi-quantitative analysis of three hydrocarbon accidents. Journal of

Chemical Health and Safety, 22, 20–22.
Kalantarnia, M., Khan, F., & Hawboldt, K. (2009). Dynamic risk assessment using failure
assessment and Bayesian theory. Journal of Loss Prevention in the Process Industries, 22,
600–606.
Karahalios, H. (2015). The management of maritime regulations. Routledge.
Karwowski, W. (2012). The discipline of human factors and ergonomics. In Handbook of
human factors and ergonomics (4th ed., pp. 1–37).
Khakzad, N., Khan, F., & Amyotte, P. (2013). Dynamic safety analysis of process systems by
mapping bow-tie into Bayesian network. Process Safety and Environmental Protection, 91,
46–53.
Khan, F. I., & Abbasi, S. (1999). Major accidents in process industries and an analysis of causes
and consequences. Journal of Loss Prevention in the Process Industries, 12, 361–378.
Khan, F. I., & Haddara, M. (2004). Risk-based maintenance (RBM): A new approach for
process plant inspection and maintenance. Process Safety Progress, 23, 252–265.
Khan, F. I., Sadiq, R., & Husain, T. (2002). Risk-based process safety assessment and control
measures design for offshore process facilities. Journal of Hazardous Materials, 94, 1–36.
Kletz, T. A. (2001). Learning from accidents. Routledge.
Kontovas, C. A., & Psaraftis, H. N. (2009). Formal safety assessment: A critical review. Marine
Technology, 46, 45–59.
Kopacz, Z., Morgas, W., & Urba nski, J. (2001). The maritime safety system, its main com-
ponents and elements. The Journal of Navigation, 54, 199–211.
Lazenby, J. (2016). The first Punic war. Routledge.
Le Coze, J. C. (2013). What have we learned about learning from accidents? Post-disasters
reflections. Safety Science, 51, 441–453.
Lees, F. (2012). Lees’ loss prevention in the process industries: Hazard identification, assessment and
control. Butterworth-Heinemann.
Leveson, N. G., & Stolzy, J. L. (1987). Safety analysis using petri nets. IEEE Transactions on
Software Engineering, 386–397.
Li, K., & Wonham, J. (2001). Maritime legislation: New areas for safety of life at sea. Maritime
Policy & Management, 28, 225–234.
Lipscombe, R. (2000). Australia’s tyranny of distance in oil spill response. Spill Science & Tech-
nology Bulletin, 6, 13–25.
MacDonald, G., & Varney, L. (1999). The control of major accident hazards regulations 1999
(COMAH) (pp. 1–10). Hemsphere Publishing Corporation.
Maher, S. T., Long, G. D., Cromartie, R. S., Sutton, I. S., & Steinhilber, M. R. (2016).
Paradigm shift in the regulatory application of safety management systems to offshore
facilities. Process Safety Progress, 35, 317–329.
Major Hazard Incident Data Service (MHIDAS). (2002). Major hazard incident data service,
OHS_ROM, reference manual. UK: Health and Safety Executive.
Marine Accident Investigation Branch. (2006). Report on the investigation of the fire onboard Star
Princess. Report.
Marine Incident Investigation Unit. (1998). Departmental investigation the accommodation fire on
board the Taiwanese bulk carrier Ming mercy off port Kembla, NSW on 7 August 1997.
Inspector of Marine Accidents, Marine Incident Investigation Unit.
Maritime Administrator. (1999). Republic of the Marshall Islands, Decision of the Maritime Admin-
istrator Republic of the Marshall Islands and the report of investigation in the matter of the explosion
and fire on board the container vessel SEA-LAND MARINER—ON 1100 off the Island of
Crete on 18 April 1998. Maritime Administrator, Republic of the Marshall Islands.
Maritime Safety Committee (MSC). (2014). Organization IM editor. SOLAS consolidated edi-
tion 2014 supplement.
Markowski, A. S., Mannan, M. S., & Bigoszewska, A. (2009). Fuzzy logic for process safety
analysis. Journal of Loss Prevention in the Process Industries, 22, 695–702.
ARTICLE IN PRESS
Mileski, J. P., Wang, G., & Beacham, L. L. (2014). Understanding the causes of recent cruise
ship mishaps and disasters. Research in Transportation Business & Management, 13, 65–70.
Miller, K. (1991). Piper alpha and the Cullen report. Industrial Law Journal, 20, 176.
Misra, K. B. (2012). Reliability analysis and prediction: A methodology oriented treatment. Elsevier.
Morris, B. F., & Loughlin, T. R. (2013). Overview of the Exxon Valdez oil spill. Academic
Press, Inc.
Moura, R., Beer, M., Patelli, E., Lewis, J., & Knoll, F. (2016). Learning from major accidents
to improve system design. Safety Science, 84, 37–45.
Murphy, J. F., & Conner, J. (2014). Black swans, white swans, and 50 shades of grey:
Remembering the lessons learned from catastrophic process safety incidents. Process Safety
Progress, 33, 110–114.
Murray, S. P. (1975). In Wind and current effects on large-scale oil slicks Wind and current effects on
large-scale oil slicks. Offshore technology conference.
Myer, P. G. (1984). IXTOC I: Case study of a major oil spill. Marine Affairs, University of
Rhode Island.
National Academies of Sciences Engineering, Medicine. (2016). Strengthening the safety culture
of the offshore oil and gas industry. Transportation Research Board.
National Commission on the BP Deepwater Horizon Oil Spill. (2011). Deep water: The Gulf
oil disaster and the future of offshore drilling. Perseus Distribution Digital.
National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling, Deep-
water: The Gulf Oil disaster and the future of offshore drilling—Report to the President,
2011.
National Ocean Industries Association (NOIA). (2005). History of offshore. Washington, DC.
National transportation Safety Board (NTSB). (2011). Collision of Tankship Eagle Otome with
Cargo Vessel Gull arrow and subsequent collision with the Dixie Vengeance Tow Sabine-Neches
Canal, Port Arthur, Texas, January 23, 2010. Washington, DC 20594.
National Transportation Safety Board. (NTSB). (1984). Capsizing and sinking of the United
States Drillship Glomar Java Sea. Washington, DC.
Nelson, R. (1972). The bay Marchand fire. Journal of Petroleum Technology, 24, 225–233.
Nivolianitou, Z., Leopoulos, V., & Konstantinidou, M. (2004). Comparison of techniques
for accident scenario analysis in hazardous systems. Journal of Loss Prevention in the Process
Industries, 17, 467–475.
Noauthor. (2003). In A. Pillay & J. Wang (Eds.), Chapter 4—Formal safety assessment of ships
and its relation to offshore safety case approach (pp. 61–79). Elsevier.
Noroozi, A., Abbassi, R., Khan, F., & MacKinnon, S. (2010). Comparative evaluation of human
error probability assessment techniques (pp. 1–10).
Noroozi, A., Khakzad, N., Khan, F., MacKinnon, S., & Abbassi, R. (2013). The role of
human error in risk analysis: Application to pre- and post-maintenance procedures of
process facilities. Reliability Engineering & System Safety, 119, 251–258.
NTSB. (1991). Marine accident report: Fire and explosion aboard the U.S. Tankship Jupiter, Bay
City, Michigan, September 16, 1990. National Transportation Safety Board.
NTSB. (1992). Explosion and fire on the US tank ship Surf City Persian Gulf. National
Transportation Safety Board.
NTSB. (1995a). Explosion and fire on board the U.S. Tankship OMI Charger. National
Transportation Safety Board.
NTSB. (1995b). Engineroom fire on board the Liberian Tankship Seal Island while Moored at the
Amerada Hess Oil Terminal.
NTSB. (2013). Fire aboard vehicle carrier M/V alliance Norfolk. National Transportation Safety
Board.
O’Neil, W. A. (2003). The human element in shipping. WMU Journal of Maritime Affairs, 2,
95–97.
ARTICLE IN PRESS
Office of Technology Assessment (OTA). Oil and gas technologies for the arctic and deep-
water. Office of technology assessment, US congress, Washington, DC 1985.
Officer of the Watch. (2013). Blowout and consequent fire onboard offshore platform-investigation
report.
Offshore Post-Everything offshore energy. (2015). Abkatun offshore explosion findings released.
Oil Rig Disasters. n.d. Oil rig disasters: Offshore drilling accidents, http://members.home.
nl/the_sims/rig/index.htm.
Okoh, P., & Haugen, S. (2013). Maintenance-related major accidents: Classification of cau-
ses and case study. Journal of Loss Prevention in the Process Industries, 26, 1060–1070.
OPG. (2010). Major accidents. International Association of Oil and Gas Producers.
OPG International Association of Oil and Gas Producers. (2008). Asset integrity—The key to
managing major incident risks.
OREDA, (Ed.), (2015). Offshore reliability data handbook (6th ed.): DNV.
Pace E, Turner C. Producing operations personnel training—A program to help meet mod-
ern deeds. Offshore technology conference, 1974.
Papanikolaou, A. (2009). Risk-based ship design: Methods, tools and applications. Springer
Science & Business Media.
Pate-Cornell MEL. (1993). Learning from the Piper alpha accident: A postmortem analysis of
technical and organizational factors. Risk Analysis, 13, 215.
Petroleum Safety Authority (PSA). (2017). Major accident risk. Norway: Petroleum Safety
Authority (PSA).
Pillay, A., & Wang, J. (2003). In A. Pillay & J. Wang (Eds.), Chapter 3—Safety analysis tech-
niques (pp. 29–60): Elsevier.
Pittman, L. W., III, Juaire, M. K., Fawcett, M. K., Parham, M. N., DeJesus, M. M., Les
Ledet, M., et al. (2016). In Investigations national center of expertise Proceedings of the marine
safety and security council.
Pratt, J. A., Priest, T., & Castaneda, C. J. (1997). Offshore pioneers: Brown & Root and the history
of offshore oil and gas. Gulf Professional Publishing.
Priest T, 4. Claiming the coastal sea: The battles for the “Tidelands,” 1937–1953, history of
the offshore oil and gas industry in Southern Louisiana, 2008a;Vol. 1: 77–83.
Priest, T. (2008b). 7. Wake-up call: Accidents and safety provision in the Gulf of Mexico offshore
industry, history of the offshore oil and gas industry in Southern Louisiana (p. 139).
Psarros, G., Skjong, R., & Eide, M. S. (2010). Under-reporting of maritime accidents. Acci-
dent Analysis & Prevention, 42, 619–625.
Purnell, K. (2009). Are HNS spills more dangerous than oil spills. UK: ITOPF Ltd, (pp. 12–14).
Qi, Q., & Ershaghi, I. (2013). Aspects of oilfield related accidents. Society of Petroleum
Engineers.
Ren, D. (2009). Application of HFACS tool for analysis of investigation reports of accidents involving
containerized dangerous goods.
Roberts, S. E., Marlow, P. B., & Jaremin, B. (2012). Shipping casualties and loss of life in UK
merchant shipping, UK second register and foreign flags used by UK shipping compa-
nies. Marine Policy, 36, 703–712.
Roberts, S. E., Pettit, S. J., & Marlow, P. B. (2013). Casualties and loss of life in bulk carriers
from 1980 to 2010. Marine Policy, 42, 223–235.
Rouhiaiuen, V. (1990). The quality assessment of safety analysis, Sl.
Rushton, A., Gowers, R., Edmondson, J., & Al-Hassan, T. (1994). Hazard and operability
study of offshore installations—A survey of variations in practice (pp. 341). Hemsphere Publishing
Corporation.
Sam, B. (2012). World maritime day: Shipping safety 100 years after the Titanic.
Shahriari, M., & Aydin, M. (2017). Factors influencing quality of accident investigations—A case
study (pp. 273). CRC Press.
ARTICLE IN PRESS
Shappell, S. A., & Wiegmann, D. A. (2001). Applying reason: The human factors analysis and
classification system (HFACS). Human Factors and Aerospace Safety.
Sherman, C. (2009). Offshore diving safety-challenges and concerns. Society of Petroleum Engineers.
Simmonds, K. R. (1994). The International Maritime Organization. Simmonds & Hill.
Singh, N. (1973). International convention of merchant shipping British shipping laws: Vol. 8
(2nd ed.). London: Stevens & Sons.
Skogdalen, J. E., & Vinnem, J. E. (2011). Quantitative risk analysis offshore—Human and
organizational factors. Reliability Engineering & System Safety, 96, 468–479.
Smythe, R. (1997). The historical roots of NEPA, Environmental policy and NEPA: Past, present,
and future. CRC Press LLC, (pp. 3–14).
South African Maritime Safety Authority. (2004). Report of the preliminary enquiry into the explo-
sion and fire onboard the mv “sea elegance” on 11 October 2003 at the Durban anchorage, Annex
to IMO DSC (p. 10).
Spouge, J. (1999). A guide to quantitative risk assessment for offshore installations. SD: CMPT
Aberdeen.
Stuart, D. (2007). Misdeclared’cargo led to Zim Haifa fire, court told, Lloyd’s List Intelligence.
Sutton, I. (2010). Process risk and reliability management [electronic resource] (p. 2010). Burlington:
Elsevier Science.
Sutton, I. (2013). Offshore safety management: Implementing a SEMS program. William Andrew.
Talley, W. K., Jin, D., & Kite-Powell, H. (2001). Vessel accident oil-spillage: Post US OPA-
90. Transportation Research Part D: Transport and Environment, 6, 405–415.
Tamburello, S. M. (2011). On determining spontaneous ignition in porous materials. College Park:
University of Maryland.
Tauseef, S., Abbasi, T., & Abbasi, S. A. (2011). Development of a new chemical process-
industry accident database to assist in past accident analysis. Journal of Loss Prevention in
the Process Industries, 24, 426–431.
Teal, J. M., & Howarth, R. W. (1984). Oil spill studies: A review of ecological effects. Envi-
ronmental Management, 8, 27–43.
Thomas, M., & Skjong, R. (2009). Cost benefit analysis of inert gas systems for chemical and product
tankers.
Transport Canada. (2016). From the Titanic to today: A brief history of marine safety. Transport
Canada. https://www.tc.gc.ca/eng/marinesafety/titanic-4136.htm.
TSB. (1999). Marine investigation report: Explosion and fire aboard the petroleum tanker Petrolab and
the subsequent destruction of the government wharf at St. Barbe, Newfoundland, 19 July 1997.
TSB. (2002). Marine investigation report: Striking and subsequent fire on board bridge 11, Wetland
Canal and bulk carrier Windoc wetland canal, Allanburg, Ontario, 11 August 2001.
TSB. (2008). Marine investigation report: Fire in cargo oil tank shuttle tanker Kometik Conception
Bay South Newfoundland and Labrador 08 April 2006. Transportation Safety Board of
Canada.
Tugnoli, A., Khan, F., Amyotte, P., & Cozzani, V. (2008). Safety assessment in plant layout
design using indexing approach: Implementing inherent safety perspective: Part
1–guideword applicability and method description. Journal of Hazardous Materials, 160,
100–109.
Turbini, R. A. W., Fresi, E., & Bambacigno, F. (1993). The Haven incident: Lessons learned with
particular reference to environmental damages (pp. 179–183). American Petroleum Institute.
U.S. Department of the Interior Bureau of Safety and Environmental Enforcement (BSEE).
(2013). Investigation of November 16, 2012, Explosion, fire and fatalities at West Delta Block
32 Platform E.
U.S. Department of the Interior Bureau of safety and Environmental Enforcement (BSEE).
(2016). Bureau of safety and environmental enforcement annual report 2016.
€ K€
Uğurlu, O., ose, E., Yıldırım, U., & Y€ uksekyıldız, E. (2015). Marine accident analysis for
collision and grounding in oil tanker using FTA method. Maritime Policy & Management,
42, 163–185.
ARTICLE IN PRESS
US Coast Guard. (2004). Report on the explosion and sinking of the chemical tanker Bow Mariner
in the Atlantic Ocean on 28 February 2004. Virginia: Marine Safety Office, Hampton
Roads. 56pp.
Utton, A. E. (1967). Protective measures and the “Torrey Canyon”, Boston College Law
Review, 9, 613–632.
Vandevelde, K. (2006). Herald of free enterprise. In Handbook on drowning (pp. 546–548).
Heidelberg: Springer.
Vaughn, C. H. (1960). International standards for safety at sea. Judge Advocate Journal, 3.
Veiga, J. L. (2002). Safety culture in shipping. WMU Journal of Maritime Affairs, 1, 17–31.
Velez P, Liles C, Satterlee K. An overview of API RP 75 and RP 14J. Offshore technology
conference, 1995.
Videiro, P. M., Cyranka, C., Nunes, G. C., & Melo, A. P. (2002). The accident of the P-36
platform—The rupture of the emergency drainage tank.
Vinnem, J.-E. (2014a). Lessons from major accidents (pp. 95–163). Spring.
Vinnem, J.-E. (2014b). Offshore risk assessment. Vol. 1. Springer.
Vinnem, J.-E. (2014c). Offshore risk assessment. Vol. 2. Springer.
Visser, R. C. (1992). Offshore accidents–lessons to be learned. National Institute of Standards and
Technology, 181.
Visser, R. C. (2011). Offshore accidents, regulations and industry standards. Society of Petroleum
Engineers.
Wang, J. (1997). A subjective methodology for safety analysis of safety requirements speci-
fications. IEEE Transactions on Fuzzy Systems, 5, 418–430.
Wang, J. (2001). The current status and future aspects in formal ship safety assessment. Safety
Science, 38, 19–30.
Wang, J. (2002). Offshore safety case approach and formal safety assessment of ships. Journal of
Safety Research, 33, 81–115.
Wang, J. (2003). Technology and safety of marine systems. Elsevier.
Wang, J., & Foinikis, P. (2001). Formal safety assessment of containerships. Marine Policy, 25,
143–157.
Wang, J., Labrie, C., & Ruxton, T. (1993). Computer simulation techniques applied to the pre-
diction and control of safety in maritime engineering. British Maritime Technology.
Wang, J., & Ruxton, T. (1997). A review of safety analysis methods applied to the design
process. Journal of Engineering Design, 8, 131–152.
Wang, J., Sii, H., Yang, J., Pillay, A., Yu, D., Liu, J., et al. (2004). Use of advances in tech-
nology for maritime risk assessment. Risk Analysis, 24, 1041–1063.
Weaver, J. L. (2014). Offshore safety in the wake of the Macondo disaster: Business as usual or
sea change? Houston Journal of International Law, 36, 147–216.
Whittingham, R. (2004). The blame machine: Why human error causes accidents. Routledge.
Witter, R. E. (1992). Guidelines for hazard evaluation procedures. Process Safety Progress, 11,
50–52.
Yabuki, H. (2011). The 2010 Manila amendments to the STCW convention. Journal for Mar-
itime Research, 1, 11–17.
Yender, R., Stanzel, K., & Lloyd, A. (2008). Impacts and response challenges of the tanker SOLAR
1 oil spill, Guimaras, Philippines: Observations of international advisors (pp. 77–81). American
Petroleum Institute.
Yeo, C., Bhandari, J., Abbassi, R., Garaniya, V., Chai, S., & Shomali, B. (2016). Dynamic
risk analysis of offloading process in floating liquefied natural gas (FLNG) platform using
Bayesian network. Journal of Loss Prevention in the Process Industries, 41, 259–269.
Yim, U. H., Kim, M., Ha, S. Y., Kim, S., & Shim, W. J. (2012). Oil spill environmental foren-
sics: The Hebei Spirit oil spill case. ACS Publications.
CHAPTER TWO
Safety in Offshore Platforms—Use

of QRA in the Norwegian Offshore
Industry
Stein Haugen1
Department of Marine Technology, Norwegian University of Science and Technology (NTNU),
Trondheim, Norway
1
Corresponding author: e-mail address: stein.haugen@ntnu.no
Contents
1. Introduction 100
2. Brief Overview Over History of QRA in Norway 101
3. General Requirements 106
3.1 Hazard Identification 106
3.2 Analysis of Initiating Events 108
3.3 Analysis of Potential Consequences 108
3.4 Establishing the Risk Picture 109
4. Release of Hydrocarbons From the Process Plant 110
4.1 Causal Analysis/Initiating Event Analysis 110
4.2 Modeling and Analysis of Event Scenarios 113
4.3 Calculation of Physical Effects of Releases 117
4.4 Calculation of Impact on Personnel and MSFs 119
5. Results Presentation 121
5.1 Fatality Risk 121
5.2 Main Safety Functions 122
5.3 QRA Summaries 123
6. Releases From Pipelines and Risers 124
7. Blowout 125
8. Ship Collision 128
8.2 Offshore Supply Vessels 129
#
Methods in Chemical Process Safety, Volume 2 2018 Elsevier Inc. 99
100 Stein Haugen
8.3 Shuttle Tankers During Loading 130

8.4 Passing Merchant Vessels 130
8.5 Consequence Analysis 132
9. Other Hazards 133
9.1 Dropped Objects 133
9.2 Structural Failure Due to Extreme Environmental Loads or Design Errors 134
9.3 Helicopter Accidents 135
9.4 Occupational Accidents 135
10. Comparison of QRA Results Against Actual Risk Level 136
11. Use of QRA for Decision Making 137
12. Future Developments 140
12.1 Simplification 140
12.2 Analysis for Operations 141
12.3 Barrier Management 141
13. Conclusions 142
References 143
1. INTRODUCTION
“Safety in offshore platforms” indicates a very wide scope of this chap-
ter, and it is clearly not possible to cover all aspects of this within the lim-
itations of a book chapter. Rather than giving a very brief overview over
this, the focus will therefore be on one particular aspect of how safety is
being managed in the offshore industry, namely the use of Quantitative Risk
Assessment (QRA), in particular in the Norwegian offshore industry.
Since the introduction of QRA in the Norwegian offshore industry
around 1980 and in the United Kingdom after Piper Alpha around 1990,
an impressive development has taken place. In this chapter, a brief summary
of some of the most important development and trends over these decades is
given. This will be followed by an overview over status, with main focus on
methods and application areas. Toward the end of the chapter, an attempt is
made at looking into the future, trying say something about where current
development trends may take us in the coming years.
In this chapter, we will use the terms major accident risk and occupa-
tional accident risk. This is different from the process industry, where the
terms process accidents and personal accidents are more commonly used.
In practice, we can assume that the use of these two terms corresponds to
each other, except of course that there will be additional hazards that are
Use of QRA in the Norwegian Offshore Industry 101
relevant for offshore facilities. A number of definitions of major accidents exist

(Okoh & Haugen, 2013), most of them from various legislative bodies or
international organizations. The events are described as adverse or unplanned
and acute or sudden. The main reason why the term “major” is being used is
of course the scale of the consequences or potential consequences. It is noted
that some definitions require actual consequences to have occurred for an
event to classified as a “major accident,” while others (including the Petroleum
Safety Authority of Norway) state that as long as the event had a potential for
causing severe consequences, this is sufficient. For this purpose, we can assume
the following definition: “an unexpected event that causes or has the potential
to cause serious consequences such as several serious casualties, extensive envi-
ronmental or asset damage, with immediate or delayed effects experienced,
within or outside the incident facility.”
The chapter provides some details on risk modeling, but it is clearly not
possible to go into a lot of detail within the framework of a book chapter.
A comprehensive and detailed discussion of the topic can be found in the
book “Offshore Risk Assessment—Principles, Modelling and Applications”
by Professor Jan Erik Vinnem (Vinnem, 2014).
2. BRIEF OVERVIEW OVER HISTORY OF QRA IN NORWAY

In Norway, the blowout at Ekofisk A in 1977 was the first eye-opener
to the Norwegian government and the public that the offshore industry
could represent a large potential for serious accidents. The blowout occurred
on April 22, 1977, on the Ekofisk 2/4A platform, during workover on a
well. The Xmas tree had been removed and the barriers that were in place
were a DHSV that most likely was not adequately secured and mud in
the well. There was a slow flow of mud from the well for a considerable
period of time, indicating that the well was not completely under control,
until the flow started increasing and then rapidly grew to a full-scale
blowout. The accident is comprehensively described in the published inves-
tigation report (NOU, 1977). The commission investigating the accident
stated that “…the accident […] was the result of such a series of unfortunate
circumstances and wrong judgements that this would be have been consid-
ered unlikely in advance.” The main causes were concluded to be human
error, although the commission interestingly notes that (translated from
Norwegian) “It is not automatically correct to talk about human error even
if all technical components functioned without error. Any system should
be designed to be operated by people and to allow for the possibility that
102 Stein Haugen
humans can make errors. The term ‘human error’ should be reserved for
those human actions that are outside the limits of tolerance that are reason-
able to expect.” This is a very forward-looking statement which shows a
much more nuanced interpretation of human errors than what was common
in those days. Another interesting aspect of this blowout is how the causes
are echoed in the Macondo Blowout (National Commission, 2011). Changes
in the planned work program, inadequate change management, and wrong
interpretation of signals from the well are all common aspects of the two
accidents.
The consequences of the accident in terms of human and environmental
damage were limited. All personnel were safely evacuated, the blowout
was stopped after 8 days, and the oil spill was estimated at 9000 tons (com-
pared to Macondo with around 700,000 tons). However, the accident had
profound implications for safety on the Norwegian Continental Shelf. The
commission stated the “Approaches and safety measures that from experience
have turned out to be satisfactory within traditional oil exploration and pro-
duction cannot unconditionally be accepted in the North Sea.” This pointed
toward needs for developing both new methods and new technologies.
One of the outcomes of the accident and the subsequent report was
the large research program called Safety Offshore (Kårstad & Wulff, 1983).
The research program was kicked off in 1978 and lasted until 1983. One
of the focus areas of this program was risk analysis and safety management.
During the period when the program was being performed, the Alexander
L. Kielland accident occurred (NOU, 1981). This was an accommodation
platform that capsized in bad weather and 123 people were killed. This of
course strengthened the focus on risk and the urgency of developing new
knowledge to operate safely in the North Sea.
When the Bravo blowout occurred, there were a set of “Safety Regulations”
(Norsk Lovtidend, 1976) in force, but there was not mention of risk analysis in
these regulations. The first regulatory document mentioning this was the
so-called CSE Guidelines (NPD, 1981) that were published by the Norwegian
Petroleum Directorate in 1981. These were not regulations as such, but were
still adhered to by the offshore industry. The CSE Guidelines introduced
risk analysis as a tool for designing safe offshore installations. In the guidelines,
the concept of Main Safety Functions (MSFs) was also introduced. This is
described in more detail in Section 5.2.
The first attempts at quantitative risk analysis were very much influenced
by the work done in the nuclear industry and in process/chemical industry.
The methods were similar to the nuclear industry (e.g., use of event trees and
fault trees) and the data that were applied were taken from a variety of indus-
tries and applications, including nuclear, process, and military/aerospace.
The studies were criticized for being “paper exercises” focusing too much
on numbers and not enough on real-world safety. However, they did con-
tribute to raise the awareness of safety issues and had an impact on design
issues like layout, need for passive fire protection, location and protection
of ESD valves, escape routes, lifeboat location, and protection of the living
quarter as a temporary shelter during emergencies. A comparison between
the first platform on the Statfjord field in the North Sea, Statfjord A, and the
Gullfaks platforms (also in the North Sea) among others shows a significant
development in layout. On Gullfaks, the hazardous areas and the living
quarter are separated as much as possible, using distance to improve safety.
Statfjord started production in 1979 and Gullfaks in 1986.
In 1992, the next step in the regulatory regime followed when a new set
of regulations were introduced, among them risk analysis regulations. These
regulations were based on the principle of risk-based risk management
or risk-informed risk management. Risk analysis should always be part of
the decision basis when making decisions that could influence risk. Another
underlying principle for the regulations was that they contained primarily
functional requirements rather than specific requirements.
Another important principle underpinning the Norwegian regulations
is the internal control principle. In practice, this means that the operators have
full responsibility for ensuring that all relevant legislation and regulations
are met. The Petroleum Safety Authority (PSA) will not perform detailed
audits and inspections of all aspects of the regulations. Instead, they only do
spot checks and do not formally approve technical solutions or risk assessments.
In 2002, the regulations were simplified from a total of 13 regulations
to only 5. Among the new regulations were the Management Regulations
(PSA, 2002), which contained requirements to risk analysis. A further sim-
plification was made in 2010, although the overall principle and structure
remain the same. These management regulations still remain in force at
the time of writing (2018), although minor amendments have been made
to the regulations and typically are made every year.
A key change in recent years is that the definition of risk has been mod-
ified. In the most recent regulations, uncertainty is introduced in the defi-
nition instead of probability and risk is defined as “the consequences of an
activity with the associated uncertainty.”
The management regulations are functional rather than specific, and
there is a separate chapter in the regulations dedicated to HSE-related
104 Stein Haugen
analysis, including a separate paragraph called risk and emergency prepared-

ness assessments (§17). The requirements are however typically high level.
An example is the first sentence, stating that “The responsible party shall
ensure that analyses are carried out that provide the necessary basis for
making decisions to safeguard health, safety, and the environment.” Other
examples are that risk analysis shall provide a “balanced and most comprehen-
sive possible picture of the risk” and that the analyses shall be “appropriate as
regards providing support for decisions.” Using terms like “appropriate”
clearly leaves a lot of room for interpretation. It should however also be men-
tioned that the regulations are accompanied by some guidance that elaborates
on the different requirements. In most cases, this is however not very detailed.
In parallel with the development of the regulations for risk analysis, a
separate NORSOK standard, Z-013, was also developed and revised. The
standard is called Risk and Emergency Preparedness Assessment and was first
published in 1998. Later revisions have followed the development in the
regulations, with revision 2 coming in 2001 and revision 3 in 2010. The
standard is discussed in more detail in Section 3. The purpose of this is
to act as guidance for operators about what will be regarded as meeting
the regulatory requirements, although following the standard is not neces-
sarily the only way that this can be achieved. In practice, the standard is
however followed in most cases, and it provides a very detailed and specific
description of how QRA should be performed.
The development in other parts of the world will not be covered here,
although the UK regime may be briefly mentioned since this has had a sig-
nificant influence on the regulations also in other countries, e.g., Australia.
In the United Kingdom, the Piper Alpha disaster in 1988 triggered a major
overhaul of their regulations, from a prescriptive regime based on approval
by the authorities, to a Safety Case regime where the responsibility for ensur-
ing safety is more clearly placed on the operators themselves (Cullen, 1990).
Several regulations were introduced following Piper Alpha, among which the
most relevant one to mention here is the Safety Case Regulations (HMSO,
1992), which required the operators to prepare a Safety Case for all the off-
shore installations, including an assessment of the risks associated with the
operations. In the years after the disaster, a quantitative risk analysis was exten-
sively used although more recently focus has turned more toward qualitative
analysis, with less emphasis on numbers.
A final comment related to this is also the introduction by EU of the Safety of
offshore oil and gas operations directive in 2013 (European Parliament, 2013).
The directive was introduced in response to the Macondo blowout in the

Gulf of Mexico. This directive also emphasizes the use of risk assessment as a
tool to understand and manage risks.
In the years since the QRAs were introduced, there has been significant
developments in methods, tools, and data applied to do risk analysis. The
requirements and practice with regard to QRA today are in practice
governed by the NORSOK standard Z-013 Risk and Emergency Prepared-
ness Assessment (NORSOK, 2010). The standard has been revised several
times, and the most recent version of the standard came as a result of revi-
sions to the regulations. The expectation from PSA is that this standard is
followed.
The standard is essentially divided into three main parts. The first part, the
first four sections, is introduction, references, and definitions, followed by a
section describing the role of assessments in risk management. This is followed
by two parts describing requirements to risk assessment (Sections 5–8) and
emergency preparedness assessment (Sections 9–12), respectively. The two
final parts are both divided into one chapter covering general requirements,
followed by chapters describing additional requirements for the different
project phases from concept selection through operation.
The scope and limitations of the standard can briefly be summarized as
follows:
– It covers offshore and onshore facilities for production of oil and gas, but
it may also be used for mobile offshore drilling units.
– It covers the risk assessment process only, not methods and processes for
risk treatment.
– It covers major accidents only, although the risk contribution from occu-
pational fatalities normally is included in the risk calculations.
– It covers quantitative analysis only.
Emergency preparedness assessment is not a topic of this chapter and is there-
fore not elaborated on any further. In the following, a summary of key
requirements for risk assessments is provided, structured in the same way
as in the NORSOK standard.
After the drop in oil prices in 2014, there has been a strong pressure to cut
costs in the offshore industry, including costs for safety-related studies. Because
of this, the NORSOK standard and the methods prescribed by the standard
have been put under pressure, and at the time of writing this, there is a strong
move toward less use of quantitative risk analysis, although the requirements
and expectations from the authorities have not changed.
106 Stein Haugen
In the following sections, the requirements and the practical perfor-

mance of QRA are described. General requirements for QRA from the
NORSOK standard (NORSOK, 2010) are described, followed by detailed
descriptions of how the analysis is performed for some of the types of acci-
dents that are major contributors to the total risk.
3. GENERAL REQUIREMENTS
The general requirements are not surprisingly high level and, general,
and do not go into a lot of details on exactly how the analysis should be per-
formed. The overall requirements are that the risk assessment always should
(NORSOK, 2010):
a) “identify hazardous situations and potential accidental events,
b) identify initiating events and describe their potential causes,
c) analyse accidental sequences and their possible consequences,
d) identify and assess risk-reducing measures,
e) provide a nuanced and overall picture of the risk, presented in a way suitable
for the various target groups/users and their specific needs and use.”
The exact scope of the analysis can vary, but it may cover risk to people, the
environment, and assets, as well as the frequency of losing MSFs (see expla-
nation in Section 5.2).
In the following, an overview over the general requirements to the main
steps of the analysis process is provided. This is followed by a more specific
and detailed discussion of how the analysis is done for some of the key acci-
dent categories that contribute significantly to risk on offshore installations in
the North Sea.
3.1 Hazard Identification

The standard underlines the importance of the hazard identification phase of
the risk assessment and suggests that checklists, experience from earlier ana-
lyses, inspections, audits, and incident reports can be used as a basis. It is also
mentioned that methods like HAZOP and FMEA may be relevant to use
(see, e.g., Rausand, 2013). The HAZID should not just identify hazards
and sources of accidents but also do a rough ranking of the hazards into
critical and noncritical, and identify potential risk measures. In practice a
comprehensive hazard identification workshop is normally conducted very
early and this is typically repeated several times during the project phases.
Specific hazard identification meetings covering parts of the installations,
specific operations, etc. are also performed as and when needed. In Annex
C of NORSOK Z-013 (NORSOK, 2010), there is a comprehensive
checklist that can form the basis for hazard identification. The checklist refers
to ISO 17776, Annex C (ISO, 2002), for a list of hazards, and in addition
the annex contains lists of Accident categories, Inherently safe design, Utility
systems, Marine hazards, Safety systems, Activities and phases, Human and
Organizational failures, Occupational hazards, and Environmental risk. This
can thus form a basis for identifying hazards, specific failures, and resulting
accidents, it can be used to identify existing and suggested safety features,
and it can be used to address occupational and environmental risk in addition
to major accident risk.
The hazard identification workshop will normally include a variety of
attendants from all key disciplines in the project and also from operations.
An independent chairperson usually chairs the workshop, accompanied
by a secretary that records the findings.
Even if the hazard identification is the basis for the risk analysis, the stan-
dard also specifies that certain hazards as a minimum shall be analyzed further
and quantified, provided they are relevant (adapted from NORSOK Z-013):
2 Release of hydrocarbons from the process plant, risers, and pipelines and
from storage
2 Release of hydrocarbons during loading/offloading
2 Blowouts and well releases
2 Accidents in utility systems, e.g., leaks of chemicals, fires, and explosion
of transformers
2 Accidents caused by external impact and environmental loads, e.g., colli-
sion, falling/swinging loads, helicopter crash, earthquake, and waves
2 Structural failure
2 Loss of stability and/or buoyancy (including failure of marine systems)
In the concept selection phase, the hazard identification should particularly
focus on hazards that will influence the overall features of the installation,
such as separation distances and main dimensioning loads. Further, there is
also a requirement to cover installation and construction risks, since there
may be large differences between alternative concepts in this respect. In the
detailed engineering phase, the HAZID is reviewed and updated and it will
also become more detailed in areas where insufficient information has been
available earlier.
108 Stein Haugen
In the operational phase, the focus becomes somewhat different and

involves applying experience from operation of the installation to obtain
a better understanding of what hazards are relevant to consider, taking into
account the technical and operational status of the installation.
3.2 Analysis of Initiating Events

The second main step in the QRA process is analysis of the (identified) ini-
tiating events. The detailed approach to this is very different from one acci-
dent category to another and this will be discussed in some detail in the
following sections. Initially, we will however look at some of the general
requirements for the analysis. By “initiating events,” we mean the hazard
types listed in the previous section, e.g., process release and blowout. In most
cases, more specific events than the very generic terms in the checklist are
however defined. This is described in more details later in this chapter.
First of all, the objective of this step is to analyze and identify the causes
of the initiating events and to assess the frequency (or the probability) of the
initiating events. Two alternatives for quantification are described. First, use
of failure data is described, with due consideration given to the applicability
of data. A comprehensive set of factors that may impair the applicability of
existing data is listed, including the type of installation, weather conditions,
design standards, developments in technology, maintenance programs, and
operational standards. Changes in both design and operation may thus render
existing datasets unsuitable for use in quantification. If existing data are con-
sidered to be unsuitable or insufficient, explicit analysis of causes of initiating
events is required to be performed.
It is noted that even if one of the objectives of this step is to “analyze and
identify the causes,” it is not explicitly required that this is done, as long as
there are existing failure data sources that are suitable for the purpose. As we
shall see in the discussion of the individual hazard types, the analysis of causes
is generally quite limited in practice in many cases.
3.3 Analysis of Potential Consequences

“Analysis of potential consequences” will for this purpose cover the entire
process of modeling/describing potential event sequences from the initi-
ating event until the negative consequences have occurred or the accident
development has stopped. There are therefore both a probabilistic element
in this, describing the probability of different sequences and outcomes,
and a description/calculation of the physical effects of the event sequence.
The physical effects may be related to loss of health and life for personnel,
negative impact on the environment, or physical damage to assets.
Specifically, the objectives are therefore described as:
– Assessing the outcomes of initiating events
– Analyzing potential event sequences that may develop
There are no general requirements, except for requirements that are general
to any risk analysis (e.g., doing the analysis at a level of detail suitable for
the context).
3.4 Establishing the Risk Picture

The next main step is to establish the risk picture, based on the hazard iden-
tification and the analysis of initiating events and potential consequences.
Increasing focus has been placed on this in recent years and more specific
requirements were included on this in the most recent revision of the
NORSOK standard.
Some of the requirements are of a general nature and cover aspects that
would be expected of any analysis. This includes a description of the objec-
tives and the scope of the analysis, the methods, data and tools used, and the
acceptance criteria. In addition, a comprehensive description of the risk con-
tributors is provided, from different areas, different types of hazards, and
with particular emphasis on the most important contributors.
An interesting side to the standard is a requirement to discuss uncer-
tainties in the analysis, including the following:
i. “the perspective on risk used in the assessment, e.g., classical, statistical, prob-
ability of frequency, combined classical and Bayesian, Bayesian, Predictive
approach;
ii. the effect and level of uncertainty given the adopted perspective and the con-
text for the assessment (including the ‘system boundaries’ and ‘system basis’)
compared to the ‘actual’ or ‘real’ systems and/or activities of interest;
iii. possible implications for the main results;
iv. occurrence of unexpected outcomes, as a result of invalid assumptions and
premises, or insufficient knowledge.”
This is quite an extensive requirement, aimed at reflecting some of the

scientific discussion over the last decade or so about how risk should be
defined. In this context it is also worth noting that PSA relatively recently
have changed their definition of risk, to “risk means the consequences of the
activities, with associated uncertainty.” In this definition, associated uncer-
tainty means uncertainty related to the potential consequences of the activities.
This includes uncertainty related to which incidents can occur, how often
they will occur, and what consequences may result.
110 Stein Haugen
There are also requirements to define and discuss concepts such as prob-
ability, frequency, mean value, and conservative approach. Uncertainty
related to knowledge (e.g., different models, limitations of models, and dis-
agreements among experts) should be highlighted and the robustness of
the conclusions should be evaluated.
Related to assumptions and presuppositions in the analysis, these should be
explicitly described, they should be grouped into analytical, technical, and
organizational/operational assumptions, their effect on operations should be
described, and the background for choosing them should be given.
In total, we can summarize many of the requirement mentioned here
into an overall goal of providing decision makers with a much more com-
prehensive description of not just the results of the analysis but also the
uncertainty in the results and the conclusions that can be drawn from the
analysis. This is clearly beneficial, although it also introduces new challenges.
Presenting this in a format and in a way that improves understanding and
clarifies the situation for the decision maker is clearly a challenge.
4. RELEASE OF HYDROCARBONS FROM

THE PROCESS PLANT
Process releases is typically one of the main contributors to total risk on
oil and gas installations, together with blowouts where this is relevant and
ship collision. Process releases is typically also the accident type where the
largest effort is put into quantification, both in terms of probabilities and
in terms of consequences. A fairly detailed description of how this is analyzed
is therefore given. This is divided as follows:
– Causal analysis/initiating event analysis
– Modeling and analysis of event scenarios
– Calculation of physical effects of releases
– Calculation of impact on personnel and MSFs
4.1 Causal Analysis/Initiating Event Analysis

4.1.1 Analysis Method
The first part of the analysis is to define specific release events (initiating
events). This is done as follows:
1. The first step is to set the limits for what constitutes process releases.
The limitations of the process system are usually set at the inlet ESDVs
(Emergency shutdown valves). These may be on a platform well
manifold or on flow lines from subsea manifolds depending on the con-

cept chosen. Further, the process system is usually limited to the ESDV
on the export risers or on the lines to storage.
2. Second, the system is broken down into segments according to the loca-
tion of the ESD valves. Each part of the system that can be isolated by
ESDVs is defined as one process segment. Normally, there will be numer-
ous other valves, both automatic and manual, that can be used to isolate
parts of the system, but these are normally not taken into account in the
analysis. The size of the segment forms the basis for calculating maximum
released amount of hydrocarbons, implying that this normally will be
conservative since other isolation opportunities usually exist.
3. For each process segment, the content of the segment is determined and
in most analyses a distinction will only be made between liquid and gas-
eous hydrocarbons. In some segments, only liquid releases are relevant,
in others only gas is present, while in some (e.g., separators) both liquid
and gas are present. In some cases, a two-phase release may also be
considered.
4. The specific release events that will be analyzed further are then defined.
For each segment and for each release type (liquid/gas), at least four release
scenarios are defined, according to hole size or release rate. A typical exam-
ple can be made to define release sizes 0.1–1, 1–5, 5–20, and >20 kg/s.
Since there are at least four release sizes and there may be both liquid and gas
in a segment, each segment may have up to eight release events defined. The
number of segments will obviously depend on the complexity of the process,
but it is not uncommon to end up with more than 100 release events in total.
Next comes the quantification of frequencies of the release events:
1. Equipment count. The quantification is not based on the specific analysis
of causes of releases, only on the quantity of equipment that can leak. For
each segment, the equipment that may leak therefore has to be counted.
This includes all types of process vessels, valves, instrument connections,
flanges, heat exchangers, and pumps. The counting will also be split on
size of the equipment (e.g., size of valves and flanges) and also more spe-
cifically on types of equipment (e.g., distinguishing between different
types of valves). The counting of equipment will be based on P&IDs.
2. Selection of failure database. The calculation of frequencies is based
on historical failure data for process equipment. NORSOK Z-013
recommends use of the HSE Leak and ignition database for offshore
hydrocarbon releases (HSE, 2008). This contains information on all
112 Stein Haugen
leaks reported to HSE since 1992. The database enables the calculation
of failure rates for different types of equipment and also broken down on
leak size.
3. Calculation of frequencies. By combining the equipment count with the
failure database, it is possible to calculate release frequencies for different
release sizes. The frequencies are calculated as a total value per event
per segment, i.e., there is no split on equipment types in the calculated
frequencies. However, the size of the equipment is taken into account,
in that small diameter equipment typically never can reach the highest
release categories due to too small release size being physically possible
(e.g., for small bore instrument connections).
The outcome of this step in the analysis is thus a set of initiating release
events, distinguishing between where in the process plant the release occurs
and distinguishing between different leak sizes. Further, each initiating event
has a frequency associated with it.
4.1.2 Discussion
As can be seen from the above presentation, no explicit causal analysis is per-
formed. By using failure rate data from offshore applications, it is implicitly
assumed that all relevant causes are reflected in the data and that we do not
need to take into account any specific causes. The obvious weakness of this is
that installation-specific causes will not be reflected at all, and that differences
between installations only are reflected in the quantity of equipment.
Studies of leaks on Norwegian offshore installations (Vinnem & Røed,
2015) have shown that maintenance activities are a key cause of leaks and
that the correlation with equipment quantity not necessarily is good. There
are thus clearly differences between installations that are not accounted for in
the way the risk analyses are done.
An important cause of leaks is intervention in the process plant, typically
to perform maintenance on equipment, replace equipment, or perform test-
ing and recertification. Some studies have shown that as much as 50%–67%
of the leaks can be attributed to this, with only a relatively small proportion
being related to technical causes such as corrosion, erosion, and fatigue. This
is an indication that relying only on equipment counts may not be sufficient.
It may be argued that the number of operations on the equipment is
more or less proportional to the number of equipment units and that the
historical data will include both leaks due to technical failures and opera-
tional errors/human error. This may be reasonable as an average, but it is
also noted that studies have been performed that show a significant difference
in the proportion of leaks caused by operational errors on the UK continental

shelf compared to Norway. Since the most commonly used basis for calculat-
ing leak frequencies is UK data, it may be questioned if the results are
reasonable.
There may also be reasons why there are differences between installations
with regard to number of interventions. The need for maintenance may
vary due to differences in design and differences in the composition of the
process flow in the system. There may also be differences in maintainability,
e.g., facilities for bypass of equipment. This may influence how much inter-
vention is required to perform maintenance.
On the other hand, there are good arguments for focusing more on
relative differences than on absolute values. As long as the same basis is used
for all QRAs on the Norwegian continental shelf, it may be the relative
differences that are important and not so much the absolute risk level that
is calculated.
4.2 Modeling and Analysis of Event Scenarios

The initiating events identified in the previous step form the starting point
for development of a set of event trees. Typically, the event tree structure
is standardized to a large degree, although different trees usually are used
for oil and gas releases. The event trees are usually developed with two
objectives in mind:
– To enable calculation of fatality risk
– To enable calculation of frequency of loss of the MSFs
Typical examples of nodes that will go into the event trees are:
– Ignition—Whether ignition of the release takes place or not is obviously
an important factor, both for fatalities and for loss of MSFs. For gas
releases, a distinction may be made between immediate ignition and del-
ayed ignition. The purpose of this is to distinguish between cases where
no or very little gas has been released before ignition occurs and those
cases where a potentially large gas cloud has built up.
– Gas detection—This is typically the first barrier system that is considered
because gas detection often triggers other automatic actions, such as iso-
lation. Early gas detection is therefore crucial in ensuring proper and early
reaction to any release. The probability of detection commonly takes into
account both automatic detection and manual detection by personnel
that are present and can see, smell, or hear the release.
114 Stein Haugen
– Isolation of release—Above, it was mentioned that the process plant is

divided into segments according to where the ESDVs are located. Failure
of isolation (failure of ESDVs) will imply that the quantities of hydrocar-
bons available to feed the release become bigger, potentially extending
the duration and the magnitude of the event.
– Other key barrier systems that are considered are deluge/firewater and
blowdown/pressure relief. Deluge can fill several functions, for cooling
equipment, to limit extent of radiation and heat loads and to extinguish
fires in the best case. Blowdown primarily removes hydrocarbons, thus
reducing the feed to the release.
– A third type of nodes in the event tree that is often included is escalation
of the initial event to other equipment or to other areas. Escalation to
other equipment can also imply escalation to another process segment,
potentially increasing the duration and magnitude of the event. “Prevention
of escalation” is one of the MSFs that are considered in the analysis and
distinguishing between situations where escalation to another area takes
place or not therefore provides direct input to the calculation of frequency
of loss of this MSF.
Other nodes may also be included in the event tree, but this gives an impres-
sion of the type of factors that are taken into account.
The second step in the modeling of event scenarios is to assign probabil-
ities to the nodes in the event tree. The sources of information vary,
depending on the type of nodes. The NORSOK standard (NORSOK,
2010) gives some guidance on how to determine the probabilities.
For barrier systems (isolation, deluge, blowdown, etc.), it is recommended
to use specifications, SIL (Safety integrity level) requirements, or actual expe-
rience data as far as possible. Explicit modeling of the reliability of the systems
(using fault tree analysis) is not required. The probabilities will not only take
into account the technical reliability of the systems as such, but also other
aspects that will influence the likelihood of successful function of the barrier
systems:
– Functionality—to what degree the systems are able to fulfill the functions
they are intended to fill. An example is the gas detection system which
usually will not have 100% coverage and also will not be able to detect
gas clouds unless they are of a certain size. This may imply that the system
is unable to detect small leaks in certain areas. This needs to be taken into
account when determining the probability of detection.
– Survivability—to what degree the systems are protected against the
physical effects of the accidents that they are intended to function in.
An example of this may be the deluge system, which among others may
have a cooling effect in fires. If the system is damaged by the fire itself,
it will obviously not be able to fill this function and the probability of
successful application of deluge is reduced. This also needs to be taken
into account.
– Availability—this is the planned outage of the systems, e.g., will fire detec-
tors typically be overridden in connection with hot work. At the same
time, hot work is an activity that may lead to fire and thus where fire detec-
tors are important. Other examples of planned outage may be during test-
ing of systems. This is also a factor that reduces the probability of success
of a barrier.
The last point, about overriding fire detectors, also brings us to another
important point to mention. During hot work, a fire guard will normally
be assigned to the work location, to compensate for the fact that the fire
detectors are not functional. This will also be taken into account when
determining the probability.
Ignition probabilities going into the event tree will usually be based on
the following aspects:
– Gas dispersion modeling describing where the gas will be located when it
is released. This is described in some more detail below.
– Location of ignition sources. Specific sources (such as hot surfaces) are
identified and in addition it is assumed that there will be minor ignition
sources (such as light fittings, electrical connections, and cables) randomly
located in the area.
– The intensity of the ignition sources is then expressed through a proba-
bility of ignition, given that gas with flammable concentrations reaches
the ignition source.
A common ignition model has been developed and is being used for
calculating ignition probabilities (DNV model).
Escalation is the third type of nodes commonly used in the event trees.
The probabilities are here also based on the calculation of physical effects.
Escalation due to explosion overpressure will be based on calculations of
expected overpressures for the given release size and location (and also taking
into account environmental conditions and ventilation conditions). This is
then compared with the design criteria for the blast protection.
4.2.2 Discussion
The event tree nodes described earlier are not the only nodes that may be
relevant to include.
116 Stein Haugen
NORSOK Z-013 does not specify which factors to take into account,
but generally states that the nodes shall reflect important barriers and other
factors that influence the outcome of event. Importantly, it is not a require-
ment that all barriers and factors should be modeled explicitly although it is
required that the most important ones should.
Explicit modeling is advantageous since it is more straightforward to do
sensitivity analysis on effects of changes in the performance of the barrier
systems and influence of other factors. The main disadvantage is that the
event trees will tend to become very large with a large number of nodes
explicitly modeled. This should however not be an important argument with
available computer tools although it may make the analysis more difficult to
understand and interpret, unless the computer tools give good guidance.
It is notable that the probabilities in the event trees reflect the barrier
function rather than just the technical barrier systems. Barrier functions
are high-level definitions of the function of a barrier (e.g., “detect gas”)
and this function may be achieved through a number of systems (e.g., the
gas detection system, portable gas detectors, or by people). This distinction
is reflected in the fact that we take into account detection of fires both
automatically (through the detectors) and manually (by personnel that are
present). The same also applies to gas detection and also isolation. Isolation
can be triggered automatically (e.g., upon detection of gas or fire) or man-
ually, either from the control room or from manual call points located
around the platform. Clearly, this gives a more realistic reflection of the bar-
rier performance compared to if we only look at the technical systems.
The technical reliability of the barrier systems is based on standard,
requirements, etc. rather than explicit modeling of the reliability. This is
common today, but if we look back at how QRAs were done before the
turn of the century, it was common to apply fault tree analysis to model
the reliability of the systems. There is no doubt that this gives a more detailed
description of the reliability and in particular a better understanding of what
the drivers are in the unreliability. High-reliability designs may thus not be
properly reflected in the risk analysis.
The arguments against doing more detailed modeling are however also
relevant to mention:
– First of all, sensitivity analysis often shows that the results are fairly insensi-
tive to changes in the input probabilities. A more detailed calculation of the
probability will therefore often not have much impact on the end results.
– Second, since the probability of failure will be a combination of contribu-
tions from technical reliability, functionality, survivability, and availability,
it is not necessarily the technical reliability that is the biggest contributor.

Detailed modeling of one of four aspects is not necessarily very useful as
long as the other three are not modeled in the same detail (which they
usually are not).
– Third, the effort required to do detailed fault tree is much higher than
the approach commonly applied today.
4.3 Calculation of Physical Effects of Releases

The next step in the analysis is to look at the physical effect of releases. This
is usually the biggest part of the analysis in terms of effort and resources
required. Calculation of physical effects comprises several aspects:
– Release calculations—this covers calculation of transient release rates and
release durations.
– Dispersion calculations—dispersion of gas under the influence of physical
and environmental parameters. This covers dispersion of flammable gas,
but also toxic gas and smoke from fires.
– Explosion calculations—calculation of explosion overpressures, drag
forces, etc., resulting from ignited gas clouds.
– Fire calculations—calculation of fire characteristics, including magni-
tudes, durations, heat radiation, temperatures, and smoke production.
Some comments are provided to these steps in the following.
The release calculations are based on the properties of the process segment
where the release takes place. This includes fluid properties, volume, pressure,
temperature, and other relevant factors. Calculations of transients are per-
formed, as an input to dispersion calculations and also to determine the duration
of the leak. According to NORSOK Z-013, the duration is the time until the
release rate has diminished to 0.1 kg/s. This is regarded as a suitable cutoff leak
rate, and in general, leaks below this level are considered negligible contributors
to risk and are therefore not included in the risk calculations.
Dispersion, explosion, and fire calculations are normally performed using
CFD (computational fluid dynamics) tools such as FLACS and KFX. This
implies detailed modeling of the geometry of the installation first, to enable
simulations with a realistic geometry to be performed. It is common practice
to perform the calculations using a probabilistic procedure (NORSOK,
2010, Annex F). In practice this will require that a large number of simula-
tions are performed, varying parameters such as:
– Leak location and leak direction. Leaks in various locations are simulated,
representing leaks from different equipment. Further different directions
118 Stein Haugen
of the leak will also be simulated to take into account that leaks may occur
in different places on the equipment. Leak from a flange will typically
occur perpendicularly to the direction of the line the flange is mounted
on, but can have any direction in the perpendicular plane (up, down, left,
right). Gas dispersion can be strongly influenced by these factors and thus
also explosion overpressures. Probabilities are assigned to different leak
locations and leak directions.
– Wind direction and wind strength. This can strongly influence gas
dispersion, gas cloud buildup, and dispersion of smoke in a fire. Proba-
bilities of occurrence of different conditions can be assigned based on
environmental data.
– Ignition point. This can have a significant impact on among others
explosion overpressures.
By repeating the explosion and fire simulations with varying values for these
parameters, it is possible to establish a spectrum of resulting physical effects
(expressed in terms of explosion overpressures, drag loads, heat loads, etc.)
in varying locations around the installation. If we use the explosion simulations
as an example, we can then order the simulation results according to explosion
overpressure, from highest to lowest. Since we have assigned probabilities to
each individual simulation, we can order the probabilities accordingly and
can establish cumulative frequencies for exceeding decreasing levels of over-
pressure. If we say that we want to design for overpressures that have a prob-
ability of occurrence of more than 10 4 per year, we can move down the
list of decreasing overpressures, adding together the probabilities for all the sce-
narios until we reach the overpressure where the probability sum exceeds
10 4 per year. This overpressure becomes our design level.
This is a simplified description, but in principle, this is how the proba-
bilistic analysis is done.
This use of the results is for design purposes, and this can give input to
design of structures, protection of escape ways, and protection of accommo-
dation safe area. In addition, this can also be used as input to fatality calcu-
lations, if we know the tolerance limits of personnel.
4.3.1 Discussion
If we look at how the different elements of the risk analysis are being done
today compared to in the early days of QRA in the North Sea, there is no
doubt that the development has been far greater in the area of calculation of
physical effects than in the probabilistic modeling. In particular, the causal
analysis is basically done in the same way as it was 20–30 years ago. In some
respects, e.g., in relation to determining the failure probabilities for barrier

systems for use in the event trees, the analysis has actually been simplified.
This may trigger some reflections on whether the level of detail in the
way the analysis is done today is reasonable. If some aspects of the calcula-
tions are very uncertain, the end results will still be very uncertain even if
we apply detailed models and put a lot of effort into other parts. If we are
concerned about uncertainty in results from risk analysis, there is clearly a
need to look more closely at where we can achieve the greatest benefits
and where it may actually be possible to save time and resources without
any significant increase in uncertainty.
One aspect of the extensive use of CFD combined with probabilistic
analysis is that the calculations may become a “black box” that requires deep
expertise to verify that the results are reasonable and physically possible. This
is clearly a risk and can of course lead to errors both in terms of over-
estimation and in terms of underestimation of the risk.
4.4 Calculation of Impact on Personnel and MSFs

The final step in the analysis of process accidents is to convert the results from
the physical effect calculations into resulting impacts on personnel and
MSFs. In practice, what is done is that we determine probabilities of fatalities
and loss of MSFs, given varying physical effects such as overpressures and
heat loads.
To be able to do this, we need information about the tolerance limits of
people and the MSFs. Tolerance limits for people are normally based on the
report “Human resistance against thermal effects, explosion effects, toxic
effects, and obscuration of vision” (DNV Technica/Scandpower, 2001).
This report gives guidance on exposure times to varying heat loads that will
lead to 100% fatalities. Similarly, effects of explosion overpressures, frag-
ments, etc. are also discussed. By comparing the tolerance limits with the
calculated physical effects, probabilities of fatalities can be determined.
For the MSFs, the tolerance limits are determined in somewhat different
ways, depending on the nature of the MSF. For several, it is the ability of
structures and equipment to survive the physical effects that determine
the tolerance limits. Prevention of escalation is related to escalation to other
areas, and it will therefore be determined by the design of the area divisions
(blast wall, fire walls) as the key factor. The same applies to the main struc-
ture. For safe area and emergency rooms, the functional requirements will be
related to personnel being able to survive and behave rationally in these areas
120 Stein Haugen
for sufficiently long (until the platform has been evacuated). Requirements
will thus typically specify that the areas should remain intact, free of gas and
smoke and with acceptably low temperature for a specified period of time.
The time is often taken as 60 min although the analysis will give input to
determine this time.
Loss of escape ways is directly related to whether personnel can use them
for escaping or not. Heat loads and smoke (in particular obscuration of
vision) will therefore be determining factors.
The final consideration before being able to determine the probability of
fatality is the location of personnel. As a basis for this, a personnel distribution
is established. This is a prediction of the average manning that can be
expected in different areas of the installation. Often, this is divided on
day and night. There is a requirement that risk should be considered for
the “most exposed group,” implying that the personnel need to be divided
into several groups, usually according to their occupation (e.g., drilling
crew, operations/maintenance personnel, and admin personnel). The aver-
age manning per group then needs to be established. The assumption is
often that the personnel are randomly distributed in the area and that the
fatality probability is determined based on that. With random distribution,
the fatality probability will in practice be determined based on geometrical
considerations, where the proportion of the relevant area that is exposed to
fatal physical effects is determined and this is taken directly as the fatality
probability.
In some cases, other assumptions about personnel distribution are also
used. In some cases, it is taken into account that human intervention in
the process systems is a major cause of releases and it can thus be expected
that one or a few people are close to where the release occurs, with the rest
being randomly distributed. Another assumption sometimes applied also
is that there may be personnel who approach the area and the location of
the release, to investigate the situation. This will increase the number of
people exposed and thus the fatality risk.
4.4.1 Discussion
This part of the analysis is fairly straightforward, but some comments can be
added to the discussion about assumptions for where personnel are located in
release scenarios. The impression may be that the different assumptions
applied will not make much difference since it is only a matter of one to
two persons that are exposed to more risk or that are added to the number
of people exposed. However, the number of people that on average are
present in a process area on an offshore installation is low. Depending on the

size of the area and the complexity of the equipment, it is not uncommon
that it is estimated that there are less than two to three persons per area (on
average). If we then add one to two more, the percentage increase is large.
Further, when we know that immediate fatalities, i.e., the fatality contribu-
tion associated with being directly exposed to the initial fire/explosion, nor-
mally are the largest contributors to total fatality risk, we can see that the
results are quite sensitive to the assumptions that we make.
5. RESULTS PRESENTATION
5.1 Fatality Risk
The main focus of QRAs is risk to personnel, and specifically fatality risk.
The fatality risk is calculated based on a number of components:
– Transportation fatalities—in most cases, this will be risk associated with
helicopter transport. This is not directly related to the facility as such,
but it is still a requirement to include this component of risk. This should
also include risk associated with shuttling between installations if this is
relevant.
– Immediate fatalities—this is the immediate effects of the accident, e.g.,
due to explosion overpressure or impacts. This is usually relevant only
for those in the immediate vicinity of where the accident occurs.
– Escape fatalities—this is related to escape from the area of the installation
where personnel are located when the accident occurs to the safe area
(usually the accommodation). A key factor in the analysis here is whether
the accidental effects may block escape ways, thereby trapping people.
It is commonly assumed that if people are trapped and there are no evac-
uation means that they can reach, they will be killed.
– Evacuation and rescue fatalities—while escape was about getting to the
safe area, evacuation and rescue are about the process of getting away
from the installation and being picked up from the sea. Fatalities during
this process, e.g., due to failures when launching lifeboats, will be
included in this component.
This breakdown will of course give a better understanding of where the
weak points in the design are and thus where improvements should be
made. Further, the fatality risk should be presented per area (often a fatal
accident rate (FAR) value is calculated based on 100% occupancy) and also
divided on different groups of personnel. As mentioned earlier, there is a
122 Stein Haugen
requirement in the regulations that risk should be calculated for the most
exposed groups and the crew is therefore split into smaller groups.
Experience is that the transportation risk and the immediate fatality risk
are the two most important contributors to total fatality risk. Both of
these are very much proportional to how many individuals are directly
exposed to risk (either through transport or by working in areas where an
accident may occur) and in reality we can only reduce these contributions
significantly by reducing the number of people exposed or by reducing the
probability of accidents.
Fatality risk can be expressed in different ways and it is common to use
different measures of risk:
– Risk acceptance criteria for fatality risk are commonly expressed in terms
of either FAR or individual risk per annum (IRPA). Both can be regarded
as risk measures that express risk to individuals, although in different ways.
– Risk in an area can be expressed in different ways, based either on calcu-
lation of FAR or IRPA. In both cases, the assumption is that a person is
exposed to the risk in the area 100% of the time. This is different from
ordinary IRPA/FAR calculations, where the proportion of time that per-
sons are present in an area is taken into account.
– Fatality risk is also commonly expressed as PLL values (Probable Loss of
Life). This is a group risk measure, expressing the total risk for a group
of people (in this case, all employees, contractors, and visitors at the instal-
lation). PLL is typically used to evaluate the effect of risk-reducing measures,
by comparing PLL with and without the risk-reducing measure in place.
It is not well suited to express acceptance criteria since it depends on the
size of the group being considered, i.e., the size of the crew on the platform.
5.2 Main Safety Functions

A particular aspect of the Norwegian regulations is the introduction of the
MSFs as a way of measuring risk exposure. The MSFs are a set of key func-
tions that are essential for maintaining the safety of the personnel onboard
and the installation as such. The MSFs are defined as follows (from the Facil-
ities Regulations by PSA):
– Prevent escalation: preventing escalation of accident situations so that
personnel outside the immediate accident area are not injured.
– Escape ways: at least one escape route from every area where personnel
are found until evacuation to the facility’s safe areas and rescue of per-
sonnel have been completed.
– Safe area: protecting the facility’s safe areas so that they remain intact
until the facility has been evacuated.
– Structural integrity: the capacity of main load-bearing structures until
the facility has been evacuated.
– Emergency rooms: protecting rooms of significance to combatting acci-
dents so that they remain operative until the facility has been evacuated.
It is possible to see the logic in how this contributes to protect people from
being killed. Prevent escalation will avoid that a large number of people are
killed by the immediate effects, by limiting the extent of the initial effects.
Provided escape ways are available to a safe area, they can also get to a safe
location and stay safe, as long as the structural integrity of the installation is
intact. Finally, if emergency rooms are available, effective management of
the incident can also take place.
From a designers point of view, this is often an easier way to ensure a safe
design than by using measures of fatalities directly. Requirements to “Prevent
escalation” can be turned into requirements for passive fire protection, blast
protection, requirements for deluge, etc. Requirements to provide “Escape
ways” will be converted into requirements to the layout of the installation
and to protection of the escape ways against fire and blast loads.
In the QRA, the MSFs are evaluated by calculating the annual frequency
of loss of the MSFs. For a given type of accidents, e.g., fires, the total annual
frequency is calculated (considering all fires that can make the escape ways
unusable) per area. It is thus the frequency of not being able to escape per
area and per accident type which is calculated. Similar calculations are being
done for all the MSF. NORSOK Z-013 (NORSOK, 2010) contains a
separate annex B that elaborates on the interpretation and calculation of
loss of the main safety functions.
The general requirements for QRA also contain requirements for sen-
sitivity analysis and establishment of input to design accidental loads. Exam-
ples of parameters that should be considered in sensitivity analysis are
manning and personnel distribution, leaks frequencies, ignition probabili-
ties, performance of barrier functions, and activity levels.
5.3 QRA Summaries

A returning issue related to the QRA has been that the studies were not used
very much to support decision making in operations. Decisions in operations
are typically related to what activities can take place safely, need for mainte-
nance, can we continue operating even if some equipment has failed, etc.
124 Stein Haugen
To improve the situation, efforts have been made to extract relevant

results from QRAs and present these in a simplified manner. The underlying
assumption has been that the reports were too technical and made for QRA
experts rather than for operational staff on offshore installations and that it
was too difficult to extract relevant information from all the models and data
presented.
To a certain extent, this is correct, but it is also clear that the models
applied in QRAs not necessarily are designed to provide decision support
for operations. This has made it quite difficult to extract results that can
be truly useful for decision making in an operational context. The result
of this has therefore also been that the QRA summaries have been used
to some extent, but not nearly as much as the operators would have liked
to do.
6. RELEASES FROM PIPELINES AND RISERS

There are many similarities between the way that the analysis of pro-
cess releases and riser and pipeline releases are performed and only a short
summary of the main differences is therefore provided.

For process releases, the plant was divided into segments according to where
the ESDVs are located and several leak sizes were defined for each segment.
Risers/pipelines are usually defined to end at the last ESDV before the
process plant, i.e., where the process plant starts and releases are classified as
process releases. This means that there are usually no further isolation means
on the riser/pipeline and it is meaningless to divide it into segments as we do
for the process plant. Instead, different release points are often defined
according to how the riser is routed:
– Release on platform, “outside” riser ESDV (if relevant)
– Release in air, below the platform
– Release in splash zone
– Release below splash zone
– Release on seabed, inside 500 m safety zone
The subdivision may be different, but the main purpose is that the subdivi-
sion is done to reflect where the hydrocarbons are released since this will
impact on the physical effects. Releases below the platform will primarily
give fires on sea and releases below the sea surface will have lower release
rates and also be more diluted before they reach the surface, reducing the
probability of ignition. Releases that occur outside the safety zone are nor-
mally considered to be too far away to impact the platform, although there
clearly may be implications for the environment.
Different leak sizes are also used for risers and pipelines, in much the same
way as for process releases.
The basis for determining leak frequencies are historical data from off-
shore pipelines. One recommended source from NORSOK Z-013 is the
Parloc reports (Energy Institute, 2015). No detailed causal analysis is usually
performed although if the risers are particularly exposed (or particularly well
protected), specific analysis of some causes, e.g., impact, may be performed.

Event trees are applied also for riser releases, but these are usually much sim-
pler than the event trees for process releases. There are few barrier systems in
place to modify the effects of riser/pipeline releases and therefore fewer
nodes are required to model. Ignition is obviously still a relevant factor,
but the ignition probabilities will normally be much smaller.

This step is similar as for process releases, with the additional element of fire
on sea. This may also occur for process releases, although normally the quan-
tities spilled to sea will not be large enough to cause significant fires on the
sea surface.

The principles are again very much the same as for process releases. The
main concerns are usually heat that may endanger the structure of the instal-
lation and smoke/heat that may impact on escape ways and in particular
evacuation means.
7. BLOWOUT
Blowout, or uncontrolled release of hydrocarbons from the reservoir,
is another large contributor to risk on installations where this is relevant.
Not all installations have platform wells but import produced hydrocarbons
through flow lines (which is covered under riser and pipeline releases) from
subsea manifolds or from dedicated drilling/wellhead platforms. The follow-
ing discussion will be mainly relevant for platforms that have wellheads on
126 Stein Haugen
the platform, although elements are relevant also for installations where the
wellheads are located on the seabed below the platform. The overall prin-
ciples of modeling are similar to process releases and only the key differences
are therefore pointed out in the description.

Specific initiating events for blowout are defined first based on the well
operations taking place. Exactly how this is done may vary, but some typical
examples are:
– Producing wells: This is the normal situation, where no intervention is
taking place and the well is in a steady-state production.
– Well intervention: A large variety of well interventions may take place,
from very simple operations leaving all barriers intact, to operations
where the whole configuration of the well barriers has to be changed.
– Well construction: This can be regarded as another type of well interven-
tion, but often this is also considered part of drilling.
– Well drilling: Drilling of wells is considered separately. It is also common
to distinguish between drilling of exploration wells and drilling of pro-
duction wells. The reason for this is that when production wells are being
drilled, the geology and thus the pressure in the reservoir are usually much
better known compared to when drilling exploration wells. This also
affects the probability of a blowout during the operation. A specific con-
sideration during drilling is the possibility that shallow gas blowouts may
occur. This may occur if there are (usually small) pockets of gas above the
main reservoir where the well is planned for.
In addition to type of operation, it is also common to distinguish between
different types of well, i.e., whether it is an oil or gas producing well,
whether it is a gas injection well, or either it is a well for injecting water,
CO2, or other nonflammable materials. This is primarily relevant for the
consequences should a blowout occur.
Further, the location of the release is also considered. The exact subdi-
vision will depend on the layout of the platform and the wells. To illustrate,
typical scenarios may be subsea blowout (outside tubing or casing), blowout
from wellhead, and blowout on drill floor.
Finally, it is also common to define scenarios depending on the release
size. It is then distinguished between well releases and blowouts. A well
release is defined as a release where the barriers are shut in within a short
time, effectively isolating the reservoir and thereby limiting the duration
of the release. A blowout is those situations where all barriers have failed
and the release is being continuously fed from the reservoir.
For all these scenarios, occurrence frequencies are based on historical data
(SINTEF, 2018). Generic frequencies are available to support determination
of frequencies per well or per operation. Platform-specific frequencies are
calculated by multiplying with the number of producing wells, number
of planned well operations, etc.
7.1.2 Discussion
It may be noted that it is not common to perform causal analysis in this
case either (as for process releases). More detailed tools are available
(Arild, Ford, Loberg, & Baringbing, 2009), but these are nor commonly
used in QRAs, but rather for planning of specific wells. This implies that
the detailed design of the wells, specific aspects of the reservoir, etc. normally
not are reflected in the QRA. There are thus also limits on what recommen-
dations related to blowout risk that can come out of a QRA. In practice, the
only changes that will affect the risk is the number of wells/number of oper-
ations and the measures that are introduced to reduce the consequences of
blowouts (in practice this will mainly be passive fire protection and fire/blast
walls to separate drilling/well areas from the rest of the installation).

Event trees are used also for modeling of blowouts. The event trees are fairly
simple compared to those that are used for process releases. Factors that typ-
ically are taken into account are whether ignition occurs or not and whether
the release flows to sea, causing a fire on sea in addition to on the platform.
In addition, escalation to other areas may also be relevant to include.
The reason for the simpler structure of the event trees for blowout is that
there are fewer technical systems that influence the development of the sce-
nario after the blowout has occurred. Isolation, detection, fire water, and
pressure relief will not really influence the development of this scenario
to any significant extent. Isolation is not possible if a blowout has occurred,
automatic detection is of limited relevance since the release will be manually
detected in any case, pressure relief is not relevant, and firewater will have
limited or no effect on a blowout due to the size of the release.
128 Stein Haugen

Calculation of physical effects of releases and calculation of impact on per-
sonnel and MSFs are for all practical purposes performed in the same way as
for process releases. Similar methods and tools are being used and the same
types of results are calculated. The only exception is the release size and the
duration of the release. The release size is determined based on reservoir
characteristics (pressure, well flow rate, well geometry), and for a blowout,
the duration will be defined as at least as long as it takes to evacuate the
platform.

Calculation of physical effects of releases and calculation of impact on per-
sonnel and MSFs are performed very much in the same way as for process
releases.
8. SHIP COLLISION
A third large contributor to risk in many cases, together with process
releases and blowout, is ship collision. This is normally grouped into one
category, although it covers a set of scenarios that are very different with
respect to how the probability of the events is modeled. The discussion will
be structured as follows:
– Definition of initiating events
– Calculation of collision frequencies
– Modeling of consequences

Many users of the sea may come close to an offshore installation and thus
represent a risk of collision. The different groups of vessels behave differently
and have different motivations for getting close and this is reflected in the
modeling. The following are the main groups of vessel that may be covered
by a QRA:
– Visiting offshore supply vessels (OSVs)—split on voyage from shore/
previous location, approach, loading/unloading, and departure
– Other visiting vessels (diving support, work vessels, anchor handlers, etc.)
– Flotels, drilling rigs located in field, other permanently located moored
vessels (Floating Storage Units)
– Shuttle tankers (most common for Floating Production and Storage vessels)
– Passing merchant vessels

– Others
Historically, it is not surprising that vessels operating close to the offshore
installations have caused the largest number of collisions. The large majority
of these collisions are however minor impacts, often causing no or very little
damage to both the offshore installation and the ship. Typically, this is the
case for OSVs, which have to come in close during loading/offloading.
In particular in rough weather conditions, minor impacts may occur. In
the following, we will elaborate on the following types of collisions:
– OSVs
– Shuttle tankers during loading
– Passing merchant vessels
The operation modes the vessels are in are quite different, requiring different
models to calculate the collision probability. For OSVs and shuttle tankers,
the analysis is often to a large degree based on historical data, with limited
modeling and analysis. The discussion below is therefore primarily qualita-
tive. For merchant vessels, more comprehensive analysis is normally done
and this is explained in some detail.
8.2 Offshore Supply Vessels

The operation of OSVs and relevant hazards can be described as follows,
from leaving port and until they leave the platform to return to port or
to go to another installation:
– First is the transit phase, when they go from port toward their destination.
The relevant risk in this period arises when they approach the platform.
There have been cases when the OSV has hit the platform because the
crew of the OSV has not slowed down and changed course in time. This
is a situation quite comparable to the passing merchant vessels scenario,
and the modeling of the event is done in a similar manner.
– Entering the safety zone around the platform and approaching the plat-
form to take up position for loading/offloading. This requires careful
maneuvering, and especially in situations with current, wind, and waves
(often acting in different directions), collisions may occur. Typically, these
will however be low-speed impacts.
– Collisions during loading/offloading, when the OSV is located close to the
platform. It is common that the vessels are on DP (Dynamic Positioning)
during this operation and several collisions have occurred because the
DP systems gets “confused,” either because it loses or gets the wrong
130 Stein Haugen
position information, because of unexpected/quickly changing loads on the

ship (due to gusts or waves) causing the DP system to overcompensate or
because it comes outside the specified range and uses too much power to
move back to the right position. Again, the speed will usually be low and the
impact energy limited. Damage to installations has however occurred
because of this, although no cases of severe damage leading to loss of instal-
lations are known.
– Collisions may potentially also occur when loading is completed and
the vessel is due to leave the position close to the installation although
this is far less likely.
8.3 Shuttle Tankers During Loading

An operation of a similar nature as OSV operations is loading of shuttle
tankers. In the North Sea, tandem loading with the shuttle tanker moored
with the bow toward the aft of the FPSO is the most common solution. Sev-
eral accidents have occurred during this type of operation, also in recent
years. In the period 2000–15, there were a total of nine incidents involving
drive-off and collisions on the Norwegian continental shelf (Dong, Rokseth,
Vinnem, & Utne, 2016). Five of these occurred during tandem loading, and of
these, two resulted in collision. In all the cases, the shuttle tanker was on DP.
During tandem loading, the distance between the FPSO and the shuttle
tanker is typically 80–150 m. In some cases, the two ships are connected with
a hawser, in addition to the loading hose. Accidents can occur (and have
occurred) during all phases of the operation:
– During connection
– During loading
– During disconnection/departure
During loading, one may experience the same problems as mentioned earlier
for OSVs that the DP system ends up overreacting to deviations or errors in
position information. The time for operators to react to this is very small, and
even if the distance between the two ships is relatively small, the shuttle
tanker will still have time to build up sufficient speed to potentially cause
extensive damage to the FPSO.
8.4 Passing Merchant Vessels

Passing merchant vessels have been of concern to the offshore industry for
a long time, mainly because the impact energy of large vessels will be so
large that it can have catastrophic consequences if the installation is hit
(Haugen, 1998). The main issue is that the cause of collision normally
will be that the ship is unaware of the installation and therefore can hit
the installation at service speed.
The analysis of the probability of collision is performed in the following
steps:
1. The ship traffic in the area around the installation is described. An under-
lying assumption is normally that the merchant ship traffic follows fairly
well-defined routes between ports (as defined by the shortest route tak-
ing into account any obstructions). This has been confirmed by obser-
vations of traffic. The basis for identification of traffic is today normally
AIS data, which gives comprehensive information about the number of
vessels, types of vessels, size, speed, etc. Based on this, ship traffic lanes are
established, characterized by a mean distance from the platform, a course,
and a standard deviation describing the variance in the exact route
followed by the ships in the lane. Further, the standard assumption is that
the traffic is normal distributed.
2. Based on the statistical description of the traffic lane, the probability of
a ship traveling in this lane being on course toward the platform is cal-
culated. This is often termed the geometrical collision probability. By
multiplying this with the number of ships traveling the lane (normally
split on vessel size), the annual geometrical frequency of collision
between a ship and the platform can be calculated. A particular issue
related to this factor is the use of autopilot. Some years back, it was
common practice for supply vessels traveling from shore to an installa-
tion to set their target exactly on the installation. This meant that the
geometrical collision probability would be very close to 1, because
the autopilot would ensure that the ship was on a collision course. After
an accident occurred, where the autopilot was not turned off in time
and the supply vessel collided with the platform, procedures were
changed and it became mandatory to set the course 1 nm to the side
of the installation.
3. The geometrical probability is calculated on the basis that no actions to
avoid collision are taken by the ship. In most cases, the ship will of course
change its course and travel to the side of the platform, typically with a
minimum distance of 1–2 nautical miles (nm). This is in some models
called Probability of Ship-Initiated Recovery. Different models take into
account different factors, but this probability is typically influenced by
the size of the ship, the flag of the ship, and the vessel type.
132 Stein Haugen
4. Even if the ship fails to take action because the bridge crew has fallen
asleep or is occupied with other tasks, there may still be a possibility that
the platform (or other external parties) may be successful in warning the
ship and thus initiating actions to be taken. This is called Probability of
Platform-Initiated Recovery. The most common way of doing this is
to contact the vessel by radio. It may be noted that most of the platforms
on the Norwegian continental shelf now are under surveillance from
shore-based facilities that have as their primary task to detect ships that
are on collision course and contact this by radio to verify that they are
aware of the situation and that they are planning to change their course.
Since the collision probability is dependent on the ship traffic in the area, very
large variations in the risk can be seen from one installation to another. The
results from these studies will influence operations if the risk is high. Additional
operational measures to reduce risk may be implemented in some cases, the
design loads for installations may also be increased, and there have also been
cases where the location of an installation (in particular drilling rigs) has been
moved to reduce risk.
8.5 Consequence Analysis

The consequence analysis is based on a simple comparison of the kinetic
energy of the ship (including added mass) and the design criteria of the instal-
lation. It has been common practice to design for supply vessel collisions,
with 11/14 MJ as the collapse criterion. Ships with higher impact energy
than this are commonly assumed to cause collapse of the platform, although
experience is that most installations can tolerate significantly higher impact
energies than this without global collapse. Examples are concrete platforms
and also FPSOs. The calculations are therefore in many cases very conservative.
The fatality risk is calculated based on the collapse probability. Simplified
analysis is usually applied, assuming that 50% of the crew onboard will be
killed if collapse occurs.
In addition to collapse of the platform, there may also be cases where
risers are exposed to impacts and these will typically tolerate far smaller
impact energies than the main structure. In such cases, the design loads of
the risers will be applied as a limit criterion and the ensuring release from
the risers will be considered in the same way as other riser releases, although
often with a higher ignition probability because the impact itself may gen-
erate sparks which can ignite the release.
9. OTHER HAZARDS
The previous sections describe the analysis process for some of the
most important accident types for offshore installations. A number of other
accident types are also considered and in the following some brief comments
are given on some of these.
9.1 Dropped Objects

Dropped objects is an important contributor to risk and separate dropped
object studies are normally performed, considering detailed lifting patterns,
laydown areas and types, size and mass of objects that typically are lifted. The
purpose of these studies is usually to provide input to design of dropped
object protection and dimensioning of structures and equipment against
impact. The purpose is thus to achieve a specified safety level through design
rather than to calculate a risk level.
Because of this, dropped objects are often treated in a simplified manner
in QRAs. The two main effects that may cause fatalities are if equipment/
structures are hit or if people are hit directly.
It is commonly assumed that dropped objects only can lead to local dam-
age of equipment or structures, not major collapse. There are some excep-
tions from this, notably for floating installations where dropped objects may
fall into the sea and penetrate buoyancy tanks. In general, damage to struc-
tures is however not considered critical and will therefore not contribute to
major accident risk as calculated in the QRA. Damage to equipment may
cause release of hydrocarbons and this may in turn lead to a major accident
if the release is large and ignition takes place. It is however common to
assume that no lifting will take place over (unprotected) hydrocarbon con-
taining equipment. The risk related to this is therefore negligible. Further,
since historical data are used for process leaks, these are also considered to
contain leaks due to impact. It is therefore often assumed that a contribution
from dropped objects already is included implicitly in the data that we are
using and that it should not be calculated separately and added on top. These
are simplifications that do not take into account local variations in lifting
activity, equipment, and equipment protection.
The second contributor to fatality risk, that people are hit directly, is
often also assumed to be included in the historical data that we are using.
Occupational accidents are included in the risk picture calculated in QRAs
134 Stein Haugen
(see later), and this is normally based on historical data (fatality risk per
worked hour or similar measures). The historical data will also typically
include fatalities due to dropped objects and the contribution is therefore
considered to be included without separate analysis of the probability of
people being hit. Again, this is a simplification since no local specifics are
taken into account, except for the number of exposure hours.
9.2 Structural Failure Due to Extreme Environmental Loads or

Design Errors
Structural failure leading to collapse of offshore installations is also a signif-
icant contributor to risk. The best known example from the Norwegian
offshore industry is the Alexander L. Kielland capsizing (NOU, 1981),
which was caused by fatigue of a weld, leading to breakage of a key structural
element followed by loss of a leg.
The Norwegian regulations have for long time specified probabilistic
criteria for design against accidental loads. These criteria specify that struc-
tures should be able to survive accidental loads with an annual frequency
higher than 10 4 per year.
Based on this, it has been argued that the probability of complete loss of
an installation due to structural failure, whether it is due to loads in excess of
what the structure is designed for or due to strength lower than the regula-
tions require, should be less than 10 4 per year. It has therefore been quite
common to include a contribution of 10 4 per year to account for this
type of accidents. Sometimes, it is also argued that since 10 4 is the upper
limit, the actual frequency of collapse is likely to be lower than this. A lower
value is therefore sometimes also used although the basis for choosing this
is somewhat arbitrary.
The fatality risk is also calculated in a very crude manner. No detailed
analysis is usually performed, but it may be assumed that on average 50% of
the personnel on the installation will be killed if a structural collapse occurs.
This is clearly an extremely simplified approach, but it can be argued that
with probabilistic design criteria, the risk associated with this type of acci-
dents is being controlled through the design process and a separate risk anal-
ysis will not really add much to this process. On the other hand, since one of
the purposes of the analysis also is to verify whether the total risk level is
acceptable or not, it may be argued that this very simplified approach exag-
gerates the risk level. In practice, these results from the risk analysis are not
used for decision making in any case.
9.3 Helicopter Accidents

According to NORSOK (NORSOK, 2010), transport to and from the
installation should also be included in the risk picture for an offshore instal-
lation and is thus quantified in the QRA. Two scenarios are usually
considered:
– Accidents during take-off/landing. This includes accidents that may
happen both at the installation and at the onshore base.
– Accidents during flight.
The basis for the quantification is historical data for helicopter accidents.
HSE (2004) have collected data for UK operations and these also form
the basis for risk analyses performed in Norway. In addition, several studies
of helicopter safety have been performed in Norway (SINTEF, 2010). The
models take into account the following:
– The number of take-offs/landing and the number of flight hours.
– The probability that a person in a helicopter experience an accident
will be killed. This is also split on accidents during take-off/landing
and during flight.
– The average number of persons in the helicopter.
By combining this with helicopter accident frequency data, FAR and PLL
can be calculated. It is noted that local variations in weather conditions,
approach to the platform, and availability of resources to rescue personnel
are not taken into account in the analysis.
In practice, the results from the analysis of helicopter accidents will also
have a very limited impact on design and operations. In practice, there is
very little that can be done to change the number of take-offs and landings
or the flight hours (location of helicopter bases is often also influenced by
political decisions rather than safety aspects). There may be certain proce-
dural measures and emergency response measures that can be taken, although
this is usually not informed by the risk analysis. The analysis is in any case
too coarse to be able to reflect the effect of this type of measures.
9.4 Occupational Accidents

A final element of fatality risk that is also included in the QRA is occupa-
tional accidents or personal accidents. The QRA is primarily aimed at
quantifying major accident risk, and as such, this is outside the scope of
the analysis. However, it is still common practice (and a requirement in
the standard) that this contribution also should be included.
136 Stein Haugen
Similar to several of the accident types mentioned earlier, this is however

done in a very simplified manner and acts more to ensure that a contribution
from this type of accidents also is included rather than aiming to reflect a
detailed or very specific risk picture.
Historical data for occupational accidents per worked hour are used as a
basis for the calculation. Frequently, this is split on different personnel
groups, such as operator/maintenance personnel, drilling personnel, and
catering/admin personnel. Different groups have different historical acci-
dent rates. Historical data for offshore personnel are being collected by
PSA (PSA, 2017a). The historical data are then combined with the number
of hours worked per year for each group and a total PLL contribution is cal-
culated. Similarly, FAR values can also be calculated for the different groups
or for the installation crew as a whole.
In effect, no local factors related to the installation are taken into account
except the number of people in each group of personnel. The results there-
fore have no practical implications for risk management.
10. COMPARISON OF QRA RESULTS AGAINST ACTUAL

RISK LEVEL
A detailed comparison of results from QRAs against the actual risk
level is an extensive task and requires access to all QRAs performed for off-
shore installations on the Norwegian continental shelf. This is not feasible,
among others because the studies are not publicly available. However, some
simple comparisons based on experience may be possible. This has been
done for two cases, complete loss of installation and fatality risk.
For the Norwegian offshore activity, there has been only one case where
a complete loss of an installation has occurred, with a significant number of
fatalities. This was the Alexander L. Kielland accident which occurred in
1980. There have been other significant cases also, including a ship collision
where the platform was so extensively damaged that it later had to be
removed. However, it did not collapse as a result of the accident. Accidental
collapse is therefore considered to have occurred only once. Alexander L.
Kielland was a floating accommodation platform, not a production/drilling
installation, but is still relevant to include. If we look at the total period of
offshore drilling and production in Norway, this started in 1966 and has con-
tinued since this. Calculating the average number of installations operating
in the North Sea during this period requires extensive data collection, but as
a coarse estimate, we can use 100 installations on average over this 52-year
period. Roughly, we can say that this corresponds to 5000 installation years.
The average probability of global collapse thus can be calculated as 1 in 5000,
i.e., 2 10 4 per year.
This is of course an extremely simple calculation, but still is an indication
that the number typically used in QRAs, 1 10 4 per year, is not very far off
the mark compared to what we have experienced so far.
Comparing fatality risk is also possible. According to the PSA (PSA,
2017a), the number of fatalities in the Norwegian oil and gas activity has
been 283 over the period 1967–2016. The average number of fatalities
per year is thus about 5.5. The calculated fatality risk in QRAs will vary
a lot, depending among others on the manning levels, but as a very coarse
average estimate, the calculated PLL will be of the order 0.1–0.5 fatalities per
year per installation. If we assume 100 installations operating in any given
year, this gives an estimate of between 10 and 50 fatalities per year, i.e.,
between factors 2 and 9 higher than the experienced risk level. It should also
be mentioned that the observed number of fatalities has declined steadily
over the period.
The fatality calculations indicate that the calculated risk is higher than
what experience indicates. When considering that the risk level is decreasing
and that the risk estimates are based on historical data, this should not
come as a surprise. Another factor is also that the QRAs usually apply con-
servative assumptions, in the sense that there is a tendency to choose models
and data that tend to overestimate the risk rather than use expected values.
This will also give higher risk estimates.
The implication of overestimating the risk may be that more resources
are spent on reducing risk than actually expected by society or required.
On the other hand, the performance of QRAs has been standardized to
the extent that the results from QRAs from different installations are com-
parable on a relative scale. It may therefore be argued that the practice that
has been developed with regard to protection levels corresponds to the risk
level that we consider to be acceptable, regardless of what the numbers say
or what the “correct” risk level is.
11. USE OF QRA FOR DECISION MAKING

The QRA practice that has developed over the last 30–40 years and
that is reflected in the NORSOK standard has been driven by the needs of
design projects. The first requirements for performing QRA were related to
design of installations and the development that has taken place since then
138 Stein Haugen
has continued to build on this foundation. This raises some issues related to
the basic principles and assumptions that underpin the methodology that is
being used. In particular, this is relevant when the use of QRA has moved
from supporting design related to decisions to operational decisions.
Risk analysis is primarily a tool for supporting decisions about risk.
Choosing the right tool obviously therefore requires a good understanding
of the decision that we are going to support. The question may then be asked
if design decisions and operational decisions are similar in nature or whether
they require different information to inform the decisions?
To develop a better understanding of the problem, we need to look at
the types of decisions that may be relevant to support. Yang and Haugen
(2015) have proposed a structure for decisions that may be useful to consider.
First, decisions are grouped into planning decisions and execution deci-
sions. The main difference between these two groups is the time available
for making the decision. For planning decisions, there will be time for a
systematic identification and evaluation of alternatives. This is the type of
decisions where traditional risk analysis may play a role. Execution decisions
are decisions that are much quicker and which are taken based on preplanning
and/or experience and pattern matching. For this purpose, it is the planning
decisions that are the most interesting, and these are further subdivided into
strategic decisions and operational decisions.
Examples of decisions are execution of an intervention and reacting
upon deviations. Planning decisions are further divided into two categories:
strategic decisions and operational decisions. Long planning horizon (with
time to consider risks and benefits of choices carefully), low decision fre-
quency, and long-term effects characterize strategic decisions. The disadvan-
tage is that few details often are available, limiting the available information
or making it uncertain. Blunt-end decision makers make these decisions.
Examples are approval of major projects, choosing from alternative designs/
technology, and deciding on maintenance strategy before operation starts.
Operational decisions are related to actions that will be taken and implemented
within a shorter period. The planning period is relatively short, however, long
enough to carry out formal risk assessments. Middle-level decision makers, such
as operational managers, typically make these decisions. Approval of medium-
term operational plans for a 1- to 3-month period, approval for initiating pro-
jects, and approval of shorter term operational plans (1–2 weeks) are examples
of operational decisions which require risk assessment to understand both
short-term and long-term effects on risk. Another type of operational decisions
is made on a daily basis, such as approving work permits and daily plans.
In many of the decisions, different personnel groups will provide impor-

tant input to the decision process and may in fact also be directly involved
in the decision. In operational decisions where technical issues are involved
(as is very often the case), engineering support personnel will provide input.
Often, sharp end personnel from operations will also be involved. The total
picture of how decisions are made is therefore more complex than indicated
by the figure. Planning decisions is a typical arena for rational choice decision
making, with bounded rationality. For the decision situations we are con-
sidering, risk is an important dimension of the decision in rational decision
making (Rausand, 2013). The results from risk assessment are used as direct or
indirect input to decisions. Risk acts as one of the decision rules (through use
of ALARP principle and societal risk criteria) to assist evaluating alternatives.
On the other hand, formal risk assessment may also be translated into rule
compliance for decision makers. This can range from safety-related regula-
tions to rules that are expected to be followed by sharp-end workers
(Hopkins, 2011). Execution decisions are made by sharp-end personnel with
minimal or no planning, typically during the implementation/execution of
different work activities. These may well have been planned in advance, but
not necessarily in all detail and not necessarily to cover all situations which
may arise during performance of the work. This is an arena where decision
making best can be described by naturalistic decision-making theory. Sharp-
end operators need to make rapid decisions. It is common to use their mental
model to simulate and imagine what might happen next, to look for the first
workable option, instead of the best option (Klein, 2011).
In naturalistic decision making, risk assessment is normally invisible during
the decision-making process and an informal assessment process is concealed
in the mental models and the experience of professionals (Hopkins, 2011).
Depending on the degree of urgency of the situation that the sharp-end per-
sonnel are facing, we divide execution decisions into instantaneous decisions
and emergency decisions. Instantaneous decisions are taken spontaneously by
sharp-end operators, e.g., to follow or deviate from procedures; ignore or
react upon deviations in normal working conditions. The decision making
emphasizes situation assessment and pattern matching, and “when action is
the central focus, interpretation, not choice, is the core phenomenon”
(Weick, Sutcliffe, & Obstfeld, 2005). Decisions are typically taken quickly,
although not necessarily because there is a need to do so. Emergency decisions
are the decisions taken in emergencies to avoid or adapt to hazardous situa-
tions. Time dynamic is often so fast that pattern matching may not catch
the development of the situation. The risk that we consider when we are
140 Stein Haugen
making planning decisions will not be the same as the risk we consider for exe-
cution decisions. Different characteristics of strategic decisions and operational
decisions result in different risk expressions that are required as input to make
rational choice. Furthermore, risk information that is required by sharp-end
personnel under different levels of urgency to make execution decisions also
varies.
Different decisions are made by different people and require different
information to make the decisions (Yang & Haugen, 2016). This also indi-
cates that different analyses may be required (Vatn & Haugen, 2013).
12. FUTURE DEVELOPMENTS

QRAs have been quite widely criticized in recent years, in particular
after the drop in the oil price in 2014. The criticism has been mainly related
to the cost of doing the studies and that the benefit does not outweigh
the cost. The reality of this claim will not be discussed here, but there are
some development trends that can be anticipated based on this criticism
and more general developments in QRA methodology.
12.1 Simplification
One trend that is strongly advocated by those who want to cut costs is to
simplify and standardize the studies. As it is today, large efforts are put into
particularly two aspects of the risk assessments:
– Calculating frequencies of leaks from process equipment
– Calculating consequences of fires and explosions in general
With regard to the consequence calculations, the argument is that there have
been built so many installations in the North Sea over the last years, and so
many fire and explosion simulations have been performed that we will not
learn very more from repeating this for another (similar) installation. It is also
argued that the outcome in terms of requirements for protection against fires
and explosions to a large extent is similar regardless of the installation. It is
therefore argued that rather than doing QRA, requirements for fire and
explosion protection can be standardized.
There is undoubtedly a lot of work going into QRAs today that provides
a very limited added value. A thorough review of the way that QRA is done
today is therefore considered to be useful and the end result may well be that
changes to the approach should be made. However, criticizing the QRAs is
really starting at the wrong end. We should first make sure that we under-
stand what decisions we need to make about risk, in design, construction,
and operation. From this, we can identify the need for decision support, in
particular related to risk. The conclusion may then be that some decisions
require quantitative input, while other decisions do not require this. Only
with this as a basis can be determined whether QRA is a useful tool or not,
and how QRAs should be performed. In this, one should also take into
account all the qualitative information (e.g., scenario descriptions) that is con-
tained in QRAs. One should take care to avoid that this information is not
available any more because it will reduce the understanding of what may hap-
pen on the installation and can impact emergency response and emergency
training.
The way the situation looks at the time of writing this, it is expected that
there will be a move toward simpler QRAs in the future. However, at pre-
sent, it looks as if this is driven more by cost cutting and then by a careful
consideration of what is useful and not.
12.2 Analysis for Operations

Another development that can be expected is that QRA better suited for
operational support is developed. Significant effort has been put into devel-
oping dynamic QRAs (Paltrinieri & Khan, 2016), although it is the opinion
of the author that rethinking the way QRAs are modeled is necessary to be
successful. QRAs are traditionally modeled to reflect details in the design,
while activities and operations are modeled implicitly or taken into account
only through generic data. In operations, the design is for all practical pur-
poses fixed and the changes in the risk level from day to day are largely due
to changes in ongoing activities. One approach to this has been proposed
by Haugen and Edwin (2017). In this approach, the modeling techniques
are fairy traditional, although a hybrid approach using combinations of
event trees, fault trees, and Bayesian belief networks is proposed. However,
key factors that change during operations are modeled explicitly, while more
static aspects (like layout and passive fire protection) are modeled in a
simpler manner.
12.3 Barrier Management

In recent years, the PSA have emphasized the importance of barrier man-
agement in their follow-up of the oil and gas industry (PSA, 2017b). Expec-
tations from PSA include that the industry establish overviews over which
barriers they have in place to protect against major accidents, what the func-
tion of the barriers are, and what the status of the barriers are at any time
142 Stein Haugen
(whether they are fully functional, partly functional, or out of operation).

Most operating companies have conducted extensive projects in recent years
to comply with this.
A weakness in many cases has been that the link between QRA, risk
management in general, and barrier management has not been very clear
in many cases. The barrier management projects have been run as separate
projects and most operators have established various forms of “barrier
panels” that shall help them to keep an overview of the status of the barriers.
From an operational risk analysis point of view, the barrier panels provide
an important input to determine the “living” risk level for an installation.
It is expected that these links between barrier management and updated
risk analysis will be utilized in the future and that new risk analysis models
will be built based on this.
13. CONCLUSIONS
Quantitative risk analysis has been extensively used by the Norwegian
offshore industry for the last 30–40 years. In this period, there has also been
a significant reduction in risk related to the offshore industry. This can of
course not be attributed only to the use of QRA, since a large variety of
improvements aimed at reducing risk have been introduced over this period.
However, it is not unreasonable to assume that QRA has contributed to the
risk reduction, in particular in terms of improving layout, technical safety
systems, and other design features of installations. It may be more question-
able to what extent QRA has contributed to improve operations. Risk
analysis as such has undoubtedly contributed also in this area, but it is prob-
ably fair to say that this is more related to systematic qualitative analysis, even
if we can see examples of QRA contributing also.
In recent years, questions have been asked about the value of continuing
this work, the argument being that we have learned as much as we can learn
from QRAs, and that the added value from continuing this is limited. In the
opinion of this author, this is a move in the wrong direction. There are cer-
tainly aspects of QRAs that add a very little value, but rather than concluding
that the whole concept of QRA has failed, one should examine the way that
we do QRA, to either remove or modify the parts that do not add value.
I am also convinced that there are areas where QRAs still can contribute
very much, and also can strengthen decision making in situations where
it is today not being used.
To achieve this, we need to be more precise about what we want from

QRAs, including what decisions we need support for and whether QRA or
other means is the best approach to providing that decision support. Expe-
rience from talking to operations personnel is that they see a great need for
improved decision support and it is my belief that QRA can provide some of
the answers that they are looking for, realizing of course that this never will
be more than one aspect of the input required to these decisions.
REFERENCES
Arild, O., Ford, E. P., Loberg, T., & Baringbing, J. W. T. (2009). KickRisk—A well specific
approach to the quantification of well control risks. Society of Petroleum Engineers.
Cullen, W. D. (1990). Report of the official inquiry into the Piper Alpha disaster. London, UK:
HMSO.
DNV Technica/Scandpower. (2001). Human resistance against thermal effects, explosion effects,
toxic effects and obscuration of vision, 20 March 2001.
Dong, Y., Rokseth, B., Vinnem, J. E., & Utne, I. B. (2016). In Analysis of dynamic positioning
system accidents and incidents with emphasis on root causes and barrier failures.Risk, reliability and
safety: Innovating theory and Practice: Proceedings of ESREL 2016 (Glasgow, Scotland, 25–29
September 2016). 166.
Energy Institute. (2015). The update of loss of containment data for offshore pipelines. Oil and Gas
UK/Energy Institute [March 2015].
European Parliament. (2013). Directive 2013/30/EU of the European Parliament and of the
Council of 12 June 2013 on safety of offshore oil and gas operations.
Haugen, S. (1998). An overview over ship-platform collision risk modeling. In C. G. Soares
(Ed.), Risk and reliability in marine technology: A. A. Balkema.
Haugen, S., & Edwin, N. J. (2017). Dynamic risk analysis for operational decision support.
EURO Journal on Decision Processes, 5(1–4), 41–63.
HMSO. (1992). The offshore installations (safety case) regulations. London, UK: HMSO.
Hopkins, A. (2011). Risk-management and rule-compliance: Decision-making in hazardous
industries. Safety Science, 49(2), 110–120.
HSE. (2004). UK offshore public transport helicopter safety record (1976–2002), Prepared by John
Burt Associates Limited/BOMEL Limited for the Health and Safety Executive.
HSE. (2008). HSE Leak and ignition database for offshore hydrocarbon releases, RR672, prepared by
Health and Safety Laboratory.
ISO. (2002). EN ISO 17776: 2002 petroleum and natural gas industries—Offshore production
installations—Guidelines on tools and techniques for hazard identification and risk assessment.
Kårstad, O., & Wulff, E. (1983). Sikkerhet på sokkelen. Universitetsforlaget. in Norwegian.
Klein, G. A. (2011). Streetlights and shadows: Searching for the keys to adaptive decision making.
MIT Press.
National Commission on the BP Deepwater Horizon Oil Spill. (2011). Deep water: The Gulf
oil disaster and the future of offshore drilling (p.398). Perseus Distribution Digital.
Norsk Lovtidend. (1976). Sikkerhetsforskrifter for produksjon m.v. av undersjøiske
petroleumsforekomster. Kgl. res. av 9.7.1976 (in Norwegian).
NORSOK. (2010). Z-013 risk and emergency preparedness assessment. Oslo, Norway: Standard
Norge, Revision 3.
NOU. (1977). Uncontrolled blowout at Bravo 22. April 1977, NOU 1977:47 (in Norwegian).
NOU. (1981). The “Alexander L. Kielland” Accident. NOU 1981: 11, Oslo 1981. Norwegian,
Summary in English.
144 Stein Haugen
NPD. (1981). Guidelines for safety evaluation of platform conceptual design. Stavanger, Norway:
Norwegian Petroleum Directorate.
Okoh, P., & Haugen, S. (2013). Maintenance-related major accidents: Classification of
causes and case study. Journal of Loss Prevention in the Process Industries, 26(6), 1060–1070.
Paltrinieri, N., & Khan, F. (2016). Dynamic risk analysis in the chemical and petroleum industry:
Evolution and interaction with parallel disciplines in the perspective of industrial application.
Butterworth-Heinemann.
PSA. (2002). Regulations relating to management and the duty to provide information in the
petroleum activities and at certain onshore facilities (The Management Regulations), Last amended
18 December 2017.
PSA. (2017a). RNNP—Trends in risk level in the petroleum activity—Summary report 2016—The
Norwegian Continental Shelf, Petroleum Safety Authority, 27 April 2017.
PSA. (2017b). Principles for barrier management in the petroleum industry—Barrier Memorandum
2017.
Rausand, M. (2013). Risk assessment: Theory, methods, and applications. John Wiley & Sons.
SINTEF. (22 March 2010). Helicopter Safety Study 3, SINTEF report A15753. Trondheim,
Norway: SINTEF.
SINTEF. (2018). Offshore blowout database. https://www.sintef.no/en/projects/sintef-offshore-
blowout-database/accessed April 2018.
Vatn, J., & Haugen, S. (2013). On the usefulness of risk analysis in the light of deepwater
horizon and Gullfaks C. In Oil and gas, technology and humans: Risk assessment methods
in organizational change (pp. 71–89): Ashgate.
Vinnem, J. E. (2014). Offshore risk assessment—Principles, modelling and applications of QRA
studies. London: Springer.
Vinnem, J. E., & Røed, W. (2015). Root causes of hydrocarbon leaks on offshore petroleum
installations. Journal of Loss Prevention in the Process Industries, 36, 54–62.
Weick, K. E., Sutcliffe, K. M., & Obstfeld, D. (2005). Organizing and the process of
sensemaking. Organization Science, 16(4), 409–421.
Yang, X., & Haugen, S. (2015). Classification of risk to support decision-making in hazard-
ous processes. Safety Science, 80, 115–126.
Yang, X., & Haugen, S. (2016). Risk information for operational decision-making in the
offshore oil and gas industry. Safety Science, 86, 98–109.
CHAPTER THREE
Human Factors in Marine

and Offshore Systems
Rabiul Islam*, Hongyang Yu†,1
*National Centre for Ports and Shipping, Australian Maritime College, University of Tasmania, Launceston,
TAS, Australia
†
School of Chemistry, Physics, and Mechanical Engineering, Queensland University of Technology, Brisbane,
QLD, Australia
1
Corresponding author: e-mail address: hongyang.yu@qut.edu.au
Contents
1. Introduction 145
2. Success Likelihood Index Method 146
2.1 SLIM Process 147
2.2 Practical Guidance of SLIM for Marine and Offshore Systems 149
2.3 Advantages and Disadvantages of SLIM 150
3. Human Error Assessment and Reduction Technique 150
3.1 Application of HEART for Marine and Offshore Systems 156
3.2 Advantages and Disadvantages of HEART 157
4. Bayesian Network 158
5. Conclusion 166
References 166
1. INTRODUCTION
Modern marine and offshore systems are becoming more sophisti-
cated. This, along with an increasing trend of moving operations to more
remote and harsh environment make safe and uninterrupted operation more
important than ever. However, ensuring safety of operation under these new
operating conditions is a challenging task which may not be tackled under a
single methodological framework. In recent years, there have been signifi-
cant advancements in the system-centric methods for improving the safety of
the complex system operation. Particularly, the dynamic risk-based methods
focusing on developing techniques for real-time tracking and mitigation of
risk of operation have received much interest. On the other hand, human-
centric methods represent another important branch of development which
aims at finding systematic ways to assess and minimize the risk of “human
factor”-related accidents.
#
146 Rabiul Islam and Hongyang Yu
Human error is a leading factor for marine and offshore systems.

According to Rothblum (2000) and Pennie, Brook-Carter, and Gibson
(2007), human factors account for 75%–96% of casualties in marine opera-
tions. If a human factor-related error does not even lead to catastrophic acci-
dent, however, it may still incur significant economic losses due to delayed
operations. Some of the most common causes of human errors are lack of
training, lack of work experience, and fatigue (Islam, Yu, Abbassi,
Garaniya, & Khan, 2017). The development of a standardized and consistent
methodology that is able to quantify the risk of human factor-related acci-
dents based on some of its most common causes is essential to prevent these
accidents from occurring.
In general, the risk of an accident can be determined by its likelihood of
occurrence and associated consequences. This risk quantification framework
is widely applied to estimation of the risk of accidents caused by human fac-
tors. While the quantification of consequences is often well supported by
historical accident data, the estimation of failure probability associated with
human factors frequently relies on experts’ assessment. The latter is a subjec-
tive assessment which is highly dependent on the experience of the individ-
uals undertaking the assessment. This subjectivity may introduce significant
uncertainty or bias in the risk quantification.
It may not be possible to completely remove subjectivity in the assess-
ment process; however, it is possible to reduce it by standardizing the assess-
ment procedure. This chapter focuses on introducing three commonly used
quantitative techniques together with their streamlined procedures for human
error likelihood assessment, including success likelihood index method
(SLIM), human error assessment and reduction technique (HEART), and
Bayesian network (BN).
2. SUCCESS LIKELIHOOD INDEX METHOD

SLIM is a human error assessment method based on expert judgment.
It was first developed by Embrey et al. (1984). It is a simple and flexible tech-
nique. SLIM in human error assessment drives from the concern that human
performance affected by various factors. These factors effect on human per-
formance known as Performance Shaping Factor (PSF). The likelihood of a
particular error is the combined effect of a set of PSFs in a specific situation.
As this is an expert judgment method hence it is required to collect the relative
importance of the each PSF from the experts. Experts provide the importance
Human Factors in Marine and Offshore Systems 147
score based on the effect on reliability in task being evaluated. Each relative
score provided by the experts is numerical depending upon how “good”
or “bad” meaning that the PSF will enhance or reduce reliability.
SLIM is suitable to use for Human Error Probability (HEP) assessment
where human error data are not available. SLIM was used by many
researchers to estimate HEP for marine and offshore systems (DiMattia,
2004; Islam, Abbassi, Garaniya, & Khan, 2016; Noroozi, Khakzad, Khan,
MacKinnon, & Abbassi, 2013). DiMattia (2004) used SLIM to determine
HEP for offshore platform musters. Noroozi et al. (2013) used SLIM to
estimate HEP for the maintenance procedures (pre and post) of process facil-
ities. Moreover, Islam et al. (2016) used SLIM to quantify HEP to estimate
HEPs for the maintenance procedures of marine engines. SLIM also has
been used for the development of human error assessment tools for marine
and offshore systems. Islam, Yu, et al. (2017) used SLIM to develop a mono-
graph for human error likelihood assessment of marine operations. Moreover,
Khan, Amyotte, and DiMattia (2006) used SLIM to develop Human Error
Probability Index (HEPI) for offshore master process.
These applications demonstrate that SLIM could be used to estimate the
HEP for the marine and offshore systems. Earlier applications of SLIM con-
firmed that human reliability assessor can rely on expert judgment when there
is an insufficient data (DiMattia, 2004; Khan et al., 2006; Noroozi et al., 2013).
2.1 SLIM Process

The HEP results are depending on the outcome of seafarers’/operators’
performance known as a PSF. PSF is a factor relating to environment of
workplace or task that can affect performance negative or positively. It is
required to rate the PSF on tasks and weight the PSFs in SLIM process.
A Success Likelihood Index (SLI) for each task depends on the rate of the
task and weight of the PSFs. HEPs are estimated from the SLI results for each
task. Weighting and rating data are required to be collected from the expert
panels who have extensive knowledge and experience on the marine and
offshore systems. The process illustrated in Fig. 1 is required to be followed
to determine the HEPs for the marine and offshore systems.
2.1.1 Selecting Expert Panel for Marine and Offshore Systems

The expert panel is required to select in SLIM. An expert panel should com-
prise at least two seafarers/operators with minimum 10 years of experience
in marine and offshore systems, one human reliability assessor who is familiar
and also has some experience with marine and offshore systems.
Selecting expert panel for marine

and offshore systems
Identifying the scenarios and tasks

for marine and offshore systems
Selecting PSFs for the marine and

offshore system
Collecting rates and weights for

marine and offshore system SLI for PSFs SLI = Rate × Weight
Determining SLIs and HEPs Total SLI for a given task SLIs = å Rate × Weight
Analysis of HEP results Calculation of HEP Log (HEP) = a (SLI) + b
Fig. 1 Steps for estimating the HEPs for marine and offshore systems through SLIM.
2.1.2 Identifying the Scenarios and Tasks for Marine

and Offshore Systems
Scenarios related to marine and offshore systems are required to be identified
under which task will be performed by the seafarers/operators. For example,
level of experience or training of the seafarers/operators conducting the task
for marine and offshore systems. Similarly, tasks are also identified based on
the documentation provided by the prescribed classification societies’ rules
and regulations. These documents include preventive and planned mainte-
nance schedules of marine and offshore systems.
2.1.3 Selecting PSFs for the Marine and Offshore System

According to the identified scenario and task for the marine and offshore
systems expert panel is required to select a set of PSFs. The human reliability
assessor then asked expert panel to select major PSFs based on the scenario.
2.1.4 Collecting Rates and Weights for Marine and Offshore System
The expert panel is asked to rate each selected task in the scenario being
assessed. The rating for a task is given on a scale 1–9, where 1 is the minimum
and 9 is the optimal.
Similar to the rating, the weighting of a PSF is relatively important and is
assigned by the expert panel. Weights are provided based on the importance
of the PSF on selected scenario for the marine and offshore systems. After
collecting the weights from the expert human reliability assessor has to nor-
malize all the PSF weights for a task. As sum of all the PSF for a task should
not be more than 1.
2.1.5 Determining SLIs and HEPs

SLI for a task can be determine P by the weight of each PSF multiplied
with the ratings, such that SLIs ¼ Rate Weight. After calculating the
SLIs, HEP for each task can be estimated by the logarithmic relationship
through Eq. (1).
Log ðHEPÞ ¼ aðSLIÞ + b (1)
Constant “a” and “b” can be determined from the HEPs for the tasks with
highest and lowest SLI values.
2.2 Practical Guidance of SLIM for Marine and Offshore

Systems
This section provides the practical guidance of SLIM process for HEP
estimation. HEPs are estimated following the SLIM process described in
previous section. The description of practical guidance provided below.
Suppose a human reliability assessor selected an expert panel with three
judges who have worked more than 10 years as a chief engineer in an
onboard ship. The assessor selected the scenario that a second engineer is
going to conduct the maintenance activities of marine systems. Then the
assessor identified two maintenance activities of fuel pump required to be
perform as per manufacturer manual. Now the assessor asked the expert
panel to identify the PSFs based on the scenario. Depending upon the sce-
nario expert panel identified six PSFs. Then the assessor asked the expert
panel to choose most important PSFs, and they have identified three major
PSFs as follows:
• Training
• Experience
• Fatigue
Now the assessor asked the expert panel to give the rating (in a scale 1–9) and
weighting (0–1) to the tasks and PSFs. The collected data from the expert
panel and SLI calculation presented in Table 1.
According to the total SLI, HEP then calculated using Eq. (1). The HEP
for cleaning centrifugal filter is 4.98 102 and fuel and lubricating oil filter
6.94 104.
Table 1 SLI Calculation Based on the Rating and Weighting Data From the Expert Panel
PSFs
Training Experience Fatigue
Tasks Rate Weight Rate Weight Rate Weight SLI (Total)
Cleaning centrifugal 6 0.35 6 0.40 5 0.25 ¼6 0.35 6 0.40 5

filter of a fuel pump 0.25 ¼ 6.3
Cleaning fuel and 8 0.35 7 0.40 9 0.25 ¼8 0.35 7 0.40 9
lubricating oil filter 0.25 ¼ 17.64
of a fuel pump
Table 2 Advantages and Disadvantages of SLIM

Advantages Disadvantages
This is a flexible method (dealing with It is a sophisticated method for obtaining
the entire range of human error forms PSFs from a judgment
without requiring a detailed
decomposition of the task)
It is validated according to a variety of It is difficult to ensure that the PSFs are
cases until now truly independent
It is usually a highly plausible approach The choosing of PSFs is currently
for the assessors (regulators and experts) somewhat arbitrary and so unsatisfactory
who participate affair. There is a lack of selection criteria
for choosing good experts
Probabilities of target tasks may be
modified by adding a new task to the set.
SLIM’s PSFs are fairly global in
comparison to the more specific PSFs in
methods such as HEART
2.3 Advantages and Disadvantages of SLIM

Advantages and disadvantages of the methodology are required to study, as it
helps human reliability assessor to choose the appropriate methodology for
particular industry (Table 2).
3. HUMAN ERROR ASSESSMENT AND

REDUCTION TECHNIQUE
HEART is a first-generation technique for human error assessment.
It was first developed by Williams (1986). It is a quick and simple method
for human error assessment. This technique is applicable for safety critical
industries for human error assessment such as marine and offshore industry,
nuclear industry, and healthcare and transportation industry. Recently,
HEART is now developed for HEP assessment particularly for marine and
offshore operations by researchers (Akyuz, 2015; Islam, Abbassi, Garaniya, &
Khan, 2017; Noroozi, Abbassi, MacKinnon, Khan, & Khakzad 2014;
Noroozi, Khan, MacKinnon, Amyotte, & Deacon, 2014). This technique
assesses the relations between seafarers/operators, their specific activities/
subactivities, and Error Producing Conditions (EPCs)/Error Influencing
Factors (EIFs). It is required to follow the steps for estimating the HEP for
marine and offshore systems as illustrated in Fig. 2.
At first, it is required to select a scenario for the marine and offshore sys-
tems. This may include marine environmental and operational conditions.
Then identification of the activities or subactivities that required to be
perform for the marine and offshore systems. The next step is to ascertain
Selecting a scenario for marine and

offshore systems
Identifying the subactivities for

marine and offshore systems
Identifying generic task related to

marine and offshore systems
Applying the Error Producing

Condition (EPC) table
Applying the Error Influencing

Factor (EIF) table
Determining Seafarers/Operators
Assessed Proportion of Effect
(SAPOE/OAPOE) of each EPC and
EIF on HEP
Estimating HEPs for the

subactivities of marine and offshore
systems
Fig. 2 Steps to estimate HEP for marine and offshore system.

generic task type related to selected scenario for marine and offshore systems.
To determine nominal human unreliability score it is essential to identify
generic task type. There are nine generic task type provided by Williams
(1986). However, Islam, Abbassi, et al. (2017) identified four most impor-
tant task types for marine and offshore operations. These four task types will
be helpful to estimate for the HEP for marine and offshore systems. The
generic task type for marine and offshore operations is provided in Table 3.
Generic task is the nature of seafarers’/operators’ activity/subactivity.
The nominal human unreliability score for the generic tasks is between
the mean of the 5th and 95th percentile boundaries (Williams, 1986). Nom-
inal human unreliability is a scale/label of the possible error which makes
seafarers’/operators’ performance unreliable.
The next step is applying the EPC table to identify multiplier of nominal
probability. EPCs are obvious in the scenario and have a negative influence
on seafarers’/operators’ performance. Moreover, multiplier of nominal
probability is an amount of EPC by which human unreliability increases.
There were 38 EPCs in initial HEART developed by Williams (1986).
However, Islam, Abbassi, et al. (2017) developed HEART table specifically
for the marine and offshore operations. There are 37 EPCs for marine and
offshore operations that influence on seafarers’/operators’ performance. The
EPC table for the marine and offshore operations is presented in Table 4.
Table 3 HEART Generic Categories for Marine and Offshore Operations (Islam, Abbassi,
et al., 2017)
Proposed Nominal
Human Unreliability
Task (Mean of 5th–95th
Generic Task Type Percentile Boundaries)
Routine, highly practiced, rapid task involving E 0.02
relatively low level of skill
Restore or shift a system to original or new state F 0.003
following procedures, with some checking
Completely familiar, well-designed, highly G 0.0004
practiced, routine task occurring several times per
hour, highly trained, and experienced person
Respond correctly to system command even when H 0.00002
there is an augmented or automated supervisory
system providing accurate interpretation of system
stage
Table 4 EPC Table for the Marine and Offshore Operations (Islam, Abbassi, et al., 2017)
Multiplier of Nominal
Error-Producing Condition Probability Amount
1 Lack of familiarity with ship’s/offshore systems and 17
equipment but does not occur frequently
2 Shortage of time available for error diagnosis and repair 11
within the system
3 Not following easily accessible information such as 9.0
maintenance and troubleshooting manual for the tasks
4 Mistakes in maintenance manuals or out of date manuals 8.0
5 A discrepancy between the seafarers’/operators’ practice 8.0
and that of the ship designer
6 No obvious means of reversing an unintentional action 8.0
in a maintenance task
7 An overload of information for the maintenance 6.0
8 Apply a modified technique during maintenance which 6.0
may not be current practice
9 Seafarers’/operators’ need to transfer accurate 5.5
knowledge from task to task without any loss
10 Uncertainty in the required performance standards of 5.0
seafarers/operators set by the IMO
11 A difference between apparent and real risk of the 4.0
maintenance tasks
12 Poor, unclear, or improper information written in the 4.0
ship’s/offshore maintenance logbook provided by the
previous seafarers who have already finished their shift
13 Confirmation of system’s response for intended action 3.0
not direct or timely
14 Inexperienced seafarers/operators (i.e., newly qualified 3.0
or newly joined crew)
15 A poor quality of information conveyed by usual 3.0
procedures and crews onboard
16 A poor or no quality check by the supervisor 3.0
17 A conflict between short- and long-term objectives of 2.5
the maintenance tasks
18 Inadequate information for accuracy checks for the 2.5
maintenance tasks
Continued
Table 4 EPC Table for the Marine and Offshore Operations (Islam, Abbassi,
et al., 2017)—cont’d
19 A knowledge and skill gap between the educational 2.0
successes of a seafarer and the requirements of the
maintenance task
20 A guidance by the senior seafarer/supervisor for using 2.0
difficult procedure for the maintenance
21 Seafarers/operators have less opportunity to exercise 1.8
mind and body outside the immediate limitations of the
maintenance work
22 Faulty maintenance equipment, tools, and spare parts 1.6
23 A need to make decisions that are beyond the level of an 1.6
experienced seafarer/operator
24 Lack of proper distribution of maintenance tasks and 1.6
responsibility among the seafarers/operators
25 Improper way to keep track of progress during a 1.4
maintenance activity
26 A danger (i.e., concentration limits of toxic chemical) 1.4
that can exceed physical capabilities of seafarers/
operators
27 Less importance given to the particular maintenance task 1.4
28 Seafarers/operators high level of emotional stress 1.3
(feeling lonely or home sick) because of absence from
home and family
29 Symptom of ill health among seafarers/operators 1.2
30 Low morale by the crew at maintenance work 1.2
31 Contradiction in the meaning of displays and procedures 1.2
of maintenance task
32 Poor lighting in which the maintenance work is being 1.15
performed
33 Persistent inoperativeness or very repetitious cycling of 1.1 for first half
low mental workload of maintenance tasks hour
1.05 for each hour
thereafter
34 Interruption of seafarers’/operators’ standard 1.1
work–sleep cycles set by the regulators
Table 4 EPC Table for the Marine and Offshore Operations (Islam, Abbassi,
et al., 2017)—cont’d
35 Maintenance task pacing due to the disturbance of other 1.06
colleagues
36 Additional or fewer team members than those required, 1.03 per additional
to satisfactorily perform maintenance seafarers
37 Age of seafarers/operators performing physically 1.02
demanding maintenance tasks
EPC selection from the table depending upon the scenario and activity
required to be performed. Selected EPC value (multiplier of nominal prob-
ability) acts as an EPC representative in Eq. (2).
Moreover, EIFs may need to apply depending upon the selected scenario.
EIFs are the factors that does not cover in the EPC table but have an influ-
ence on seafarers’/operators’ performance. These factors generally affect the
seafarers/operators due to the impact of marine environmental and opera-
tional conditions. The EIFs table for marine and offshore operations was intro-
duced by Islam, Abbassi, et al. (2017). EIFs table is illustrated in Table 5. There
are 13 EIFs for deck and engine department seafarers/operators. The multi-
plier of nominal probability amount for deck and engine department seafarers/
operators is not the same due to the nature of the workplace they perform
their activities. Hence, it is very important to select the proper EIFs value
based on the selected scenario. Similar to EPCs, EIF multiplier of nominal
probability amount also acts as an EIF representative in Eq. (2).
Finally, it is necessary to assign Seafarers Assessed Proportion of Effect
(SAPOE)/Operators Assessed Proportion of Effect (OAPOE) and estimate
overall HEP. SAPOE/OAPOE includes EPC and EIF effect on seafarers’/
operators’ performance. SAPOE/OAPOE is weighted for each selected
EPC and EIF based on its significance by the experts. Individually EPC
and EIF are weighted from 0 to 1 according to the analyst knowledge
and experience.
Assessed effect ¼ ðMultiplier of nominal probability 1Þ

SAPOE + 1 (2)
Eq. (1) is used to estimate the effect of EPC, EIF, and its relevant
SAPOE/OAPOE on nominal human unreliability. The HEP of each
Table 5 EIF Assessment for Engine and Deck Departments (Islam, Abbassi, et al., 2017)
Multiplier of Nominal Probability Amount
EIF ED DD
1 Normal weather condition 1.00 1.00
2 Moderate weather condition 1.90 1.83
3 Extreme weather condition 2.87 2.73
4 Normal workplace temperature 1.00 1.00
5 Extreme workplace temperature 2.40 2.39
6 Low ship motion 1.00 1.00
7 Medium ship motion 1.90 1.87
8 High ship motion 2.71 2.70
9 Low noise and vibration level 1.00 1.00
10 High noise and vibration level 2.11 2.00
11 Work range and stress 1.00 1.00
12 Work underload and stress 1.40 1.39
13 Work overload and stress 2.37 2.29
subactivity is estimated by multiplying the selected nominal human

unreliability with nominal value of SAPOE/OAPOE related to each
EPC and EIF.
3.1 Application of HEART for Marine and Offshore Systems

Details of HEART for marine and offshore systems are discussed in preced-
ing section. This section focuses on the application of HEART to estimate
HEP for marine and offshore systems.
3.1.1 Selecting the Scenario

Suppose a senior operator is completely familiar with certain maintenance
activities however, has given them less importance, and not keeping the
track of progress the proper way. Additionally, the activities do not have
adequate information available for accuracy checks. Moreover, the operator
performs activity in moderate sea conditions and high level of noise and
vibration.
3.1.2 Identifying Generic Task Related to the Selected Scenario

A generic task related to the activity is identified according to the selected
scenario. In the case of selected activity, task H is considered from Table 3,
which shows nominal unreliability as 0.00002. After that EPCs are identified
and the maximum predicted multiplier of nominal probability is selected for
the defined scenario from Table 4. Similarly EIF scenario that has the max-
imum predicted multiplier of nominal probability are selected from Table 5.
Then a proportionate weight factor is applied to the maximum predicted
multiplier of nominal probability which is shown in the “OAPOE” column
in Table 6. Using Eq. (2), assessed effect of each EPC and EIF is estimated.
Finally, the assessed effect multiplied with nominal human unreliability and
the HEP estimated for the maintenance of a condensate pump is estimated as
1.33 1005.
3.2 Advantages and Disadvantages of HEART

The advantages and disadvantages of the HEART technique are summa-
rized in Table 7.
Table 6 HEP Estimation for the Maintenance of a Condensate Pump

Nominal Multiplier
Generic Human of Nominal Assessed
Task Unreliability EPCs and EIFs Probability OAPOE Effect
H 0.00002 Less importance given 1.4 0.10 1.04
to the task
Not keeping the track of 1.4 0.13 1.052
progress proper way
Inadequate 2.5 0.15 1.225
informationfor accuracy
checks for the
maintenance tasks
Moderate weather 1.90 0.59 1.531
condition
High noise and 2.11 0.74 1.821
Vibration level
Total assessed effect 6.669
HEP 1.33 105
Table 7 Advantages and Disadvantages of HEART

Advantages Disadvantages
It is quick and simple to use with There are some doubts over the consistency
little training of the method
Each EPC has a remedial measure There is a shortage of validation studies
individually
It gives quantitative output to the Dependence and EP interaction is not
analyst accounted for by this method
It is highly flexible and applicable It is subjective and reduces its consistency
to different areas and reliability
4. BAYESIAN NETWORK
The application of the human error likelihood assessment techniques
discussed earlier continues to remain a main stream in practice. Despite
the ubiquity of their applications, these techniques suffer from two major lim-
itations. The first major limitation can be attributable to the assumption of
independence between human factors and their associated actions, while
the second limitation is the lack of an adaptive and efficient mechanism to
incorporate new information for likelihood updating. These limitations
can restrict their applicability in marine and offshore operations involving
more complex systems under dynamic operating conditions. In recent years,
Bayesian analysis, particularly, Bayesian network, has become a popular
approach for reactive likelihood update. Owing to its flexible graphic repre-
sentation and robust inference engine, BN is a promising candidate to address
the weakness of the traditional human error likelihood assessment techniques.
BN is directed acyclic graph that consists of a set of nodes connected by
directed arrows. Each node epitomizes a random variable, and the arrows
represent the causal relationship between the random variables. The direc-
tion of an arrow determines the dependence of one variable on another. For
a pair of nodes, the node from which the arrow is directed is the parent node,
while the node receiving the arrow is the child node. An arrow from a child
node can never return to any of its parent nodes. The nodes that do not have
any child nodes are referred as leaf nodes. In contrast, the nodes without any
parent nodes are the root nodes.
Fig. 3 shows an exemplary BN for human error likelihood assessment con-
sidering three group of factors: environmental factors, operational factors,
and internal factors. The environmental factors and operational factors are also
Fig. 3 BN model for HEP estimation of marine operations (Islam, Khan, Abbassi, &
Garaniya, 2017).
grouped together as external factors. Both the external factors and the internal
factors can contribute to human error. While the nodes representing weather
conditions, temperature, ship motion, noise and vibration, and workload and
stress are the root nodes, the HEP node is the only leaf node. All the other
nodes are intermediate nodes.
Each root node can have multiple states, and each state has its own prob-
ability of occurrence. As a root node cannot be in more than 1 state at a time,
the probabilities of occurrence for all states have to sum to 1. The probabil-
ities for the states of the root nodes are also known as the prior probabilities.
An example of the prior probabilities for the states of the root nodes in Fig. 3
is shown in Table 8. These probabilities can be specified either by experts
(e.g., experienced seafarers) or estimated from historical data.
Apart from the dependence structure specified by the arrows, the
strength of the dependence can also be determined by the means of a con-
ditional probability table. For instance, the conditional probability tables in
Table 8 can be used to quantify the strength of dependence between the
environmental factor node and its parent nodes. Similarly, Table 9 quantifies
the strength of dependence between the operational factor node and its par-
ent nodes, and so does Table 10 for that between the internal factor node and
its parent nodes. Subsequently, once the states of the environmental and
operational factors are determined, the state of the external factor can be
inferred through using the conditional probability Table 11. Finally, the
HEP can be determined via inference through Table 12 together with
the inferred states of the internal and external factors (Table 13).
Table 8 Prior Probabilities of the Root Nodes (Islam, Khan, et al., 2017)
States
Root Nodes Normal Moderate Extreme External Factors
Weather conditions 0.90 0.07 0.03 Environmental
Workplace temperature 0.95 — 0.05
Ship motion Low Medium High Operational
0.92 0.06 0.02
Noise and vibration 0.97 — 0.03
Workload and stress Mid-range Underload Overload
0.91 0.06 0.03
Low — High Internal
Training 0.04 — 0.96
Experience 0.04 — 0.96
Fatigue 0.96 — 0.04
Table 9 CPT for Environmental Factor (Islam, Khan, et al., 2017)
Weather Conditions Normal Moderate Extreme

Workplace temperature Normal Extreme Normal Extreme Normal Extreme
Environmental factor 0.00 0.80 0.80 0.80 0.60 1.00
(bad)
Environmental factor 1.00 0.20 0.20 0.20 0.40 0.00
(good)
BN provides an efficient way of updating the state of any node within

the network given newly available information. For example, the state
probability of the environmental factor node can be updated given that
a nearby weather station has reported an extreme weather condition and
a normal workplace temperature is expected for an upcoming maintenance
activity. This update is easily achieved by using the product and sum rules
of probability. The product rule is first applied to obtain the joint proba-
bility of weather condition, workplace temperature, and environmental
factor. To simplify the notation, the nodes for weather, temperature,
and environmental factor are represented by x1, x2, and x3, respectively.
The joint probability is given as.
P ðx1 , x2 , x3 Þ ¼ P ðx1 ÞP ðx2 ÞP ðx3 j x1 , x2 Þ (3)

Table 10 CPT for Operational Factor (Islam, Khan, et al., 2017)
Ship Motion
(Roll and Pitch) Low Medium High
Workload and Mid-range Underload Overload Mid-range Underload Overload Mid-range Underload Overload
stress
Noise and Low High Low High Low High Low High Low High Low High Low High Low High Low High
vibration
Operational 0.00 0.60 0.00 0.60 0.60 1.00 0.60 1.00 0.60 1.00 0.60 1.00 0.60 1.00 0.60 1.00 0.60 1.00
factor (poor)
Operational 1.00 0.40 1.00 0.40 0.40 0.00 0.40 0.00 0.40 0.00 0.40 0.00 0.40 0.00 0.40 0.00 0.40 0.00
factor (good)
Table 11 CPT for Internal Factor (Islam, Khan, et al., 2017)
Training Low High

Experience Low High Low High
Fatigue Low High Low High Low High Low High
Seafarers’ internal factors (bad) 1.00 1.00 0.00 1.00 0.00 1.00 0.00 0.00
Seafarers’ internal factors (good) 0.00 0.00 1.00 0.00 1.00 0.00 1.00 1.00
Table 12 CPT for External Factor (Islam, Khan, et al., 2017)
Environmental Factors Bad Good

Operational factors Bad Good Bad Good
Seafarers’ external factors (bad) 1.00 0.00 0.00 0.00
Seafarers’ external factors (good) 0.00 1.00 1.00 1.00
Table 13 CPT for Determining HEP
Seafarers Internal Factors Bad Good

Seafarers external factors Bad Good Bad Good
Maintenance activities of marine operations (failure) 1.00 0.50 1.00 0.00
Maintenance activities of marine operations (success) 0.00 0.50 0.00 1.00
It is noted that the factorization of the joint probability in Eq. (3) is based
on the fact that the weather and temperature conditions are independent of
each other, while the environmental factor depends on both conditions.
This factorization rule can be expressed in a more general rule for factori-
zation of large BN, as shown in Eq. (3).
Y
n
P ðX Þ ¼ P ðxi j Paðxi ÞÞ (4)
i¼1
where Pa(xi) is the set of parent nodes for node xi. An immediate interpre-
tation of Eq. (4) is that a node is independent of any other node that is not its
direct parent node. Given the joint probability, the conditional probability
of the environmental factor given an extreme weather condition and normal
workplace temperature is obtained by using the Bayes’ rule and the sum rule:
P ðx1 ¼ extreme, x2 ¼ normal, x3 Þ

P ðx3 j x1 ¼ extreme, x2 ¼ normalÞ ¼
P ðx1 ¼ extreme, x2 ¼ normalÞ
¼X
x3
P ðx1 ¼ extremeÞP ðx2 ¼ normalÞP ðx3 j x1 ¼ extreme, x2 ¼ normalÞ
¼ X
P ðx1 ¼ extremeÞP ðx2 ¼ normalÞ P ðx3 j x1 ¼ extreme, x2 ¼ normalÞ
x3
¼ P ðx3 j x1 ¼ extreme, x2 ¼ normalÞ
(5)
Interestingly, it turns out applying the sum–product rule and the Bayes’
rule yields the same expression on both sides of Eq. (5). This is because that
the states of the root nodes are already known without uncertainty. As a
result, this conditional probability can be directly read from Table 8 as
P(x3 ¼ badj x1 ¼ extreme, x2 ¼ normal) ¼ 0.6 and P(x3 ¼ goodj x1 ¼ extreme,
x2 ¼ normal) ¼ 0.4. On the other hand, it is also possible to obtain the mar-
ginal probability of x3 if neither the weather condition nor the workplace
temperature is not known except for their prior probabilities. In such a case,
only the sum–product rule is needed.
XX
P ðx3 ¼ poorÞ ¼ P ðx1 ÞP ðx2 ÞP ðx3 ¼ poorj x1 , x2 Þ
x1 x2
X X
¼ P ðx1 Þ P ðx2 ÞP ðx3 ¼ poorj x1 , x2 Þ (6)
x1 x2
¼ 0:1106
P ðx3 ¼ goodÞ ¼ 1 P ðx3 ¼ poorÞ
(7)
¼ 0:8894
The probability of a poor environmental factor is almost 50% higher
when an extreme weather condition is expected, which makes perfect sense
in terms of logical reasoning. It is also noted that such a probability update
takes into account the joint behavior of both the weather and workplace
condition which is not achievable using the conventional human likelihood
assessment techniques.
This type of inference can be easily extended to update the state prob-
abilities of other nodes in the BN. Fig. 4 shows the marginal state probabil-
ities of the intermediate nodes and the HEP node without any information
input. The human error likelihood is evaluated to be at a level of 19%.
On the other hand, when new information regarding the weather and
operational conditions becomes available as shown in Fig. 5, where the
Weather conditi... Workplace Ship motion Workload and stress
temperature Noise and vibration
Normal 90% Low 92% Mid_range 91%
Moderate 7% Normal 95% Medium 6% Underload 6% Low 97%
Extreme 3% Extreme 5% High 2% Overload 3% High 3%
Operational fa...
Environmental factors Bad 8% Fatigue
Training Experience
Bad 11% Good 92%
Low 4% Low 4% Low 96%
Good 89%
High 96% High 96% High 4%
Seafarers external fact... Seafarers internal ...

Bad 18% Bad 0%
Good 82% Good 100%
HEP for the maintenance of marine engin...
Failure 19%
Success 81%
Fig. 4 Marginal human error likelihood without update.

Weather conditi... Workplace Ship motion Workload and stress
temperature Noise and vibration
Normal 100% Low 100% Mid range 100%
Moderate 0% Normal 0% Medium 0% Underload 0% Low 0%
Extreme 0% Extreme 100% High 0% Overload 0% High 100%
Operational fa...
Environmental factors Bad 60% Fatigue
Training Experience
Bad 80% Good 40%
Low 4% Low 4% Low 96%
Good 20%
High 96% High 96% High 4%
Seafarers external fact... Seafarers internal ...

Bad 48% Bad 0%
Good 52% Good 100%
HEP for the maintenance of marine engin...

Failure 24%
Success 76%
Fig. 5 Updated human error likelihood with new environmental and work conditions.
weather condition is normal, workplace temperature is extreme, ship

motion is low, mid-range workload, and high noise and vibration level,
the human error likelihood has increased to 24%. Again, this type of analysis
considers the interactions of all the root nodes and intermediate nodes for
update, which is impossible using the conventional methodologies.
5. CONCLUSION
This chapter provides three methodologies to estimate the HEPs for
marine and offshore systems. The SLIM approach is based on expert judgment
and various uncertainties affect the final outcomes. The lack of consistence of
the HEART approach is attributable to assumption of independence among
contributory factors of EPC. Both SLIM and HEART do not have the capa-
bility of updating probability when new information is available. BN has the
capability of dynamic probability updating. Hence, it is the preferred tech-
nique as compared to other techniques provided in this chapter when dealing
with dynamic operating condition. BN jointly models relationships between
human factors and seafarers’/operators’ actions in a hierarchical structure and
is therefore capable to estimate HEP more accurately.
REFERENCES
Akyuz, E. (2015). Quantification of human error probability towards the gas inerting process
on-board crude oil tankers. Safety Science, 80, 77–86.
DiMattia, D. G. (2004). Human error probabilty index for offshore platform musters. Ph.D. Halifax,
NS, Canada: Dalhousie University.
Embrey, et al.. (1984). An approach to assessing human error probabilities using structured expert
judgement. Upton, NY: Brookhaven National Laboratory. Department of Nuclear
Energy.
Islam, R., Abbassi, R., Garaniya, V., & Khan, F. I. (2016). Determination of human error
probabilities for the maintenance operations of marine engines. Journal of Ship Production
and Design, 32(2), 1–9.
Islam, R., Abbassi, R., Garaniya, V., & Khan, F. (2017). Development of a human reliability
assessment technique for the maintenance procedures of marine and offshore operations.
Journal of Loss Prevention in the Process Industries, 50(Pt. B), 416–428.
Islam, R., Khan, F., Abbassi, R., & Garaniya, V. (2017). Human error probability assessment
during maintenance activities of marine systems. In Safety and health at work (pp. 1–29).
Elsevier Korea LLC. https://doi.org/10.1016/j.shaw.2017.06.008.
Islam, R., Yu, H., Abbassi, R., Garaniya, V., & Khan, F. (2017). Development of a mono-
graph for human error likelihood assessment in marine operations. Safety Science, 91,
33–39.
Khan, F. I., Amyotte, P. R., & DiMattia, D. G. (2006). HEPI: A new tool for human error
probability calculation for offshore operation. Safety Science, 44(4), 313–334.
Noroozi, A., Abbassi, R., MacKinnon, S., Khan, F., & Khakzad, N. (2014). Effects of cold
environments on human reliability assessment in offshore oil and gas facilities. Human
Factors and Ergonomics Society, 56(5), 825–839.
Noroozi, A., Khakzad, N., Khan, F., MacKinnon, S., & Abbassi, R. (2013). The role of
human error in risk analysis: Application to pre-and post-maintenance procedures of
process facilities. Reliability Engineering & System Safety, 119, 251–258.
Noroozi, A., Khan, F., MacKinnon, S., Amyotte, P., & Deacon, T. (2014). Determination of
human error probabilities in maintenance procedures of a pump. Process Safety and
Environmental Protection, 92(2), 131–141.
Pennie, D., Brook-Carter, N., & Gibson, W. (2007). In Human factors guidance for maintenance.
Paper presented at the human factors in ship design, safety and operation conference.
Rothblum, A. M. (2000). In Human error and marine safety. Paper presented at the National Safety
Council Congress and Expo, Orlando, FL.
Williams, J. (1986). In Heart—A proposed method for assessing and reducing human error. Paper
presented at the 9th advances in reliability technology symposium, UK.
CHAPTER FOUR
Safety During Oil and Gas Transfer

and Transport
Sankaramoorthy Narayanasamy*, Fan Yang†, Rabiul Islam*,
Abdullah Sardar*, Vikram Garaniya‡,1, Pedram Kooshandehfar*,
Natalia Nikolova*
*National Centre for Ports and Shipping, Australian Maritime College, University of Tasmania, Launceston,
TAS, Australia
†
Institute of Ship Power and Engineering, Marine Engineering College, Dalian Maritime University, Dalian
City, China
‡
National Centre for Maritime Engineering and Hydrodynamics, Australian Maritime College, University of
1
Corresponding author: e-mail address: v.garaniya@utas.edu.au
Contents
1. Safety During Marine Operations 170
1.1 Introduction 170
1.2 Oil Transport Safety Regulatory Evaluation 171
2. Different Risk Contributors and Their Impacts 175
2.1 Toxicity 176
2.2 Static Electricity 178
2.3 Reactivity 178
2.4 Corrosive Cargos 178
2.5 Pollution 179
2.6 Fire and Explosion 181
2.7 Low Temperature Problems 185
2.8 Ship/Shore Operation 187
3. Formal Safety Assessment Techniques 188
3.1 Review of the Current Safety Practices 188
3.2 Firefighting Strategies 191
3.3 Training for Emergencies 194
3.4 Static Charge Separation 195
3.5 Air Pollution Prevention Practice 198
3.6 Oil Pollution Prevention Practice 198
4. Safety Management Strategies 200
4.1 The Implementation of Process Safety in Offshore Operations 200
4.2 Risk Management Strategies in Offshore and Shipping Operations 201
5. Conclusions 203
References 203
#
170 Sankaramoorthy Narayanasamy et al.
ABBREVIATIONS
API American Petroleum Institute
BLEVE boiling liquid expanding vapor explosion
DWT deadweight tonnage
DPA designated person ashore
DR design review
EPH early procedure HAZOP
ESD emergency shut down
FMEA failure modes and effects analysis
FMECA failure mode, effects and criticality analysis
HAZID hazard identification analysis
HAZOP hazard and operability study
IMO International Maritime Organization
LNG liquefied natural gas
LPG liquefied petroleum gas
MDR master document register
MRVs marine readiness verifications
OSHA Occupational Safety & Health Administration
PSM process safety management
PSSA particularly sensitive sea area
SEMP safety and environmental program
SEMS safety and environmental management systems
SJA safe job analysis
SOLAS Safety of Life at Sea
SOPEP shipboard oil pollution emergency plan
SQRA semiquantitative risk analysis
1. SAFETY DURING MARINE OPERATIONS

1.1 Introduction
Marine operations are associated with handling of substances from or to the
port or construction sites to installation site. Activities of marine operations
include load transfer, transportation, subsea operations, decommissioning
and deconstruction, moving rigs, and pipe arranging (Veritas, 2003).
Process is defined as any activity that involves storage, manufacturing,
handling, or moving of hazardous chemicals. Safety during these activities
is generally considered to be process safety. From the oil and gas industry
perspective, process safety focuses on process-related failures, including run-
away chemical reactions, pipe ruptures, or vessel overflow. The likelihood
of this kind of event is rare, but they can still have catastrophic consequences
Safety During Oil and Gas Transfer and Transport 171
(Sutton, 2014). These failures are mainly due to improper implementation

of management systems, such as operating procedures, mechanical integrity,
training, prestart up safety reviews, management of change, etc. (Seyr &
Muskulus, 2016). Overall, process safety is a blend of engineering, manage-
ment, and operational skills and practices that focuses on preventing any
catastrophic incidents.
Generally, in the offshore oil and gas industry, the marine operations are
specially scheduled, nonroutine operations of limited duration related to the
load transfer, transport, and installation of items (Natskår, Moan, & Alvær,
2015). The onshore process safety management (PSM) program has strong
similarities with marine PSM. This means that most practices and techniques
developed for onshore facilities can also be used offshore, with a few mod-
ifications (Sutton, 2014).
This chapter mainly focuses on safety during transfers and transport of oil
and gas commodities. It comprises five sections. First, it introduces the his-
tory of oil tankers and evaluation of various safety standards and regulations.
In Section 2, different risk factors during the transport of oil and gas are
outlined. While, the current practices and formal safety assessments
(FSAs) are discussed in Section 3. Section 4 provides general safety manage-
ment strategies. The final section provides general conclusion.
1.2 Oil Transport Safety Regulatory Evaluation

Oil tankers are the backbone of the oil and gas industry business. Tankers are
designed to transport the oil and gas commodity in bulk quantity. Today
there are around 3500 oil tankers available on the market, with a combined
capacity of over 280 million deadweight tonnes, carrying more than 100
million tonnes of oil a day (Information Resources Management
Association, 2015).
Worldwide demand for oil increased in the early 1900s with the advent
of the diesel engine. The British Admiralty’s decision to increase the speed
and range of their ships by converting them from coal to oil in 1912, coupled
with the greater popularity of the automobile in the 1920s caused the world-
wide demand for oil to continue to grow. Ship size gradually increased as
technology improved and greater economies of scale were achievable. As
the majority of products that these early tankers carried were refined prod-
ucts, with production plants generally sited near to their source fields, their
size remained relatively small by today’s standards. This growth continued
until the mid-1970s, when oil companies were beginning to order the first
ultra large crude carriers in excess of 300,000 DWT (deadweight tonnage).

Oil prices increased to the point where demand fell dramatically and
shipping, being a derived demand, also suffered from the down turn in
trade. Some newly constructed tankers went directly from the shipyard in
which they were built to lay up, some were never traded. At that time, there
was a surplus of 100 million DWT in the tanker market, or about 30% of
the fleet.
As the tankers have increased in size, so too have their designs developed.
The advent of computers for naval architects quickly revolutionized the
design of ships as much more accurate stress models were developed. This,
coupled with the invention of high-tensile steel, dramatically reduced the
weight of construction materials on ships. The majority of tanker designs
remained this way for a number of years until the 1978 International
Conference on Tanker Safety and Pollution Prevention, which formally
laid down requirements relating to tanker design and operation. The Inter-
national Convention for the Safety of Life at Sea (SOLAS) now requires new
tankers to have their accommodation and machinery spaces aft of the cargo
deck, separated by means of a cofferdam, pump room, or other noncargo
tanks, with intention of preventing the ingress of cargo vapor into the
accommodation, machinery spaces, and any other spaces that may hold a
source of ignition.
In addition to the requirements for the siting of accommodation and
machinery spaces, other safety regulations were introduced, including
SOLAS II-2 Part D (Lloyd, 2007):
• Keeping deck spills away from the accommodation and other service
spaces by use of a coaming or other similar means;
• Any part of the accommodation space that looks over the cargo deck and
its outward sides for a distance of 3 m aft needs to be insulated to A-60 fire
rating. Also these areas must not have openings that can allow the passage
of vapor into the accommodation and have port holes of the nonopening
type;
• Machinery spaces, except Category A, can be located forward of the
cargo deck provided they are separated from the tanks by use of a cof-
ferdam or noncargo tank;
• Special steps are to be taken to keep cargo vapors off the deck and out of
spaces that may contain a source of ignition; and
• The requirement for tankers greater than 20,000 DWT and those with
crude oil wash, to be fitted with an inert gas plant.
Additionally, cargoes, which react in a hazardous manner with other

cargoes, should have separate:
• Pumping and piping systems (which do not pass through cargo tanks
containing such cargoes);
• Tank venting systems.
Tankers also come under more stringent regulations over and above that
required for cargo ships when it comes to such things as the carriage and
installation of life saving and firefighting appliances, as well as duplication
of essential equipment such as steering gear.
In addition to the extra safety requirements, it is perhaps the antipollu-
tion regulations that have had the biggest impact on tanker design in recent
times. Recognizing the larger role tankers were playing in international
trade and their potential to pollute the marine environment, the Interna-
tional Maritime Organization (IMO) held the International Convention
for the Prevention of Pollution of the Sea by Oil, 1954 (OILPOL 1954).
The conference recognized that tanker accidents, although spectacular,
did not contribute a great deal to ocean pollution. The main causes of oil
pollution were routine shipboard operations such as tank washing and
ballasting. OILCON therefore placed limits on the locations where oily
wastes could be dumped. When the 123,000 DWT tanker “Torrey
Canyon” ran aground in the Scilly Isles in 1967, this was the largest oil
pollution incident to that time and IMO held an extraordinary session of
its council to address the incident (Bhattacharya, 2009). Although the
“Torrey Canyon” was the catalyst for what we now know as marine pollu-
tion (MARPOL), this was not achieved until 1973. Until then IMO
adopted changes to OILPOL and introduced a procedure known as “load
on top” whereby instead of discharging tank washings directly overboard,
tanks were washed internally to another cargo tank. This oil/water mixture
was then allowed to separate, the water pumped out from under the oil, and
the next cargo loaded on top of the remaining deposits.
As soon as it was realized that the OILPOL was no longer applicable to
the current-trading environment, in 1973 IMO held the International
Convention for the Prevention of Pollution from Ships, abbreviated to
MARPOL. One of the requirements to come out of this conference was
the requirement for new tankers over 70,000 DWT to have segregated
ballast tanks (SBTs), where specific tanks, lines, and pumps were used for
the uptake and discharge of ballast. These tanks were to be placed in posi-
tions where the greatest impact from grounding or collision was likely to be,
therefore, protecting the cargo tanks from rupturing. To ensure that these
ships remained safe, minimum quantities of ballast were established. The
ballast had to be sufficient to fully submerge the propeller and sink the ship
to a minimum molded draft amidships of not less than 2.0 + 0.02 L, and a
trim of no greater than 0.015 L.
The late 1970s were a bad period for tankers. As more plied the seas,
the rate of accidents also increased, most of which were in or around the
United States. When the “Argo Merchant” ran aground on Middle Rip
Shoal in Massachusetts, threatening the surrounding fishing grounds, the
United States asked IMO to consider further regulating tankers (Ornitz &
Champ, 2002).
Consequently, IMO held the 1978 International Conference on Tanker
Safety and Pollution Prevention (Luoma, 2009). Besides the changes to
SOLAS, IMO required new tankers over 20,000 DWT be fitted with a
crude oil washing (COW) system. They also expanded the requirements
for SBTs to new crude tankers above 20,000 DWT, and product tankers
above 30,000 DWT. In addition, existing tankers over 40,000 DWT had
to have either SBTs or a COW system fitted. To avoid the majority of
the tanker fleet becoming redundant overnight, IMO introduced the con-
cept of clean ballast tanks. This allowed, for an interim period, existing
tonnage to designate cargo tanks to be used specifically for ballast and avoid
an expensive retrofit of SBTs. These tanks were to be kept clean and used for
ballast only. The disadvantage of this arrangement was that the cargo lines
were still used for ballasting the vessel, and therefore the risk of contamina-
tion and pollution remained.
It was another tanker grounding that led to some of the most important
changes to date to MARPOL. In probably one of the best known incidents
of our time, the “Exxon Valdez” ran aground in Prince William Sound,
Alaska, on March 23, 1989, resulting in the largest crude oil (39,000 tonnes)
spill in US waters (Wickens & Huey, 1993). The US government again
approached IMO to take action and recommended that double hulls
become mandatory. In 1992, amendments to MARPOL introduced double
hulls, requiring new tankers over 5000 DWT to be fitted with double
bottom and wing tanks, which extend the full depth of the ship’s side, thus
protecting 100% of the cargo tanks should a grounding or collision occur.
Existing tankers had until their 30th birthday to comply, although Regula-
tion 13G made provision for an enhanced program of inspections for
existing tonnage.
After the “Erika” and “Prestige” incidents, calls were made for the phas-
ing out of single-hull tankers to be brought forward (Stenman, 2005). In
December 2003, IMO adopted an amendment to Regulation 13G, which
brought forward the phasing-out date of pre-MARPOL tankers (greater
than 20,000 DWT that do not comply with SBT requirements) to April
2005, and a sliding scale for other noncompliant tankers that should have
seen all single-hull tankers gone by 2010. Single-hull tankers older than
15 years are also subject to the condition assessment scheme, requiring more
stringent inspections of the structure of the ship, with the maintenance of
documentary evidence and formal procedures. Other methods such as the
“mid-deck” concept may be accepted as an alternative to a double hull.
With a mid-deck ship, the tanks’ sides are protected by double sides, but
no double bottom. In the event of the bottom being holed, hydrostatic
pressure prevents the oil from escaping.
In what other directions will tanker design go? Understandably, the ship
owners do not want any more changes. Similarly, as the 40 years from the
1950s to the 1980s saw significant changes in the design and function of the
oil tanker, so too has the following years. The difference is that initially it was
at the ship-owners direction, whereas now they are finding changes being
enforced on them to comply with a changing legal and social environment.
2. DIFFERENT RISK CONTRIBUTORS AND THEIR IMPACTS

Crude oil is a complex mixture of various chemical compounds that
are commonly known as hydrocarbons. The mixture can also contain traces
of sulfur, nitrogen, vanadium, and oxygen. Hydrocarbons consist of com-
binations of hydrogen and carbon in differing ratios and molecular structure,
as well as weight. Depending on the number of carbon atoms and the way in
which they combine with hydrogen atoms, hydrocarbon structures vary.
Hydrocarbons can be arranged as straight chains, branched chains, or closed
rings. Alkanes and the alkenes are the two main chemical families of hydro-
carbons (McCain, 1990).
Due to the great variation in hydrocarbon structure, countless synthetic
products can be manufactured with many different properties. Crude oil is
flammable and its gases can be explosive. Lighter fractions of crude oil will
burn readily in air to give off carbon dioxide and water. The major form of
gas occurring naturally in crude oil is methane with smaller percentages of
propane, ethane, and butane. These gases can be liquefied by either cooling
or pressurizing them in a suitable container. Similarly, crude oil can be

cracked by applying heat to it and condensing its vapors.
In many instances the type and quality of the crude oil will determine the
products it can be refined into. Crude oils vary from very sweet to sour,
heavy to light, and vary in color from black to brown and can sometimes
be found in shades of green and amber. These variables are not only an indi-
cator of the field and depth from where the crude originates, but also of the
type of crude oil.
Crude oils generally fall into three classifications: asphalt-based, paraffin-
based, or mixed-based. Asphalt-based crudes contain little paraffin and are
often high in sulfur, nitrogen, and oxygen, they are used for making gaso-
lines and of course, asphalt. Paraffin-based crudes are high in paraffin wax
and can be refined into motor fuels, lube oils, and kerosene. Mixed-based
crudes have some amounts of both paraffin wax and asphalt in them and
can be refined into virtually any product but in lesser amounts. Another var-
iable in crude oil is its sweetness. This obviously is not sugar sweetness, but
rather the presence or absence of hydrogen sulfide (H2S). H2S has a rotten
egg odor and can be toxic if inhaled in large doses. Crude oil with a high
content of H2S is considered sour crude, while one with a low H2S content
is considered sweet. Various risk factors involved during transport of oil and
gas are described in this section.
2.1 Toxicity
The toxicity of a substance can be loosely defined as the potential of that
substance to do harm. To assess toxicity, information is needed concerning
the effects of the substance on biological systems, along with data on dosage,
form, and duration of exposure. Given the nature of the chemical handling
and manufacturing trades, the hazard from toxicity is ever present and per-
sonnel must therefore have a good understanding of the factors involved.
There are three phases involved in a toxic event: a chemical phase, a distrib-
utive phase, and an interactive phase. In the chemical phase, the substance
may break down spontaneously or react with something else to create the
toxic effect. However, apart from corrosives and irritants, most chemicals
must be absorbed in order to produce a toxic effect. Material that enters
through the lungs and the skin passes into the general systemic blood circu-
lation, while that entering via the intestinal route passes to the liver. The
product is then distributed throughout the body and the body attempts to
excrete it either through respiration, through the intestine, or through
the kidneys.
If the material is not discharged in an unaltered state, the body will

metabolize it wholly or partly into another substance. The principal method
of metabolizing foreign substances used by the body is by the use of enzyme
action in the liver. The body attempts to change the physical or chemical
properties of the substance into a form that can be efficiently and effectively
excreted.
The final phase of the toxic cycle is the interactive one, where the chem-
ical or its metabolite reacts with the biological tissue and produces the
damage. The damage caused leads to severe disease or, if the person is for-
tunate and has proper care, complete repair.
A substance can enter the body in four ways:
1. Injection—This is the least common and results in puncture wounds
(from deliberate or accidental administration). It is characterized by
the delivery of the toxin deep into the organism: into muscles, fatty tis-
sue, or the vascular system. In all cases, seek medical assistance.
2. Absorption—This is the most common, although not necessarily the
most serious route of entry. The skin forms a barrier to the ingress of
most materials, but local reactions (rashes, dermatitis, swellings, skin car-
cinomas, and lesions) may occur. There is also the possibility of systemic
effects (lipid-soluble substances for instance). The rates of absorption are
dependent on the solubility of the material (in fat or water), temperature,
humidity, and pressure, to name a few.
3. Ingestion—This is also known as oral absorption. Given proper work-
place hygiene, this should never occur. The material is absorbed along
the length of the gastrointestinal tract, and the properties of the substance
depend on whether absorption occurs in the stomach or intestine. The
presence of food is not always a protection. While they may protect
against irritants, fatty foods increase the uptake of lipid-soluble material,
and the digestive process aids in both distribution and contact with cell
material. The rates are dependent upon the time of day, the physical
form of the substance, and the physiology of the person involved.
4. Inhalation—The most usual route, and the one with the most effects. The
dose depends upon the physiochemical properties of the substance, the
concentration in the lungs, the duration of the exposure, and the individ-
ual’s ventilation rate. Generally, there are problems in that the smaller the
particle, the further down it goes. Physical fitness also plays a part. The
poorer the lung function, the poorer the clearance. Lungs congested from
cigarette smoking for instance are nowhere near as efficient as the lungs of
a nonsmoker. The very nature of the lung, a highly efficient mechanism
for gas exchange, means that absorption rates are very fast.
2.2 Static Electricity

Static electricity presents a fire, as well as an explosion hazard on a ship. The
hazard is the greatest when cargo operations are being carried out and when
the tanks are being washed. It is at these times that a static charge can develop
and if no precautions are taken a discharge can occur, which in certain cir-
cumstances can prove disastrous. The conditions that make such an event
possible are that there must be a charge of sufficient potential difference
and there must be a flammable atmosphere, the trigger is providing a path
between the two charged masses. Static charge develops in three stages,
the first is called charge separation, then charge accumulation, and finally
electrostatic discharge.
2.3 Reactivity
Reactive cargoes should never be allowed to come in contact with each
other, as the resulting chemical reaction could prove hazardous for the ship.
This contact could also cause both cargoes to become contaminated and be
unacceptable to the consignee. There are several types of reactive cargoes.
They could be self-reactive, react with air, react with other cargoes, or react
with water. This reaction could produce any one or a combination of the
following:
1. heat
2. vapor release
3. a rise in pressure in a tank
4. affect the cargo quality
5. increase the danger of fire or explosion
6. increase the health hazard
7. polymerization
It must also be remembered that some chemicals require inhibitors added to
them to prevent any self-reaction or reaction with air. These cargoes need to
be closely monitored for rising temperature that may indicate a reaction.
The inhibitors themselves can also pose the additional hazard of being highly
toxic, so additional protective measures must be taken when handling them.
2.4 Corrosive Cargos

Corrosive cargos pose a threefold threat to the ship. First cargo could harm
human tissue and cause serious damage that could be permanent. Second,
they can corrode tank construction materials, pipes, pumps, and other
fittings, and finally corrosive liquids can become flammable and produce
flammable gases when in contact with some metals or fibrous materials.
When some corrosive cargoes come in contact with some metals, hydrogen
gas evolves. This gas is flammable. Certain corrosive materials coming into
contact with a fibrous material can start a fire.
If a ship is carrying a corrosive cargo, all materials used in the construc-
tion of the tanks and cargo system should be resistant to corrosion. When a
corrosive cargo is being handled all persons on duty should wear full-
protective clothing, including protective eye wear. Great care should be
taken when opening up a tank, space, valve, line, or blank if there is a
possibility that splashing could occur. Materials such as cotton waste must
not be used to mop up corrosive liquid spills, as these materials will catch
fire. If a person is splashed by a corrosive substance, that person should
remove all clothes and shower themselves down with copious quantities
of water.
In addition to the corrosive hazards posed by some chemicals, there is the
additional hazard of frostbite that is present in liquefied gas carriers as a lot of
these carry their cargoes at temperatures well below freezing. Consequently,
all the associated pipelines and equipment will be extremely cold so care
must be exercised when working around them, especially when the risk
of contact with a cargo leak is considered.
2.5 Pollution
The main impact of spilt oil is on local marine life and the severity will
depend on the many factors of the spill such as:
Type of oil
Location of spill
Species of marine life in the area
Timing of breeding cycles and migration and
The weather during the spill
Oil can affect marine life by either coating their body with oil or poisoning
them. Oil-coated marine life can find themselves prone to hypothermia or
having their mobility severely restricted, hampering their ability to source
food and water or in turn becoming easy prey themselves. This is more
prevalent in those incidents that involve the spillage of heavy oils. Light oils,
which do not last long in the environment due to their rapid evaporation, are
much more poisonous than black oils and therefore mainly poisoning
marine life. This poisoning can affect the animal directly through inhalation,
absorption, or ingestion, or it can affect those higher in the food chain which
in turn have relied on those below them for sustenance. Effects of poisoning
can include making the animal ill, damaging or irritating eyes, nose, and
internal organs, and reducing the thickness or size of eggs. However, it is
not just major oil incidents that have an effect on marine life. It is suggested
that illegal dumping of oil by passing ships results in injury to or death of up
to 350 penguins annually at Phillip Island (Garcı́a-Borboroglu, Boersma,
Reyes, & Skewgar, 2008).
When the oil enters the sea, it begins to change as different and some-
times competitive forces act on the spill. There are a number of processes the
oil can go through that can affect its duration and impact:
• Spread
• Movement/drift
• Evaporation
• Dissolution
• Dispersion
• Emulsification
• Sedimentation
• Biodegradation
• Oxidization
The changes in the characteristics of the oil due to physical, chemical, and
biological processes is called “weathering” and vary according to the type of
oil. The lighter the oil, the faster it is likely to weather. You are not expected
to these effects, but you should be aware that an oil slick does go through
physical changes throughout its duration. It is not only marine life that suffers
from oil pollution, but also surrounding inhabitants fall victim, especially
those that rely on the ocean for their livelihood. Examples would be seaside
resorts, charter boat, and dive tour operators that rely on their pristine
beaches and clean water to attract tourists, and local fishing industries could
also suffer as fishermen find their catch either contaminated or greatly
reduced. In addition, oil spills with small fractions of hydrocarbons can prove
hazardous to boats plying through it.
The ability with which an affected environment can recover from an
event depends on the severity of the incident, as well as the composition
of plant and animal life. An area once restored will repopulate and recover
in a shorter period if it has a population of highly mobile organisms with a
short maturation period rather than a slower maturing population of plants
and animals. Animal life does not tend to repopulate as easily as planted areas,
and a habitat in the tropics is able to restore itself in a shorter period than one
in a temperate zone.
2.6 Fire and Explosion

As a risk factor, whenever there is a fire involving flammable liquids, it is not
the liquid itself that burns, but more precisely it is the vapor given off by the
liquid that ignites. Two factors, namely, a spark and a flammable atmo-
sphere, need to be present simultaneously for a fire to result. On tankers
where there are many hazards, the philosophy is to eliminate one of the fac-
tors in any area. For instance, it is not possible in current circumstances to
eliminate the evolution of gas in the cargo area of a ship. The emphasis is to
eliminate all sparks or incendiary factors from the area. The opposite is true
for the accommodation area. Thus, one of the ways used on a ship to prevent
the occurrence of a fire or explosion is reduction of the oxygen content in
the atmosphere of a tank. This is accomplished by using an inert gas gener-
ator or plant, and a fixed piping system to deliver it to each tank or space to
be protected.
Further, the hydrocarbon gases burn with intense heat, between 1000°C
and 2000°C. Liquefied natural gas (LPG) fires produce quantities of smoke
and soot restricting radiant heat to some degree. Though, liquefied natural
gas (LNG) fires produce little smoke, the radiant heat is excessive. In all cases,
fire fighters require fully protective clothing and must take advantage of
water spray protection.
In 1980, experiments were carried out in Maplin Sands, United King-
dom, during which quantities of refrigerated LNG and propane were
released onto water and ignited (Hirst & Eyre, 1983). The tests involved
instantaneous releases of up to 15 m3 of LNG and propane and also pipeline
discharge of these liquids at rates of up to 6 m3/min. These tests showed that
for a cloud or vapor fire, surface emissive power for LNG and propane was
very similar, being in the order of 173 kW/m2. However, for a pool fire (dis-
cussed later) the emissive power was 43 kW/m2 for propane and almost five
times greater for LNG, at 203 kW/m2. This is due to both the higher vapor-
ization rate of LNG and also the fact that the LNG flame produces more
luminous soot, resulting in a higher surface emissive power. Jet or vapor
releases and the resultant air/fuel turbulence creates more “equal” combus-
tion. It is interesting to note that of the 20 LNG releases undertaken during
these experiments, ignition was only successful in 7 cases and of the 14 propane
releases only 4 were successfully ignited. Different types of fire accidents are
described later.
2.6.1 Jet Fires

These are fires in gas (liquid or vapor) leaking under pressure. Such leak
sources are pump and blower shaft seals, pipe flanges, and small pipeline rup-
tures. The fire will remain at the source of the leak. The flame length and
heat will be proportional to the pressure within the leaking vessel and
depends on whether the leak is liquid or vapor. It can be recognized that
fire from a liquid jet is going to be much more intense than that of a vapor jet.
2.6.2 Unconfined Pool Fires

Large open pool fires are not likely on the decks of gas carriers as the drainage
is good with deck camber and open scuppers.
2.6.3 Confined Pool Fires

The very large drip trays under the connection manifolds on bigger refrig-
erated gas carriers, could, in the worst of circumstances, contain considerable
pools of liquid that would make a significant pool fire if ignited.
Radiant heat from pool fires decreases with the inverse square of the dis-
tance from the fire. Any radiation above 6 kW/m2 will cause intense pain to
human skin within seconds and above 10 kW/m2 will cause blistering. Safe
distances from pool fires are measured in tens of meters (McGuire &
White, 2000).
2.6.4 Explosions
As described earlier, an enormous amount of heat is produced during hydro-
carbon combustion. In the open, where rapid heat expansion can dissipate
easily, the combustion reaction will proceed at a steady rate. In confined
spaces, however, pressures will rise, increasing the reaction rate, which in
turn increases the pressure. Even in the open, any surrounding confinement
will lead to escalation of the combustion rate. In enclosed spaces, such as
cargo tanks or compressor houses, a rapid exponential rise of pressure will
occur until the boundaries rupture in an explosion.
2.6.5 Boiling Liquid Expanding Vapor Explosion

This phenomenon applies only to pressurized storage of liquefied gases. In a
pressure tank containing liquid propane, for example, the liquid will be at
ambient temperature and under considerable pressure. It will contain

enough specific heat for more than half of it to vaporize instantly, should
the pressure be removed by any cause. If fire from another source were
to impinge on the propane tank, it would heat up. In short, the rising inter-
nal pressure lifts the tank pressure relief valves and the escaping vapor itself
ignites. This now becomes a stable condition. The tank pressure remains at
maximum allowable relief valve setting, and the liquid remains at the boiling
temperature proportional to that pressure. The areas of the tank surrounding
the remaining liquid are temperature controlled by the liquid within. How-
ever, the areas of the tank containing the vapor space have no temperature
control and will soften in the heat of the impinging fire to the point of
failure. The resulting rupture of the tank instantly drops the pressure to zero.
More than half of the remaining liquid then instantly vaporizes carrying the
remaining liquid outward as droplets. All of this material combusts in a
gigantic fireball doing great damage. Fragments and end caps of pressure
tanks can be blasted more than a kilometer by the explosive force from a
boiling liquid expanding vapor explosion (BLEVE). No BLEVEs have been
reported occurring on liquefied gas carriers. Only pressurized tanks can
suffer a BLEVE and the siting of such tanks on-board ship makes it unlikely
that fire will impinge on them. Furthermore, the IGC code (international
code for the construction and equipment of ships carrying liquefied gases
in bulk) requires a deluge system to be fitted to keep tanks water sprayed
and thus cooled in the event of fire.
2.6.6 Leakage
Cargo-related emergencies other than fire are those where accidental release
of gas occurs. The more readily envisaged incidents of this type are listed
later, together with the fundamental strategies of dealing with them. The
incidents are listed in the order of the approximate likelihood of their
occurrence.
2.6.6.1 Liquid/Vapor Leak on Deck

This can only be detected visually. A small vapor leaks on the ship’s fore-
deck is unlikely to be quickly detected at sea. Fixed gas detectors usually
have at least one detection point on the foredeck but with any cross-deck
breeze it not likely to pick up traces of leaking vapor from a small leak.
A small liquid leak is a more serious problem in that it produces much more
vapor and may damage any noncryogenic steel it impinges on. Again,
detection while steaming may not be quick, although liquid leaks are more
highly visible through streams of white condensation moisture. Small leaks

are not usually of enough concern to activate the ship’s general alarm. They
are stopped by shutting off supply to the leakage point. Both vapor and
liquid are dispersed using a fire hose. Approach to the leak is always made
from windward. At sea, the ship can be maneuvered to create the best
cross-deck airflow.
Large leaks, especially of liquid, are a serious problem. The fixed gas
detector will alarm. A visual assessment of the circumstances ascertains
the degree of severity in the case of liquid leaks. There is danger of asphyx-
iation to personnel on deck, there is danger of ignition, and there is danger of
severe damage to any noncryogenic plating the liquid comes into contact
with. In these circumstances the deluge system must be activated. It supplies
heat energy to evaporate spilled liquid and assist in dispersing vapors. It is
therefore already cooling all surfaces should there be ignition. Most likely
the emergency shut down (ESD) will be activated. In any case the cargo
system must be remotely operated to shut off supply to the leak. Unless there
are casualties to be rescued, emergency parties would not be deployed on
deck until the situation is under control.
2.6.6.2 Liquid/Vapor Leak in Compressor House

Any gas leaks in the compressor house can be picked up by the fixed gas
detector. Unlike leaks on the open deck, these must not be handled by
personnel other than properly controlled emergency persons. The obvious
danger is that investigating personnel will enter the compressor house and be
overcome by the escaped gas.
2.6.6.3 Burst Hose/Major Manifold Connection Leak

This is another very serious situation. Any personnel near the connection
manifold must make their escape as rapidly as possible. Bearing in mind
the near certainty of the generation of an enveloping vapor cloud from
any sizeable quantity of spilled liquid, oxygen will be excluded from the area
and asphyxiation is a serious danger. The situation should be dealt with in the
same manner as for that described in Section 2.6.6.1.
2.6.6.4 Liquid/Vapor Leak in Void Space

The presence of vapor in the void space can be detected by the fixed gas
detector. The presence of liquid gas in the void space can be detected by
the void space temperature sensors, which will drop to the cargo’s boiling
temperature at atmospheric pressure. On practically all fully refrigerated
LPG ships, the void spaces are kept inert below 5% O2. On LNG carriers
with membrane tanks, the interbarrier space is kept under pure N2. On LNG
ships with spherical tanks, the void spaces are kept under dry air but with the
facility to inert them. The first action on these LNG ships would be to inert
the void space containing the leaking tank.
LPG carriers are fitted with cargo-driven eductor systems for draining
liquid cargo from the void space. Should the leaking liquid reach sufficient
quantity, these can be used to transfer it to another cargo tank. Liquid in the
void space would be subject to constant evaporation from heat imparted to it
by the sea.
2.6.6.5 Liquid Loss From Tank Rupture in Collision or Grounding

To date no rupture of a cargo tank has occurred on a gas carrier as a result of
collision or grounding, although there have been a number of both types of
incidents. This is largely attributed to the design philosophy of the IGC code
and preceding codes, which placed the cargo tanks as separate containers
within the ship’s hull.
2.7 Low Temperature Problems

From the study so far, it should be appreciated that wherever the commonly
carried liquefied gases exist as liquids at normal (ambient) pressures, they will
do so at their atmospheric boiling temperatures. The greater proportion of
liquefied gases shipped is carried in refrigerated storage. LNG and LPG boil
at 163°C and 43°C, respectively. Even in pressurized storage for LPG,
where the liquid gas is carried at ambient temperature, allowance must be
made for the gas to be loaded from refrigerated storage at its atmospheric
boiling point, or for accidental loss of pressure and consequent drop in
temperature to atmospheric boiling point.
Therefore, all the cargo handling systems on gas carriers must be con-
structed from materials capable of maintaining full integrity at the liquid
temperatures of the gases the ships are licensed to carry, allowing for full
pressure loss. Some of the problems associated with the very low liquid
temperatures are as follows.
2.7.1 Brittle Fracture

Accidental spillage of the liquid gas on to parts of the vessel not constructed
from suitable material, such as deck and ship’s side plating, can cause crack-
ing of the steel. Large amounts of seawater contain enough specific heat to
help preventing damage. On LNG carriers, a permanent curtain of seawater
is poured down the ship’s side under the manifold connection during cargo
operations.
2.7.2 Thermal Distortion

Sometimes referred to as “Thermal Shock,” this is damage caused by
unequal contraction. If liquid gas is introduced into a large structure such
as a cargo tank, it will reduce whichever part of the tank it is in contact
with down to liquid temperature. A tank bottom may therefore be reduced
to 43°C by incoming liquid propane, while the top of the tank remains
relatively warm. The localized contraction can distort the entire structure.
The effect is eliminated by operationally precooling structures and pipelines
evenly.
2.7.3 Insulation Cold Spots

All refrigerated gas carriers have heavily insulated tanks. Should localized
damage or deterioration occur in this insulation, the atmosphere around
the tank can come into direct contact with the very cold metal. Any
moisture in this atmosphere will condense, forming ice on the surface of
the tank. The ice, in turn, will force more insulation away from the tank
surface and thus the problem increases. Routine insulation inspection is
standard operational practice on these ships. On LNG carriers, pure nitrogen
is injected in a constant stream between the insulation and the tank,
preventing any moisture laden air from coming into contact with it.
2.7.4 Ice and Hydrates

Ice and hydrates can form during the cool-down process. This problem
refers more to LPG carriers than others, as in these gas ships it is very com-
mon to change cargo grades from one voyage to the next. Tanks which have
contained butane may have free water in the cargo residue (butane exists as a
liquid at 1°C or 2°C). Subsequent cool down of these tanks with pro-
pane to 43°C will certainly freeze the water and may also combine with it
to form hydrates. If no drying out time is available, the use of antifreeze
(methanol) helps. Ice may also be formed from moisture condensing out
of inert gas during cool down, if the inert gas has not been properly dried.
2.7.5 Frostbite
Liquefied gas, if spilled, extracts latent heat by evaporation from whatever
surface it comes into contact with and this includes human tissue. Human
tissue is composed of cells, which are 80% water. Water expands greatly
when turning to ice, destroying the cells of living tissue as it does so. The
cellular damage done is very similar in effect to burning and cold burns
like other burns, will vary in severity. The treatment is also much the same
as for burns.
2.7.6 Rollover
Under normal circumstances the temperature gradient in a storage tank of
liquefied gas will go from cool (most dense) at the bottom to warmer (less
dense) at the top. In shore storage tanks, or during very static circumstances
on-board ship, a layering effect can cause this temperature gradient to be
reversed. Constant evaporation from the surface of the liquid can cause
the uppermost layer to become cooler than deeper down. An unstable sit-
uation now exists in the tank, with warmer liquid held under static head
pressure by a cooler denser surface layer. Any small disturbance can cause
the layers to exchange in a massive displacement of each other. The warmer
liquid, freed from the static pressure, produces very large quantities of vapor.
The problem can be avoided by liquid circulation within the tank on a reg-
ular basis, together with close monitoring of tank temperature sensors at
different levels.
2.8 Ship/Shore Operation

The time of highest risk is when a vessel is in port undertaking cargo transfer
or cleaning operations with commercial pressures to complete the turn-
around in the shortest period of time. Representatives from different asso-
ciated shore parties are on-board requiring different information. The
turnaround may entail loading, discharging, washing, and back loading,
all within a few hours. Organization of the ship is therefore vital for a smooth
operation.
The key to all port operations is communication. Not only in regard to
the structured organization of the ship but also between the shore operators
and the ship. All cargo operations have to be preplanned and documented.
It is essential that the ship has all tanks/lines, etc., prepared, cargo orders
confirmed and information exchanged between parties. The Mate must
check whether his information and that of the terminal is the same. All pro-
cedures are discussed and worked out. Most terminals and port authorities
use the ICS guide as a base checklist for the ship/shore briefing. It must be
completed and signed by all parties before any cargo operation begins. The
chief officer should also give standing orders for the upcoming cargo oper-
ation detailing requirements for cargo and ballast, as well as any other
significant events.
The surveyor checks the tanks for cleanliness before loading (and/or) or
confirms the quantity onboard. A responsible person should accompany the
surveyor, with some tank inspections taking considerable time as will sample
testing. Terminal personnel attend to the ship’s manifold with deck officers
and connect hoses, ensuring that static lines are installed and checked (where
the port demands their use), checking that connecting flanges have the right
gaskets, bolts, etc., and that purging pieces are in position and pigs are ready
for use.
The vessel must be familiar with the shore-emergency procedures.
Again, communication with the shore is vital and ESD procedures are con-
firmed. The VHF in the CCR is always on the harbor/terminal emergency
channels. Telephone numbers for all associated services are readily available
in the CCR. All tankers supply a fire wallet to the shore authorities including
a ship’s fire plan, crew list, and cargo plan to aid shore-emergency services.
Most accidents occur when there is a deviation from standard-accepted
practice. The correct personnel, well trained with an awareness of all hazards
involved—especially environmental, health, and explosion—are important.
Equipment failure is another area for creating incidents, but in the main,
with proper ongoing maintenance checks (known hazard areas, etc.), these
can be controlled.
3. FORMAL SAFETY ASSESSMENT TECHNIQUES

3.1 Review of the Current Safety Practices
The storage and handling of oil and gas is considered to be a critical oper-
ation. Handling hydrocarbons involves many activities which can lead to an
incident or an accident if not performed to the standards. Many safety prac-
tices exist in industry. Some of these practices are region-dependent, while
some are ship operator-dependent. Some of the current safety practices
employed in the industry are discussed here.
3.1.1 Hazard Identification and Risk Management Techniques

In 2002, IMO developed a risk analysis tool called formal safety assessment
(FSA) through the rule-making process MSC/Circ.1023/MEPC/Circ.392
and subsequently amendments were made to that by MSC/Circ.1180-
MEPC/Circ.474 and MSC-MEPC.2/Circ.5 (Albert Embankment, 2002).
FSA is a technique used for risk analysis and cost assessment. It helps to
enhance maritime safety, loss of life, marine environment, and property
(Ventikos & Psaraftis, 2004).
Moreover, FSA can be used as a tool to evaluate new regulations for mar-
itime safety and protection of the marine environment. It helps to make
comparison between existing and new improved regulations with a view
of achieving a balance between the various technical and operational

issues (i.e., the human element, maritime safety, protection of the marine
environment, and costs) (Ventikos & Psaraftis, 2004). It is estimated that
the cause of almost 80% of the incidents or accidents in the shipping
industry is due to human error (Islam, Khan, Abbassi, & Garaniya, 2018).
FSA recognizes the importance of the role of “human elements” in ship
safety and includes “human reliability analysis” in the FSA. The FSA consists
of five steps:
• Identification of hazards (list of all relevant accident scenarios with
potential causes and outcomes)
• Assessment of risks (evaluation of risk factors)
• Risk control options (measures to control and reduce the identified risks)
• Cost benefit assessment (determining cost effectiveness of each risk
control option) and
• Recommendations for decision-making (information about the hazards,
their associated risks, and the cost effectiveness of alternative risk control
options is provided).
Key components of FSA process are explained in detail below.
3.1.1.1 What Is Hazard?

A hazard is something that can lead to undesired outcomes in the process of
meeting an objective (Kuo, 2007). This definition can apply to any activity,
situation, operation, or system. In the safety context, the undesired outcome
means injuries to workers, damage to property, and pollution of the envi-
ronment, or a combination of all three.
3.1.1.2 Why Need to Identify the Hazard?

Risk management is fundamental to all process safety works. Identifying the
hazards is the first and most important step. The consequence and likelihood
reduction cannot be implemented unless the hazards are identified.
3.1.1.3 How to Identify the Hazards?

The following techniques and methods are recommended to identify the
hazards in marine operations.
3.1.1.3.1 Hazard Identification Analysis Hazard identification analy-

sis (HAZID) is a valuable technique to identify and examine hazards when
the operations procedures have been developed. This technique is used to
ascertain and evaluate hazards at the conceptual and front-end engineering
stages. Moreover, this technique conducted in combination with a pres-

creening study is useful to reveal weaknesses in the design and to determine
the marine operations concept and methods. Furthermore, this method can
be used as a tool for evaluating the potential risks the operation. The method
is also used as a tool for assessing the potential risks the operation primarily
typifies (Giardina & Morale, 2015).
3.1.1.3.2 Hazard and Operability Study A hazard and operability

study (HAZOP) is a structured technique for a complex-planned operation
to ascertain and assess difficulties that may represent risks to humans or
equipment. It is capable of identifying problems during the early stage of
project development and potential hazards in existing systems. The purpose
of conducting a HAZOP is to identify design and engineering issues. This
technique breaks down overall complex design process into a number of
simpler sections known as nodes which are then studied individually. The
HAZOP is a qualitative technique and is carried out by the experienced
multidisciplinary team during a series of meetings. The aim of this technique
is to motivate the imagination of participants to identify potential hazards
and operability problems (Shukla & Shah, 2011). There are four basic steps
to the process:
1. Forming a HAZOP team
2. Identifying the elements of the system
3. Considering possible variations in operating parameters
4. Identifying any hazards or failure points
3.1.1.3.3 Early Procedure HAZOP Early procedure HAZOP (EPH) is

an interdisciplinary and structured approach to identify exposures and oper-
ability glitches for the planned marine operations procedure (Veritas, 2003).
EPH is commonly used as a tool in the development of marine operations
procedures and is typically performed when a draft procedure is available.
The same technique as for a detailed procedure HAZOP is used. EPH
can be combined with design review.
3.1.1.3.4 System HAZOP System HAZOP analysis is applicable to

marine systems critical to the successful execution of the marine operation.
Such systems and all other systems are important for the operation such as
hydraulics, ballast systems, and essential electrical systems. In HAZOP anal-
ysis an interdisciplinary team uses a systematic methodology to ascertain haz-
ards and operability difficulties due to missing information or errors in the
design which may result in an undesired event (Veritas, 2003).
3.1.1.3.5 Procedure HAZOP Procedure HAZOP is an interdisciplin-

ary and methodical approach to identify hazards and operability complica-
tions for the planned marine operations procedure (Veritas, 2003). The
HAZOP as developed and used today is a tool to identify hazards and poten-
tial operational problems, and unless the solutions to these possible problems
are immediately evident, the HAZOP shall refrain from finding solutions
and carrying out redesign.
3.1.1.3.6 Design Review Design review (DR) is a systematic approach
to review a particular design solution and is used in order to reveal weak-
nesses in design of a system, structure, or component.
3.1.1.3.7 Failure Mode and Effects Analysis/Failure Modes, Effects,
and Criticality Analysis Failure mode and effects analysis (FMEA) is a
method to ascertain and analyze important failure mode and associated
effects with the specific system under consideration (Veritas, 2003). Besides,
failure mode, effects, and criticality analysis (FMECA) is an addition of the
FMEA. However, both methods are suitable to use for critical and complex
systems such as ballast system.
3.1.1.3.8 Semiquantitative Risk Analysis SQRA is a semiquantita-
tive risk assessment, which may be used in combination/part of other hazard
review techniques (EPH, HAZID, and/or HAZOP). Generally, the results
of a Semiquantitative risk analysis (SQRA) are tabulated in predefined forms,
which may be used as input to or part of the hazards register (risk register) for
the project.
3.1.1.3.9 Safe Job Analysis Safe job analysis (SJA) is used to identify
hazards and risk-reducing measures for a particular work task or activity. SJA
is particularly relevant for work tasks and activities not adequately covered
by the operations procedure, as part of a deviation request to an approved
procedure and for work involving several work groups or work tasks or
activities in the same area. SJA is particularly relevant for work tasks and
activities with details not adequately covered by the operations procedure,
SJA shall be performed by the actual personnel involved in the tasks or
activity.
3.2 Firefighting Strategies

Small jet fires on the open deck may be rapidly extinguished using the dry
powder hoses and subsequent vapor leak dispersed by water hose with jet
nozzles until fuel supply has been shut off. However, a general approach
to gas fires onboard is to allow them to burn until the source of fuel can be
closed off. The obvious disadvantage in using an extinguishing medium on a
gas fire is that once the flame is extinguished, the leaking gas will continue to
accumulate and may reignite with more damaging consequences. With
remote-operated valves and ESD systems, it is possible to shut off the fuel
supply fairly rapidly without having to approach the fire.
If this approach is to be taken and a fire left burning, one of the first lines
of defense will be the deck spray system. This will keep all surfaces cool as the
fire burns out. A second line of defense is the use of fire hoses to assist in
cooling, with the hose teams, for heat protection, working behind hose
nozzles set to spray on approach. If the fire is very large, or within a cargo
compressor house containing condensers, it is potentially very dangerous
from excessive radiant heat in the first case or explosion in the second. Here,
the strategy must be to endeavor to control the fire remotely rather than risk
the lives of fire crews by approaching it. Compressor houses are fitted with
fixed fire smothering systems. These will require vent fan and flap shutdown
prior to activation.
3.2.1 Initial Decisions

From the different responses earlier, it can be seen that in the initial stages of
an emergency vitally important decisions need to be taken as soon as possi-
ble. Modern managerial practice is to generate checklists of sequential
actions for different emergencies, and there is little doubt that these would
prove to be of further value in the handling of the problem. In the first
instance, however, decisions need to be taken urgently so as to preclude
locating, sifting through, and finally reading action checklists. Given a
cargo-related alarm of a serious nature (cargo leak of any sort, or fire) being
raised, the following must be instantly answered:
1. Activate ESD?
2. Start deluge?
3. Sound general alarm and bring ship to emergency stations?
4. Shut down ventilation?
5. Any casualties?
At first consideration it might seem appropriate to initiate actions 1–4 in any
alarm situation, but that may not always be the case. Reviewing them in
order actions are:-
1. Activation of ESD will not only close the manifold valves, it will shut
down the entire cargo handling plant. For example, an LPG carrier load-
ing propane routinely has high tank pressure problems during the load-
ing. These are handled by deploying return gas blowers pumping the
excess vapor ashore through a vapor return line and reliquefaction

condensing the remainder. To shut it all down will definitely result in
the tanks over pressuring, the safety relief valves lifting, and large quan-
tities of vapor being vented at the vent mast riser. Under calm weather
conditions, this vapor cloud will descend to the deck level. The question
must be asked “Will ESD activation cause further and more serious
problems?”
2. Start the deluge system to pump great quantities of water all over the
deck. In particular in the manifold areas, large drip trays are specifically
located to catch liquid gas spills. Should a spill occur, followed by igni-
tion, the situation is one of a confined pool fire. Large quantities of water
entering the liquid pool will only increase the fire by increasing the
liquid evaporation rate. “Will deluge operation help or hinder?”
3. Sounding the general alarm results in crews immediately abandoning
whatever they are doing and mustering at designated emergency muster
stations. Even with the very best of training, this process takes time. If the
duty watch on deck is making progress on a small local fire, is it an advan-
tage to pull them away?
4. If the incident has produced a large vapor cloud, as yet not ignited, it may
well surround the accommodation. The ship’s accommodation is
designed to work on positive pressure at all times. This means that the
accommodation interior is always at a marginally higher pressure than
outside, so airflow is always outward at any opening. If the fans are
stopped, this protection will no longer be there and escaped cargo vapors
can flow in at any opening.
Appropriate initial decisions need to be taken very quickly. The ability to
make correct ones will depend on the clarity of the situation reported from
the alarm raiser and the practice in training of the command team. If the ESD
is not operated, individual valves and machines can rapidly be manually shut
down, leaving any that are needed open and running but not adding to the
problem. Deluge can be started and vent fans shut down instantly when
required at any stage in a developing scene.
3.2.2 Secondary Decisions

The need for decisions continues as the scene evolves:
1. If casualties, how many, who are they, where are they?
2. How life threatening are the conditions at the scene now?
3. How life threatening at the scene will the conditions become as it
develops?
4. What communications are necessary at this time and with whom?
The information required to answer the first three questions must come
from those who raised the alarm. They will completely influence the
response:
1. The prime concern is always for safety of personnel onboard. Depending
on the situation with the casualties, the first and second emergency
parties and all firefighting appliances can be concentrated on their rescue.
2. Allowing for the prime concern in (1), how dangerous is it for the
rescuers to proceed? It will not help to add to the casualty list. If there
are no casualties, how safe is any proposed action to control the current
situation? Does the action proceed or do the crews fall back?
3. If it is immediately practicable for action to be undertaken by emergency
teams, for how long will it be reasonably safe? How long before pulling
the crews back?
4. At this stage, what communications need to be made to (a) other vessels,
(b) harbor authorities, and (c) terminal authority?
3.3 Training for Emergencies

Modern shipboard safety management is now a well-established practice,
which ensures that the standard emergency party structures and drills are
used to train seafaring students. However, a problem for line management
and operators (i.e., ship’s officers) is the proliferation of instruction. Com-
pany manuals, ISM code, MARPOL (SOPEP—shipboard oil pollution
emergency plan) and SOLAS all require contingency plans for emergencies
and regular drills to prepare for them. It is general practice that only a single
set of contingency plans must be used to meet all this legislated instruction. It
is the direct responsibility of the master and designated person ashore (DPA)
to ensure that this is the case. To some extent, each of the assertive shore
authorities generating instruction remains unaware of the requirements of
the other. The unification of these requirements is on the ship. There must
be no variation between plans for each conceived emergency, no matter
which of the many legal and managerial imperatives they have been pro-
duced to comply with.
Once a standard set of plans have been devised, they must obviously be
put into practice at drills. The second important point is that repeated
rehearsal of a predetermined response at drills is nearly useless as a practice
for a real emergency. In fact, it is detrimental in that once properly enacted, it
gives the illusion of a satisfactory result (Okana, 2008). Any drill which is
completed without undue problem is no more than efficiently organized
self-delusion. One method of opening up drill scenarios is to have the drill

devised by two nominated “referees.” These persons are not part of the
response to the emergency but the originators and managers of it. While
all the ship’s crew are aware of who the referees are for any particular drill,
no one, including the master, knows what the emergency will be. The
referees first devise and set up the exercise, then participate in it as controllers,
wearing some sort of identification badge. They may simulate alarms, instruct
responding emergency parties regarding situations encountered, incapacitate
personnel, and generally control the development of circumstances. The ben-
efits of such a drill are that everyone in the emergency teams, no matter what
their status in the organization, has to respond to unexpected events. To
undergo these drills is at first a salutary experience as, inevitably, the sponta-
neous response to an unprepared for event is often not correct. However,
repeated exercises develop rapid thinking, familiarity with the full range of
emergency equipment and flexibility in its use.
For the above, a thorough analysis of the exercise must be made at
debriefing. This is as necessary as the exercise itself. To assist in this, it is ben-
eficial to have one UHF transceiver dedicated to a tape recorder so that a full
record of actions against time can be used at the debriefing. It should be said
here that from experience in introducing this style of training, debriefing the
initial exercises will be difficult. Individuals do not enjoy their less than
perfect responses being highlighted before the group. This problem must
be overcome for everyone to benefit from mistakes made. Leadership should
come from the master, perhaps by discussing his performance first.
This advanced and usually quite stressful training should only be under-
taken by crews who have undergone a lot of preparatory work. Initial
drills should concentrate on slow speed equipment familiarization with each
piece of emergency gear, until every person is totally familiar with its loca-
tion and use. A later stage can enact set scenarios, coordinating separate
activities, but still without emphasis on speed but rather, correct operation.
Finally, the drills can be escalated to unknown emergencies with referees
controlling them.
3.4 Static Charge Separation

When two dissimilar materials come into contact with each other, charge
separation will occur at the interface. The two materials may be solid or
liquid; however, if both materials are liquid they should be immiscible. At
the interface, a charge, either positive or negative, transfers from one material
to the other, the substances thus become charged with respect to each
other. As long as the materials are in contact with each other, this potential
difference will remain small and so no hazard will exist. The materials, and
hence the charged field, can however be separated by many different pro-
cesses, such as:
• The flow of oil or oil/water mixture, through a pipeline or through a
fine filter
• The settling of a solid or denser immiscible liquid through another liquid
• Liquid being ejected through a high-speed nozzle
• The splashing of a liquid against a solid surface, agitation can also achieve
the same effect
• The vigorous rubbing together and the subsequent separation of certain
synthetic polymers.
When the two areas are separated the potential difference can become quite
large. The areas adjacent to the charged area also begin to acquire a charge
and the combined area is known as an electrostatic field. An example of
charged fields in an oil tank is where the liquid oil is of one potential, while
the mist in the ullage space develops the opposite charge. Another charged
field can develop when a tank is being washed. The water impinging on the
tank’s surfaces produces a charge between the water mist and the liquid at the
bottom of the tank. If an uncharged conductor is placed within a charged
field, it will develop the same charge as the region within which it is placed.
The field also polarizes the charge within the conductor, as a charge of one
potential develops at one end, a charge of the opposite polarity develops at
the other. Such a charge is known as an induced charge and the presence of
the field maintains this state.
3.4.1 Charge Accumulation

After charges have been disconnected, they will likely recombine and coun-
teract each other which is charge relaxation. The rate of relaxation depends
on the conductivity of the material in question. If the material is a good con-
ductor then the rate will be rapid. There are instances where the rate of
relaxation equals the rate of accumulation, thus no charge develops between
the two materials. A poor conductor, however, has a poor rate of relaxation
and develops a charge more rapidly, while at the same time it discharges it
much more slowly. If however a good conductor is surrounded by a poor
one, then the rate of relaxation will depend on the rate of relaxation of the
poorer conductor.
3.4.2 Electrostatic Discharge

An electrostatic discharge will occur when there is a breakdown in the mate-
rial between the two points containing a charge. This breakdown is depen-
dent on the voltage gradient between the two areas and the distance between
them. The field strength or voltage difference can be ascertained by dividing
the voltage difference between two points by the distance between them.
A field strength of 3000 kV/m is sufficient to cause a breakdown in air or
petroleum gases. Field strength increases near protrusions, and these areas
are therefore the most likely place for an electrostatic discharge to occur.
A discharge can also occur between a protrusion and the ullage space, but
such a discharge is unlikely to cause a fire or explosion. An electrostatic dis-
charge can also occur in the following circumstances:
• between the sampling apparatus and the surface of a charged petroleum
liquid
• between an unearthed floating object on the surface of a charged liquid
and an adjacent tank structure
• between unearthed equipment suspended in a tank and the tank
structure
For the possibility of an incendiary spark to be created by this discharge, the
following requirements will have to be met:
• The gap must be short enough to allow the discharge to take place with
the voltage difference present, but not short enough for the flame to be
quenched
• Sufficient electrical energy to supply the minimum amount necessary to
initiate combustion
• The energy needs to be released nearly instantaneously into the
discharge gap.
3.4.3 General Precautions Against Electrostatic Hazards

The proper bonding of all objects to the ship structure is an effective way of
eliminating the chance of static buildup. The objects required to be insulated
and bonded in hazardous conditions are as follows (Gibson, 1997):
• Ship-shore hose couplings and flanges, if more than one nonconducting
hose length is used in a hose string
• Portable tank cleaning machines
• Conducting manual ullaging and sampling equipment
• The float of a permanently fitted ullage device if it lacks an earthing path
through the metal tape.
The most effective method of ensuring a proper bonding occurring is by

connecting two conductors with a metallic conductor. Metallic objects
floating in a static accumulator will also develop a charge and can discharge
when in the proximity of a part of the ship’s structure. All tanks should
therefore be inspected after dry docking to eliminate such a possibility.
3.5 Air Pollution Prevention Practice

On May 19, 2005, Annex VI of MARPOL, the Regulations for the Preven-
tion of air Pollution from Ships, came into force. This law recognizes that
tankers contribute to atmospheric pollution, while carrying out normal
operations. The gases that cause this pollution are hydrocarbon vapors
and inert gas, and the main activities that contribute to pollution are:
• The breathing or venting of loaded tanks
• Purging or gas freeing operations
• Loading cargo tanks
When the vessel is at sea, no action is taken against this form of pollution,
though it must be borne in mind when purging inert tanks to stand to
windward and not to breathe in the fumes that exit the tank as this could
asphyxiate a person. However, some ports now have regulations that pro-
hibit the discharge of vapors and inert gas into the atmosphere. This is espe-
cially true in the United States where some ports are using local regulations
to prohibit discharge of fumes and that country’s Clean Air Act restricts or
prohibits the emission of gases into the atmosphere. Similarly, there is one
berth at the Shell terminal in Sydney which prohibits the discharge of vapors
or gases into the atmosphere. These regulations are generally implemented
in ports where the tanker terminal is in a heavily populated area. Such
regulations appear to be increasingly applied by port authorities around
the world.
A vapor line to the ship may also be provided through which all the
gases are discharged to the terminal for treatment, before venting to the
atmosphere. This vapor line must be fitted with a manually operated isola-
tion valve with a visible means of ascertaining whether the valve is opened or
closed. The vapor line should be distinctly marked.
3.6 Oil Pollution Prevention Practice

After discharge of petroleum products, or if it is necessary to enter cargo
tanks, oil tankers are required to be cleaned. MARPOL recognized that this
was the major source of oil pollution from ships and has placed limitations on
where and how oily mixtures can be discharged into the sea. Consequently,
oil tankers must now wash their tanks internally, with the washings being
transferred either to another cargo or slop tank or to a shore reception
facility.
Slop tanks are normally filled with salt water to be used for washing, and
this water is circulated around the tank wash heads to clean the tanks. The
oily residues float on the top of the water in the slop tank, thereby allowing
clean water to be drawn from the bottom of the tank. After washing, the
water that remains in the slop tank may be discharged overboard, providing
a number of conditions are met. The tank must be left for a minimum of 12 h
to allow the water and oil to stratify, leaving the oil floating on the water.
The tank is dipped using an interface detector that allows the amount of oil
in the tank to be determined. Once the amount of water to be pumped out
has been determined the oil content metering system is put into service.
MARPOL places the following limitations on the discharge of oily
residues (Curtis, 1984):
• The ship is not in a special area
• The ship is >50 nautical miles from the nearest coast
• The ship is proceeding en-route
• The instantaneous rate of discharge does not exceed 30 L per
nautical mile
• The total amount of oil discharged into the sea should not be more than
1/30,000 of the full amount of the cargo from which the residues have
been produced.
The discharge of the residues must be done via an overboard discharge that
is above the ship’s loaded waterline. This is to be monitored throughout
the decanting operation, and the pumps stopped if the discharge shows signs
of oil. If the discharge exceeds the limits mentioned earlier, then the system
will alarm and automatically switch into recirculate mode where the con-
tents of the slops tanks are returned, therefore stopping the discharge into
the sea.
IMO have designated so-called special areas where the discharge of oily
residues are prohibited due to their ecological significance or limited water
flow. These are always being reviewed and updated as IMO identifies more
areas requiring special attention. Currently these areas are Mediterranean
Sea, Baltic Sea, Red Sea, Gulfs Area, Gulf of Aden, Antarctic Area, North
West European Waters, and Oman Sea.
In a local (Australia) context the Great Barrier Reef has been designated
a particularly sensitive sea area (PSSA) where any discharge is prohibited.
In addition, the outer base line of the reef is classed as “nearest land,” so
consequently any distances measured to comply with pollution require-
ments must be made from this line. The Australian Government has also
applied to IMO to have Torres Strait afforded the same classification. Tanker
ships of more than 150 gross tonnage are required to carry an on-board oil
pollution emergency plan.
4. SAFETY MANAGEMENT STRATEGIES

This section includes identification and management of marine pro-
cess safety as a key area in offshore process engineering projects. Discussion
on process safety implementation in offshore operations and risk manage-
ment strategies in offshore and shipping operations are included.
4.1 The Implementation of Process Safety in Offshore

Operations
In 1992, the PSM of highly hazardous chemicals, which applied to the
onshore process industries, was promulgated and administered by the Occu-
pational Safety & Health Administration (OSHA). In response to the effects
of the Piper Alpha catastrophe of 1988, Recommended Practice 75 was
published by the American Petroleum Institute (API) (Pate-Cornell,
1993). It appealed to offshore operators to prepare and implementing a
safety and environmental management program (SEMP). Later on in
2010, in response to the Deepwater Horizon disaster, SEMP made a legal
requirement, known as the safety and environmental management systems
(SEMS) (Visser, 2011).
Both SEMP and SEMS use a set of management elements very similar to
those from OSHA (Sutton, 2014).
1. Safety and environmental information
2. Hazards analysis
3. Operating procedures
4. Training
5. Prestart-up review
6. Assurance of quality and mechanical integrity of equipment
7. Safe work practices
8. Management of change
9. Investigation of incidents
10. Emergency response and control
11. Audit of safety and environmental management program elements
12. Records and documentation
4.2 Risk Management Strategies in Offshore and Shipping

Operations
To manage the risk during marine operations, in addition to those men-
tioned in the previous section, the following strategies should be studied.
4.2.1 Operational Feasibility Assessments

All marine operations shall be confirmed to be feasible. It is important to
document operational feasibility at an early project stage in order to avoid
extra costs due to reinforcements, change of vessels or equipment, or change
of marine operations’ concept at a late stage. It is also important to identify
and highlight potentially critical activities at an early stage. All objects shall
be designed with due consideration to the forthcoming marine operations.
The objects shall be designed to resist loads characteristics and conditions,
but more realistically, to handle marine operations.
4.2.2 Document Verification

Document verification is essential as a quality assurance element in marine
operations. The purpose of such verification is to avoid design or planning
errors that may lead to disastrous marine operations. All main operational
procedures shall be subject to verification. Engineering documentation
and drawings shall be verified as agreed between the client and the verifier
based on the master document register (MDR) for the project.
4.2.3 Familiarization
All personnel involved in the execution of marine operations shall be familiar
with the operation. Thorough familiarization of personnel is a key issue to suc-
cessful marine operations. It is essential that all involved personnel have an
in-depth understanding of their work tasks, authority, and responsibility before
and during the operations. This shall also involve all vessels’ marine crew.
4.2.4 Personnel Safety Plans

The preparation of safety plans applies to marine operations and work on
vessels, objects, platforms, or part thereof where personnel are involved.
The purpose of preparing personnel safety plans, defining escape routes
and safe access, is to ensure and verify safe access at all times for personnel
working on vessels, objects, platforms, or parts thereof.
4.2.5 Emergency Preparedness

Emergency preparedness systems are necessary to minimize time and ensure
an effective and appropriate response in the event of an incident or accident.
All offshore operations must have an emergency system that covers all vessels
and personnel involved. Normally various companies involved in marine
operations have their own individual emergency preparedness system. These
systems shall be linked by an emergency preparedness-bridging document.
4.2.6 Marine Readiness Verification

Marine readiness verifications (MRVs) apply for all marine operations. Typ-
ical purposes for MRVs are to verify:
A. readiness for the planned marine operations including all involved
parties (i.e., company, contractors, subcontractors, etc.)
B. that risks associated with the marine operations are identified and man-
aged during the operations
C. that the marine operations are well planned, understood by personnel
involved, and will be undertaken in a safe and effective manner
D. that adequate emergency preparedness can be implemented during the
operations
E. a simplified MRV performed as part of a mobilization, where the
following items are particularly relevant:
a. check that all actions from HAZOPs, etc., are closed.
b. check that all check-list/punch-list actions are properly managed or
closed.
4.2.7 Inspection and Testing

The main purpose of testing is to verify the expected usefulness and capacity
of systems and equipment. Another purpose is to make the operators familiar
with the system or equipment. All necessary systems and equipment should
be thoroughly inspected and tested prior to commencing maritime
operations.
4.2.8 Survey of Vessels

Survey of vessels is primarily performed by on/off-hire surveyors to docu-
ment the suitability for the intended use. Being a basis for claims in the case
of damage and to determine consumption of fuel, lubes, and water, etc., the
condition before and after use may be assessed. All vessels having a key role
shall be surveyed before start of a marine operation.
4.2.9 Toolbox Talk

A toolbox talk focuses on safety issues associated with the workplace vulner-
abilities and safe work practices through an informal safety meeting.
Generally, meetings are conducted prior to the beginning of a job/shift. This

meeting is normally very short in duration; however, it is an effective tech-
nique for updating the worker’s knowledge and exchanging information on
safety checks at the last minute. Mostly toolbox talks are delivered by the
operators to make sure all relevant actions are completely understood and
the task performed without any incidents. Toolbox talks are applicable to
all marine activities and should be performed before commencement of such
activities (Walker, Sunderland, Fraser, & Peuscher, 2012).
4.2.10 Survey of Operations

Survey of the preparations for the operations, including the current weather
conditions and forecast, is an essential part of the verification of the opera-
tions. It should be confirmed that all outstanding actions and items have been
adequately addressed and closed before start of the operation. Survey of
operations is normally performed by a surveyor to check that all approved
procedures are strictly adhered to during the operations. For medium- and
high-risk operations, an independent marine surveyor is required.
5. CONCLUSIONS
Maritime transport is still the dominant mode of transport for various
goods including commodities such as oil and gas. Hence, the safety regula-
tions are very important for the reputation of the oil and gas tanker industry.
IMO has been making steady and significant progress in implementing
various safety standards. Nowadays the International Safety Guide for Oil
Tankers and Terminals (ISGOTT) is extensively known as a standard work
reference on safe oil tanker and terminal operations. As oil and gas are
volatile and toxic, different risk factors exist during the marine operation.
In addition to current safety practice, this chapter provides measures to
mitigate various risk factors. For its sustainable growth, the industry needs
to be proactive to minimize undetectable accident events.
REFERENCES
Albert Embankment. (2002). Guidelines for formal safety assessment (FSA) for use in the IMO rule-
making process. MSC/Circ 1023.
Bhattacharya, S. (2009). Impact of the ISM code on the management of occupational health and safety
in the maritime industry. United Kingdom: Cardiff University.
Curtis, J. B. (1984). Vessel-source oil pollution and MARPOL 73/78: An international suc-
cess story. Environmental Law, 15, 679–710.
Garcı́a-Borboroglu, P., Boersma, P., Reyes, L., & Skewgar, E. (2008). Petroleum pollution
and penguins: Marine conservation tools to reduce the problem. In Marine pollution:
New research (pp. 339–356). New York: Nova Science Publishers.
Giardina, M., & Morale, M. (2015). Safety study of an LNG regasification plant using an
FMECA and HAZOP integrated methodology. Journal of Loss Prevention in the Process
Industries, 35, 35–45.
Gibson, N. (1997). Static electricity—An industrial hazard under control? Journal of
Electrostatics, 40, 21–30.
Hirst, W., & Eyre, J. (1983). Maplin sands experiments 1980: Combustion of large LNG and
refrigerated liquid propane spills on the sea. In Heavy gas and risk assessment—II
(pp. 211–224): Springer.
Information Resources Management Association. (2015). Transportation systems and engineer-
ing: Concepts, methodologies, tools, and applications. USA: IGI Global.
Islam, R., Khan, F. I., Abbassi, R., & Garaniya, V. (2018). Human error probability assess-
ment during maintenance activities of marine systems. Safety and Health at Work, 9(1),
42–52. https://doi.org/10.1016/j.shaw.2017.06.008.
Kuo, C. (2007). Safety management and its maritime application. United Kingdom: Nautical
Institute.
Lloyd, G. (2007). Rules for classification and construction, V—Analysis techniques, Part 1 Strength
and stability, Chapter 1—Guidelines for strength analyses for ship structures with the finite element
method, Section 2—Global strength analysis for containership structures. Hamburg, Germany. .
Luoma, E. (2009). Oil spills and safety legislation. Finland: Publications from the Centre for
Maritime Studies, University of Turku.
McCain, W. D. (1990). The properties of petroleum fluids. USA: PennWell Books.
McGuire, G., & White, B. (2000). Liquefied gas handling principles on ships and in terminals.
United Kingdom: Witherby & Co Ltd.
Natskår, A., Moan, T., & Alvær, P. Ø. (2015). Uncertainty in forecasted environmental
conditions for reliability analyses of marine operations. Ocean Engineering, 108, 636–647.
Okana, K. (2008). In STCW convention’s certification provisions for safety and emergency response
training: Analysis of apparent ambiguities IMLA 16 proceedings. Izmir, Turkey: Dokuz Eylul
Publications.
Ornitz, B., & Champ, M. (2002). Oil spills first principles: Prevention and best response. United
Kingdom: Elsevier.
Pate-Cornell, M. E. (1993). Learning from the piper alpha accident: A postmortem analysis of
technical and organizational factors. Risk Analysis, 13, 215–232.
Seyr, H., & Muskulus, M. (2016). Safety indicators for the marine operations in the instal-
lation and operating phase of an offshore wind farm. Energy Procedia, 94, 72–81.
Shukla, T., & Shah, P. D. (2011). In Comparative study between PHA (process hazard analysis)
evaluation techniques for chemical process industries Nirma University international conference on
engineering. Ahmedabad, India: Institute of Technology, Nirma University.
Stenman, C. (2005). The development of the MARPOL and EU regulations to phase out single
hulled oil tankers pp. 1–45. Sweden: School of Economics and Commercial Law,
Goteborg University.
Sutton, I. (2014). Process risk and reliability management. United Kingdom: Gulf Professional
Publishing.
Ventikos, N. P., & Psaraftis, H. N. (2004). Spill accident modeling: A critical survey of
the event-decision network in the context of IMO’s formal safety assessment. Journal
of Hazardous Materials, 107, 59–66.
Veritas, N. (2003). Risk management in marine-and subsea operations. Norway: Det Norske
Veritas.
Visser, R. C. (2011). In Offshore accidents, regulations and industry standards SPE Western North
American region meeting (pp. 1–9). Alaska: Society of Petroleum Engineers.
Walker, K., Sunderland, J., Fraser, S., & Peuscher, W. (2012). In Oil and Gas Producers
Association (OGP) life-saving rules International conference on health, safety and environment
in oil and gas exploration and production. Perth, Australia: Society of Petroleum Engineers.
Wickens, C., & Huey, B. M. (1993). Workload transition: Implications for individual and
team performance. United States: National Academies Press.
ARTICLE IN PRESS
Safety During Offshore Drilling

Operation
Khaled ALNabhani1
Centre for Risk, Integrity and Safety Engineering (C-RISE), Faculty of Engineering and Applied Science,
1
Corresponding author: e-mail addresses: khaledalnabhani@yahoo.com; ksnan2@yahoo.com
Contents
1. Introduction 1
2. Classification of Offshore Drilling Rigs 2
2.1 Bottom Support Rigs 3
2.2 Floating Rigs 4
3. General Procedures of Offshore Well-Drilling Operations 5
4. A Hypothetical Scenario Simulates Real and Safe Offshore Drilling Operation 8
4.1 Oman-1 Hypothetical Exploration Well 9
5. Common HSE Risk Assessment and Management System Adopted in Offshore
Drilling Operations 25
5.1 HSE Training Matrix 26
5.2 Emergency Responses Plans and Safety Drills 26
5.3 HSE Risk Assessment Matrix 29
6. Discussions 30
6.1 The World’s Most Catastrophic Offshore Drilling Operation Disasters 43
6.2 Common-Reported Occupational Accidents During Offshore Drilling
Operation 50
7. Quantitative Risk Assessment and Dynamic Accident Modeling Using SMART
Approach 50
7.1 The Working Principle of Dynamic Accident Modeling and Quantitative Risk
Assessment Using the SMART Approach 59
8. Conclusion 60
References 61
1. INTRODUCTION
Offshore drilling operations are dangerous and risky operations. Fatal
accidents, eloquent injuries, the loss of assets, and damage to the environment
are results of risks associated with offshore drilling operation that negatively
#
Methods in Chemical Process Safety 2018 Elsevier Inc. 1
ARTICLE IN PRESS
2 Khaled ALNabhani
influence the reputation of this industry. Despite all the efforts made by the
stakeholders in the oil and gas industry to prevent the occurrence of accidents
but have failed to eliminate the probability of operational or occupational
accidents occurring. The resulting impacts of these accidents pose a major
threat to the future of oil and gas industry due to the potential social, eco-
nomic, and environmental consequences associated with.
Reaching the primary goal of achieving better standards of occupa-
tional health, safety, and environmental protection will be developed by
strengthening safety measures with substantial better understanding of safe
operational procedures by following recommended safe operational guide-
lines. In view of developing a safe operational guideline and safety processes
to promote safety in the offshore well-drilling operations, it is very impor-
tant to get a good understanding of offshore drilling operations and learn
from past accident and develop a dynamic integrated safe system able to
update any change or deviation from the main system and its subsystem
components. Thus one of the fundamental objectives of this chapter is to scru-
tinize the sequence of the drilling operation that is backed up by a hypothetical
scenario regarding the existing offshore well-drilling operations. This scenario
will also examine various aspects of the operation that portray the typical prac-
tices used globally during the offshore oil and gas drilling operations and to
accurately depict an actual oil well-drilling process in view of unveiling the
necessary methods of carrying out a safer operational process. Although, off-
shore drilling operations are commonly similar in terms of the applied methods
but there might be variances depending on the characteristics of the oil well,
field, the type of drilling rig, formation type, geological features, operational
modification or deviation from the processes, technical specifications, rep-
lanning identified projects, or operations based on the contractual terms that
define the general operations such as well-trajectory changes.
2. CLASSIFICATION OF OFFSHORE DRILLING RIGS

The design of offshore drilling rigs takes in consideration two impor-
tant features which are portability and the maximum water depths in which
they are being used as shown in Fig. 1.
Usually, offshore drilling rigs used in the oil and gas industry are the
rotary offshore drilling rigs that consist of six in-built systems as stated below:
1. Power system
2. Hoisting system
3. Rotary system
ARTICLE IN PRESS
Safety During Offshore Drilling Operation 3
Fig. 1 Offshore drilling operations.
4. Drilling fluid circulating system

5. Well-control system and
6. Well-monitoring system
Accordingly, offshore drilling rigs used in the oil and gas industry fall under
two categories.
2.1 Bottom Support Rigs

1. Drilling barge: Is a barge where a complete drilling rig unit is fitted or con-
structed on it. Drilling barges are also called Mobile Offshore Drilling
Unit (MODU), which is moved to different locations using a tugboat.
Usually, drilling barrages are not designed to operate in deep seas, but
they are designed to drill on shallow waters with depth about 50 ft like
inland lakes and rivers.
2. Jack-up rigs: The Jack-up drilling rigs are the most common offshore
bottom-supported drilling rigs that are classified as a MODU. The fea-
tures of Jack-up drilling rigs are similar to the drilling barge rigs, which
ARTICLE IN PRESS
4 Khaled ALNabhani
are built on a floating body structure. The dimensions of the structure

play important role for the drilling rig to be moved from one location
to another with a tugboat. The Jack-up drilling rigs can be fitted with
varying lengths of leg support suitable for different offshore depths
and the process of installing a jack-up rig involves raising the rig above
water level on hydraulic legs that extend as far as the sea floor for balance.
The Jack-up drilling rigs are designed to operate in an open water and are
suitable to be used in shallow waters, and moderate waters with depths
are low as 450 ft.
3. Platform rigs: This type of drilling rigs is designed and built on a fixed plat-
forms that are permanently installed and are left there even after drilling
activities are over due to the fact that the cost of moving these platforms
or dismantling the rig is very costly. Therefore, rigs are left in the plat-
form after completing drilling operation and used later for any work over
activities.
2.2 Floating Rigs

1. Submersible rigs: The submersible rigs have similar properties to the drilling
barges; they are engineered for use in the open ocean waters that have
relatively shallow depths. Some features of the rig include a structure
supported by huge buoyant devices that are submerged and flooded. They
offer support during a drilling process by resting on the seafloor. When
the work is complete, the water is then pumped out of the buoyant devices
to restore the buoyancy of the vessel that is drawn to a different location.
This rig is classified as a MODU.
2. Semisubmersible rig: The semisubmersible drilling rigs are the most pop-
ular type of offshore floating drilling rigs. They are used for deep sea dril-
ling with depths of more than 6000 ft. They are moved between multiple
locations using their in-built engines; these rigs are classified as MODU.
When in use, the pontoons of this rig become partially flooded. They are
posted at locations by mooring lines that have been attached to the sea-
floor anchors or by the flexible propellers (thrusters); they are rotated to
keep the vessel stationary dynamically over the hole (this is referred to as
dynamically positioned).
3. Drillships: The drillships are larger ships that have been built for offshore
drilling operations in deepwater operations of depths as much as 13,000 ft.
They are built on traditional ship structure and moved between locations
by their engines. The drillships are not designed for use in turbulent waters
ARTICLE IN PRESS
like the semisubmersibles, but they have the advantage of a larger storage
capacity. The drillships are cheaper than the semisubmersibles, the modern
designs use the dynamic positioning system to remain positions over the
drilling site, this system adds to the high cost of the drillship. They are
adequate for drilling operations over long periods without the need for
logistic support because of their large size and bigger storage space. Drillships
move faster between locations than the semisubmersibles because of their
own engines. They are classified as Mobile.
3. GENERAL PROCEDURES OF OFFSHORE

WELL-DRILLING OPERATIONS
The offshore drilling operations in the oil and gas sector are done in
accordance with a set of steps that make up the entire process. The first step
in this process is drilling a large diameter hole; this is followed by running a
large diameter casing, which is called a conductor. As drilling progress
downward, there will be an increase in the downhole pressure, while this
takes place smaller holes are progressively drilled. The next step in this pro-
cess is the installation of smaller and stronger casings at the previous casing
shoe point. In the event of the casing extending back to the surface, it will be
referred to as liners. The liners are designed with the purpose of fortifying
the well. In line with this occurrence, it should be noted that each well has an
independent well design, different from the rest. This variation occurs as a
result of different criteria. During the process of drilling from a platform or in
drilling activities that involve the use of a jack-up rig, a conductor pipe is
installed. The conduction pipe is securely set on the seabed to permit a
circulation of the drilling fluid that is responsible for removing the cuttings.
These drilling processes also include the installation of blowout preventers
(BOPs) below the drilling rig to prevent any kicks during the drilling
process.
Spudding is one of the initial processes during a drilling process. Offshore
deepwater wells are spudded prior to the installation of a riser and then a
combined of seawater and sweeps are employed to drill the top hole section.
To achieve the most effective deepwater well designs, the first casing string is
positioned at a shallow depth that ensures the formation has an adequate
mechanical strength to prevent a collapse of the formation. This action also
fortifies the formation against the pressure that will be generated in the next
(deeper) interval. There is a limit to the number of casing strings that can be
applied in a well, and for this reason, the riserless drilling process which is
ARTICLE IN PRESS
6 Khaled ALNabhani
water based and uses weight drilling fluids is used to drill to a depth at which
the formations have the required strength, this process consequently causes
the discharge of weighted water-based mud in large volumes on the seafloor.
Drawing from insights in this field over the past decades has resulted in
the development of mechanical subsea systems that facilitate deepwater
riserless drilling with weighted mud permit the application of a dual-gradient
hydrostatic pressure.
The BOP and riser are installed on the wellhead system at the seafloor once
the section at the top of the hole is drilled. The primitive function of the drilling
riser is to calculate the drilling fluid (also referred to as the drilling mud) to expel
the cuttings. The wellhead system is run, while it is connected to the first string
of casing that has been fitted inside a conductor casing. Conductor casing is
commonly conducted as “riserless drilling,” without a riser connection hence
the fluid and cuttings are deposited directly on the seafloor.
In the process of drilling, the drilling bit (of an ideal size and specifications
referred as bit optimization) is rotated to penetrate certain geological forma-
tions mechanically or hydraulically or with the use of a downhole motor.
The hole is drilled into the subsurface formations using high-pressure drilling
fluid (mud) that is circulated down through the bottom-hole assembly
(BHA) to the bit nozzles. While circulating downward, drilling fluid (mud)
lifts the drilling cuttings upward through the casing annulus. The circulation
system of the drilling fluid starts at the mud tank, which holds a large volume
of mixed drilling fluid. The mud pumps used to draw the drilling fluid from
these tanks and pumps, the drilling mud back at a high pressure inside the
BHA to the drilling bit. This also generates hydraulic power to rotate the
bit through roller bearings inside the bit and penetrate geological formations
and circulate back the drill cuttings to the surface. Drilling mud also used to
cool down the drilling bit. This is the reason why pit optimization is crucial
to increasing the rate of penetration during a drilling process. The fluid and
drill cuttings channeled to the surface are separated at the surface by the
vibrating shale shakers. The shale shakers are fitted with fine screens of var-
ious microns that expedite the removal of drill cuttings from the drilling
fluid. The fluid is further processed by passing it through a degasser to elim-
inate gas; supplemental solids contained in it are separated with the use of
desanders, desilters, and centrifuges. Also, the drilling fluid is chemically
treated to retain the important properties that make it reusable. Currently,
the offshore drilling industry is delineated by common practices of waste
management deposal and management, which are employed depending
on the regulatory permits that apply and cost cuttings plans. In these
ARTICLE IN PRESS
processes, the drill cuttings may be discharged on the ocean water, or

retrieved and sent to land for disposal or converted into slurry if they are
found to containing radioactive hazardous materials that used to be
reinjected for hydraulic fracturing activities or for enhanced oil recovery
applications. Therefore, it is imperative to develop a clear system that con-
trols fluid management efficiently and ensures peculiar treatment because of
the high costs of the drilling fluid; this risk associated with it; and limitation of
storage capacity in drilling units.
The planning stages of a drilling process involve the evaluation and
design of the well’s depth interval; the results will determine the need for
a reevaluation and modification during the wellbore drilling and construc-
tion processes. This is a common practice in the case of an exploration well
due to a lack of correlated information in the new field. Factors such as the
length of each interval, the density of drilling fluid, the drilling BHA design,
the casting design, the type and quantity of cement that will be used, the
type of drilling fluid to be used, and many other considerations are decided
based on the magnitude of surface pressure anticipated, operational problems
encountered during drilling, formation evaluation results, and other drilling
parameters. Other determinants used in making these decisions include the
limitation of selected equipment, well cost optimization, the actual wellbore,
reservoir conditions, etc.
There are a variety of techniques used in the identification of potentially
promising formations or sometimes referred to as the pay zone within the
geological formations being drilled. The most basic techniques are mud log-
ging, well logging, and coring. Mud logging and coring processes for
instance involve the evaluation of drill cuttings and formation samples that
are collected during drilling process to determine the formation type and the
presence of hydrocarbons. Moreover, the sophisticated techniques referred
to as well logging or measurement, while drilling involves the use of special
electronic tools and sensors. These techniques are run either in the drill string
or on a wire line commonly at selected casing points. The aim of this process
is to evaluate the key rock and formation properties using spectral gamma
logs, porosity, resistivity, neutron logs, and other geochemical sensors. These
techniques could also be used to investigate the integrity of cement work
done for casing such as the cement bond logs (CBLs).
The establishment of well control is achieved by creating barriers to pre-
vent unexpected influxes of formation fluids into the wellbore that usually
known as a well kick. They are referred to as safety barriers. A drilling fluid
of sufficient density is used to generate the preeminent safety barrier; this
ARTICLE IN PRESS
8 Khaled ALNabhani
produces a hydrostatic pressure that restricts the influx of subsurface forma-

tion pressure. Radically, the density of drilling has varying properties that
range between light mud such as seawater or to heavy mud, which is in accor-
dance with the formation and wellbore conditions. It is vital to have in mind
that if the density of the drilling fluid is too high or the exposed formations
are too weak, it might result in the existence of fractures. This situation could
potentially hinder the circulation of drilling fluid. Consequently, it might lead
to a kink or a considerable damage to the formation.
Accordingly, the pay zone form the wire line logging will be identified
and subsequently perforated. Then based on the collected data from logging
and conditions of the reservoir, it may be fractured hydraulically and stim-
ulated using acids to enhance the production. Finally, based on certain com-
pletion program, the drilled well is completed in two phases called upper
and lower completion. The upper completion is made up of the production
tubing from the production tree to the subsurface safety valve and the pro-
duction tubing that connects with the production packer that is installed in
the production liner. The lower completion is made up of the gravel-pack
packer, sand control screens, and a lower sump packer. These parts are all
connected by the production tubing. Finally, the completion of the well
involves the installation of a production tree sitting on the seafloor that can
be either vertical or horizontal, electric or hydraulic.
4. A HYPOTHETICAL SCENARIO SIMULATES REAL

AND SAFE OFFSHORE DRILLING OPERATION
The Arabian Peninsula is one of the wealthiest regions in the world
in terms of wealth generated from oil. This region controls the largest
and most productive oil and gas fields in the world. For instance, the Ghawar
onshore field in Saudi Arabia is considered as the largest field in the world
(Sorkhab, 2007). Its dimensions are almost 280 km in length and it has a
width of 30 km. This oil field produces an estimated 6.25% of the world’s
oil (Sorkhab, 2007). The Arabian Peninsula regions are known to have
relatively similar geological formations, hence the oil and gas can be found
existing together in both the onshore and offshore fields. Worth mentioning
that, Sultanate of Oman own a very strategic geographical location in the
Arabian Peninsula with a coastline of 3165 km formed between the Arabian
Sea on the southeast and the Gulf of Oman connects with the Indian Ocean
at the northeast (International Business Publications, 2009). Oman’s strategic
geographic location increases the likelihood of Oman owning one of the
ARTICLE IN PRESS
largest oil and gas reservoirs in the region. This accomplishment will be deter-
mined by the outcome of ongoing explorations. Since, Oman is considered
as one of the preeminent countries that have successfully achieved the highest
standards of occupational health, safety, and environmental protection in rela-
tion to safe oil and gas drilling operations. Accordingly, a hypothetical scenario
was developed from Oman that simulates the operations of actual offshore
drilling explorations and exhibits a safe drilling operation presented here, so
that it can be used as an important reference for future academic studies or
as an important standard for the oil and gas industry.
4.1 Oman-1 Hypothetical Exploration Well1

4.1.1 Well Objective
The hypothetical scenario for drilling an offshore exploration well known as
Oman-1 and is scheduled to be drilled in block November 18 in the north-
east of Oman (Fig. 2). The Jack-up drilling rig will be used for this project
because of its capacity to drill in shallow waters in depths up to 400 ft. The
proposed duration for this project is 100 days as shown in Table 1.
The primary objective of the well is to facilitate the exploration of poten-
tial zones, where hydrocarbon reserves are suspected to exist in the Arab res-
ervoir. This is in accordance with the initial interpretation of the seismic
surveys conducted in 2015. The primary objective of Oman-1 is to use
source rock and secondary formations to explore the potential extension
of pay zones and to produce hydrocarbon by fracking the tight reservoir.
This will be done by drilling a vertical pilot hole to a depth of 12,000 ft then
to drill horizontally to a depth of 16,000 ft. The secondary objective of this
project is to collect geological data stored in reservoir rocks at vertical depths
of 6000 and 12,000 ft and at horizontal section of 12,000–16,000 ft, where
fracking horizontal section and kick point are planned to be at 137.3 degree to
enhance hydrocarbon production. This information will aid the future activ-
ities aimed at developing the fields in block November 18. Processes such as
mud logging, coring, and wire line logging proposed to be used to evaluate
the well. Finally, well will be completed according to the updated completion
program based on collected data.
In the course of drilling exploration well Oman-1 activity, only two sup-
ply and logistics vessels will be used to transport catering provisions, supplies,
casing/tubing, drilling, tools fuel, fresh water, mud, and chemicals, and
1
Geological formations and depths assumed in this hypothetical scenario may resemble or slightly differ
from one location to another due to geological faults.
ARTICLE IN PRESS
10 Khaled ALNabhani
Fig. 2 Oman-1 well schematic.
Table 1 Oman-1 Well Time Breakdown vs Depth

Hole Depth Accumulated
Section (in.) (TD/MD) (ft) Interval (ft) Casing (in.) Time (Days)
42 500 0–500 vertical 36 10
17½ 3800 500–3800 vertical 13⅜ CSG 27
12¼ 8000 3800–8000 vertical 9⅝ CSG 40
8½ 12,000 8000–12,000 vertical 7 LNR 60
6 16,000 12,000–16,000 horizontal 4½ LNR 100
ARTICLE IN PRESS
cementing materials to the drilling rig. Supply vessels will also be deployed to
transport used hazardous waste materials from the drilling rig in block
November 18 to Duqum disposal facility for onshore disposal. The drilling
unit will be fully operational at the well location, a temporary 500 m radius as
a statutory safety zone will be created around the drilling unit, and this means
no vessels will be permitted to enter this area with the exception of the dril-
ling units support vessels. For this purpose, the ports—Sultan Qaboos port,
Duqum port, and Sohar port—have been proposed to be used as the logistic
base for the mobilization of drilling vessels and equipment. Morever, a heli-
copter will be used to transport to facilitate crew change and to transport
visitors between the coast and the rig. For this purpose, a medium range heli-
copter will be exclusively made available for the duration of the drilling
activity to facilitate crew mobility using Muscat International Airport, Sohar
Airport, and Duqum Airport.
4.1.2 Well Plan

The hypothetical exploration well Oman-1 is planned to be drilled in
100 days as per below time breakdown vs depth.
Drilling operation program summary for well Oman-1
1. Drill top hole section to total depth (TD) 500 ft measured depth (MD)
2. Run and cement 3600 casing
3. Install 3000 diverter
4. Run 17½00 BHA and drill surface hole section to 3800 ft MD
5. Run and cement 13⅜00 surface casing (two cement stages)
6. Install 13⅜00 casing head housing (CHH)
7. Run 12¼00 BHA to drill intermediate hole section to 8000 ft MD
8. Run open hole logs
9. Run and cement 9⅝00 production casing (two-stage cement)
10. Install 13⅜00 well head-10 k BOP
11. Pull out of hole BHA and run coring tools
12. Plug and abandon 8½00 open hole
13. Kick off plug and sidetrack
14. Run directional 8½00 BHA to drill-targeted formation at TD 12,000 ft MD
15. Run and cement 700 liner
16. Run directional 600 BHA to drill to reservoir at TD 16,000 ft MD
17. Run open hole logs
18. Run and cement 4½00 liner
19. Complete the well according to completion program
ARTICLE IN PRESS
12 Khaled ALNabhani
4.1.3 General Prespud Checklist

It is imperative that a prespud checklist is done on wells that have been mar-
ked to be drilled. The essence of this check is to ensure that all the conditions
to ensure the success of spudding is in place and drilling can be commenced.
These precheck processes are aimed at promoting a safe and economical dril-
ling processes as per the plan. Errors while drilling are not accepted because
they could potentially result in huge losses due to high daily rig rate as well as
cause production delay that will hinder the plans for daily oil production
from the wells, which is usually estimated at 30,000–80,000 barrels daily
depending on the reservoir. The below prespud checklist is proposed for
the exploration well (Oman-1) and can be used as an example of a typical
and systematical checklist. This checklist reminds drilling crew about impor-
tant steps required for a safe and economical drilling operations, which includes
but is not limited to:
1. Organize a prespud meeting with the entire workforce who has a role
to play in the well construction.
2. Confirm that all communication equipment and backups are fully
functional.
3. Determine the turbidity of the seawater.
4. Carry out a comprehensive rig acceptance testing and confirm the
functionality of other equipment on the checklist.
5. The drilling contractor should inform the operating company that all the
precheck conditions are done at least 24 h before the scheduled spudding.
6. A proper inspection of every item in the drilling rig should be done to
ascertain rig acceptance.
7. Inspect all sensors; calibration gages then proceed to complete the docu-
mentation for the entire process. Copies of the documentation should be
sent to the operating company before the commencement of spudding.
8. Inspect the supplied Barite and cement onboard to ensure that it is ade-
quate for the process. Arrangements must be made for an extra 50 tons
of these products as back up.
9. Inspect the materials provided for the initial top hole sections to ensure
the quantity at the rig is sufficient.
10. Create an inventory to access the drill pipes, heavyweight drill pipes,
drill collars, lifting subs, elevators, tongs, safety clamps, and slips, cross-
overs, BOP and fishing tools before the commencement of spudding
and are up to the prescribed industry standard.
11. Inspect the liners installed on the mud pumps liners stock and the relief
valves on mud pumps (set at 90% of pressure rating capacity).
ARTICLE IN PRESS
12. Ensure that the trip tank has been adequately calibrated and that all
lines, pumps, and related equipments are ready to be switched when
necessary.
13. Organize a prephase meeting, which should include the entire team
involved in the drilling process for the first top hole section.
14. Ensure that there is a prejob safety meeting (PJSM) organized before
any operation while drilling Oman-1.
15. Conduct a visual inspection of the conductor casing.
16. Inspect the wellhead equipment to ensure they are up to the standards
of the well specification. This inspection will also ascertain that they
are at the location.
17. Verify the positioning of the rig. This assessment should be profession-
ally vetted.
18. Obtain the approval from the operating company prior to well spudding.
4.1.4 Drilling 4200 Top Hole Section

4.1.4.1 Objective
The primary aim of drilling, the 4200 top hole section is to enable the posi-
tioning of a 3600 conductor to fortify the upper section. It is also meant to
prevent any occurrence of formation washout, improve stability of the well
against ocean waves, and it provides a topside support for the planned
platform.
4.1.4.2 Operation Summary

The process of drilling a 4200 -conductor hole will involve the use of a
3600 -mill tooth bit and a 4200 underreamer. The depth of the section TD
is 500 ft. Drilling of the vertical hole is done across the Aruma formation
groups, which are predominantly layers of dolomite, limestone, gypsum,
and claystone. The next phase is the expansion of the hole to 4200 at a landing
depth of 3600 casing, this is done with the underreamer. Finally, the 3400 bit is
applied through the surface to the section TD, the essence of this process is to
make sure that the hole is clean and smooth enough to accommodate the
3600 conductor casing. A cement stringer will be used to cement the conduc-
tor at designated points on the seabed. There is usually no trace of shallow gas
or hydrocarbons at this bearing formation, which occur in the surface hole
section, however, as a safety measure, it is recommended that a diverter is
installed. This diverter will be used also during the drilling of the next surface
hole section, hence a 3000 diverter which is suitable for the 17½00 BHA
surface hole section is installed.
ARTICLE IN PRESS
14 Khaled ALNabhani
Operational risks expected while drilling 4200 hole section

1. Excessive shocks and vibrations, which could cause accidents and inju-
ries due to dropping objects. In the event of this problem encountered
during drilling, a mud motor and a shock sub in BHA will be deployed.
The recommendations are to drill using controlled parameters (reduces
the RPM and increases the WOB, avoids neutral points in the shock sub,
and maximizes the application of soft torque). It is also imperative to
avoid running sensitive tools or BHA components that are known to
be vulnerable to shock and vibrations.
2. Spillage cement on the seabed. If the divers and cameras used at the loca-
tion indicate that cement has been spotted on the seabed, the pumping of
cement should be immediately stopped. The spacer will be mixed with a
dye to see any cement returns in the sea floor. The areas where cement
had been spotted should be properly cleaned.
Recommended safe drilling procedures
1. Hold PJSM. Discuss job data, procedures, contingency plans, safety,
environment, communication means, and assign responsibilities among
crew members.
2. Keep BHA for drilling 4200 hole section ready for operation.
3. Waite for low waves to spud the well.
4. Measure distance of conductor deck, air gap, and water depth.
5. Pick up 3600 BHA, start drilling. Avoid pulling bit out of seabed, while
drilling and making connection.
6. Drill to TD at 500 ft MD. Verify the stinger fits into the shoe.
7. At section TD, sweep the drilled section with Hi-Vis pill and circulate
hole clean.
8. Pick up 4200 underreamer BHA.
9. Wait for slack tide to reenter into the drilled hole and open it to 4200 .
10. At TD sweep Hi-Vis pill and circulate hole clean.
11. Pull out of hole 4200 underreamer BHA.
12. Hold PJSM for 3600 casing running job. Discuss job data, procedures, con-
tingency plans, safety, environment, communication means, and assign
responsibilities among crew members.
13. Pick up and run 3600 conductor casing.
14. Let subsea camera or divers at sea floor to ensure casing enters into
drilled hole. Wait for slack tide, if required.
15. In case of any problem, use slings/tuggers to maneuver casing into the hole.
16. Run in the hole with filling up every casing joint. Use theoretical
volume to fill conductor.
ARTICLE IN PRESS
17. Ensure verticality of conductor.

18. Fill up annulus volume between drill pipe and conductor.
19. Circulate at least two annular volumes. Verify there are no returns from
casing-drill pipe annulus during circulation.
20. Cementing crew to perform PJSM (discuss job data, procedures, safety,
environment, communication means, and assign responsibilities among
crew members).
21. While circulating, the cementing crew prepare for the cementing
job (mix cementing products and cementing lines to be rigged up to
the floor).
22. Pressure test cementing lines to 1500 psi.
23. Start pumping the cement and special care should be taken for pack off
which might cause the casing to collapse. Confirm final cementing
pressure.
24. Stop pumping cement as soon as the cement is seen at seabed. In case of
leaking cement stinger while cementing job, sting out and sting-in back
to stab-in shoe. Slack off drill string weight and continue pumping
cement.
25. Jet flush seabed of any cement to ensure area is clean of cement.
26. Rig down cementing lines and wait on cement.
27. Cut 3600 casing above the deck.
28. Nipple up and install 3000 500 psi diverter spool with diverter line and
hydraulic actuator valve.
29. Install bell nipple and flow line.
30. Function test diverter.
31. Fill up hole to surface and verify no surface leak in diverter system.
32. Pressure test the diverter/casing, to check if there is any leak in the
system.
4.1.5 Drilling 17½00 Surface Hole Section

4.1.5.1 Objective
The primary aim of drilling a 17½00 surface hole section is to isolate the loss
zones that may occur during the creation of the surface hole section from the
reactive shales. This will make it possible for the installed wellhead to pro-
gressively drill into the potential hydrocarbon deposits in the next sections.

Drilling the surface section will involve the use of a 17½00 bit to TD 3800 ft
(MD). Seawater will be used as the drilling fluid due to its adequate PH levels
ARTICLE IN PRESS
16 Khaled ALNabhani
tagged at between 9.5 and 10 for top hole section drilling. The hole will
be drilled across the black and blue shale formation, which is made up of
shale and limestone. The entire areas are swept clean to eliminate all traces
of seawater. The process of cleaning the hole is done by using prehydrated
Bentonite and Duovis Hi-Vi. Finally, a 13⅜ casing will be set inside the blue
shale to cover the total loss zone if any and at the same time isolating the
highly reactive shale. The 13⅜00 casing will be cast in cement in two stages.
Operational risks expected while drilling 17½00 hole section
1. Excessive shocks and vibrations, which could cause accidents and inju-
ries due to dropping objects. In the event of this problem encountered
during drilling, a mud motor and a shock sub in BHA will be deployed.
The recommendations are to drill using controlled parameters (reduces
the RPM and increases the WOB, avoids neutral points in the shock sub,
and maximizes the application of soft torque). It is also imperative to
avoid running sensitive tools or BHA components that are known to
be vulnerable to shock and vibrations.
2. Total losses that could cause a kick. In the event of this challenging
situation while drilling, the drilling process should reach an expected
total loss zone in Aruma and Wasia formations group (1000–2500 ft
MD/TVD). Increase the flow rate while drilling in total losses. Drilling
should continue to reach the casing point, and then it should be switched
to seawater. Spills should be cleared off while drilling.
1. Hold PJSM for drilling job. Discuss job data, procedures, contingency
plans, safety, environment, communication means, and assign respon-
sibilities among crew members.
2. Run in hole 17½00 BHA required to drill 17½00 hole section.
3. Wash down and tag top of cement of the previous section and drill out
stab-in shoe.
4. Continue drilling 17½00 hole section to expected loss zone 1000–2500 ft.
5. Circulate hole clean, to avoid loading of annulus at deeper depth while
drilling with losses.
6. Take survey every stand (three joints of drill pipe).
7. Use conventional spud mud to the depths of 1000–2500 ft, if no loss
occur, continue with spud mud to 3800 ft.
8. In case of losses encountered between 1000 and 2500 ft:
• Switch to seawater treated with lime or mix polysal with seawater to
suppress the shale reactivity and continue drilling.
• Pump in the annulus 10 ppg mud at 75 bbls/h with the trip tank.
ARTICLE IN PRESS
• If weighted mud is not able to catch up, pump around 10 barrel per
minute seawater at backside.
• If Hi-Vis pills are not working effectively and hole cleaning
becomes an issue (excessive drag/over pull in connections, high
break up torque), switch to high-density pills.
9. Continue to drill up to TD 3800 ft.
10. Perform wiper trip to the previous shoe and in case of full returns, while
drilling perform flow check, do not over pull. Ream all tight spots.
11. Hold PJSM for 13⅜00 casing job. Discuss job data, procedures, contin-
gency plans, safety, environment, communication means, and assign
12. Run in hole 13⅜00 surface casing.
13. Circulate hole clean to the loss zone.
14. Cementing crew perform PJSM prior any operation (discuss job data,
procedures, safety, environment, communication means, and assign
responsibilities among crew members).
15. While circulating, the cementing crew prepare for the cementing job.
Mix cementing products and cementing lines to be rigged up to the floor
(first stage tail should extend 500 ft above the 13⅜ casing shoe. Lead
slurry should extend to the total loss zone, or 100 ft above the cementing
stage tool if full circulation maintained through drilling operations. Fifty
percent excess for open hole should be consider in the cement volumes
calculation).
17. Mix and pump first stage lead slurry followed by first stage tail slurry at
constant rate.
18. Increase pressure and inflate the internal casing packer, then increase
pressure to open stage collar according to specification.
19. Circulate confirming full returns.
20. Mix and pump second stage slurry.
21. Drop manually the closing plug.
22. Displace with seawater.
23. Pressure up to close the stage collar.
24. Bleed off and confirm stage collar closed (no U-tube observed).
25. Perform 30 min flow check prior to lifting the diverter.
26. Lift up the diverter.
27. Perform top job to fill the annulus to conductor deck.
28. Install CHH and pressure test CHH welds to 2000 psi.
29. Install 13⅝00 10 K BOP stack, kill, and choke lines.
ARTICLE IN PRESS
18 Khaled ALNabhani
30. Pressure test Ram BOP with low/high pressure 300/4000 psi for
15 min, and annular BOP with low/high pressure 300/3500 psi using
test plug.
31. Keep lower valve in CHH open while testing BOP stack and install
wear bushing.
4.1.6 Drilling 12¼00 Intermediate Hole Section

4.1.6.1 Objective
The primary objective of the drilling this section is to seal and isolate any
unstable shale zones that are possibly discovered in the Wassia and Khamaha
formations group.

The drilling of intermediate hole section will be drilled using 12/1400 pdc bit
across Wassia and Khamaha formations group that usually include Fiqa,
Natih, Nahr Umr, Shuaiba, and Kharabib formations. The 9⅝00 intermediate
casing will be set at TD 8000 ft and cemented in two stages. The purpose of
using a 9⅝ intermediate casing is to effectively isolate the shale/unstable
zones in the formations indicated earlier, to provide an adequate control
of pressure while drilling the next 8½00 hole section.
Operational risks expected while drilling 12¼00 intermediate hole
section
1. One of the potential encountered during drilling 12¼00 intermediate hole
section is the experience of partial or total losses. This happens when the
drilling section is not properly monitored that may lead to a well-control
issue. The consequence of this is a loss of the first safety well-control bar-
rier (drilling fluid). In the event of this occurrence, the drilling parameters
should be closely monitored. Also, LCM should be added to the drilling
mud before it enters the Shuaiba zone (potential zone where losses occur
in between Wassia and Khamah). If losses are not cured, then proceed
with another attempt, the cement plug. Commence drilling with not less
than mud density of 11 ppg of mud cap in annulus.
2. Well control, this situation is one of the consequences of an controlled
“partial/total losses” which will consequently cause the formation pres-
sure to overwhelm hydrostatic pressure exerted by drilling fluid, keep
kill sheet ready. The surge and swab during pull out of hole/run in hole
should be closely monitored. If the problem with controlling the well
still persists, then proceed to using the “bull heading” killing method
or any appropriate well-killing methods.
ARTICLE IN PRESS
3. Poor cement job and a build-up annulus pressure. This will conse-
quently lead to difficulties to control the well, hence a formation integ-
rity test (FIT) and the use of LCM slurry is required to reduce any
potential losses. If the problem persists, the annulus should be isolated
with the use of two-stage cement layers with an inflatable casing packer.
Finally, an evaluation of the cement job should be done by means
of CBL.
4. The release of H2S gas is expected from any deeper formation is pene-
trated because of the lack of additional data from other offset well is
due to the fact that this well is first exploration well drilled in block
November 18. H2S gas is proven to be toxic to human beings even at
minute concentration. At higher concentrations, this gas is known to be
killer, flammable, and corrosive on contact with metals. Processes such
as maritime transportation, fishing, manned oil, and gas infrastructure in
the downstream sector could potentially be affected in the event of a blow-
out as a result of H2S gas explosion. The consequences of this event are
loss of life, interference in business activities, legal liabilities, compensation
claim, fines, and possibly legal prosecution. It is important that a surface
blowout of H2S gas is promptly taken care of and controlled to avoid
loss of life or injuries, fire or explosions at the location. Safety measures
to prevent this accident are the installation of sensors that must be tested
and ascertained to be fully functional. H2S drill and emergency escapes
drills should be regularly conducted at the location with identified master
points.
5. Exposure to different levels of radiation. This is due to unpredictable
emissions from technologically enhanced naturally occurring nuclear
radioactive materials, which are deposited with the return drilling fluid
and drilling cuttings. The workforce is at the risk of exposure to gamma
radiation emissions that are highly penetrative and have the ability to spread
as far as a 100 m as indicated by the API. There is also the risk of ingestion
and inhalation of alpha and beta particles. To prevent this catastrophe at a
location, the preventive measures stipulated by the TENORM safety
management made by ALNabhani, Khan, and Yang (2017a, 2017b)
should be adopted and strictly adhered to.
1. Hold PJSM for drilling job. Discuss job data, procedures, contingency
2. Run in hole 12¼00 BHA for drilling 12¼00 hole section.
ARTICLE IN PRESS
20 Khaled ALNabhani
3. Drill out cement plugs and float collar and float shoe of 17½00 surface
hole section and drill 10–20 ft of the new formation.
4. Perform a FIT (is a test of the strength and integrity of a new formation
as well as test strength of shoe and it is the first step after drilling a casing
shoe track) and a leak off test—LOT (pressure test shoe and formation
until formation breakdown to find the fracture pressure (fracture
gradient) of formation and shoe that help to manage drilling fluid den-
sity in drilling this section). Result of the test must be shared with oper-
ating company prior any further action to be taken in drilling further
this section.
5. Drill till top of Shuaiba, circulate and continue drilling up to TD 8000 ft
MD, take surveys every stand and optimize drilling parameters.
6. Sweep at TD with Hi-Vis pills, circulate, and clean the well.
7. Perform flow check.
8. Perform wiper trip to previous shoe.
9. Ream all tight spots and report if any.
10. Hold PJSM for logging job. Discuss job data, procedures, contingency
11. Rig up wire line tools and perform hole logging.
12. Retrieve wear bushing.
13. Secure the well and repressure test 9⅝00 casing ram using test mandrel,
test pressure should be to 80% of the collapse of the pipe, or the work-
ing pressure of the flanges.
14. Hold PJSM for 9⅝00 casing job. Discuss job data, procedures, contin-
15. Run in hole 9⅝00 production casing to casing point and wash down as
required if any obstruction.
16. Circulate hole clean to the loss zone.
17. Cementing crew perform PJSM prior cementing job. Discuss job data,
procedures, safety, environment, communication means, and assign
18. While circulating, the cementing crew prepare for the cementing job.
Mix cementing products and cementing lines to be rigged up to the
floor (first stage tail should extend 500 ft above the 9⅝00 casing shoe.
Lead slurry should extend to the total loss zone, or 100–200 ft above the
cementing stage tool if full circulation maintained through drilling
operations. Fifty percent excess for open hole should be consider in
the cement volumes calculation).
ARTICLE IN PRESS

20. Mix and pump first stage lead slurry and first stage tail cement slurry at
constant rate.
21. Inflate internal casing packer to open stage collar.
22. Wait on cement and circulate confirming full returns.
23. Flow check the well.
24. Lift up the 13⅜00 BOP stack and install 9⅝00 casing slip and rest BOP stack.
25. Mix and pump second stage slurry.
26. Nipple up and pressure test 13⅜00 -10 k BOP stack.
27. Use plug type tester and pressure test BOP for 5300 psi for 15 min.
4.1.7 Drilling 8½00 Hole

4.1.7.1 Objective
The primary objective of drilling 8½00 hole is to evaluate the reservoirs in
shale, and reservoir rock in Sahtan group formations such as Tuwaiq. This
will be achieved by drilling first a pilot vertical hole using 8½00 pdc bit then
sidetrack to create a secondary wellbore to collect more geological formation
from group formations using coring technique and finally to land 700 liner
prior the reservoir. NaCl polymer mud with mud weight between 10 and
11 ppg will be used to drill this section.

This hole will be drilled across the Sahtan formations group. The 700 liner
will be set at TD 12,000 ft MD. The 700 liner purpose is to provide struc-
tural support for the well.
Major expected operational risk while drilling 8½00 hole section
1. Well control, this situation is one of the consequences of uncontrolled
partial/total losses or lack of sufficient drilling fluid weight, which will
consequently cause the formation pressure to overwhelm hydrostatic
pressure exerted by drilling fluid, therefore, keep kill sheet ready. The
surge and swab during pull out of hole or during run in hole should
be closely monitored. If the problem with controlling the well still per-
sists, then you may proceed to using the “Bull heading” killing method
or any appropriate killing method.
2. The release of H2S gas is expected from any deeper formation is pene-
trated because of the lack of additional data from other offset well is
due to the fact that this well is first exploration well drilled in block
November 18. H2S gas is proven to be toxic to human beings even at
minute concentration. At higher concentrations, this gas is known to
be killer, flammable, and corrosive on contact with metals. Processes
ARTICLE IN PRESS
22 Khaled ALNabhani
such as maritime transportation, fishing, manned oil, and gas infrastruc-

ture in the downstream sector could potentially be affected in the event
of a blowout as a result of H2S gas explosion. The consequences of this
event are loss of life, interference in business activities, legal liabilities,
compensation claim, fines, and possibly legal prosecution. It is important
that a surface blowout of H2S gas is promptly taken care of and controlled
to avoid loss of life or injuries, fire or explosions at the location. Safety
measures to prevent this accident are the installation of sensors that must
be tested and ascertained to be fully functional. H2S drill and emergency
escapes drills should be regularly conducted at the location with identi-
fied master points.
3. Exposure to different levels of radiation. This is due to unpredictable
emissions from technologically enhanced naturally occurring nuclear
radioactive materials, which are deposited with the return drilling fluid
and drilling cuttings. The workforce is at the risk of exposure to gamma
radiation emissions that are highly penetrative and have the ability to spread
as far as a 100 m as indicated by the API. There is also the risk of ingestion
and inhalation of alpha and beta particles. To prevent this catastrophe at
a location, the preventive measures stipulated by the TENORM safety
management made by ALNabhani et al. (2017a, 2017b) should be adopted
and strictly adhered to.
1. Hold PJSMs for drilling operation. Discuss job data, procedures, con-
tingency plans, safety, environment, communication means, and assign
2. Run in hole 8½00 BHA for drilling 8½00 hole section.
3. Drill out stage tool, cement plugs, and float collar of the previous
section.
4. Drill to 10 ft above the float shoe, circulate bottoms up.
5. Perform casing pressure test to 5500 psi.
6. Continue drilling out float shoe and 10–20 ft of new formation,
circulate hole clean.
7. Hold PJSM and perform FIT and result must be shared with operating
company.
8. Continue drilling 8½00 pilot hole section to the coring points.
9. Sweep the hole and perform flow check.
10. Perform wiper trip to previous shoe.
11. Hold PJSM and perform coring operations.
12. Remove wear bushing and perform BOP pressure test.
ARTICLE IN PRESS
13. Continue drilling 8½00 pilot hole section to TD 12,000 ft MD.

14. Circulate hole clean.
15. Flow check and pull out of hole to surface.
16. Hold PJSM to start 8½00 hole logging program.
17. Perform wiper trip.
18. Hold PJSM then proceed 8½00 hole plug and abandonment to start the
sidetrack section.
19. Batch mix and pump the cement slurry and batch mix and pump of kick
off plug.
20. Rig down cement equipment.
21. Hold PJSM run in hole sidetrack BHA until tag top of cement and
initiate sidetrack hole.
22. Pull out of hole side track BHA and run in hole directional BHA and
deviate as per directional plan of 137.3 degree and set parameters to
finally have a horizontal well at 12,000 ft.
23. Pull out if hole directional BHA and circulate hole clean.
24. Spot Hi-Vis/high-density pill in open hole.
25. Flow check and pull out of hole to surface.
26. Hold PJSM and run in hole 700 liner.
27. Set the liner hanger and set hanger by slacking off the liner weight.
28. Bleed off pressure.
29. When liner weight has been lost (in deviated well may be not easily
clear) and the tool is released, set down again on top of the liner to com-
pensate for upward hydraulic forces.
30. The cement volume to be calculated based on the volume from the
caliper log data plus 50% excess.
31. Hold PJSM, rig up cement equipment and pump cement slurry for
700 liner as per cementing program.
32. Rig down cement equipment.
33. BOP stack will remain same, as was on previous section 10 k
arrangement.
34. Use plug type tester and pressure test BOP for 5500 psi for 15 min.
4.1.8 600 Hole Horizontal Section

4.1.8.1 Objective
The main objective of drilling this section is to drill horizontally from
12,000 ft and therefore have horizontal access through paying zone for more
production.
ARTICLE IN PRESS
24 Khaled ALNabhani

The plan is to drill horizontally of 4000 ft of 600 hole section to TD
16,000 ft MD across shale and reservoir rocks in Khuff and Gharief forma-
tion. Then 600 horizontal hole will drilled using salt polymer mud of 11.5 ppg
and be cased with 4½00 cemented liner. Finally, the well will be stimulated
with multistage fracturing equipment.
Major expected operational risk while drilling 600 hole section
1. Well control, this situation is one of the consequences of uncontrolled
partial/total losses or lack of sufficient drilling fluid weight, which will con-
sequently cause the formation pressure to overwhelm hydrostatic pressure
exerted by drilling fluid, therefore, keep kill sheet ready. The surge and
swab during pull out of hole or during run in hole should be closely mon-
itored. If the problem with controlling the well still persists, then you may
proceed to using the “Bull heading” killing method or any appropriate
killing method.
2. The release of H2S gas is expected from any deeper formation is penetrated
because of the lack of additional data from other offset well is due to the fact
that this well is first exploration well drilled in block November 18. H2S gas
is proven to be toxic to human beings even at minute concentration.
At higher concentrations, this gas is known to be killer, flammable, and
corrosive on contact with metals. Processes such as maritime transporta-
tion, fishing, manned oil, and gas infrastructure in the downstream sector
could potentially be affected in the event of a blowout as a result of H2S gas
explosion. The consequences of this event are loss of life, interference in
business activities, legal liabilities, compensation claim, fines, and possibly
legal prosecution. It is important that a surface blowout of H2S gas is
promptly taken care of and controlled to avoid loss of life or injuries, fire
or explosions at the location. Safety measures to prevent this accident are
the installation of sensors that must be tested and ascertained to be fully
functional. H2S drill and emergency escapes drills should be regularly con-
ducted at the location with identified master points.
3. Exposure to different levels of radiation. This is due to unpredictable emis-
sions from technologically enhanced naturally occurring nuclear radioactive
materials, which are deposited with the return drilling fluid and drilling cut-
tings. The workforce is at the risk of exposure to gamma radiation emissions
that are highly penetrative and have the ability to spread as far as a 100 m
as indicated by the API. There is also the risk of ingestion and inhalation
of alpha and beta particles. To prevent this catastrophe at a location, the pre-
ventive measures stipulated by the TENORM safety management made by
ALNabhani et al. (2017a, 2017b) should be adopted and strictly adhered to.
ARTICLE IN PRESS

1. Hold PJSM for drilling operation. Discuss job data, procedures, contin-
2. Ensure waste management—skip and ship system (transport of cuttings
to shore for disposal) is fully functional.
3. Run in hole 600 BHA for drilling 600 hole section.
4. Drill out landing collar and float collar to 10 ft above float shoe of
the previous section.
5. Perform casing pressure test to 4500 psi for 15 min.
6. Continue drilling out float shoe and 10–20 ft of new formation.
7. Hold PJSM and perform FIT.
8. Continue drilling 600 horizontal section to well TD at 16,000 ft. MD.
9. Perform flow check.
10. Perform wiper trip to the previous shoe.
11. Circulate hole clean, sweeping hole with Hi-Vis pill.
12. Pull out of hole to surface.
13. Hold PJSM and run in hole 600 wireline equipment.
14. Pull out of hole and rig down wireline tools.
15. Circulate hole clean.
16. Spot Hi-Vis pill on bottom.
17. Hold PJSM and run in hole 4½00 liner to the TD.
18. Set hanger by slacking off the liner weight.
19. Bleed off pressure to zero.
20. Circulate bottom up and hold PJSM for 4½00 liner cement job.
21. Rig up cement tools and pressure test lines to 6000 psi.
22. Cement 4½00 liner with 50% open hole excess.
23. Ensure well is static and rig down cement equipment.
24. Well to be finally completed as per completion program.
5. COMMON HSE RISK ASSESSMENT

AND MANAGEMENT SYSTEM ADOPTED
IN OFFSHORE DRILLING OPERATIONS
The following HSE tools are commonly used in the oil and gas indus-
try as a part of the HSE management system adopted also in offshore drilling
operations. They include:
• HSE training matrix
• Emergency responses, plans, and safety drills
• HSE risk assessment matrix
ARTICLE IN PRESS
26 Khaled ALNabhani
These techniques are characterized as classical in nature as can be explored

further in the following sections. Whereas, the uses of these techniques are
limited to certain types of identified risks and consequences for which
the professionals have proffered limited mitigating recommendations.
Unfortunately, these techniques are not able to dynamically integrate or
update any change or deviations that are commonly experienced with very
complicated systems and subsystems such as what is happening in the oil and
gas operations.
5.1 HSE Training Matrix

The HSE training program is widely recognized as the recommended stan-
dard in the offshore drilling industry. The program includes training every
staff involved in the drilling operations (workers, contractors, subcontrac-
tors, etc.). It is mandatory that every personnel involved in the project
undergo a comprehensive HSE competency assessment at different levels
of HSE training. It is practically impossible to commence a drilling operation
if the workforce has not been confirmed to possess the required certifications
that indicate they have completed the required HSE courses. HSE training
course is mostly merged with the induction courses newly employed staff go
through in the oil and gas industry. There are different levels of HSE training
requirements for offshore drilling operations; these classifications have been
made based on the competencies as illustrated in Table 2.
5.2 Emergency Responses Plans and Safety Drills

In the oil and gas industry, the primary aim of every drilling company is to
professionally conduct safe drilling operations without any of operational,
occupational, and environmental accidents. It is the priority of drilling com-
panies to conduct safe drilling operations with adequate emergency response
system that meets the offshore drilling specifications for safety and part of safe
HSE management system. These measures include but are not limited to
H2S gas leak response, environmental pollution response, as well as quick
responses to any failure in the communication system. Responses to fire
and incidences of explosion for instance are set up as part of the contingency
plans in the case of related emergencies during drilling operations. The man-
agement must endorse these plans and an adequate awareness must be cre-
ated at the project location among all workers levels. The safety measures are
focused on developing a safer drilling procedure, which includes but not are
limited to well spudding and other related operations; the emergency safety
ARTICLE IN PRESS
Table 2 Minimum HSE Training/Competency Requirements Training Matrix Intended as

Guidance Only for Safe Offshore Drilling Operation
S. No. HSE Training Course Required Workers Categories
1 Medical Fitness Examinations All
2 HSE Induction All
3 H2S Awareness & Escape All
4 Basic Offshore Safety Induction & Emergency All
Training (BOSIET)
5 Site HSE Induction All
6 Assigning a Mentor All
7 Operation Familiarization All
8 Equipment Familiarization All
9 Competency Assessment All
10 Life Support Training All
11 H2S All
12 Chemical Hazardous Material Handling Professional level
and Management
13 Fire Warden Professional level
14 Radioactive Management Professional level
15 Environmental Management Professional level
16 Health Risk Assessment Professional level
17 Process Safety Professional level
18 Well Integrity Professional level
19 Crane Rigger and Banksman Professional level
20 HAZOOP Professional level
21 Life Saving Rules Professional level
22 Injury Prevention Program Professional level
23 IT Security Professional level
24 Mobile Elevating Work Platform Operator Professional level
25 Overhead Traveling Crane Operator Professional level
26 Forklift Operator Professional level
Continued
ARTICLE IN PRESS
28 Khaled ALNabhani
Table 2 Minimum HSE Training/Competency Requirements Training Matrix Intended as

Guidance Only for Safe Offshore Drilling Operation—cont’d
S. No. HSE Training Course Required Workers Categories
27 Welder Certification Professional level
28 Engagement Alert Professional level
29 Confined Space and SCBA Professional level
30 Working at High Professional level
31 Gas Testing Professional level
32 Incident Investigator Professional level
33 Permit to Work Holder Professional level
34 Permit to Work Signatory Professional level
35 Permit to Work Auditor Professional level
36 High Voltage Safety Professional level
37 Environmental Hazard Identification Professional level
38 IWCF—Well Control Professional level
39 Stuck Pipe Prevention Professional level
40 DROPS Professional level
41 First Aider Professional level
42 Stuck Pipe Prevention Professional level
44 Dynamic Positioning Operator Professional level
45 Helicopter Landing Officer Professional level
46 Lifting Operations Professional level
47 Offshore Lifeboat Coxswain Professional level
48 Helideck Emergency Response Training Professional level
49 HSE Leadership Program Supervisory and
management level
50 Accident Investigation and Report Supervisory and
management level
51 Safety Leadership for Supervisors and Supervisory and
Managers management level
52 Safety for Executives Executives
53 Safety Leadership for Executives Executives
ARTICLE IN PRESS
responses that define safe gathering area outside 30-ppm rupture exposure
radius circle; inspection and calibration of all gas monitors and related equip-
ment, inspection of communications, and firefighting equipment’s and
prominently labeling safe areas within the location where the workforce
can gather in the event of an emergency.
Furthermore, it is a common practice during offshore drilling operations
as a part of HSE management system is to regularly organize safety drills tai-
lored to the different kinds of emergency situations that may occur. The aim
of this exercise is to ensure every member of the workforce knows the cor-
rect way to respond in the event of an emergency. These measures include
(but not limited to):
1. Well-control drills. Minimum frequency required is twice per week
per crew (four drills).
2. Rescue from confined space drill, minimum frequency required is once
per 12 weeks.
3. Casualty handling drill, minimum frequency required is once per 8 weeks.
4. H2S drill, minimum frequency required is once per week (two drills).
5. First aid drill, minimum frequency required is once per 12 weeks.
6. BOP drill, minimum frequency required is once per week (two drills).
7. Vertical rescue drill, minimum frequency required is twice per year.
8. Fire pump drill, minimum frequency required is once per week.
9. Oil spill equipment clean out drill, minimum frequency required is
once every 6 months.
10. Disaster drill, minimum frequency required is once every 6 months.
11. Fire-fighting/BA drill, minimum frequency required is once per 4 weeks.
12. Confined space rescue drill, minimum frequency required is once every
12 weeks.
5.3 HSE Risk Assessment Matrix

Theoretically, it is one of the main priorities of stakeholders in the oil and gas
industry to adopt and adhere to the adequate safety measures during explor-
atory and drilling explorations. While, practically and in reality, the situation
may be different, where some senior rig managers are paying more attention
to drill well faster and striving to achieve more cost saving for their compa-
nies. This could compromise adoption of safer practices that can result in
serious catastrophe. Most of accidents that have happened in the past were
as a result of negligence and wrong decision making. Other causes include
working at a quicker pace due to pressure to meet targets during a drilling
ARTICLE IN PRESS
30 Khaled ALNabhani
project, problems could also arise due to frequent modifications made to the
drilling processes and production plans, and also the high drilling contractors
rate especially in cases where the drilling project has been outsourced based
on cost per feet, cost per day, or well lump-sum conditions. It should be
noted that the safety measures and environmental risk assessment provision
currently being used in the oil and gas industry are basically classic and asso-
ciate with a lot of uncertainty. These safety provisions are also observed to be
static and void of the capacity to be applied dynamically under unforeseen
events or in cases where the standard processes of the normal integrated sys-
tem have been modified. For example, there are many techniques which are
used by in the oil and gas industry to establish safety management and risk
assessment plans as part of their HSE management system, such as the risk
assessment matrix, hazards and effects management process, hazard identifi-
cation (HAZID), hazards analysis (HAZAN), hazards and operability
(HAZOP), task risk assessment (TRA), quantitative risk assessment
(QRA), and job safety plan (JSP), which have been aligned with the scope
of work, risk scenarios within that scope of work. In many instances, risk
assessments are not scientifically based or developed by means of academic
expertise, for example, lack of aspects of psychology that is focused on the
science of behavior and the mind. This could provide an explanation for the
continued occurrence of accidents despite the efforts that have been put in
place to prevent accident and to improve safety measures in the industry.
Table 3 is an actual example of risk assessment that widely and commonly
used for offshore drilling operation that is scientifically discovered to be not
sufficient enough to provide enough protection to workers or safe opera-
tion. Hence the need for reevaluation before it is developed into a quanti-
tative dynamically applicable risk assessment that covers all possible
emergencies that could occur as an integration of abnormal events in the
drilling operation in both main system and its subsystem.
6. DISCUSSIONS
The International Labor Organization (2017) has reported that there
are a growing number of deaths in the industry after every 15 s due to acci-
dents or disease related to work. The overall index indicates that 153
workers are victims of work-related incidents. The daily reports show an
average of 6000 people who die as a result of work-related diseases or occu-
pational accidents, and more than 2.3 million deaths and 317 million acci-
dents are recorded annually. The consequence of work-related diseases or
Table 3 An Example of an Offshore Drilling Operation Risk Assessment Matrix
ARTICLE IN PRESS
Continued
Table 3 An Example of an Offshore Drilling Operation Risk Assessment Matrix—cont’d
ARTICLE IN PRESS
ARTICLE IN PRESS
Continued
ARTICLE IN PRESS
ARTICLE IN PRESS
Continued
ARTICLE IN PRESS
ARTICLE IN PRESS
Continued
ARTICLE IN PRESS
ARTICLE IN PRESS
Continued
ARTICLE IN PRESS
ARTICLE IN PRESS
ARTICLE IN PRESS
42 Khaled ALNabhani
occupational accidents occurrences in the industry is a loss of manpower rep-

resented as compromised productivity due to nonproductive time (NPT).
Whereas, NPT is usually a tool used to evaluate safety performance in the
industry. The consequences of these daily work-related accidents are alarming.
Economically, the low standards of occupational safety and poor health prac-
tices cause an estimated 4% loss in the global gross-domestic product (GDP)
annually. Moreover, factors such as human errors, injuries, fatalities, and envi-
ronmental damages are not considered as part of the assessments for classical
risk and safety measurement and therefore are associated with high levels of
uncertainty. Consequently, there is an urgent need to improve the safety stan-
dards and risk assessment practices in the oil and gas industry with the support
of academic experts in this field.
Oil and gas industry is known to be one of the leading industries as
shown by the global statistics and it is geared toward meeting the global
demands for energy. This industry has also employed a large number of
workforces. A good example in the United States is the Gulf of Mexico that
is acclaimed to have one of the world’s modest concentrations of offshore
rigs. It was tagged at about 213 units in 2015, where the average number
of employees in any offshore drilling rigs revolves an average of not less than
80 employees.
Several reports from the Center for Disease Control and Prevention
(CDC, 2013) have indicated an increased morbidity and mortality rate in
the oil and gas industry. The weekly report that was published on April 26,
2013 reported that a significant increase in the fatality rate of 27.1 against
3.8 deaths per 100,000 from 2003 to 2010 in the oil and gas extraction industry
situated in the United States (onshore and offshore activities). On the contrary,
a report in 2010 showed 11 deaths that occurred in the deepwater horizon
explosion. The same year, it was reported that the UK offshore oil and gas
industry experienced a dramatic increase in the number of major accidents
that had occurred in the industry. All these figures are scary facts that act as
a reminder of the hazards that have been caused by offshore drilling.
Moreover, the Occupational Health and Safety study of Al-Rubaee and
Abdullah Al-Maniri (2011) reported that a majority of the work-related
injuries in the oilfield occurred as a result of foreign objects in the eyes. This
type of injury was commonly reported and made up to 27.6% of the total injury
reports. Next, were the cases of man falls or slips that made up to 11.8%. 38.8%
of the injuries occurred in the upper parts of the human anatomy and were
recorded as the largest incidences that have ever happened. The group that
was most affected by the injuries were workers aged below 30 years and this
ARTICLE IN PRESS
category made up of 52% of the reported cases. The average rate of injuries per
1000 exposed workers in this industry stood at 19.8% annually.
The maritime workers at offshore installation sites will be exposed pre-
dominantly to the hazardous conditions. This is because of a large number of
the workforce that operates within a small location that is surrounded by
large water bodies. For instance, the number of the workforce in the differ-
ent jack-up mobile offshore drilling locations falls between the range of
80 and 200 workers who have been trained professionally in their required
fields of expertise as well as the recommended safety measures. This work-
force operates daily for 12 h and works in shifts (day and night) with a shift
change occurring at 6:00 a.m./p.m. This rotation plan can only be nurtured
for periods between a month and a year and are based on the role played by
workers. Psychological studies have shown that workers who endure long
rotational patterns such as what is applied in the oil and gas industry are
prone to suffering from physical and mental exhaustion with high potential
of making an accident. In addition, more than a 100 people who work in the
offshore locations of drilling rigs are faced with different types of risks. This
workforce is drawn from the drilling crew of the contracting firm, the rep-
resentatives from operating company’s service contractors, and special crew
members who have various roles to play at these locations to accomplish well
drilling. Some of them include but are not limited to cementing services,
casing running services, logging while drilling, measurement-while-drilling
and wireline logging services, drilling tool services, fishing and milling ser-
vices, perforation services, H2S services, wellheads and well completion ser-
vices, and special downhole tools services.
Considering the facts mentioned earlier, later sections illustrate the
world’s most catastrophic offshore drilling operation disasters, as well as
the commonly reported occupational accidents occurred in the offshore
drilling industry.
6.1 The World’s Most Catastrophic Offshore Drilling Operation

Disasters
This section aims to create awareness about the accidents, how they have
happened and what are the causes behind them. Below are some examples
of the most catastrophic offshore drilling operations disasters.
1. BP Macondo well Deepwater Horizon blowout in-Gulf Mexico
Consequences level: Catastrophe
Frequency: Occasional
Accident summary
ARTICLE IN PRESS
44 Khaled ALNabhani
The BP Macondo well deepwater horizon blowout that happened in

the Gulf of Mexico in 2010 was recorded as one of the worst accidents
in the history of offshore drilling operations. The involvement of BP, a rep-
utable oil company made it imperative that a critical analysis was conducted
to find out how the accident happened and the safety measures that should
always be in place to prevent a similar catastrophe from happening in the
future.
The causes identified for this particular case of a blowout were found
many after a critical investigation was done (Center for Catastrophic Risk
Management, 2010). However, the main cause of this accident was identi-
fied as a fault that developed in the cement barrier, which was set in the pro-
duction casing string. This was caused by negligence displayed by the
operators who failed to adhere to the safe operational procedures by making
wrong professional decisions.
The top management team in charge of this operation failed to observe
the regulations prescribed by the offshore safety authorities which function
as a part of BOEMRE, the body with governing authority over offshore
exploration.
Among the list of faults identified by the investigative panel into this inci-
dent include inadequate measures put in place for risk management, making
changes in the previous plans at the last minute, overlooking the important
indicators that signaled a potential disaster, poorly coordinated control
response in the event of an accident, and inadequate emergency bridge
response training by the companies and individuals in charge of the drilling
operations.
In this accident, a total of 11 members of the work staff lost their lives.
The oil spill that resulted from this accident was massive. It was put at 5 mil-
lion bbl of spilled oil in the Gulf of Mexico, Louisiana.
ARTICLE IN PRESS
Overall, this accident was labeled as one of the worst catastrophes in the
offshore exploration industry; however, it is a rare occurrence, which
could only happen when important signals are overlooked and when
wrong decisions are made during drilling and oil exploration operations.
2. The sinking of the PETROBRAS-P36
Accident summary
The second offshore accident that will be addressed in this section is the
sinking of the PETROBRAS. The PETROBRAS was a P36 floating plat-
form that was located in the Brazilian Atlantic Coast before the accident
occurred on March 20, 2001. This P36 floating platform was designed to
function as a floating drilling unit, however, between 1997 and 1999
(Whelan, 2013); the PETROBRAS was modified to become a floating pro-
duction unit. The changes that were made included the addition of new
equipment and intensive structural upgrades to meet the requirements, its
new functions. It was shocking to hear that the PETROBRAS had capsized
and sank on March 20, 2001. This event happened after several explosions
were reported to have occurred aboard the structure.
Investigations revealed that a faulty alignment caused the first explosions
at the emergency drain tank with the production heater. A buildup of
hydrocarbons was made possible due to the close positioning of these two
structures. The resulting explosions created an outlet through which volatile
gases were released, and this caused multiple explosions, sinking the
PETROBRAS-P36.
The investigation reports of this accident were enlightening. It was
discovered that there were number of mistakes that led to this accident
ARTICLE IN PRESS
46 Khaled ALNabhani
were a failure in the mechanical component design, error in judgment,

poor training, and inadequate emergency response measures. It was a grave
accident that led to the death of 11 people and about 137 people injured.
The PETROBRAS-P36 sank due to critical structural damage caused by
the explosions. This accident was tagged as one of the worst in the offshore
exploration industry; it is however tagged as a potentially occasional accident
of occurrence.
3. The Piper Alpha disaster in the North Sea
Accident summary
The Piper Alpha catastrophe occurred in the North Sea, United

Kingdom. This was an accident that could have been avoided; the inves-
tigations revealed that this accident happened as a result of a gas leak from
one of the condensate pipes located at the platform. During routine main-
tenance, day shift workers removed the pressure safety valve of the con-
densate injection pump and two blind flanges were installed to seal
temporarily. Unfortunately, the workers who resumed for duty in the
evening were not notified of changes made and the temporary measures
that had been put in place. One of the new workers switched on the con-
densate injection pump, and this caused the gas leak and consequently the
explosion.
The Piper Alpha catastrophe revealed that this catastrophe happened as a
result of poor communication (Chernov & Sornette, 2016), lack of profes-
sionalism handover during the shift change, negligence on the part of the
workers. As a result, 167 people lost their lives in this accident, and the loss
due to damaged assets was estimated to be $1.4 billion.
This accident was tagged as one of the most catastrophic events in the
offshore oil exploration globally, and the reports indicate that it could occa-
sionally occur if the adequate professional measures are not observed.
ARTICLE IN PRESS
4. The Destruction of the Alexander L. Keilland semisubmersible platform

Accident summary
This accident happened on March 27, 1980 in the North Sea, Norway
(Naess, Haagensen, Moan, & Simonsen, 1982). The Alexander L. Keilland
was a semisubmersible platform, which was used alongside the Edda oil rig
during oil and gas exploration in the North Sea. This platform was used to
accommodate the workers involved with the drilling operations. The
destruction was caused by strong winds and waves that reached as high as
12 m. The contact of seawater with the bracings caused one of the bracings
attached to one of the five legs, which supported the structure to malfunc-
tion, consequently causing a collapse of the platform.
This was a sad event, about 123 crew members lost their lives, and the damage
to assets ran into millions of dollars. This accident was classified as a catastrophe,
and the investigations indicate that it could occasionally happen in the future.
5. The Bohai-2 Jack-up oil rig disaster in the Gulf of Bohai
Accident summary
ARTICLE IN PRESS
48 Khaled ALNabhani
The Bohai-2 Jack-up rig disaster happened in the Gulf of Bohai, off the
Chinese coast in November 1979. The investigations conducted to deter-
mine the causes of this accident revealed that the deck equipment was
not properly stored away after use. Consequently, the severe weather con-
ditions damaged the ventilator pump installed on the platform. This caused a
hole on the deck resulting in excessive flooding.
Seventy-two crew members lost their lives in this accident. The esti-
mated losses due to damaged assets were massive. This accident was classified
as a catastrophe in the offshore oil and gas industry. The investigations also
revealed that measures must be put in place at offshore locations to prevent
similar accidents that could likely occur occasionally.
6. The Seacrest Drillship disaster
Accident summary
The Seacrest drillship disaster happened in 1989 in the South China Sea,
Thailand. The cause of this accident was reported to be severe weather con-
ditions, which caused the drill ship to capsize (Mannion, 2013).
The drillship was hit by Kavali Cyclone that caused strong waves as high
as 40 ft. The day the accident occurred, the pressure put on the drillship cau-
sed an unavoidable instability in the high-centered gravity on the drillship.
This instability was attributed to the heavy drillstrings made up of 12,500 ft
of drill pipe that was on the ship at the time of the accident. The drillship
capsized under the strength of the waves.
ARTICLE IN PRESS
Unfortunately, 91 crew members lost their lives in this accident, and

there were huge losses from damaged oil and gas exploration equipment.
This accident was classified as a catastrophe in the offshore exploration
industry and the companies involved suffered huge losses form damaged
assets. This accident was also classified as a potentially occasional event,
which should be prevented by adequate emergency response measures.
7. The Ocean Ranger oil drilling rig disaster in the North Atlantic Sea
Accident summary
The Ocean Ranger oil drilling rig catastrophe that happened in the North
Atlantic Sea just off the coast of Newfoundland, Canada, involved a semisub-
mersible mobile offshore drilling rig. This catastrophe happened on February
15, 1982. The semisubmersible mobile drilling rig was destroyed by a severe
North Atlantic cyclone (Wilcutt & Harkins, 2011). The storm was character-
ized by winds as fast as 190 km/h, and waves that rose as approximately 20 m
high where it caused the windows to break and the water entered the control
room. This was identified in the investigations as the cause of the tragedy at this
offshore location. A total of 84 crew members lost their lives on this day, and
valuable assets worth millions of dollars were destroyed. This accident was
classified as a catastrophic event in the offshore exploration industry, and
the investigation revealed that similar accidents could occur occasionally.
ARTICLE IN PRESS
50 Khaled ALNabhani
6.2 Common-Reported Occupational Accidents During

Offshore Drilling Operation
Table 4 illustrates the most common reported occupational accidents in off-
shore drilling operation.
7. QUANTITATIVE RISK ASSESSMENT AND DYNAMIC

ACCIDENT MODELING USING SMART APPROACH
Forty years’ worth of research has explored the fact that operational
and occupational misconducts pose significant risks to a number of people
involved in the oil and gas industry particularly in the drilling activities. It
is, however, feasible to mitigate accidents related to oil and gas drilling oper-
ations in its preliminary stages through preventive methodologies such as an
adequate maintenance of appropriate safety measures and the creation of
barriers to reduce the dangers of risks and life-threatening situations. Oper-
ational and occupational risks from offshore drilling operations are easy to be
identified in early stages, but physically this is a generally deficient practice in
the oil and gas industry. The situation could be improved by developing
adequate systems which aid the prediction of impending calamities, effective
control measures, and mitigating risks at the source, as well as propagating
the importance of incident prevention with the aim of making the drilling
inherently processes safer. It is important to carry out assessments and checks
to ascertain the efficiencies of safety barriers provided, confirming the ade-
quacy of these provisions will further prevent the occurrence of major oper-
ational and occupational accidents, thus promoting safety and health of the
workers. Thus, this section is developed and focused on the introduction of a
new approach toward dynamic accident modeling and quantitative risk
assessment in the typical oil and gas offshore extraction and production oper-
ations, this will be done by implementing the SHIPP (system hazard iden-
tification, prediction, and prevention) methodology and rational theory
(SMART approach) developed by ALNabahni et al. (2017b). The proposed
approach is characterized by the following unique features: (i) dynamic
modeling of operational and occupational accidents and risks considering
the effectiveness of the provided safety barrier, (ii) uncertainty reduction
by establishing a reliable system that facilitates the prediction of the likeli-
hood that the safety barriers might fail, and (iii) dynamic updating of any
abnormal event probability occurrence as new information becomes avail-
able from both integrated main system and its subsystems based on
ALNabhani’s SMART approach toward dynamic accident modeling and
Table 4 Common Reported Occupational Accidents in Offshore Drilling Operation
S. No. Accident Summary Root Cause Consequences Cons Level Frequency Photo
1 Injured party (IP) was Not following the safe A broken finger and the Accident High
working on the drill operational procedures. worker away from work (critical)
collars caused the tongs Lack of toolbox talk and for 2 weeks
to move toward the drill PJSM
collar. The IP’s fault was
Lack of training.
that he did not drip the
Inadequate supervision
tongs at the handle.
ARTICLE IN PRESS
Thus, the jaw came in Human error and poor
contact with the drill communication
collars, and it was
propelled backward
hurting his fingers
2 IP fell off the platform Human error caused by Broken wrist, away Accident High
lack of concentration from work for 3 weeks (critical)
for recuperating
Continued
Table 4 Common Reported Occupational Accidents in Offshore Drilling Operation—cont’d
3 IP lost his balance while Unprofessional and Fractured arm and Accident Medium
walking over a rotary improper housekeeping shoulder. Away from (critical)
table, his left foot was and human error (lack of work for 3 weeks for
caught in an uncovered concentration) recuperating
utility hole, and he
tripped over the rig
floor
ARTICLE IN PRESS
4 IP operating a tong and Negligence of the safety IP was hospitalized for Accident High
wrongly held the tong procedures, inadequate 2 weeks with a hairline (critical)
by its jaw instead of training, poor fracture in his finger
gripping the handle supervision, no PJSM
from safe position. The and tool box talk,
weight of the tool human error due to lack
caused the second jaw to of concentration, and
swing and close trapping poor communication
the worker’s right finger
in between
5 IP suffered injuries to his Poor safety awareness, Fractured right foot Accident High
foot when 3½00 drill pipe lack of toolbox training, little toe. 2 weeks not (critical)
landed on his foot poor supervision, poor attending work for
communication, human recuperating
error caused by poor
concentration
ARTICLE IN PRESS
6 A Floorman struck the Negligence of the IP stayed away from Accident High
finger of a helper who proper safety work for 4 weeks (critical)
was gripping the holder procedures, lack of recuperating from the
while the floorman was training, poor injury to his fractured
hammering the safety supervision, human finger
clamp to correctly reset error caused by lack of
the alignment in an 5½00 concentration and no
drill collar SPJM or toolbox talk
7 IP’s right hand got Negligence of the IP suffered a fractured Accident High
caught inside the tong’s professional safety finger and had to (critical)
jaw while breaking out measures, lack of undergo 3 weeks for
3½00 drill pipe training, inadequate recuperating
supervision, human
error due to lack of
concentration to hold
tong from safe positions,
inadequate
communication, and no
SPJM or toolbox talk
Continued
10 IP walking near to the Inadequate 4 weeks medical Accident High
rotary table where there housekeeping and recuperation for a (critical)
was some spillage of cleaning processes, the fractured right lower leg
OBM fluids as a result of absence of warning
connections breakout signs, and lack of
that caused his slipping, professionalism
he twisted his ankle
falling to the rig floor
ARTICLE IN PRESS
11 A 4½00 tubing fell from Negligence of the IP spent 4 weeks away Accident High
the edge of the pipe rack proper safety from work recuperating (critical)
on a roustabout’s left procedures, lack of from a fractured toe on
foot training, inadequate the left foot
supervision, human
error caused by lack of
concentration,
inadequate
communication. Lack
of PJSM and toolbox
talk and stoppers at the
end of the rack was not
in place
14 IP handled a slip by its Negligence of the IP spent 2 weeks away Accident High
handle while attempting proper safety from work recuperating (critical)
to set the drill pipe in a procedures, inadequate from the injury that
hole. The body of the toolbox talk, inadequate affected his fingers
elevator dropped down training, inadequate
the hole while the driller supervision, human
attempted to lower the error due to lack of
drill pipe and the concentration, and
elevator. The body of inadequate
ARTICLE IN PRESS
the elevator fell on the communication
handle of the slip
trapping the IP’s right
hand causing injury to
two of his fingers
15 There was a failure in Negligence of proper IP spent 4 months away Catastrophic Medium
the snake line on which safety measures, from work recuperating
the last wrap of the drill inadequate training, from a fractured wrist
line was spooled from inadequate and shoulder
the traveling block. The maintenance, and a poor
consequence of this was visual inspection
the drop of the 1½00 drill
line with a height of
10 m; it struck an IP on
the left arm causing
serious injury
Continued
16. IP in the process of Negligence of the IP spent 3 weeks away Accident High
removing the slips with proper safety from work for (critical)
his left hand and by procedures, inadequate recuperating from a
mistake he inserted his training, no toolbox or fractured thumb
right hand into one of training, inadequate
the jaws of a tong, and supervision, human
while lifting the slips, he error due to a lack of
pressed the jaws and the concentration, and
ARTICLE IN PRESS
tong shut in error. This inadequate
caused an injury to the communication
thumb on his right hand
17 IP in error activated the Negligence of the IP spent 4 weeks away Accident Medium
rotary belt of a washing proper safety procedures from work recuperating (critical)
machine gun while an in the workplace, from the injury on his
electrician held it. The inadequate training, fingers
rotary belt started to spin inadequate
pulling the electrician’s communication, human
finger into the pulley error due to lack of
concentration, and
inadequate supervision
18 IP with a tong, placed Negligence of the IP spent 3 weeks away Accident High
his right hand into the proper safety from work (critical)
tong’s jaws in error procedures, inadequate
while attempting to fit a training, inadequate
3½00 drill pipe into it. supervision, human
His little finger was error due to lack of
accidentally crushed concentration and
between the back of the inadequate
jaw and the support arm communication. Lack
ARTICLE IN PRESS
of toolbox talk and
PJSM
19 IP’s hand got trapped Negligence, inadequate IP spent 3 weeks away Accident High
between the elevator training, inadequate from work. His right (critical)
and the elevator links as supervision, human index finger was
he attempted to remove error due to poor crushed in this accident
the sling from the joint concentration, and
after hooking the casing inadequate
joint to the elevator communication. Lack
of toolbox talk and
PJSM
Continued
20 Mud tester was standing Not following the safe A deep cut exposing the Accident Low
on top of a working procedures. Lack of bone and resulting in (critical)
mud pump, performing toolbox talk multiple fractures to his
a cleaning job of piston ankle and foot
Lack of training
chamber using a wash
his right foot slipped Lack of supervision
inside the piston cavity
Lack of concentration
ARTICLE IN PRESS
(human error)
Lack of communication 10 weeks off work
ARTICLE IN PRESS
quantitative risk assessment. In this approach, ALNabhani considered the

occurrence of an accident as a result of interaction of many random, physical,
or latent components in the system or its subsystem in sequential or non-
sequential order, which will lead to system degradation and eventually to
an accident. The proposed approach creates an integrated framework that
aids the dynamic prediction and updating data related to abnormal events
or the introduction of new evidence, information, and deviation in the
operation process with the use of Bayes’ theorem. The essence of this
approach is to develop a system to aid the monitoring of operational and
occupational risks in a dynamic pattern. This will promote the development
of effective and protective measures to reduce the imminent risks related to
the oil and gas industry.
7.1 The Working Principle of Dynamic Accident Modeling

and Quantitative Risk Assessment Using the SMART
Approach
The SMART approach is a hybrid of SHIPP methodology and rational the-
ory. The SHIPP methodology is a generic framework used to identify, eval-
uate, and model process accidents (Rathnayaka, Khan, & Amayotte, 2011,
2013). The rational theory is used to model dynamically the behavior of the
possible root and passive causes that contribute to accidents. It is based on the
logical, inductive, and probabilistic analyses. The basic premise of rational
theory is that an accident occurrence is a result of joint conditional behavior
among different parameters. By integrating the SHIPP methodology and
rational theory, the SMART approach is able to: (i) determine the interac-
tions between different components in both the system and its subsystem,
and the identification of events that could potentially cause risks in the oil
and gas extractions and production processes; (ii) identify and analyze all pos-
sible operational and occupational hazards; (iii) create thousands of models to
represent different possible accident scenarios based on the effectiveness of the
safety barriers with the use of the Monte Carlo simulation; (iv) predict and
update the failure probabilities of the identified safety barriers; and (v) promote
the proactive management procedures in the oil and gas industry associated
with risks, this will be done by employing adaptive risk management or precau-
tionary principle methodologies. Fig. 3 depicts the SMART approach flow-
chart, which represents the oil and gas operational and occupational risk
modeling. A detailed representation of how this approach has been adopted
was demonstrated and validated by ALNabhani et al. (2017a, 2017b) using a case
study of TENORM occupational exposure scenarios in the oil and gas activities.
ARTICLE IN PRESS
60 Khaled ALNabhani
Fig. 3 Dynamic accident modeling and quantitative risk assessment using the SMART
approach.
8. CONCLUSION
Overall, the oil and gas operations are potentially a source of detri-
mental environmental and occupational that include but not limited to off-
shore drilling activities. It is rather unfortunate that the measures to facilitate
safety risk assessments and the deployment of the management tools in the
industry as earlier mentioned are not sufficient enough to mitigate, control,
and prevent accidents because they are classical and they have not been
ARTICLE IN PRESS
developed based on proper scientific evaluation. Therefore, a new method-

ology of dynamic modeling and quantitative risk assessment was proposed.
This model was based on the SMART approach that integrates the SHIPP
methodology and rational theory. This approach provided a systematic plat-
form and comprehensive risk assessment framework based on safety barrier
performance evaluation and dynamic updating of abnormal events in the
system and its subsystems. The SMART approach provides a systematic
framework for modeling, predicting, updating, and managing the risks dur-
ing oil and gas extraction and production phases.
Based on the available analytical studies and accident report, it is apparent
that there is a need to develop adequate safety measures that will prevent
operational and occupational risks during processes such as extractions
and production of oil and gas, while offshore drilling operations are being
carried out. It is equally important to find an effective scientifically based
solution to conduct studies on human behavior from the psychological per-
spective. It is necessary to promote the development of this effort because
occupational accidents are still happening and this will have negative impacts
on the society. Future studies should be carried out using advanced dynamic
modeling and quantitative risk assessments, which involve contributions
from academic and technical experts who should play active roles in the
oil and gas HSE management system.
REFERENCES
ALNabhani, K., Khan, F., & Yang, M. (2015). Review: Technologically enhanced naturally
occurring radioactive materials in oil and gas production. Process Safety and Environmental
Protection, 99, 237–247.
ALNabhani, K., Khan, F., & Yang, M. (2016a). Scenario-based risk assessment of
TENORM waste disposal options in the oil and gas industry. Journal of Loss Prevention
in the Process Industries, 40, 55–66.
ALNabhani, K., Khan, F., & Yang, M. (2016b). The importance of public participation in
legislation of TENORM risks management in the oil and gas industry. Journal of Process
Safety and Environmental Protection, 102, 606–614.
ALNabhani, K., Khan, F., & Yang, M. (2017a). Dynamic modeling of TENORM exposure
risk in the oil and gas industry using SMART approach. Journal of Petroleum Exploration
and Production Technology, 3, 1–14.
ALNabhani, K., Khan, F., & Yang, M. (2017b). Management of TENORMs produced dur-
ing oil and gas operation. Journal of Loss Prevention in the Process Industries, 47, 161–168.
Al-Rubaee, F., & Abdullah Al-Maniri, A. (2011). Work related injuries in an oil field in
Oman. Oman Medical Journal, 26(5), 315–318.
Center for Catastrophic Risk Management—CCRM. (2010). Final report on the investigation of
the macondo well blowout. Performed by Deepwater Horizon Study Group, pp. 1–121.
Center for Disease Control and Prevention—CDC. (2013). Fatal injuries in offshore oil and gas
operations—United States, 2003–2010. Morbidity and mortality weekly report (MMWR).
Available from https://www.cdc.gov/mmwr/preview/mmwrhtml/mm6216a2.htm.
Accessed 10 March 2017.
ARTICLE IN PRESS
62 Khaled ALNabhani
Chernov, D., & Sornette, D. (2016). Examples of risk information concealment practice.
In Man-made catastrophes and risk information (pp. 122–124). Springer International
Publishing Switzerland [Chapter 2].
International Business Publications—IBP. (2009). Oman economic and development strat-
egy handbook. In Strategic information and program 2020. Washington, DC: International
Business Publications, pp. 1–281.
International Labor Organization. (2017). Available from http://www.ilo.org/global/
topics/safety-and-health-at-work/lang–en/index.htm. Accessed September 2017.
Mannion, D. (2013). In The capsize of the drillship Seacrest. Coastal and ocean engineering under-
graduate student forum, COASTAL. PT-13, St. John’s, NL: Faculty of Engineering and
Applied Science, Memorial University.
Naess, A., Haagensen, P., Moan, T., & Simonsen, T. (1982). In Investigation of the Alexander
L. Kielland failure—Metallurgical and fracture analysis. Offshore technology conference, 3–6 May,
Houston, TX.
Rathnayaka, S., Khan, F., & Amayotte, P. (2011). SHIPP methodology. Predictive accident
modelling approach. Part I. Methodology and model description. Process Safety and Envi-
ronmental Protection, 89, 151–164. https://doi.org/10.1016/j.psep.2011.01.002.
Rathnayaka, S., Khan, F., & Amayotte, P. (2013). Accident modelling and risk assessment
framework for safety critical decision-making: application to deep-water drilling oper-
ation. Journal of Risk and Reliability, 227, 1–20.
Sorkhab, R. (2007). The king of giant fields. GeoExPro, 4(7).
Whelan, S. (2013). In Petrobras P-36 accident-Rio de Janeiro, Brazil. Coastal and ocean engineering
undergraduate student forum, COASTAL. PT-13, St. John’s, NL: Faculty of Engineering
and Applied Science, Memorial University.
Wilcutt, T., & Harkins, W. (2011). Porthole to failure. The sinking of the ocean ranger. Available
from https://sma.nasa.gov/docs/default-source/safety-messages/safetymessage-2011-
12-12-thesinkingoftheoceanranger-vits.pdf?sfvrsn¼4. Accessed 26 September 2016.
CHAPTER SIX
Safety of Offshore Topside

Processing Facilities:
The Era of FPSOs and FLNGs
Nima Khakzad1, Genserik Reniers
Faculty of Technology, Policy, and Management, Delft University of Technology, Delft, The Netherlands
1
Corresponding author: e-mail address: n.khakzadrostami@tudelft.nl
Contents
1. Introduction 269
2. Offshore Topside Facilities 270
3. Floating Production, Storage, and Offloading Vessels 272
3.1 FPSO 272
3.2 FLNG 278
4. Conclusions 285
References 285
1. INTRODUCTION
The need for more fossil energy resources has resulted in an ever-
increasing offshore operations including drilling, extraction, producing,
and processing of oil and natural gas. Forced by the extraction and depletion
of the most of shallow water recourses, the pursuit of oil and gas resources
has shifted toward deep water and ultradeep water operations.
The depth of water, which in most cases makes it impossible to employ
fixed platforms, from one hand and the remote locations of deep-water off-
shore operations, which are hundreds of kilometers away from shore, from
the other hand have resulted in an outgrowth of floating production, stor-
age, and offloading vessels. Such vessels, depending on the type of substances
they process, i.e., crude oil or natural gas, are usually referred to FPSO and
FLNG vessels, respectively.
FPSOs have been in operation for almost two decades now (Leonhardsen,
Ersdal, & Kvitrud, 2001), but the first FLNG, Shell’s Prelude FLNG, just came
#
270 Nima Khakzad and Genserik Reniers
into operation in 2017, 475 km north–northeast of Broome, Western

Australia. Longer than four soccer fields, Prelude FLNG is the largest
offshore floating facility ever built, hosting more than 600 staff, and able
to produce 117% of Hong Kong’s annual natural gas demand.
With the exclusion of long subsea pipelines and large onshore facilities,
FPSO and FLNG vessels not only avoid the installation cost of floating and
semisubmersible platforms but also lower the transportation cost since the
produced oil and gas can directly be transported via sea to destination facil-
ities onshore. However, such floating facilities also present numerous risks,
including multiphase jet and spray fires, cryogenic releases, possibility of
large deflagrations through to escape paths, anoxia hazards, mooring, and
collision impacts (Jones, 2014).
Compared to standard offshore facilities (discussed in Section 2), the haz-
ard identification and safety assessment of FPSOs and FLNGs will be more
challenging due to their two key differences, that is, their size and the larger
range of release scenarios. A thorough comparison of techniques for hazard
identification and risk assessment of FPSO/FLNG vessels, such as fire risk
assessment, cryogenic risk assessment, explosion risk assessment, and quan-
titative risk assessment, can be found in Jones (2014).
In this chapter, we aim to point out safety challenges faced with the
application of FPSO and FLNG vessels. In Section 2, offshore topside facil-
ities are described, including fixed platforms, compliant towers, tension leg
platforms, SPAR platform, and FPSOs/FLNGs. Section 3 is devoted to the
description of FPSOs/FLNGs in more detail along with safety issues and
previous attempts to safety assessment and risk analysis of such vessels. Con-
clusions are in Section 4.
2. OFFSHORE TOPSIDE FACILITIES

Offshore topside facilities can be divided to two main categories: dril-
ling rigs and production facilities. Offshore topside facilities based on their
application to shallow, deep, and ultradeep waters are categorized in three
general types as fixed platforms (jackup rigs) for use in shallow waters up to
300 ft, semisubmersible platforms for use in waters more than 300 ft deep,
and FPSOs and FLNGs for use in waters over 10,000 ft deep. Different types
of offshore topside facilities have been depicted in Fig. 1 (Americas Offshore
Energy, n.d.):
• Fixed Platforms (FP), which are supported by piles on the seabed,
with a deck on top for crew, the drilling rig, and production facilities.
Safety of Offshore Topside Processing Facilities 271
Fixed Platform Compliant Tower Tension Leg Platform Mini-Tension Leg

(FP) (CT) (TLP) Platform
(Mini-TLP)
B
SPAR Platform Floating Production Shuttle Floating Production, Storage,
(SPAR) System Tanker and Offloading System
(FPS) (FPSO)
Subsea System
(SS)
Fig. 1 Different types of offshore facilities (http://www.americasoffshoreenergy.com/

#/?section¼producing-offshore).
The fixed platform is economically feasible for installation in water

depths up to 1500 ft.
• Compliant Tower (CT) consists of a narrow, flexible tower and a piled
foundation that can support a conventional deck for drilling and produc-
tion operations. Compared with FP, CT withstands large lateral forces
and is usually used in water depths between 1000 and 2000 ft.
• Tension Leg Platform (TLP) consists of a floating structure held in place

by vertical, tensioned tendons connected to the sea floor. TLPs can be
used in waters up to 4000 ft deep.
• SPAR Platform (SPAR) consists of a large diameter single vertical cylinder
supporting a deck. SPARs are usually used in water depths up to 3000 ft.
• Floating Production System (FPS) consists of a semisubmersible unit
anchored in place with wire rope and chain, or can be dynamically posi-
tioned using rotating thrusters. Production from subsea wells is trans-
ported to the surface deck through production risers. FPS can be used
in ultradeep water.
• Floating Production, Storage, and Offloading System (FPSO) is a large
tanker type vessel. It is used to process and stow production from subsea
wells and to offload the stored oil to a smaller shuttle tanker. The shuttle
tanker then transports the oil to an onshore facility for further processing.
FPSOs are suitable for deep water areas where a pipeline infrastructure
does not exist.
3. FLOATING PRODUCTION, STORAGE, AND

OFFLOADING VESSELS
3.1 FPSO
An FPSO is a floating production storage and offloading, aimed at the devel-
opment of small and/or remote oil and gas fields in deeper water; it does not
need expensive subsea oil pipelines to onshore (Fig. 2).
The module layout of a typical FPSO has been depicted in Fig. 3.
A FPSO receives production fluids from subsea oil reservoirs via risers,
Fig. 2 FPSOA OSX-1 at Rio de Janeiro Coast. Image courtesy of Edersguerri.

1 5 4 4 3 7 7
2 1 9
3 4 7 6 8
6 8
1 Utilities, chemicals, 3 Laydown area 6 Oil treatment 9 Turret

and methanol Utilities, chemicals,
2 Acommodation/office 4 and methanol 7 Gas treatment
HP/LP scrubber
Grated floor 5 Power 8 and flare
generation
Fig. 3 Schematic of a typical FPSO’s module layout (Suardin, McPhate Jr, Sipkema,
Childs, & Mannan, 2009).
which is separated on the deck into oil, gas, and water. The oil is then
offloaded to an oil tanker. The produced gas is exported, reinjected, or
combusted (Suardin et al., 2009). Compared to other offshore platforms
depicted in Fig. 1, an FPSO is faster to build, can operate at different water
depths, and can easily be relocated (Shimamura, 2002).
Fires and explosions have been identified as major potential hazards for
FPSO (Table 1), and thus similar safety measures and fire protection systems
used at offshore oil and gas facilities (HSE, 2009) can presumably be used to
prevent and mitigate fires and explosions. However, limitations in the space
and weight of the FPSO may pose more constraints on the type and siting of
safety measures (e.g., the design and sizing of fire water pumps as pointed out
by Suardin et al., 2009). Besides, fire safety systems need to be able to cope
with the forces caused by the FPSO’s movements, need to have a certain
level of flexibility, and must meet stringent anticorrosion requirements.
Passive fire protection (PFP), also known as fireproof coating, is the most
common way used to protect main structural elements that support walk-
ways, open escape routes, and process vessels containing hydrocarbon
(Friebe, Beom-Seon, & Yanlin, 2014; HSE, 2009). As identified by HSE
(2009), PFP is aimed at providing up to 2 h fire resistance for fire and blast
walls, including covered escape routes such as tunnels on FPSO’s, especially
in case of jet fires and pool fires.
PFP technically takes priority over active fire protection systems such as
sprinkler systems and water deluge systems due to their passive performance
(no need for detection and actuation systems, and thus lower failure rates),
and lower maintenance and inspection costs. However, fireproof coating
materials are susceptible to physical damage and water ingress which may
decrease their efficiency (lower fire resistance) or lead to complete
unavailability (HSE, 2009; Landucci, Argenti, Tugnoli, & Cozzani, 2015).
Table 1 FPSO Modules in Fig. 3 and Relevant Accident Scenarios (Suardin et al., 2009)
Module Equipment Included Hazards
Oil treatment Separators and pumps Jet fire, pool fire,
explosion
Glycol regeneration/fuel Separators, contractor, and Jet fire
gas system/metering compressors
Power generation Natural gas power generation Jet fire, pool fire,
and diesel powered explosion
Flare system High pressure and low pressure Jet fire, pool fire,
scrubber for oil and gas explosion
Gas compression systems Compressors Jet fire, pool fire,
explosion
Flash gas compression Scrubbers and compressors Jet fire, pool fire,
explosion
Risers Oil and gas risers Jet fire, pool fire,
explosion
High-performance fireproofing materials, such as intumescent, vermic-

ulite sprays, high performance cementitious materials, and silica blankets, are
normally rated to offer a 2-h fire protection with a high efficiency
(s ¼ 0.999), even in case of extreme heat radiations, e.g., 200 kW/m2
(Gomez-Mares, Tugnoli, Landucci, & Cozzani, 2012). PFP is already in
place and does not require external activation; thus, ignoring the external
loads and environmental deteriorating processes (e.g., corrosion or water
ingress) an optimistic unitary availability can be considered for such barriers
(i.e., probability of failure on demand, PFD ¼ 0.0).
In case of an effective performance, the fireproof coating adds an extra time
to failure (ttfp) to the time to failure of the unprotected process vessel (ttfo), thus
delaying the failure of the process vessel as ttf ¼ ttfo + ttfp. As such, the failure
probability of the protected vessel (or structural elements) would decrease.
Considering, for example, the failure probability of atmospheric and pressur-
ized process vessels exposed to external heat radiation as (Cozzani et al., 2013):
Pressurized vessels : ln ð ttf Þ ¼ 0:95 ln ðQÞ + 8:85 V 0:032

Atmospheric vessels : ln ð ttf Þ ¼ 1:13 ln ðQÞ 2:67 10ð5Þ V + 9:9

ttf
Y ¼ 12:54 1:85 ln
60
Pr ¼ ΦðY 5Þ
where ttf is the time to failure (s); Q is the received heat radiation (kW/m2);
V is the process vessel’s volume (m3); Y is the probit value; Pr is the failure
probability of the vessel; Φ(.) is the cumulative standard normal distribution.
Ideally, ttfp ¼ 120 min (rating time), but the fireproof coating deteriorates
over time due to fire exposure, environmental and chemical activities (expo-
sure to sea water and humidity), and thus not maintaining its initial protec-
tion integrity.
In case of low performance fireproof coating or deteriorated coating, a
percentage α of ttfp is usually considered as fire resistance (e.g., α ¼ 0.25 in
Khakzad, Landucci, Cozzani, Reniers, & Pasman, 2018). The impact of fire-
proof coating on exposed structures and process vessels can be modeled
using an event tree in Fig. 4 (Khakzad et al., 2018).
Water deluge is an active fire protection system aimed at providing
a spray curtain (usually salt water, which causes nozzle blockage and
internal corrosion) in order to shield the target vessel from a primary fire
(HSE, 2009). Similar to other active fire protection systems, a water
deluge consists of a gas, heat and flame detection, logic solver, and an
actuation system, each with their own reliability, availability, and effi-
ciency. In addition to the previous components of a water deluge system,
large pumps and pipework add more complexity to the system compared
with PFP.
As pointed out in HSE (2009), on installations with minimum facilities
and limited space (FPSOs implied), a general area protection system such as
water deluge will provide a higher level of personnel protection than other
Fig. 4 Performance evaluation of fireproof coating used to protect a target equipment

from external heat radiation (Khakzad et al., 2018).
more specialized systems. However, water deluge is ineffective against jet

fires but is highly effective against pool fires. Water deluge systems are
applied on target vessels, typically pressurized vessels, and are activated in
case of fire. Such as sprinkler systems, due to process or internal failures, this
type of safety barriers might not respond on demand, which can be taken
into account via a PFD.
If effectively designed and maintained, and successfully activated, the sys-
tem would completely shield the target vessel, reducing radiation on the wall
to a negligible incoming heat flux. However, as demonstrated in previous
studies (Finucane & Pinkney, 1988; Roberts, 2004), even if the safety barrier
is successfully activated, a fraction of heat radiation can be received by the
target vessel in case of inappropriate design or lack of maintenance. In the
present study a 50% fraction (i.e., Qr ¼ 0.5Qo) was assumed. This can also
be considered as an implicit ineffectiveness of the safety barrier. The impact
of water deluge system on exposed structures and process vessels can be
modeled using an event tree in Fig. 5 (Khakzad et al., 2018), where
PFD ¼ 4.43 10–2 (Landucci et al., 2015).
Fig. 6 depicts the amount of water needed by water deluge system for
different modules of a FPSO (Suardin et al., 2009).
Since explosion is also a credible accident scenario for FPSOs, fire and
blast walls are used to separate the process area from the other areas as
depicted in Fig. 7 (Kang et al., 2017).
Fig. 5 Performance evaluation of water deluge system used to protect a target equip-
ment from external heat radiation (Khakzad et al., 2018).
Maximum water required for deluge system for each module in FPSO
10,000 Back to Water
Calculation
9000
Risers
8000
Water application rate (m3/hr)
Flash gas compression

7000 package
Gas compression system
6000
Flare system
5000
4000 Power generation
3000 Glycol regeneration/fuel gas

system/metering
2000 Oil treatment 2
1000
Oil treatment
0
FPSO
Fig. 6 Water required by water deluge systems on FPSO (Suardin et al., 2009).
een
all betw
Blast W d Utility
a n
Process
een
all betw
Blast W c ess
nd Pro
Turret a
Fig. 7 Separation of process area from the other areas using blast walls (Kang, Choi,
Choi, Ryu, & Lee, 2017).
Aside from the fire and explosion hazards, collisions, green water inci-
dents, mooring line failures, pitting corrosion in cargo tanks, cracking of rails
in turret area, and loss of heading control have been reported as other incidents
for FPSOs. Fig. 8 depicts the collision frequency of FPSOs compared to other
Collisions/operational years 0.2
0.15
0.1
0.05
0
ket
s
uni
ts S' ys Us
Jac le GB buo /FS
obi ng PS
O
M Loadi F
Fig. 8 Collision frequencies in the Norwegian Continental Shelf from 1982 to 2000
(Leonhardsen et al., 2001).
offshore facilities on the Norwegian Continental Shelf (Leonhardsen et al.,

2001). The collisions have occurred both during cargo offloading operations
and mooring of FPSOs mostly between loading platforms and tankers.
For mooring line failures, incorrect heat treatment and fatigue crack
were to blame as the causes. However, loss of heading control should also
be regarded as a concern due to the possibility of excessive twisting and ten-
sion of mooring lines. Cracking of welds between cargo- and ballast tanks
has also been reported on the FPSOs. 60% of the cracks were through thick-
ness and have caused oil seepage from the cargo tanks into ballast tanks.
Pitting corrosion in cargo tanks with a maximum depth of 60% of the plate
thickness has also been observed, though only a limited number of cracks
and corrosion are believed to have contributed to the possibility of a signif-
icant accident (Leonhardsen et al., 2001).
3.2 FLNG
Many natural gas resources are located in remote offshore fields, where sub-
sea pipelines structures do not exist or are not economically viable. Floating
liquefied natural gas (FLNG) vessels have been designed to facilitate the pro-
duction, liquefaction, and storage of natural gas at sea (Fig. 9).
The first FLNG begins operations this year off the coast of Northern
Australia over Shell’s Prelude natural gas field. FLNG pumps up natural
gas, storing it within massive storage tanks at the temperature of 162°C.
On a regular basis, storage tanks are off-loaded to gas tankers. When fully
Fig. 9 Shell Prelude FLNG. Image courtesy of Royal Dutch Shell.
Refrigerant LNG
compression –161°C
Pipeline
feeds gas To ships
Gas treatment Heat LNG

condensates impurities exchangers storage
• Carbon dioxide
• Mercury
• Hydrogen sulfide
• Water
Fig. 10 LNG liquefaction process (http://goldborolng.com/about-lng/what-is-lng/).
loaded, the FLNG may contain 600,000 t of liquefied natural gas (LNG).
It also produces around 3.6 million tonnes per year of LNG.
FLNG vessels makes it possible to transfer LNG directly from the floating
facility to a variety of consumers around the world via waterways. The LNG
liquefaction process in onshore LNG plants and FLNG vessel are all but the
same (Fig. 10). The process includes:
• to separate condensates from gas. The gases such as methane, ethane, pro-
pane, and butane are then compressed and sent to the liquefaction unit.
• impurities such as carbon dioxide and hydrogen sulfide are removed
through acid-gas removal column.
• water and mercury are removed from the remaining natural gas through
absorber and regeneration column.
A. Field specific part B. Liquefaction part
A1. Slug A2. Gas/liquid B1. Acid gas B4. Liquefaction B6. Cooling B7. Heating
catcher separation C1~C4 removal system system system
C5~C6 C1~C4
A3. B8. Inert B9. N2
B2. Dehydration B5. Fractionation gas supply supply
Stabilization
C5~C6
B3. Mercury B10. HPU
A4. Condensate removal
Condensate LPG tank LNG tank LNG tank

tank
Well
Fig. 11 Schematic of a typical FLNG’s module layout (Dan, Lee, Park, Shin, & Yoon, 2014).
• nearly pure natural gas is condensed to LNG through a liquefaction sys-

tem, consisting of heat exchangers, expansion valves, and compressors.
A schematic of a typical FLNG’s module layout has been depicted in Fig. 11
(Dan et al., 2014).
Like any other onshore and offshore installations which handle large
inventory of flammable and explosive chemical substances, fires and explo-
sions are the most feared accident scenarios at FPSO and FLNG vessels. As a
result, any equipment which handle, process, store such chemicals, includ-
ing risers, pipelines, separators, heat exchangers, turbines, compressors, and
pumps, can be a point of undesired release and subsequent fires and explo-
sions (Khan & Amyotte, 2002).
LNG is a flammable gas (liquid) which under favorable conditions can
cause fires and explosions. Loss of containment events in form of high pres-
sure gas, LNG, refrigerant, and LPG can give rise to gas dispersion, fire,
explosion, and due to the low temperature of LNG (s162°C) to cryogenic.
The Cleveland East Ohio Gas Explosion which occurred in 1944 after a
leakage from a LNG tank in the East Ohio Gas Company’s tank farm caused
130 deaths (Encyclopedia of Cleveland History, n.d.). The liquefaction pro-
cess, in particular, takes place mostly under high temperature, high pressure
conditions which increase the likelihood and severity of potential accident
scenarios.
In case of LNG spillage, depending on factors such as the medium (on
water or on the ground), possibility of immediate or delayed ignition,
and whether the release takes place in a confined area, a number of accident
scenarios can be envisaged as depicted in the event tree in Fig. 12. Among
confined area
Dispersion in
Immediate
Delayed
medium
Spillage
ignition
ignition
Water Rapid phase
transition
Pool fire/jet
Yes
LNG spillage fire
Yes
Ground
Flash fire
Yes Vapour cloud
No
explosion
No
Dispersion into
No
air
Fig. 12 Event tree analysis for LNG release.
the accident scenarios, rapid phase transition (RPT), also known as cold
explosion, is a phenomenon specific to cryogenic chemicals such as LNG,
where LNG vaporizes violently upon contact with water causing a physical
explosion. During a cold explosion there is no combustion but a huge
amount of energy is released in the form of heat.
Dan et al. (2014) assessed the risk of fire and explosion in a FLNG with a
focus on the LNG liquefaction process units. They considered a number of
release scenarios with the LNG and refrigerant leakages from valves as the
most probable scenarios causing fire and explosion. Risk contours of fire
and explosion for the considered release scenarios have been depicted in
Fig. 13.
Despite the similarities between onshore and offshore LNG plants in
terms of both operations and accident scenarios, the safety of the latter seems
more challenging as, due to usually compact structures and limited space,
application of onshore safety measures such as inherently safer design tech-
niques and safety distances (Khan & Amyotte, 2002), is not easily possible.
Aside from accident scenarios such as fires and explosions which are
common between LNG plants onshore and FLNGs (Dan et al., 2014), there
are several scenarios which can be envisaged mainly due to the floatation of
FLNGs. Among others, the grounding of FLNGs, their collision with
´ 10–4
5
4.5
3.5
2.5
1.5
0.5
0
Fig. 13 Risk contours for fire and explosion at FLNG (Dan et al., 2014).
shuttle tankers during offloading operation, and failure of loading arms are
worth noting (Yeo et al., 2016). However, it should be noted that since the
application of FLNGs is quite new, compared to some 158 accidents
recorded for LNG tankers since 1959 (Vanem, Antao, Østvik, & de
Comas, 2008), there has been no accident reported for FLNGs as the first
FLNG was put into operation just in 2017. According to Vanem et al.
(2008), collision and grounding have accounted for around 90% of total
accidents reported for LNG tankers. Likewise, as reported in Yeo et al.
(2016), Lloyds shipping accident database (Blake, 1960), collision, leakage
of LNG, and foundering have been among the most feared accident scenar-
ios during offloading operations.
A collision can occur between an FLNG and a shuttle tanker or between
the FLNG and the port. A poorly designed mooring system or the failure of
the mooring system can result in instability of FLNG (and also shuttle tanker)
due to either the environmental forces such as wind, waves, and tides or
waves generated by other passing ships. A mooring system consists of
breasting, mooring dolphins, and a loading platform (Yeo et al., 2016). Large
tankers use steel wires or steel wires with nylon tails as mooring lines. Several
safety barriers are employed to dampen the impact of collisions among
which fenders are very common. Fig. 14 depicts a rubber fender for this pur-
pose, being placed between the LNG carrier and the port berth.
Leakage of LNG due to the failure of loading arms is another envisaged
accident scenario. Loading arms are to connect the manifolds of the LNG
carriers so as to transport LNG from one to another. A loading arm comprises
Fig. 14 Rubber fenders (http://www.yokohama-fenders.gr/yokohama-fenders).

Fig. 15 Loading arms. Image courtesy of Bysalt: https://en.wikipedia.org/wiki/Marine_

loading_arm.
a riser section, inboard and outboard arm sections, as well as a counterweight

to balance the inboard and outboard arms (Fig. 15). Loading arms failure can
lead to LNG leakage. To examine for leaks, the manifolds are usually pressur-
ized to around 5 bar for a duration of 5 min after the connection of loading
arms and before LNG starts to flow within the loading arms for transportation.
In case of a leakage, the emergency shutdown system (ESD) can shut down
the transfer process locally or totally.
Excessive movement of LNG careers, either the FLNG or the shuttle
tanker, beyond the operating envelope of the loading arms due to strong winds
or high waves may lead to the failure of loading arms. To prevent from such
excessive movements, the arms are secured by an arm drive that restricts move-
ment during the navigation and connection processes (Seamanship, 2008).
The grounding of FLNGs as floating vessels can be considered as another
envisaged failure mode which can give rise to the hull damage (Yeo et al.,
2016). Damage to the hull of a vessel, if severe enough, may cause a breach to
the ballast system.
Like most of other types of ships, LNG tankers have two hulls so as to
protect the cargo in the event of a collision, grounding, or a terrorist act
(GlobalSecurity.org, n.d.). Tanker grounding has reportedly been caused by
undetected sediment, coral reef, or irregular seabed topography (Cole, 2009;
Professional Mariner, 2010; Reuters, 2015; The Maritime Executive, 2015).
In the worst grounding accident of a loaded LNG tanker carrying
99,500 m3 of LNG, the El Paso Kayser ran onto rocks and grounded in
the Straits of Gibraltar in June 1979. The tanker suffered heavy bottom dam-
age over the whole length of the cargo spaces, as well as flooding to the star-
board double bottom and wing ballast tanks. However, the membrane cargo
containment was not breached, and no liquefied natural gas was spilled
(GlobalSecurity.org, n.d.).
4. CONCLUSIONS
There is a number of key features in the process and layout for (LNG)
floating production, storage, and offloading vessels that require different or
modified approaches for hazard identification and safety assessment. This is
mainly due to the size and the variation in the release scenarios from one
hand, and floatation of such vessels from the other hand which in turn
can give rise to issues such as collision and grounding.
Although the accident scenarios such as mooring failure, grounding, and
collision and ensuing hydrocarbon release are among likely scenarios (com-
parable with other mobile units and loading buoys), fires and explosions
are the most feared accident scenarios at topside facilities, including FPSOs
and FLNGs, due to a variety of extremely flammable and explosive hydro-
carbons. In addition to fires and explosions, in the case of FLNGs, an spill of
LNG on water can also give rise to RPT—also known as cold explosion—
with a huge amount of heat release.
Taking into account the design, size, and novel and inherently different
features compared to other offshore facilities, safety risk assessment and man-
agement of FPSO and FLNG vessels demand for approaches that account for
varying environmental forces and operating conditions in addition to pre-
viously well-established design practices and risk assessment techniques.
For FLNG, especially due to the young technology and lack of historical
data, dynamic techniques, for example, based on Bayesian belief network,
would be needed so that the level of risk can be updated in a real-time fash-
ion as precursor data in form of equipment malfunction, collisions, minor
release, environmental changes, etc., becomes available.
REFERENCES
Americas Offshore Energy. n.d. Available online from: http://www.americasoffshoreenergy.
com/#/?section¼producing-offshore.
Blake, G. (1960). Lloyd’s register of shipping, 1760–1960. Lloyd’s Register.
Cole, W. (2009). Navy ship grounding detailed. The Honolulu Advertiser.
Cozzani, V., Antonioni, G., Khakzad, N., Khan, F., Taveau, J., & Reniers, G. (2013). Quan-
titative assessment of risk caused by domino accidents. In: G. Reniers & V. Cozzani
(Eds.), Domino effects in the process industries, (pp. 208–228). UK: Elsevier.
Dan, S., Lee, C. J., Park, J., Shin, D., & Yoon, E. S. (2014). Quantitative risk analysis of fire
and explosion on the top-side LNG-liquefaction process of LNG-FPSO. Process Safety
and Environmental Protection, 92, 430–441.
Encyclopedia of Cleveland History, n.d., Indiana University Press. Available from: https://
case.edu/ech/articles/e/east-ohio-gas-co-explosion-and-fire/.
Finucane, M., & Pinkney, D. (1988). Reliability of fire protection and detection systems, SRD
R431. Edinburgh (UK): United Kingdom Atomic Energy Authority, University of
Edinburgh.
Friebe, M., Beom-Seon, J., & Yanlin, J. (2014). A parametric study on the use of passive fire
protection in FPSO topside module. International Journal of Naval Architecture and Ocean
Engineering, 6(4), 826–839.
GlobalSecurity.org. n.d. LNG Tanker Safety. Available online from: https://www.
globalsecurity.org/military/systems/ship/tanker-lng-safety.htm.
Gomez-Mares, M., Tugnoli, A., Landucci, G., & Cozzani, V. (2012). Performance assess-
ment of passive fire protection materials. Industrial and Engineering Chemistry Research,
51(22), 7679–7689.
HSE. (2009). Provision of active fire protection on offshore installations offshore information sheet no.
5/2009. Available online from http://www.hse.gov.uk/offshore/infosheets/is5-2009.htm.
Jones C. Lessons learnt from completing formal safety assessments for FLNG facilities.
Hazards 24, Edinburgh, UK, 7–9 2014.
Kang, K. Y., Choi, K. H., Choi, J. W., Ryu, Y. H., & Lee, J. M. (2017). Explosion induced
dynamic responses of blast wall on FPSO topside: Blast loading application methods.
International Journal of Naval Architecture and Ocean Engineering, 9, 135–148.
Khakzad, N., Landucci, G., Cozzani, V., Reniers, G., & Pasman, H. (2018). Cost-effective
fire protection of chemical plants against domino effects. Reliability Engineering & System
Safety, 169, 412–421.
Khan, F., & Amyotte, P. (2002). Inherent safety in offshore oil and gas activities: A review of
the present status and future directions. Journal of Loss Prevention in the Process Industries, 15,
279–289.
Landucci, G., Argenti, F., Tugnoli, A., & Cozzani, V. (2015). Quantitative assessment of
safety barrier performance in the prevention of domino scenarios triggered by fire. Reli-
ability Engineering and System Safety, 143, 30–43.
Leonhardsen, R. L., Ersdal, G., & Kvitrud, A. (2001). In Experience and risk assessment of
FPSOs in use on the Norwegian continental shelf: Descriptions of events. Proceedings of the
11th international offshore and polar engineering conference, o1. 1. 309-314 (ISOPE). Stavanger,
Norway. June (pp. 17–22).
Professional Mariner. (2010). LNG carrier damages coral reef in Puerto Rico grounding. Available
online from http://www.professionalmariner.com/March-2010/LNG-carrier-damages-
coral-reef-in-Puerto-Rico-grounding/.
Reuters. (2015). UPDATE 1-tanker grounded off Nigeria may siphon LNG to break free. Available
online from http://www.reuters.com/article/lng-nigeria/update-1-tanker-grounded-
off-nigeria-may-siphon-lng-to-break-free-idUSL6N0US41320150113.
Roberts, T. A. (2004). Directed deluge system designs and de-termination of the effective-
ness of the currently recommended minimum deluge rate for the protection of LPG
tanks. Journal of Loss Prevention in the Process Industries, 17, 103–109.
Seamanship, W. (2008). LNG Shipping Knowledge: Support Systems. Standard operations:
Vol. 4. Witherby Seamanship International Ltd.
Shimamura, Y. (2002). FPSO/FSO: State of the art. Journal of Marine Science and Technology, 7,
59–70.
Suardin, J., McPhate, J., Jr., Sipkema, A., Childs, M., & Mannan, S. (2009). Fire and explo-
sion assessment on oil and gas floating production storage offloading (FPSO): An effec-
tive screening and comparison tool. Process Safety and Environmental Protection, 87(3),
147–160.
The Maritime Executive. (2015). LNG Carrier Aground in Nigeria. Available online from
https://maritime-executive.com/article/lng-carrier-aground-in-nigeria.
Vanem, E., Antao, P., Østvik, I., & de Comas, F. D. C. (2008). Analysing the risk of LNG
carrier operations. Reliability Engineering & System Safety, 93, 1328–1344.
Yeo, C., Bhandari, J., Abbassi, R., Garanya, V., Chai, S., & Shomali, B. (2016). Dynamic risk
analysis of offloading process in floating liquefied natural gas (FLNG) platform using
Bayesian network. Journal of Loss Prevention in the Process Industries, 41, 259–269.
CHAPTER SEVEN
Offshore Pipelines—Elements
of Managing Risk
Shawn Kenny1
Department of Civil and Environmental Engineering, Faculty of Engineering and Design, Carleton University,
Ottawa, ON, Canada
1
Corresponding author: e-mail address: shawn.kenny@carleton.ca
Contents
1. Overview 289
1.1 Scope 289
1.2 Offshore Pipelines: A Brief Historical Perspective 290
2. Offshore Pipeline Assets: The Context for Managing Risk 293
3. Elements of a Pipeline Risk Management Framework 303
3.1 Overview 303
3.2 Project Management Risk 303
3.3 Technical Risk: Pipeline Engineering Design 305
3.4 Operational Risk: Inspection, Monitoring, Integrity Assessment, and
Management 313
4. Improving Safety Culture 313
References 316
Further Reading 324
1. OVERVIEW
1.1 Scope
For offshore pipeline systems, the integration of risk management tools
within engineering and business practices presents challenges (e.g., data col-
lection, synthesis, uncertainty) and opportunities (e.g., governance, safety,
return on investment). Risk management of assets should be an integrated
process and strategy for all organizations to translate historical knowledge
into prediction of expected future performance, and to support informed
tactical (e.g., maintenance activity) and strategic (e.g., risk philosophy)
decision-making through risk control measures. This approach can provide
perspective and insight among all stakeholders (e.g., consultants, operators,
#
290 Shawn Kenny
regulators) for common alignment of a consensus path forward in order to

achieve technical and economic goals while mitigating potential adverse
effects and, potentially, realizing competitive advantage through optimizing
value.
This chapter explores the principles and engineering practices for man-
aging risk with application to the design, construction, and operation of off-
shore pipelines. There are many factors that can be considered including
project and technical risk, as examined in this chapter, as well as individual,
societal, environmental, and financial risk, which are not addressed in this
discussion (e.g., Bai & Bai, 2014b; Jordaan, 2011). Although pipelines are
recognized as a transportation system, the study does not address the risk
evaluation or asset management of specific components (e.g., assemblies,
fittings, flanges, valves, etc.). The discussion addresses the risk analysis frame-
work, with a focused viewpoint on pipeline mechanical integrity issues,
through knowledge of a potential event (i.e., hazard identification and
characterization), estimation of the likelihood or chance (i.e., frequency
analysis) the event may occur, and assessment of the potential consequence
(i.e., impact) if the event had occurred.
A higher-level overview is used to address options analysis and risk con-
trol as these issues are dependent on specific pipeline systems, internal oper-
ating company business and risk models, and regulatory environments. The
connectivity with risk-based inspection (RBI) and integrity management
(IM) practices is integrated within the discussion. The context and signifi-
cance of tertiary factors, such as climate change and sociopolitical consider-
ations, will also be explored. Recommendations for strengthening safety
culture will also be addressed.
1.2 Offshore Pipelines: A Brief Historical Perspective

In the oil and gas industry, offshore (subsea) pipelines are used for the trans-
portation of hydrocarbon products within field developments from subsea
wellheads to local subsea and surface production facilities through flowlines
(i.e., infield, intrafield lines); between field developments through gathering
lines (i.e., interfield lines), laterals, and tie-backs; and to end users and mar-
kets (e.g., terminals, tank farms, energy utilities) through transmission (i.e.,
export, trunk lines) pipelines (see Fig. 1). Flowlines transport unprocessed
products (e.g., multiphase oil, gas, water, sand mixture) through relatively
small diameter (typically 305 mm) pipe using flexible, rigid, or bundle con-
figurations over short lengths (<30 km). Export lines, on the other hand,
Offshore Pipelines—Elements of Managing Risk 291
Fig. 1 Schematic illustration of a subsea field development and pipeline network.
transport processed oil or gas products through larger diameter (typically

508 mm) pipe using rigid pipe configurations over longer distances (up
to 1500 km). This classification highlights the interconnected role of pipe-
line systems within field development strategies to meet the project technical
and commercial goals for the delivery of hydrocarbon products. Analogous
to the human cardiovascular system, flowlines are akin to the action of cap-
illaries while export lines are similar to the role of arteries.
From a historical perspective, the Chinese used bamboo to transport nat-
ural gas at low pressure to the capital Peking as early as 400 BC (Hopkins,
2004). One of the first “modern” onshore cast iron pipelines built in
1853 and transported natural gas along a 25-km corridor to Trois Rivières,
Quebec, Canada, and one of the world’s first oil pipelines from Petrolia to
Sarnia in Ontario, Canada (CEPA, 2018). Although short lived, as it was
intended only to support the Allied war effort in the Second World War,
the first offshore pipelines were developed, installed, and operated through
the military Operation PLUTO (PipeLine Under the Ocean) under the
Combined Operations Experimental Establishment (COXE). Early design
and testing started in May 1942 and the installation of two pipeline
configurations, known as HAIS cables (i.e., flexible, layered pipe) and
HAMEL steel pipe (i.e., thick-walled tube), started in August 1942
292 Shawn Kenny
(CombinedOps, 2018). A total of 1250 km (780 miles) of pipe were installed

with 4 pipelines between the Isle of Wight, United Kingdom (UK) and
Cherbourg, France (130 km length), and 17 pipelines laid from Dungeness,
UK to Ambleteuse, France (55 km in length). Although difficulties were
encountered, the engineering accomplishments were significant and the
developments became forerunners of modern technologies including com-
posite flexible pipe, coiled tube (reeled pipe), and reel lay installation
methods. The first commercial offshore pipeline was installed in the Gulf
of Mexico in 1954, more than 100 years after the first onshore pipeline
was built (OM, 2004). Relative to the onshore counterpart, offshore pipe-
lines must address the technical complexities and risk of a dynamic and, at
times, hostile nature of the ocean environment.
Since the 1950s, a significant accumulation of knowledge and experience
with offshore pipelines systems has developed in parallel with technology
advancements, across multidisciplinary fields in science and engineering
(e.g., materials, installation). This has extended deepwater (400 m depth)
pipeline projects in the 1970s toward the recent realization of pipelines
installed within ultradeepwater (>1500 m water depth) environments in
the 1990s (Fyrileiv, Aamlid, Venås, & Colberg, 2013). Offshore pipelines
present engineering challenges for the design, operation, inspection, and
maintenance of these core assets for developing and exporting subsea hydro-
carbon resources.
The pipeline system specification has to address project-specific param-
eters with respect to operational conditions (e.g., high temperature, high
pressure, product phase, and chemistry), hydraulic and flow assurance
requirements (e.g., system deliverability, steady state, transient, and shut-in),
environmental conditions (e.g., water depth, current loads), and, poten-
tially, special project-specific considerations (e.g., seismic load effects, ice
loads, and remote northern latitudes). The engineering design premise
has to consider a number of integrated factors including route selection,
hydraulics and flow assurance, line pipe and materials selection, pressure
containment and mechanical design, corrosion protection, mechanical
integrity and life cycle, constructability, installation, as well as maintenance,
repair, and life cycle asset management.
A detailed exploration of the pipeline engineering design spiral is outside
the scope of this chapter; however, the reader is referenced to several author-
itative resources on the engineering design, construction, and installation of
offshore pipelines (e.g., Bai & Bai, 2014a; Palmer & King, 2008).
2. OFFSHORE PIPELINE ASSETS: THE CONTEXT FOR

MANAGING RISK
Offshore pipelines are a safe and cost-effective mode of hydrocarbon
transport that can compete with other modes of ocean and subsea energy
transport (e.g., FPSO and tanker, gas to wire, gas to liquids) for distances
up to 1500 km (or more) with design life of up to 50 years (Bruschi,
2004; Chyong, Noël, & Reiner, 2010; Cornot-Gandolphe, Appert,
Dickel, & Chabrelie, 2003). The concept selection and options analysis
can have a complex relationship with other factors including characteristics
of the reservoir (e.g., production rate, field life); product (e.g., oil, gas);
delivery requirements (e.g., BBL/day, m3/day, BTUs); economics and mar-
ket pressures (e.g., utilization, market size); design or technical issues
(e.g., current technology limits, emergent technologies and reliability,
CapEx, design life); geographic, physical, and environmental considerations
(e.g., water depth, distance to market, stranded (Grand Banks), northern ice
regimes); and socioeconomic or geopolitical influences (e.g., local benefits,
US Jones Act—Merchant Marine Act of 1920, transnational regulatory or
political aspects); see for example, Bruschi, 2004; Cornot-Gandolphe
et al., 2003; GMI, 2018.
On a global scale, there are more than 3.5 million kilometers of
onshore and offshore pipelines, with approximately 69% located in North
and Central America, 14% in Asia, 8% in Europe, and 9% in the rest of
the world (CIA, 2018). The total length of offshore pipelines in the United
States (US) Gulf of Mexico region is more than 45,000 km (MMS, 2001),
while in the UK sector of the North Sea there is 14,000 km of pipelines
connecting installations to beach terminals (UK HSE, 2016) and in the
adjacent Norwegian sector of the North Sea there is 8800 km of subsea pipe-
lines (NPG, 2017). Since 1966, in the UK North Sea, approximately 2500
individual assets (i.e., pipelines, umbilicals, and cables) with a combined
length exceeding 45,000 km has been installed. Export (trunk) lines account
for 18% of the total number (450 pipelines) and 63% of the total length
(28,350 km) of the North Sea pipeline inventory (UK OGIA, 2013). In con-
trast, Canada has 250,000 km of onshore gathering lines and 117,000 km of
onshore transmission pipelines (NRCan, 2018) but the subsea network is
relatively sparse with 565 km of offshore pipelines (Nova Scotia and
British Columbia) and approximately 100 km of subsea flexible flowlines
294 Shawn Kenny
(Newfoundland and Labrador). Pipeline technology has been at the fore-

front in developing engineered solutions in harsh and challenging environ-
ments (e.g., HTHP reservoirs, ultradeepwater, ice regimes, seismic zones)
for the offshore oil and gas industry.
Recent industry and market trends, such as the development of uncon-
ventional reserves (e.g., shale gas, coal bed methane) and shift toward natural
gas, have provided a catalyst for growth in the gas pipeline infrastructure
market, particularly in the United States and Europe, that is expected to
exceed $2 trillion by 2024 (GMI, 2018). The global consumption of natural
gas is expected to increase by 43% from 2015 to 2040, with an annual con-
sumption of 185 quadrillion BTU (EIA, 2017). By 2040 the demand for nat-
ural gas is projected to be 25% of global consumption with contributions
from petroleum (31%), coal (22%), renewables (17%), and nuclear (5%).
This may increase pressure on the existing pipeline network to meet the
demand with throughput capacity.
To meet this demand and address recent economic pressures for pursuing
offshore field developments, operators have opted to explore deepwater and
ultradeepwater tiebacks in order to optimize CapEx through the utilization
of existing infrastructure assets. Some of the recent activities to develop oil
field resources are summarized in Table 1 (OM, 2016). Future tieback
opportunities include the Anadarko Caesar/Tonga oil field with 30 tiebacks
(1524 m water depth) in the Gulf of Mexico, Woodside Energy & Mitsui
E&P Australia Greater Enfield development (31 km length, 550–800 m
water depth) offshore western Australia, and the BP and Deutsche Erdoel
AG long-distance development of the Giza/Fayoum and Raven gas fields
(220 km length, 800 m water depth) offshore Egypt. Over the past 15 years,
some of the more noteworthy subsea gas pipelines systems are highlighted in
Table 2. Potential future gas pipelines include the Eastmed (Mediterranean
Sea, 1300 km length, 2000 m depth, 2017 US$7 billion), Nord Stream 2
(Baltic Sea, 1220 mm diameter, 1224 km, €8 billion), and Sur de Texas-
Tuxpan (Gulf of Mexico, 1067 mm diameter, 700 km length, 2017
US$2.1 billion) projects.
As highlighted, offshore pipelines require significant capital cost invest-
ment. For example, the 1222 km, twin 1220 mm Nord Stream offshore
pipeline was 2017 €7.4 billion (2017 US$9.24). The recent Keathley Can-
yon Connector pipeline, with a wall thickness of just over 50.8 mm, cost
2015 US$0.6 million/km with the installation vessel cost of US$0.75
million/day to US$1.5 million/day (OGJ, 2015). Furthermore, offshore
pipelines require a high degree of system reliability due to the general
Table 1 Snapshot of Offshore Tiebacks and Pipelines for Oil Field Development
Pipeline Diameter Length Maximum Water
System General Location (mm) (km) Depth (m) Year
Stampede Gulf Of Mexico 457 26 1067 2018
Big foot Gulf Of Mexico 508 64 1800 2018
Wintershall North Sea 355 20/45 300 2017
Gunflint Gulf Of Mexico 305/203 37 2000 2016
Greater Enfield North West Cape 406 31 844 TBD
Australia
Big Bend and Gulf Of Mexico 305/203 64 2100 2015
Dantzler
Jack and St. Gulf Of Mexico 610 220 2140 2014
Malo
Mars Gulf of Mexico 457/610 210 900 1996
Mumbai–Uran Arabian Sea 762 203 80 1978
Brent System North Sea 914 147 150 1976
Forties North Sea 914 169 100 1975
inaccessibility, particularly at deeper water depths, for routine inspection,

maintenance, and repair activities. In contrast with the technical challenges
for the design, installation, and operation of offshore pipelines, particularly at
deeper water depths, the offshore pipeline industry can be characterized as
risk averse and conservative with respect to return on investment. The dam-
age or failure of a pipeline system can have significant consequences with
respect to market confidence, corporate reputation, loss of CapEx and
incomes, and potentially environmental impact and loss of life.
Major offshore facilities and pipeline arteries (export or trunk lines) rep-
resent critical infrastructure, to both the operating company and regional
governments that provides opportunities for revenue generation and future
development of other hydrocarbons reserves through tiebacks, upgrades,
and new builds. Export pipelines can also provide alternate uses such as
the transportation of carbon dioxide for sequestration and storage (IPCC,
2005) or gas reinjection to improve hydrocarbon recovery (UK OGIA,
2013). Consequently, operators are looking to extend the life of aging assets
to address market pressures in meeting energy demand and pipeline
throughput capacity, while maintaining the safety and efficiency of this
296 Shawn Kenny
Table 2 Snapshot of Offshore Gas Pipelines

Diameter Length Maximum Water
Pipeline System General Location (mm) (km) Depth (m) Year
TurkStream Black Sea 812 900 2200 2018
Ichthys Timor Sea 1067 882 280 2016
Keathley Canyon Gulf of Mexico 508 335 2195 2015
Connector
Walker Ridge Gulf of Mexico 610 226 2140 2015
Export
Lula-Mexilhao Brazil 457 216 2145 2011
Nord Stream Baltic Sea 1219 1224 210 2011
Block 17 Angola 406 40 1200 2010
Balearic Island Mediterranean 508 270 995 2010
Sea
Medgaz Mediterranean 610 210 2155 2009
Sea
Langeled North Sea 1067 1166 1000 2007
Greenstream Mediterranean 812 516 1127 2004
Sea
Trunkline System North West 1067 135 55 2003
Expansion Cape Australia
Blue Stream 1 Black Sea 610 376 2150 2003
Åsgard North Sea 1067 707 300 2000
Europipe-II North Sea 1067 658 80 1999
Yacheng 13-1 South China Sea 711 780 90 1996
Europipe-I North Sea 1016 620 70 1995
Zeepipe-IIA North Sea 1016 303 365 1995
Zeepipe-IIB North Sea 1016 304 365 1995
Zeepipe-I North Sea 1016 814 82 1993
infrastructure. For example, some of the UK North Sea pipelines, which

have been commissioned in the 1970s, are expected to operate up to
2030 and beyond (UK HSE, 2016). Less than 2% of the UK North Sea pipe-
line inventory, which ranges from 50 to 1117 mm diameter, has been
decommissioned (since 1966) with only 20% (i.e., 0.4% total pipeline inven-
tory) of these decommissioned pipelines having a diameter greater than
406 mm. Furthermore, 50% of these larger diameter decommissioned pipe-
lines were infield lines less than 1 km in length (UK OGIA, 2013). On the
Norwegian shelf the oldest pipelines are associated with the Ekofisk devel-
opment where the oil and pipeline gas pipelines started in 1975 and 1977,
respectively (NPG, 2017). From this perspective, there is an increasing
expectation that existing assets are extended beyond their initial design life.
From the perspective of life cycle performance and life extension, for
both new and existing assets, it is worthwhile to explore the general char-
acteristics on incidence failure rates through the schematic illustration of a
typical bathtub curve, as shown in Fig. 2 (Kapur & Lamberson, 1977;
Klutke, Kiessler, & Wortman, 2003; Kumamoto & Henley, 2000;
Muhlbauer, 2004). The bathtub curve relates the failure rate (# failures
per unit time) with the system age with three distinct regions known as
(1) early failure (infant mortality) period with decreasing failure rate (early
failures with inherent defects), (2) normal (useful) life period with constant
failure rate (random failures and events), and (3) end of life (wear out and
aging) period with increasing failure rate (wear out failures). The bathtub
curve is a generalized conceptual engineering tool that does not differentiate,
quantify, or qualify either the hazard (i.e., event, incident) or consequence
Fig. 2 Typical bathtub curve representation on the evolution of system failure rates with
time.
298 Shawn Kenny
(i.e., outcome, severity), and may not represent all systems adequately (e.g.,
Ascher, 1984; Tsang, 1995). For example, the burn-in or debugging phase,
which is common in the manufacturing industry for electronic components,
does not explicitly exist at the project-specific level. For pipeline systems, the
burn-in may be implicitly connected with the historical context of accumu-
lated experience and lessons learned, and related to the evolution of quality
systems, control, and assurance protocols used in modern pipeline engineer-
ing practices (e.g., DNVGL-SE-0160, 2015; DNVGL-ST-F101, 2017;
Ebeling, 2009; ISO 9000, 2015; ISO 9001, 2015).
During pipeline construction and installation, as well as the early failure
period, the cause may be attributed to inherent defects, errors, and omissions
that are generally identifiable, and for the most part, preventable. Experi-
ences from these events contribute to lessons learned, when documented
and reported in the public domain, and may become a catalyst for enhancing
best practices, regulations, codes, and standards. The failure rate decreases
toward a steady-state or constant failure rate during the normal life period
where failures are associated with random events due to third-party factors
(e.g., external interference with trawl gear, dropped objects, severe environ-
mental loading events). The normal (useful) life period duration is depen-
dent on many factors such as changes in the operational conditions
(e.g., fluid composition—sweet or sour), rare or extreme loading events,
or scope of inspection programs. Eventually time-dependent factors
govern (e.g., corrosion, fatigue) with an increasing failure rate that may
affect asset management decisions on life extension, repurpose, renewal,
decommissioning, and abandonment.
Pipeline operators have to understand the system characteristics, includ-
ing changes over time; such as changes in fluid service, pipeline purpose, and
develop appropriate IM systems; such as documentation and management of
change, and technical processes; such as inspection, integrity assessment and
intervention (e.g., DNVGL-ST-F101, 2017). The scope, extent, and prior-
ities for risk management will be dependent on the pipeline system charac-
teristics, nature of hazards and significance of consequences, and business risk
model. For example, the hazards, consequence, and overall risk profile for a
new build, single, large diameter gas transmission pipeline, located in deep-
water (e.g., Gulf of Mexico, Campos Basin), would have different consid-
erations than a 20-year-old multiphase, interfield gathering line located in
shallow water (e.g., UK North Sea), or flowlines in shallow water with
unique environmental hazards (e.g., Arctic, Grand Banks). The pipeline
operator for the transmission line may have to focus reliability and product
delivery to meet contractual obligations, the older interfield lines may have
to address integrity concerns associated with corrosion risk or third-party
interference, and the flowlines subject to rare events may have to establish
unique operational protocols and assume the risk of potential system loss.
Although not intended to be an exhaustive reference list (see, for example,
Bell & Lanan, 1996; Berge, 2005; Egan, Kaplan, & Zebroski, 1996; Ellinas,
Smart, Robertson, & Al-Hassan, 1995; Ewida, Hurley, Edison, & The,
2004; Hopkins, 2016; Hovem, Torstad, Bjerager, Bjornsen, & Danielsen,
2014; Palmer & King, 2008; Paulin, 2014; Paulin & Caines, 2016;
Paulin, Cocker, Humby, & Lanan, 2014; Reid, Dekker, Paardekam, &
Lewis, 2014; Samosir, Popineau, & Lechon, 2013; Thodi, Khan, &
Imtiaz, 2016; Zhai, Chauvet, Azarinezhad, Zeng, & Priyadarshi, 2015),
the literature highlights some of these key issues and challenges faced by
pipeline engineers.
There are a number of data sources that have compiled pipeline inci-
dents, near misses, and loss of containment events for offshore pipeline sys-
tems including Pipeline And Riser Loss Of Containment (PARLOC, 2012,
2015), UK Health and Safety Executive (UK HSE, 2016), Pipeline Hazard-
ous Materials Safety Administration (PHMSA, 2017), De Stefani and Carr
(2010), Ellinas et al. (1995), and Woodson (1990). Due to the composite
nature of the datasets, establishing failure statistics (e.g., event frequency,
risk) is not a straightforward task with absolute outcomes, as the effort
requires due consideration on the origins of the dataset and critical assess-
ment “the risk number” when evaluating incident databases. The data
may be biased from different technical functions (e.g., pipe diameter, prod-
uct, operational parameters, water depth, materials, hazard frequencies), his-
torical perspectives (e.g., changes in technologies, operating procedures,
pipeline function, regulations, reporting metrics, and requirements), and
other factors that may influence statistics affecting the current landscape
(e.g., decommissioned pipelines, survey response uncertainty, data gaps).
For example, the PARLOC (2015) database does not include any incident
prior to 2001 due to uncertainty in the records (PARLOC, 2012, 2015;
Robertson, Smart, & Al-Hassan, 1996). To further illustrate pitfalls in focus-
ing only on “the statistic,” between 1967 and 1990 corrosion was identified
as the largest cause (50%) of the 1047 recorded pipeline failures in the outer
continental shelf waters of the United States. However, anchor damage was
the primary contributor to environmental impact, in terms of the volume of
uncontained product released, such that “the most prevalent cause was not
the most consequential cause...” (Muhlbauer, 2004). From this perspective,
300 Shawn Kenny
provided the basis and context of the assessment is rationally developed and
clearly documented, the data assessment can be used to inform stakeholders
on potential hazards, highlight possible consequences, and provide estimates
on pipeline reliability within a relative or comparative risk assessment
framework.
Based on the composite database, the major hazards for offshore pipelines
include corrosion failure (e.g., internal, external), mechanical damage
(e.g., trawl gear, anchors, dropped objects), construction and material failure
(e.g., weld, fitting, clamp), natural hazards (e.g., wave, geotechnical), and
other unknown factors. For oil and gas pipelines in the Gulf of Mexico
(1967–1990), the distribution of identified hazards is illustrated in Fig. 3
(Woodson, 1990) where the general statistics do not identify any significant
difference in trends for product type. Similar distribution holds for the UK
North Sea sector with a relative decrease in the number of corrosion failure
incidents and increase in the mechanical damage hazards associated with
maritime activity (PARLOC, 2001).
In terms of the hazard frequencies, the PARLOC database indicates
there has not been any significant change in the average loss of containment
failure rates from 2001 to 2012 with an annual frequency of 4.9 104 fail-
ures per km-year and 4.2 104 failures per km-year (PARLOC, 2001,
2012, 2015), which is similar to the US experience in the Gulf of Mexico
(e.g., De Stefani & Carr, 2010). The failure rates are consistent with the
nominal annual target failure probabilities of current offshore pipeline stan-
dards (e.g., DNVGL-ST-F101, 2017). The trend of improving pipeline
safety with time has also been observed in other studies for onshore pipelines
(e.g., Hopkins, 2008; UK HSE, 2016). The annual frequency magnitude
(i.e., # per km-year) and trend (i.e., constant, increasing or decreasing rate)
may be influenced by time-dependent characteristics of the limits states,
nature of the underlying mechanisms (e.g., constant, deterministic function,
random variable, stationary process), and risk control measures (e.g., repair,
corrosion inhibitors). Nonetheless, these statistical datasets can be used to
inform decision makers on the level of risk and providing a benchmark
for risk estimation and reliability assessment of specific pipeline systems
within operational and management practices.
From a risk management perspective, there are challenges with differing
perspectives, priorities, and goals of stakeholders, such as operators and reg-
ulatory authorities, which may also have competing or divergent constraints.
Operators assess the risk profile for each pipeline systems and establish a rank
order prioritization of each asset with respect to decision-making for risk
A Unknown
12%
Other
2%
Natural Corrosion
hazards 48%
14%
Construction
and material
failure
9%
Mechanical
damage
15%
B Unknown
15%
Other
4%
Natural
hazards Corrosion
8% 50%
Construction
and material
failure
10% Mechanical
damage
13%
Fig. 3 Distribution of hazards for (A) oil and (B) gas pipelines in the Gulf of Mexico for
the period 1967–1990. After Woodson (1990).
control options. A generalized risk management framework is illustrated in

Fig. 4, which includes elements of risk analysis, risk evaluation, and risk con-
trol. Further discussion and guidance on the risk management framework is
presented in textbooks, codes, and standards (e.g., CSA Z662, 2015; ISO
31000, 2009; Kumamoto & Henley, 2000; Muhlbauer, 2004). In general,
for individual pipeline operators the risk profile across the asset mix is not
uniform (i.e., different pipe diameter, class, product, pressure, materials,
age) with other factors (e.g., safety target, technical consequences with fail-
ure modes, business consequences with product delivery) that may influence
risk-based decision-making outcomes. Although safety targets may be the
302 Shawn Kenny
Fig. 4 Integrated risk management flowchart.
same for a given asset class, as defined by codes, standards, or regulations, the
complex relationship governing the pipeline risk profile, as faced by oper-
ators, presents challenges for regulators (e.g., varying risk profile across pipe-
line systems, internal processes may vary across pipeline operators), which
may also impact public perception of perceived safety. Thus, there is a need
for flexibility in the interaction and relationship among the stakeholders.
3. ELEMENTS OF A PIPELINE RISK MANAGEMENT

FRAMEWORK
3.1 Overview
Offshore pipeline engineering has often pushed the limits of experience,
knowledge, and technological boundaries (Bruschi, 2012; Cavicchi &
Ardavanis, 2003; Ewida et al., 2004; Lanan, Cowin, & Johnston, 2011;
Lanan, Ennis, Egger, & Yockey, 2001; Langner, 1999; Schronk,
Biggerstaff, Langmaid, Aalders, & Stark, 2015; Tsuru, Asahi, & Ayukawa,
2006). In managing these projects, there are practical challenges faced
across the spectrum of stakeholders (i.e., engineering consultant, installation
contractor, operator, regulator) with respect to project management
(e.g., schedule, cost, procurement on long-lead items, interfaces); quality
control and assurance (e.g., change management, audits, compliance);
health, safety, and environment; and qualification of new technology
(e.g., DNVGL-RP-A203, 2017b; DNVGL-SE-0160, 2015) that can influ-
ence project life cycle risk (e.g., OGA, 2017).
The importance of integrating evidence-based decision-making and risk
management protocols within complex projects has been acquired through
direct experience and lessons learned (e.g., Hass, 2008). For complex pro-
jects, such as deepwater oil and gas pipeline, commercial space exploration,
and major civil engineering projects, lessons learned indicate weak points,
failures, and areas for improvement but can be at a cost-prohibitive learning
experience (e.g., Flyvbjerg, 2014; Hopkins, 2008; Tohara, 2007). For exam-
ple, the LNG Gorgon project (2012 AUS$52 billion), NASA Mars Science
Laboratory Curiosity (2012 US$1.77 billion), and the Big Dig project in
Boston, MA, United States (2007 US$14.6 billion) had cost overruns of
40%, 83%, and 220%, respectively (OIG, 2012; Olaniran, Love, Edwards,
Olatunji, & Matthews, 2015). There is a need to advance more robust tools,
systems, and practices that can support more effective management of mega-
projects (billions of dollars) and major projects (hundreds of millions of
dollars).
In this chapter, elements of the risk management framework in relation-
ship with project management, engineering design, and operational man-
agement of offshore pipelines through the life cycle are explored.
3.2 Project Management Risk

Project technical and business risks exist throughout daily operations and
along the pipeline life cycle (i.e., design, construction, installation,
304 Shawn Kenny
operation, and abandonment). Project variables, uncertainties, and con-

straints may change with time or in response to project decisions, which
can influence risk, associated with major elements of project management
(i.e., scope, schedule, resources). The major elements of the risk-based,
project management process include risk plans, identification, analysis
(qualitative or quantitative), and control (e.g., Kendrick, 2009; PMI,
2004; Royer, 2000). Furthermore, the relationship among and within
different elements, such as project management, operations management,
organizational influences, governance, and life cycle, is complex, dynamic,
and multilayered (e.g., PMU, 2004; Turner, 2009; Vanhoucke, 2016).
Traditional project management approaches have historically utilized a
focused hierarchal command and control, top-down model; however, the
intricacy of large scale, complex projects requires systematic, integrated,
and multidisciplinary leadership with engagement for continuous learning
and performance improvement (Bakhshi, Vernon, & Gorod, 2016;
Flyvbjerg, 2014). The management of large-scale projects does not follow
an ordered, linear system where the challenges may be related to the project
scale, logistics, or specialized technologies or expertise (e.g., Bakhshi et al.,
2016; Glouberman & Zimmerman, 2002). Inherent within complex pro-
jects and systems, some attributes may be ambiguous and nonlinear with
multifaceted interactions and dependencies between tasks and elements with
uncertain parameters and variables (e.g., Bakhshi et al., 2016; Marle,
Vidal, & Bocquet, 2013; Qazi, Quigley, Dickson, & Kirytopoulo, 2016).
This influences decision-making under uncertainty that may impact success-
ful project execution or sanction.
Recent studies are exploring how to improve and advance tools,
methods, systems, and frameworks that may enhance or reform project man-
agement practices for large-scale and megaprojects, which include Bayesian
networks, complex project management system, controlled interval and
memory modes, expected utility theory, front-end management, knowl-
edge management systems, Monte Carlo simulations, network theory,
and reference class forecasting (e.g., Biesek & Gil, 2014; Chapman &
Ward, 1996; Fang, Marle, & Zio, 2012; Flyvbjerg, 2014; Gabetta &
Gori, 2011; Hass, 2008; Marle et al., 2013; Muriana & Vizzini, 2017;
Nepal & Yadav, 2015; Qazi et al., 2016; Williams & Samset, 2010).
Properly managed risk, however, can mobilize efficiencies and create
opportunities that should improve return on investment, enhance perfor-
mance, meet targeted goals, and afford a competitive advantage through
value-added practices and outcomes. At the macroscale, there is a definitive
need for these overarching frameworks that can link strategic elements
within the project and at arm’s length hierarchical constituents (e.g., client,
corporation). There is also the need to promote successful execution of
tactical elements (e.g., design, fabrication, construction) in order to
meet project goals (e.g., engineering product) within specified constraints
(e.g., milestone, budget, functionality, reliability).
3.3 Technical Risk: Pipeline Engineering Design

Over the past 50 years, there have been significant advancements in offshore
pipeline technology such as the mitigation of section collapse for deepwater
pipelines (e.g., Kyriakides & Corona, 2007; Langner, 1999; Tsuru et al.,
2006) and installation of deepwater pipelines (e.g., Cavicchi & Ardavanis,
2003; Pulici, Trifon, & Dumitrescu, 2003). In parallel, offshore pipeline
engineering practice has evolved from the development of stress-based
design principles (e.g., ASME B31.4, 2016; ASME B31.8, 2016; CSA
Z662, 2015; ISO 13623, 2017) to more rigorous approaches through
limit state design procedures (e.g., DNVGL-ST-F101, 2017). The standards
provide minimum technical requirements to meet accepted target safety
levels. The stress-based design principles are based on a load factor design
where specific loads and load combinations are increased by a design
factor(s) and the resistance is reduced by a design factor such that the factored
loads are less than the factored resistance. Although the design factors
account for uncertainty in estimating the demand and capacity, the design
approach does not necessarily provide a uniform level of safety for the pipe-
line system.
These standards also provide latitude, with directed guidance, for the uti-
lization of alternative methods (e.g., structural reliability analysis, technology
development, and qualification) in pursuing engineering solutions for the
design, construction, installation, operation, and maintenance of offshore
pipeline systems. Sound engineering judgment or recommended practice
(e.g., DNVGL-RP-A203, 2017b) can be used to develop, advance, and ver-
ify new, reliable technology, which meets or exceeds current minimum
standards and regulations, with confidence for use to solve engineering chal-
lenges. More recently, these standards have also been expanded to address
other technical aspects, such as reliability-based design for lean gas transmis-
sion lines, and other functional requirements including safety and loss man-
agement, records management, IM, and personnel qualification (e.g., ASME
B31Q, 2016; ASME B31S, 2016; CSA Z662, 2015).
306 Shawn Kenny
For offshore pipelines, the standard DNVGL-ST-F101 (2017) is proba-

bly the most versatile and robust engineering framework that is directly
integrated with other recommended practices (e.g., cathodic protection,
DNVGL-RP-B401; offshore soil mechanics, DNVGL-RP-C212; free
spanning pipelines, DNVGL-RP-F105; On-bottom stability, DNVGL-
RP-F109). In addressing some technical challenges, there may be a need
to develop engineering tools, procedures, and technologies beyond the
scope and guidance of industry-recognized codes and standards. For exam-
ple, offshore pipelines may be subject to unique loading conditions or situ-
ated in harsh, physical environments where probabilistic frameworks, such
as those illustrated in Fig. 4, are needed to develop engineering solutions that
face significant challenges and uncertainty (e.g., Cowin, Lanan, Young, &
Maguire, 2015; Davies, Marley, & Mork, 2011; Fenton & Griffiths,
2008; Kenny, Barrett, Phillips, & Popescu, 2007; Kenny & Jukes, 2017;
King, Phillips, Barrett, & Cuff, 2012; Lanan et al., 2011, 2001;
Nobahar & Kenny, 2007; Parker, Paoletti, & Traverso, 2005;).
In this section, we are focused on the pipeline technical risk with respect
to the mechanical response from a limit state perspective (i.e., load or
demand, resistance or capacity). The risk-based design framework follows
the conventional flow path, outlined in Fig. 4, that seeks to estimate the
level of risk, evaluate the risk significance, and mitigate (if necessary) risk
to an acceptable level. The risk management process integrates risk assess-
ment (i.e., risk analysis and risk evaluation) with risk control, which is a
decision-making process utilizing monitoring, feedback, review, and
communications to verify the effectives of the overall framework. Risk
management is a dynamic, continuous activity of periodic monitoring, eval-
uation, and communication that recognizes some factors (e.g., system
demand, capacity) may change or evolve with time (e.g., operating condi-
tions, corrosion mechanisms, climate change effects).
In general, the primary motivations for developing limit state design (i.e.,
load and resistance factored design, LRFD) methods have been (1) to
account for variability and uncertainty in the loads (i.e., system demand)
and resistance (i.e., system capacity) and (2) provide a relatively uniform
level of safety for different system characteristics (e.g., materials, pressure,
temperature) and limit states. The limit state represents a condition where
the system fails to meet a performance requirement or criterion,
which can be broadly classified by serviceability, ultimate, fatigue, and acci-
dental limit states (e.g., Annex C CSA Z662, 2015; DNVGL-ST-F101,
2017). The LRFD approach is an extension of calibrated and verified
reliability-based design analysis, which can be considered a subset of risk-

based design methods (e.g., Adianto & Nessim, 2014; Annex O CSA
Z662, 2015; Hasan, 2012; Hasan, Hults, & Singh, 2015; Hasan, Khan, &
Kenny, 2012; Hasan, Sweet, Hults, Valbuena, & Singh, 2017; Nessim,
2012; Nessin, Zhou, Zhou, & Rothwell, 2009; Melchers, 2001; Zhang,
Zhang, Yu, Wu, & Chen, 2014). These methodologies have been advanced
in response to address the level of data or model uncertainty, design philos-
ophy (e.g., technical, business), and targeted safety margins that, in turn,
drive the technical approach utilized in advancing engineered design solu-
tions. The relationship between these engineering design methods is illus-
trated in Fig. 5.
The characteristic load (Sc) and characteristic resistance (Rc) are based on
defined fractiles, which represent a fraction (value) of the distribution greater
than (i.e., upper fractile) or less (i.e., lower fractile) than a defined value (i.e.,
cutoff point) on the probability density function. For example, the charac-
teristic load is defined as upper fractile (e.g., 95%) and the characteristic resis-
tance is defined as a lower fractile (i.e., 5%). The characteristic values are
different than the mean ðS, RÞ values. The safety margin is the difference
between the factored characteristic resistance and factored characteristic load
with the safety margin (β) defining the relationship between the mean factor
of safety with the deviation or variation in the factor of safety.
The discussion will now focus on the risk analysis components, which
may be performed using qualitative (e.g., scales, expert opinion, risk assess-
ment matrix (RAM)) or quantitative (e.g., discrete or continuous probabil-
ity distributions, Monte Carlo) procedures. Outcomes from the risk analysis
are used to support risk management decision-making processes (i.e., risk
evaluation, control) that can be presented in an RAM, structured approach
(e.g., bow-tie method) or as categorized, values (e.g., isorisk chart, rank
order table) in establishing the risk profile. A typical RAM, which can be
established using qualitative or semiquantitative procedures, is shown in
Fig. 6. Qualitative indicators for the frequency and consequence are used
to estimate the risk level (e.g., extreme, negligible) and direct the need
for control measures, which may be guided by quantitative indicators on
annual likelihood with assigned nominal scale values.
The outcomes can be integrated within a risk register in order to synthe-
size and rank order the risk profile across asset classes that will support risk
management decision-making with respect to scope, extent, and timing for
the allocation of resources (e.g., ISO 31000, 2009; ISO 73, 2009; PMI,
2004). The risk registry is essentially a “log book” characterizing the major
308 Shawn Kenny
Risk-based design
• Integrated with the flowchart (Fig. 4) and reliability analysis
• Use probabilistic likelihood analysis and add consequence prediction
• Check if risk estimate < tolerable risk target (i.e., risk significance)
Reliability-based design
Probability
R
• Discrete or continuous
S Sc Rc
probability distributions to
characterize the load (S) aSc fRc
and resistance (R)

• Establish failure probability
(Pf) less than target
• Estimate factored safety Load (S), Resistance (R)
margin and reliability index (b) Pf = P(aSc > fRc)
fRc
Deterministic - Limit states design ³1
g Sc
• Failure modes Factored safety margin
(limit states) φRc - αSc
Rc
• Factored loads
Probability
(demand), aS αSc φRc
• Factored Sc
resistance
(capacity), fR
Characteristic load (Sc), Resistance (Rc)
Fig. 5 Relationship among engineering design approaches for offshore pipelines.
elements of the risk assessment (i.e., risk analysis, evaluation) process and
risk control measures (i.e., mitigation or adaptation strategy, contin-
gency, responsibility, cost, residual risk monitoring) adopted that can be
rank-ordered to establish priorities, and guide engagement among stake-
holders. Essentially, the register identifies potential risks, characterizes the risk
(likelihood, impact) in qualitative and quantitative terms, highlights the
response (i.e., control measures), defines priorities (i.e., rank order risk profile),
and assigns ownership. The relationship between the risk registry and elements
of the risk management framework (Figs. 4–6) is illustrated in Fig. 7.
Impact Scale Risk score

Critical
5 5 10 15 20 25
Major
4 4 8 12 16 20
Consequence
Moderate
3 3 6 9 12 15
Minor
2 2 4 6 8 10
Negligible
1 1 2 3 4 5
Frequency
Scale 1 2 3 4 5
Quantitative indicator 1/100,000 1/10,000 1/1000 1/100 1/10
(annual frequency) (10–5) (10–4) (10–3) (10–2) (10–1)
Almost
Qualitative indicator Rare Unlikely Possible Likely
certain
Legend
Extreme risk Risk is catastrophic; Immediate risk control in AM framework
High risk Risk is unacceptable; Prioritized risk control in AM framework
Moderate risk Risk is undesirable; Alert on risk control in AM framework
Low risk Risk is acceptable; Monitor and employ AM framework
Negligible risk Risk is desirable; Employ AM framework
Fig. 6 Risk assessment matrix.
The system characterization defines the basis or ground rules for the risk
analysis where the goals or safety objectives (e.g., target safety level, policy),
scope, technical requirements (e.g., codes, standards, recommended prac-
tices, metrics), regulations, and supporting data can be documented. To esti-
mate risk there is a need to identify the hazards (i.e., what can go wrong?),
define the event frequency (i.e., what is the likelihood of “what can go
wrong” will occur?), and project the likely consequence (i.e., outcome or
impact of “what can go wrong” has occurred).
Hazard identification may be established using comparative methods
(e.g., checklists, experience with past events), structured methods
(e.g., Hazard and Operability studies, HAZOP; Failure Mode and Effects
310 Shawn Kenny
Fig. 7 Relationship between the risk registry and elements of the risk management
framework.
Analysis, FMEA), and logical methods (e.g., event and fault tree analysis).
The frequency analysis may use comparative methods (e.g., historical oper-
ational and incident data, experience with past events), logical methods (e.-
g., event and fault tree analysis), and mathematical models (e.g., Monte
Carlo, probabilistic distributions) and expert opinion. For rare events, there
may be insufficient data or uncertainty to adequately assess return periods
(i.e., recurrence interval) where other techniques (e.g., bootstrapping)
may be needed (e.g., Davies et al., 2011; Jordaan, 2011; Palmer, 1996). One
of the principal caveats to recognize, however, is that historical data and sta-
tistics represent numbers and require understanding, context, and assessment
to shape and establish the landscape of pertinent facts for the quantification of
likelihood.
Consequence analysis depends on many factors such as the product
type (i.e., water, oil, gas), toxicity (e.g., sour gas), pipeline attributes (e.g.,
diameter, wall thickness, pressure), failure event outcome (e.g., ovalization,
leak, full bore rupture), location (e.g., near platform, ultradeepwater), and
other considerations (e.g., environmental sensitivity, economic or business
costs, societal); see, for example, Annex O CSA Z662, 2015; Jordaan, 2011;
Muhlbauer, 2004.
A more comprehensive treatment of risk analysis, uncertainty, and struc-
tural reliability methods are presented in several reference books and journal
articles (e.g., Aljaroudi, Khan, Akinturk, Haddara, & Thodi, 2015; Bai &
Bai, 2014b; Jordaan, 2011; Li, Chen, Zhu, & Zhang, 2017; Mannan,
2012; Morgan & Henrion, 2003; Muhlbauer, 2004; Nessin et al., 2009;
Palmer & King, 2008; Singh, 2017).
An emerging consideration in the asset management and risk assessment
of offshore pipelines is the significance of climate change hazards. Climate
change effects (e.g., erratic or cyclic variation in temperature that influences
meteorological processes and events) add another layer of complexity that
shape and impact how we think about infrastructure performance, integrity,
and risk management. For example, in a recent study Bruyère et al. (2017)
concluded the Gulf of Mexico will experience fewer but more intense
storms with increased precipitation that may have substantial future impact
on infrastructure assets and operations. The cascading effects can be associ-
ated with greater littoral impact (e.g., storm surge, coastal erosion, and
permafrost degradation mechanisms). The frequency, scale, and intensity
of climate change-related hazards are expected to increase with more adverse
outcomes where current load events may exceed the original design basis
(Halsnæs, Drews, & Clausen, 2016; IPCC, 2014).
Reliance on the historical climate record and current engineering frame-
work will most likely lead to increased exposure and vulnerability of the
infrastructure that may affect the asset performance, resilience, and integrity.
For example, the 2005 hurricanes Katrina and Rita had a significant impact
in the Gulf of Mexico oil and gas industry where almost 3000 platforms were
affected with 163 platforms destroyed, and almost 200 km of subsea pipelines
312 Shawn Kenny
experienced significant displacement or rupture (Balint & Orange, 2006;

Coyne, Dollar, & Hardie, 2006; Cruz & Krausmann, 2008; Nodine
et al., 2007). Although the impact on offshore pipelines was not as signifi-
cant, there have been other intense storms (greater than Category 3) includ-
ing Ike in 2008, Sandy in 2012, and Harvey, Irma, and Maria in 2017.
The pipeline risk assessment framework (Figs. 4 through 6) will need to
integrate climate change risk that accounts for the variability and uncertainty
associated with climate change event predictions, hazard characteristics (i.e.
type, duration, magnitude, and intensity), and the infrastructure exposure
and vulnerability (e.g., Fig. 8). Asset resilience is based on the system ability
to meet operational (i.e., serviceability) performance requirements in
response to challenges from climate hazards and adverse events. The risk
analysis could adopt matrix approach that estimates the frequency (likeli-
hood) of a climate hazard (stressor) and associated expected resulting condi-
tion in relation to the expected consequence (impact) on the asset
performance or service-level target. Other studies have RAM approaches
to estimate the risk of climate change hazards on the resilience or vulnera-
bility of infrastructure (e.g., APEGBC, 2017; Black, Bruce, & Egener, 2014;
Praill, 2016).
Climate change assessment

Potential for climate change event to result in an adverse impact on core infrastructure by
not meeting performance targets (i.e., serviceability, ultimate limit states)
Climate hazard Exposure Vulnerability

Climate event with the potential to Physical presence of core Potential or propensity for climate
cause adverse effects (e.g., flood, infrastructure within a region that hazards to have and effect or
hurricane) or long-term change in could be adversely affected by impact (positive or negative) on
climate variables (e.g., climate change hazards core infrastructure performance
temperature, precipitation) that
impact people, property,
resources, infrastructure, services
and environment
Sensitivity Adaptive capacity

The degree (measure) to which Inherent capacity for the
core infrastructure may be affected infrastructure to minimize adverse
by climate hazards. This is related impacts and maximize
to state of infrastructure positive effects
Fig. 8 Climate change assessment framework.

3.4 Operational Risk: Inspection, Monitoring, Integrity

Assessment, and Management
Over the past 20 years, there has been an increasing tendency for extending
beyond prescriptive elements of IM with the integration of performance-
based asset management best practices, goal-based standards, and aligned
regulatory frameworks (e.g., API 580, 2016; API 581, 2016; Bell &
Lanan, 1996; Coglianese, Nash, & Olmstead, 2002; UK HSE, 2014;
Watson, 2016; Wenman & Dim, 2012; Willcocks & Bai, 2000). The under-
lying philosophy provides a more malleable and flexible approach to asset
integrity that can address changes in the risk profile with time (e.g., new haz-
ards, aging infrastructure, time-dependent mechanisms) and accommodate
other nontechnical factors (e.g., organization behaviour, human factors,
management practices, and IM systems). The major elements of an IM sys-
tem includes (1) risk assessment and planning; (2) inspection monitoring and
testing; (3) integrity assessment; and (4) mitigation, intervention, and repair
(e.g., DNVGL-RP-A203, 2017a).
The reader is directed to the comprehensive guidance on IM and RBI of
pipeline systems that has been developed and synthesized within rec-
ommended practices, handbooks, and textbooks (e.g., API 1160, 2013;
ASME B31.8S, 2016; Bai & Bai, 2014b; DNV-RP-F116, 2017; Kaley &
Powers, 2015). Furthermore, there have been a number of studies exploring
the development of tools and engineering practice guidance in support of
asset IM within risk-based frameworks (e.g., Abhinav, Saigal, & Ryu,
2016; Arunraj & Maiti, 2007; Ayello, Alfano, Hill, & Sridhar, 2012;
Azouz, Hakim, Soliman, & Awda, 2016; Dellarole et al., 2017; Khan,
2012; Khan & Haddara, 2003; Khan, Haddara, & Bhattacharya, 2006;
Khan, Sadiq, & Haddara, 2004; Li, McQueen, Bik, & Zhai, 2013; Singh,
2009, 2017; Singh & Poblete, 2015; Thodi et al., 2016; Thodi,
McQueen, Paulin, & Lanan, 2012; Titti, Dafne, Del Baldo, & Pasini, 2011).
4. IMPROVING SAFETY CULTURE

Thus far the discussion in this chapter has focused on the technical
requirements for promoting pipeline safety (e.g., mechanical integrity, leaks,
rupture) with respect to design practices, management systems (e.g., project,
risk, integrity), codes, standards, and regulations. This approach has served
the industry well in terms of improving system reliability and reducing the
frequency of catastrophic loss, however, failures still occur and we must learn
314 Shawn Kenny
from these events in support of continuous improvement. There have been a

number of major pipeline failures over the past 20 years including oil line and
gas line failures, as summarized in Table 3.
In 2010 the rupture of a 762-mm pipeline released more than
835,000 gal of oil into the Kalamazoo River with total costs exceeding
$1 billion. Some of the major factors leading up to the pipeline failure
was attributed to “…deficient integrity management procedures…” and
“…inadequate training of control center personnel…” by the operator
(Enbridge) and the “…ineffective oversight…” by the regulator
(Pipeline and Hazardous Materials Safety Administration, PHMSA)
“…of pipeline integrity management programs, control center procedures,
and public awareness...” (NTSB, 2012). The NTSB findings also pointed
to systemic deficiencies and organizational failures to addressing safety with
combined risks, which was also contributing factor in the 2010 San Bruno,
California gas line rupture. Although an important element at the personal
level and indicator of safety, there is a need to look beyond occupational
health and safety (e.g., slips, trips, and falls) and address process safety that inte-
grates technical elements with a proactive, engaged, and overarching safety
Table 3 Summary of Recent Oil and Gas Pipeline Failures

Pipeline
System Location Impact Year
Nexan Fort McMurray, AB, 5 million L bitumen- 2015
Canada water-sand
Plains Red Deer River, AB, 0.461 million L sour crude 2012
Midstream Canada
Enbridge Elk Point, AB, Canada 0.230 million L crude oil 2012
Plains Little Buffalo, AB, Canada 4.5 million L crude oil 2011
Midstream
Enbridge Marshall, MI, United States 840,000 gal oil 2010
PG&E San Bruno, CA, United 8 killed 2010
States
Ghislenghien, Belgium 24 killed; 122 wounded 2004
Olympic Bellingham, WA, United 3 killed 1999
States
ElPaso Energy Carlsbad, NM, United 12 killed 2000
States
culture and safety management system (e.g., API 1173, 2015; Annex A Safety
and Loss Management Systems, CSA Z662, 2015).
Failures within the organization can have significant negative impact on
safety, economic loss, and environmental damage (e.g., BP Macondo Deep-
water, Horizon, Space Shuttle Challenger). For these incidents there were
negative cultural threats that played a role in the adverse outcomes including
(1) production pressure, (2) complacency, (3) normalization of deviance,
and (4) tolerance of inadequate systems and resources (e.g., NEB, 2014;
Vaughan, 2016). These negative influences tend to degrade barriers to safety
(i.e., align the accident trajectory with voids in the “Swiss Cheese” model)
that can be influenced and mitigated through a positive, informed, and flex-
ible safety culture (NEB, 2014; Reason, 1998, 2000). There is a need to
balance these negative factors by developing a safety culture and establishing
threat barriers through (1) committed safety leadership, (2) vigilance, (3)
empowerment and accountability, and (4) resiliency.
The safety culture should look to address the coupled interactions among
human factors, technology, and organizational behavior. This will foster
greater awareness and more effective decision-making by human resources
that can enhance performance across organizational units to improve safety
leadership, system reliability, and ultimately return on investment. A key
goal is to connect the safety vision and policy with practice, implementation,
and outcomes through the embedded safety culture. The term culture relates
to the ubiquitous and dominant attitudes and behaviors that are the founda-
tions of an organizational strategy to meet the targeted vision, policy, and
goals—it is about what the individuals within the organization do (i.e.,
action) rather than say, think, or plan to do. Although guidance and best
practices exist, it is difficult to specify via regulations or standards (e.g.,
Zaman & Mackay, 2014).
There are a number of cultural frameworks that can be explored, shaped,
and integrated within the oil and gas pipeline industry to promote and
advance an improved safety environment. The reader is directed toward
current practices in the oil and gas and other industries (e.g., CSA Z662,
2015; IAEA, 2016; NAS, 2016), recent studies (e.g., Barling & Frone,
2004; Griffin et al., 2014; Holland & Shemwell, 2014; Kurtz, 2011;
Kvalheim & Dahl, 2016; Maslen, 2015; Reason, 1998, 2000; Sutton,
2014), and research publications on high reliability organizations (e.g.,
Enya, Pillay, & Dempsey, 2018; Hales & Chakravorty, 2016; Kessler,
2013; Paranhos, Kozak, & Boyd, 2017; Shemwell & Brooks, 2014) and
high-performance work systems (e.g., Barling et al., 2008; Dhillon, 2016;
316 Shawn Kenny
Zacharatos & Barling, 2005; Zacharatos, Barling, & Iverson, 2005) to gain a
more in-depth understanding of safety culture and how these systems can be
integrated within organizational, business, and engineering practices.
REFERENCES
Abhinav, G., Saigal, R. K., & Ryu, Y. (2016). Performance-based reliability of ASME piping
design equations. Journal of Pressure Vessel Technology, 139(3) 10 p. Paper PVT-16-1033.
https://doi.org/10.1115/1.4034584.
Adianto, R. H., & Nessim, M. (2014). In Limit states design for onshore pipelines: Designing for
hydrostatic test pressure and restrained thermal expansion.Proceedings of the international pipeline
conference, paper IPC-2014-33437, 9 pp. https://doi.org/10.1115/IPC2014-33437.
Aljaroudi, A., Khan, F., Akinturk, A., Haddara, M., & Thodi, P. (2015). Risk assessment of
offshore crude oil pipeline failure. Journal of Loss Prevention in the Process Industries, 37,
101–109. https://doi.org/10.1016/j.jlp.2015.07.004.
APEGBC. (2017). Developing climate change-resilient design for highway infrastructure in British
Columbia (interim). Professional Engineers and Geoscientists of British Columbia [101 pp].
API 1160. (2013). Managing system integrity for hazardous liquid pipelines (2nd ed.). American
Petroleum Institute. Includes errata, 99 pp.
API 1173. (2015). Recommended practice for pipeline safety management systems (1st ed.).
American Petroleum Institute, 27 pp.
API 580. (2016). Risk-based inspection (3rd ed). American Petroleum Institute [94pp].
API 581. (2016). Risk-based inspection methodology (3rd ed.). American Petroleum Institute
[632 pp].
Arunraj, N. S., & Maiti, J. (2007). Risk-based maintenance—Techniques and applications.
Journal of Hazardous Materials, 142(3), 653–661.
Ascher, H. (1984). Repairable systems reliability: modeling, inference, misconceptions and their
causes (lecture notes in Statistics, vol. 7). CRC Press/Marcel Dekker, Inc.. ISBN: 978-
0824772765, 244 pp.
ASME B31.4. (2016). Pipeline transportation systems for liquids and slurries. American Society of
Mechanical Engineers International. ISBN: 978-0791870242, 136 pp.
ASME B31.8. (2016). Gas transmission and distribution piping systems. American Society of
Mechanical Engineers International. ISBN: 978-0791871218, 212 pp.
ASME B31Q. (2016). Pipeline personnel qualification. American Society of Mechanical
Engineers International, 140 pp.
ASME B31S. (2016). Managing system integrity of gas pipelines. American Society of Mechanical
Engineers International, 76 pp.
Ayello, F., Alfano, T., Hill, D., & Sridhar, N. (2012). In A bayesian network based pipeline risk
management.Proceedings of the NACE international, paper 2012–1123, 14 pp.
Azouz, A., Hakim, M. A., Soliman, Y., & Awda, H. (2016). In Major advancement in pipeline
integrity management through an integrated quantitative risk assessment approach.Proceedings of the
offshore technology conference, paper 27065-MS, 9 pp. https://doi.org/10.4043/27065-MS.
Bai, Q., & Bai, Y. (2014a). Subsea pipeline design, analysis, and installation (1st ed.). Gulf
Professional Publishing. eBook ISBN 9780123868893, ISBN 9780123868886, 824 pp.
Bai, Y., & Bai, Q. (2014b). Subsea pipeline integrity and risk management. Gulf Professional
Publishing. ISBN: 978-0123944320, 429 pp.
Bakhshi, J., Vernon, I., & Gorod, A. (2016). Clarifying the project complexity construct:
Past, present and future. International Journal of Project Management, 34, 1199–1213.
https://doi.org/10.1016/j.ijproman.2016.06.002.
Balint, S. W., & Orange, D. (2006). In Panel discussion: Future of the Gulf of Mexico after Katrina
and Rita.Proceedings of the offshore technology conference, paper 18410-MS, 4 pp. https://doi.
org/10.4043/18410-MS.
Barling, J., Dupre, K. E., Kavanagh, J. M., Kenny, S., Khan, F., & Veitch, B. (2008). In The
integration of high performance work systems and workplace safety in the oil and gas industry.Pro-
ceedings of the SPE-111573, 23 pp.
Barling, J., & Frone, M. (2004). The psychology of workplace safety. American Psychological
Association. ISBN: 978-1-59147-068-7, 336 pp.
Bell, R. L., & Lanan, G. A. (1996). In Subsea pipeline operational risk management.Proceedings of
the offshore technology conference, paper 8040-MS, pp. 99–103. https://doi.org/10.
4043/8040-MS.
Berge, J. O. (2005). In North Sea pipelines: Pushing the technology front.Proceedings of the inter-
national society of offshore and polar engineers, paper I-95-345, 6 pp.
Biesek, G., & Gil, N. (2014). Building options at project front-end strategizing: The power of capital
design for evolvability. Project Management Institute, ISBN: 9781628250428, 178 pp.
Black, R. A., Bruce, J. P., & Egener, I. D. M. (2014). Canadian climate change risk assessment
guide: A strategic overview of climate risks and their impact on organizations. Summit Enterprises
International Inc, 31 pp.
Bruschi, R. (2004). In Natural gas high pressure transportation over long distance and harsh environ-
ments. Proceedings of the 4th international pipeline conference, Ostend, Belgium.
Bruschi, R. (2012). In From the longest to the deepest pipelines. Proceedings of the international off-
shore and polar engineering conference. (pp. 8–23).
Bruyère, C. L., et al. (2017). Impact of climate change on Gulf of Mexico hurricanes. NCAR
Technical Note NCAR/TN-535+STR. 165 pp. https://doi.org/10.5065/D6RN36J3.
Cavicchi, M., & Ardavanis, K. (2003). In J-lay installations lessons learned.Proceedings of the off-
shore technology conference, paper 15333-MS, 11 pp. https://doi.org/10.4043/15333-MS.
CEPA. (2018). https://www.aboutpipelines.com/en/pipeline-101/pipeline-history/.
Chapman, C., & Ward, S. (1996). Project risk management: Processes, techniques and insights. John
Wiley, ISBN: 0471958042, 344 pp.
Chyong, C. K., Noël, P., & Reiner, D. M. (2010). In The economics of the nord stream pipeline
system. EPRG working paper 1026, Cambridge working paper in economics 1051: University
of Cambridge, 40 pp.
CIA. (2018). https://www.cia.gov/library/publications/the-world-factbook/fields/2117.
html.
Coglianese, C., Nash, J., & Olmstead, T. (2002). Performance-based regulation: Prospects and lim-
itations in health, safety and environmental protection. Regulatory Policy Program Report No.
RPP-03, Center for Business and Government, John F. Kennedy School of Government.
Harvard University, 35p.
CombinedOps. (2018). https://www.combinedops.com/pluto.htm.
Cornot-Gandolphe, S., Appert, O., Dickel, R., & Chabrelie, M. F. (2003). In The challenges
of further cost reductions for new supply options (Pipeline, LNG, GTL).Proceedings of the 22nd
world gas conference [16 pp].
Cowin, T. G., Lanan, G. A., Young, C. H., & Maguire, D. H. (2015). In Ice based construction
of offshore arctic pipelines.Proceedings of the offshore technology conference, paper 25522-MS,
17 pp. https://doi.org/10.4043/25522-MS.
Coyne, M., Dollar, J., & Hardie, J. (2006). In Shell pipeline’s infrastructure recovery after hurricanes
Katrina and Rita.Proceedings of the offshore technology conference, paper 18413-MS, 6 pp.
https://doi.org/10.4043/18413-MS.
Cruz, A. M., & Krausmann, E. (2008). Damage to offshore oil and gas facilities following
hurricanes Katrina and Rita: An overview. Journal of Loss Prevention in the Process Industries,
21(6), 620–626. https://doi.org/10.1016/j.jlp.2008.04.008.
318 Shawn Kenny
CSA Z662. (2015). Oil and gas pipeline systems. Canadian Standards Association [868 pp].
Davies, G., Marley, M., & Mork, K. (2011). In Limit state design methodology for offshore
pipelines against ice gouging—Industry guidelines from the ICEPIPE JIP.Proceedings of
the offshore technology conference, paper 22037-MS 22 pphttps://doi.org/10.4043/
22037-MS.
De Stefani, V., & Carr, P. (2010). In Amodel to estimate the failure rates of offshore pipeliens.Pro-
ceedings of the international pipeline conference, paper IPC2010–31230, 11 pp.
Dellarole, E., Sotgiu, M. G., Sodini, S., Frassi, A., Varano, F., & Bonuccelli, M. (2017).
In Quantitative risk-based methodology for pipeline integrity management.Offshore mediterranean
conference, paper 2017–660, 13 pp.
Dhillon, B. S. (2016). Safety and reliability in the oil and gas industry: A practical approach. CRC
Press. ISBN: 9781498746571, 213 pp.
DNVGL-RP-A203. (2017a). Integrity management of submarine pipeline systems. DNV GL AS,
189pp.
DNVGL-RP-A203. (2017b). Technology qualification. DNV GL AS, 114 pp.
DNVGL-SE-0160. (2015). Technology qualification management and verification. DNV GL AS,
31 pp.
DNVGL-ST-F101. (2017). Submarine pipeline systems. DNV GL AS, 521 pp.
Ebeling, C. E. (2009). An introduction to reliability and maintainability engineering (2nd ed.).
Waveland Press Inc. ISBN: 978-1577666257, 544 pp.
Egan, G. R., Kaplan, S., & Zebroski, E. L. (1996). In Risk assessment of a deep sea pipeline.
Proceedings of the offshore technology conference, paper 8041-MS. (pp. 105–112). https://
doi.org/10.4043/8041-MS.
EIA. (2017). International energy outlook. U.S. Energy Information Administration.
#IEO2017. www.eia.gov. 76 pp.
Ellinas, C. P., Smart, D. T., Robertson, J., & Al-Hassan, T. (1995). In PARLOC—Pipeline
and riser loss of containment: North sea experience.Proceedings of the international society of offshore
and polar engineers, paper I-95-345. 8 pp.
Enya, A., Pillay, M., & Dempsey, S. (2018). A systematic review on high reliability
organisational theory as a safety management strategy in construction. Safety, 4, 6–18.
https://doi.org/10.3390/safety4010006.
Ewida, A. A., Hurley, S. J., Edison, S. H., & The, C. E. (2004). In Shallow to deepwater facilities
and flow assurance challenges in offshore Newfoundland. Proceedings of the international society of
offshore and polar engineers, paper I-04-076. (pp. 524–531).
Fang, C., Marle, F., Zio, E., & Bocquet, J.-C. (2012). Network theory-based analysis of risk
interactions in large engineering projects. Reliability Engineering & System Safety, 106,
1–10.
Fenton, G. A., & Griffiths, D. V. (2008). Risk assessment in geotechnical engineering. John
Wiley & Sons. ISBN: 9780470178201, 461 pp.
Flyvbjerg, B. (2014). What you should know about megaprojects and why: An overview.
Project Management Journal, 45(2), 6–19. https://doi.org/10.1002/pmj.21409.
Fyrileiv, O., Aamlid, O., Venås, A., & Colberg, L. (2013). Deepwater pipelines––Status,
challenges and future trends. Journal of Engineering for the Maritime Environment, 227(4),
381–395. https://doi.org/10.1177/1475090212450659.
Gabetta, G., & Gori, G. (2011). The use of knowledge management to improve pipeline
safety. In G. Bolzon, T. Boukharouba, G. Gabetta, M. Elboujdaini, & Mekki (Eds.),
Integrity of pipelines transporting hydrocarbons: Corrosion, mechanisms, control, and management,
NATO science for peace and security series C: Environmental security: Springer Science &
Business Media. ISBN: 9789400705944, 322 pp.
Glouberman, S., & Zimmerman, B. (2002). Complicated and complex systems: What would suc-
cessful reform of Medicare look like? Commission on the Future of Health Care in Canada
Toronto. ISBN: 0662327780, 37 pp.
GMI (2018). Global Market Insights. https://globenewswire.com/news-release/

2017/09/04/1106873/0/en/Gas-Pipeline-Infrastructure-Market-to-surpass-2-Trillion-
by-2024-Global-Market-Insights-Inc.html, September 4, 2017, 04:00 ET, Global Market
Insights, Inc.
Griffin, M. A., Hodkiewicz, M. R., Dunster, J., Kanse, L., Parkes, K. R., Finnerty, D., et al.
(2014). A conceptual framework and practical guide for assessing fitness-to-operate in the
offshore oil and gas industry. Accident Analysis and Prevention, 68, 156–171. https://doi.
org/10.1016/j.aap.2013.12.005.
Hales, D. N., & Chakravorty, S. (2016). Creating high reliability organizations using mind-
fulness. Journal of Business Research, 69(8), 2873–2881. https://doi.org/10.1016/j.
jbusres.2015.12.056.
Halsnæs, K., Drews, M., & Clausen, N. E. (2016). Socio-economic impacts—Offshore
activities/energy. In M. Quante & F. Colijn (Eds.), Regional climate studies. North sea region
climate change assessment: Springer Cham, ISBN: 978-3-319-39745-0. https://doi.org/
10.1007/978-3-319-39745-0_14.
Hasan, S. M. (2012). Risk-based design of a process component. Ph.D. Thesis Memorial
University of Newfoundland, 221 pp.
Hasan, S., Hults, J., & Singh, B. (2015). Risk-based design of pipelines, risers. Pipeline & Gas
Journal, 242(10), 63–65.
Hasan, M., Khan, F., & Kenny, S. (2012). Probability assessment of burst limit state due to
internal corrosion. International Journal of Pressure Vessels and Piping, 89, 48–58.
Hasan, S., Sweet, L., Hults, J., Valbuena, G., & Singh, B. (2017). Corrosion risk-based subsea
pipeline design. International Journal of Pressure Vessels and Piping, 159, 14. https://doi.org/
10.1016/j.ijpvp.2017.10.003.
Hass, K. (2008). Managing complex projects: A new model. Berrett-Koehler Publishers, ISBN:
978-1567262339, 298 pp.
Holland, D., & Shemwell, S. (2014). Implementing a culture of safety. Xlibris Corporation,
ISBN: 978-1493151516414 pp.
Hopkins, P. (2004). In Pipeline integrity: Some lessons.Proceedings of the WTIA internaitonal pipelie
integrity and repairs conference, 26 pp.
Hopkins, P. (2008). In Learning from pipeline failures.Proceedings of the WTIA/APIA welded pipe-
line symposium, 15 pp.
Hopkins, D. (2016). In Grand banks bundle.Proceedings of the offshore technology conference, paper
27373-MS, 19 pp. https://doi.org/10.4043/27373-MS.
Hovem, L. A., Torstad, E., Bjerager, P., Bjornsen, T., & Danielsen, H. K. (2014).
In Managing risk in Deepwater frontiers—Key learnings from five continents. Proceedings of
the world petroleum congress, paper 21-1221:10.
IAEA. (2016). Leadership and management for safety. General safety requirements, No. GSR part 2,
IAEA safety standards for protecting people and the environment. Vienna, Austria: International
Atomic Energy Agency, Vienna International Centre. ISBN: 978-9201045164 26 pp.
http://www.iaea.org/books.
IPCC. (2005). Carbon dioxide capture and storage: Special report of the intergovernmental
panel on climate change. In B. Metz (Ed.), Intergovernmental panel on climate change: Work-
ing group III. ISBN: 9780521866439, 431 pp.
IPCC. (2014). Climate change 2014: Synthesis report. In R. K. Pachauri & L. A. Meyer
(Eds.), Contribution of working groups I, II and III to the 5th assessment report of the
intergovernmental panel on climate change. Geneva, Switzerland: IPCC, Core Writing Team.
151 pp.
ISO 13623. (2017). Petroleum and natural gas industries—Pipeline transportation systems (3rd ed.).
. International Organization for Standardization, ISO/TC 67/SC 2, 84 pp.
ISO 31000. (2009). Risk management: Principles and guidelines. Switzerland: ISO 31000,
International Organization for Standardization, Geneva, 24 pp.
320 Shawn Kenny
ISO 73. (2009). Risk management—Vocabulary (1st ed.). International Organization for
Standardization, ISO/TMBG Technical Management Board, 15 pp.
ISO 9000. (2015). Quality management systems—Fundamentals and vocabulary (4th ed.).
International Organization for Standardization, ISO/TC 176/SC 1 concepts and
terminology51 pp.
ISO 9001. (2015). Quality management systems—Requirements (5th ed.). . International
Organization for Standardization, ISO/TC 176/SC 2 quality systems29 pp.
Jordaan, I. (2011). Decisions under uncertainty: Probabilistic analysis for engineering decisions.
Cambridge University Press. ISBN: 978-0521369978690 pp.
Kaley, L. C., & Powers, K. O. (2015). Risk management of pipelines. In R. Winston Revie (Ed.),
Oil and gas pipelines: Integrity and safety handbook (pp. 699–726): John Wiley & Sons.
Chapter 48. https://doi.org/10.1002/9781119019213.ch48.
Kapur, K. C., & Lamberson, L. R. (1977). Reliability in engineering design. Wiley. ISBN: 978-
0471511915, 608 pp.
Kendrick, T. (2009). Identifying and managing project risk: Essential tools for failure-proofing your
project (2nd ed.). AMACOM. ISBN: 978-0814413401, 384 pp.
Kenny, S., Barrett, J., Phillips, R., & Popescu, R. (2007). In Integrating geohazard demand and
structural capacity modelling within a probabilistic design framework for offshore arctic pipelines.
Proceedings of the international offshore and polar engineering conference, paper I07-492. (pp.
3057–3064).
Kenny, S., & Jukes, P. (2017). Polar and arctic technology. In J. Carlton, P. Jukes, &
Y. S. Choo (Eds.), In offshore section C, chapter 13, encyclopedia of marine and offshore engi-
neering. John Wiley & Sons Ltd. ISBN: 978-1118476406. https://doi.org/
10.1002/9781118476406.
Kessler, E. H. (2013). Encyclopedia of management theory. SAGE Publications. ISBN: 978-
1412997829. https://doi.org/10.4135/9781452276090.
Khan, F. (2012). Development of a tool for risk based integrity (RBI) assessment of process components.
Report for Petroleum Research NLReport C9–07, 89 pp.
Khan, F. I., & Haddara, M. M. (2003). Risk-based maintenance (RBM): A quantitative
approach for maintenance/inspection scheduling and planning. Journal of Loss Prevention
in the Process Industries, 16(6), 561–573.
Khan, F. I., Haddara, M. R., & Bhattacharya, S. K. (2006). Risk based integrity and inspec-
tion modeling (RBIM) of process components/system. Risk Analysis, 26(1), 203e221.
Khan, F. I., Sadiq, R., & Haddara, M. M. (2004). Risk-based inspection and maintenance
(RBIM): Multi-attribute decision-making with aggregative risk analysis. Process Safety
and Environment Protection, 82(6), 398–411.
King, T., Phillips, R., Barrett, J., & Cuff, A. (2012). In GIS based analysis for pipeline protection
against ice gouging.Proceedings of the offshore technology conference, paper 23791-MS, 11 pp.
https://doi.org/10.4043/23791-MS.
Klutke, G.-A., Kiessler, P. C., & Wortman, M. A. (2003). A critical look at the bathtub
curve. Proceedings of IEEE Transactions on Reliability, 52(1), 125–129.
Kumamoto, H., & Henley, E. J. (2000). Probabilistic risk assessment and management for engineers
and scientists (2nd ed.). . Wiley-IEEE Press. ISBN: 978-0780360174620 pp.
Kurtz, R. S. (2011). Oil pipeline regulation, culture and integrity. Public Integrity, 13(1),
25–40. https://doi.org/10.2753/PIN1099-9922130102.
Kvalheim, A., & Dahl, Ø. (2016). Safety compliance and safety climate: A repeated cross-
sectional study in the oil and gas industry. Journal of Safety Research, 59, 33–41.
https://doi.org/10.1016/j.jsr.2016.10.006.
Kyriakides, S., & Corona, E. (2007). Mechanics of offshore pipelines: Volume 1 buckling and collapse
(1st ed.). Elsevier, ISBN: 978-0080467320, 448 pp.
Lanan, G. A., Cowin, T. G., & Johnston, D. K. (2011). In Alaskan Beaufort sea pipeline design,
installation and operation.Proceedings of the offshore technology conference, paper 22110-MS, 9
pp. https://doi.org/10.4043/22110-MS.
Lanan, G. A., Ennis, J. O., Egger, P. S., & Yockey, K. E. (2001). In Northstar offshore arctic
pipeline design and construction.Proceedings of the offshore technology conference, paper 13133-
MS, 8 pp. https://doi.org/10.4043/13133-MS.
Langner, C. G. (1999). In Buckle arrestors for deepwater pipelines.Proceedings of the offshore technol-
ogy conference, paper 10711-MS, 12 pp. https://doi.org/10.4043/10711-MS.
Li, X., Chen, G., Zhu, H., & Zhang, R. (2017). Quantitative risk assessment of submarine
pipeline instability. Journal of Loss Prevention in the Process Industries, 45, 108–115. https://
doi.org/10.1016/j.jlp.2016.12.001.
Li, M., McQueen, M., Bik, M., & Zhai, D. (2013). In Subsea geo-hazard risk assessment and
pipeline integrity management—A GIS-based data integration approach.Proceedings of the offshore
technology conference, paper 24397-MS, 10 pp. https://doi.org/10.4043/24397-MS.
Mannan, S. (2012). Lees’ loss prevention in the process industries, volumes 1–3—Hazard identifi-
cation, assessment and control (4th ed.). Elsevier. ISBN: 978-0123971890.
Marle, F., Vidal, L.-A., & Bocquet, J. C. (2013). Interactions-based risk clustering method-
ologies and algorithms for complex project management. International Journal of Production
Economics, 142, 225–234.
Maslen, S. (2015). Organisational factors for learning in the Australian gas pipeline industry.
Journal of Risk Research, 18(7), 896–909. https://doi.org/10.1080/13669877.2014.
919514.
Melchers, R. E. (2001). Structural reliability analysis and prediction (2nd ed.). John Wiley &
Sons. ISBN: 978-0-471-98771-0, 437 pp.
MMS. (2001). Brief overview of Gulf of Mexico OCS oil and gas pipelines: Installation, potential
impacts, and mitigation measures. U.S. Department of the Interior, Minerals Management
Service, Gulf of Mexico OCS Region. OCS Report MMS 2001-067, 19 pp.
Morgan, M. G., & Henrion, M. (2003). Uncertainty: A guide to dealing with uncertainty in quan-
titative risk and policy analysis. Cambridge University Press. ISBN: 0521427444, 332 pp.
Muhlbauer, K. (2004). Pipeline risk management manual: Ideas, techniques, and resources (3rd ed.).
Elsevier, ISBN: 9780080497709, 395 pp.
Muriana, C., & Vizzini, G. (2017). Project risk management: A deterministic quantitative
technique for assessment and mitigation. International Journal of Project Management,
35(3), 320–340. https://doi.org/10.1016/j.ijproman.2017.01.010.
NAS. (2016). Strengthening the safety culture of the offshore oil and gas industry. National
Academies of Sciences, Engineering, and Medicine, 240 pp, 10.17226/23524.
NEB. (2014). Advancing safety in the oil and gas industry: Statement on safety culture. National
Energy Board, 19 pp.
Nepal, B., & Yadav, O. P. (2015). Bayesian belief network-based framework for sourcing risk
analysis during supplier selection. The International Journal of Production Research, 1–22.
Nessim, M. (2012). In Limit states design and assessment of onshore pipelines. Proceedings of the
international pipeline conference, paper IPC2012–90449 (pp. 657–665). https://doi.org/
10.1115/IPC2012-90449.
Nessin, M., Zhou, W., Zhou, J., & Rothwell, B. (2009). Target reliability levels for design
and assessment of onshore natural gas pipelines. Journal of Press Vessel Technology, 131(6),
12 p. https://doi.org/10.1115/1.3110017.
Nobahar, A., & Kenny, S. (2007). Analysis and design of buried pipeline for displacement
controlled hazards: A probabilistic approach. Journal of Offshore Mechanics and Arctic Engi-
neering, 129, 219–228. https://doi.org/10.1115/1.2426989.
Nodine, M. C., Gilbert, R. B., Kiureghian, S. G. W., Cheon, J. Y., Wrzyszczynski, M.,
Coyne, M., et al. (2007). In Impact of hurricane-induced mudslides on pipelines.Proceedings
of the offshore technology conference, paper 18983-MS, 13 pp. https://doi.org/10.4043/
18983-MS.
NPG (2017). Norwegian Petroleum Directorate. http://www.norskpetroleum.no/en/
production-and-exports/the-oil-and-gas-pipeline-system/, Data last synchronized
17.05.2018.
322 Shawn Kenny
NRCan. (2018). Pipelines across Canada. Natural Resources Canada. http://www.nrcan.gc.ca/

energy/infrastructure/18856.
NTSB. (2012). Enbridge incorporated hazardous liquid pipeline rupture and release, marshall, mich-
igan, July 25, 2010. National Transportation Safety Board, Pipeline Accident Report
NTSB/PAR-12/01164 pp.
OGA. (2017). Lessons learned from UKCS oil and gas projects 2011–2016. Oil & Gas Authority,
30 pp.
OGJ, , & OGJ, (Eds.), (2015). Williams, DCP start gas flow from Keathley canyon connector. Oil
and gas journal 02/10/2015. http://www.ogj.com/articles/2015/02/williams-dcp-
start-gas-flow-from-keathley-canyon-connector.html.
OIG. (2012). NASA’s challenges to meeting cost, schedule and performance goals. Office of
Inspector General, Report IG-12-021, 72 pp.
Olaniran, O. J., Love, P. E. D., Edwards, D., Olatunji, O. A., & Matthews, J. (2015). Cost
overruns in hydrocarbon megaprojects: A critical review and implications for research.
Project Management Journal, 46(6), 126–138. https://doi.org/10.1002/pmj.21556.
OM. (2004). Special anniversary—The history of offshore: Developing the E&P infra-
structure. Offshore Magazine 01/01/2004, F. Jay Schempf, Special Correspondent.
http://www.offshore-mag.com/articles/print/volume-64/issue-1/news/special-report/
special-anniversary-the-history-of-offshore-developing-the-ep-infrastructure.html.
OM. (2016). Operators advancing long-distance subsea tiebacks. Offshore Magazine, 76(8)
08/11/2016, Jessica Tippee, Assistant Editorhttp://www.offshore-mag.com/articles/
print/volume-76/issue-8/subsea/operators-advancing-long-distance-subsea-tiebacks.html.
Palmer, A. (1996). In The limits of reliability theory and the reliability of limit state theory applied to
pipelines (pp. 619–626). Proceedings of the offshore technology conference, paper 8218-MS.
https://doi.org/10.4043/8218-MS.
Palmer, A., & King, R. (2008). Subsea pipeline engineering (2nd ed.). Pennwell Corp. ISBN:
978-1593701338, 624 pp.
Paranhos, E., Kozak, T. G., & Boyd, W. (2017). Highly reliable organizations in the onshore nat-
ural gas sector: An assessment of current practices, regulatory frameworks, and select case studies.
Joint Institute for Strategic Energy AnalysisNREL/SR-6A50-67941. 68 pp.
Parker, E. J., Paoletti, L., & Traverso, C. J. (2005). In A probabilistic framework for geohazard
analysis: The example of free-field liquefaction.Proceedings of the offshore technology conference,
paper 17681-MS, 7 pp. https://doi.org/10.4043/17681-MS.
PARLOC. (2001). PARLOC 2001: The update of loss of containment data for offshore pipelines.
Energy Institute, 2003.
PARLOC. (2012). In R. Borresen, H. Harton, & A. Bolsover (Eds.), Pipeline and riser loss of
containment 2001–2012: Update project by oil & gas UK and EI. Presentation. Oil & Gas UK
and Energy Institute, 21 pp.
PARLOC. (2015). Pipeline and riser loss of containment 2001–2012 (PARLOC 2012) (6th ed.).
. Oil & Gas UK and Energy Institute. ISBN: 978-0852937273, 106 pp.
Paulin, M. (2014). In Arctic offshore pipeline design and installation challenges.Proceedings of the off-
shore technology conference, paper 24607-MS, 13 pp. https://doi.org/10.4043/24607-MS.
Paulin, M., & Caines, J. (2016). In The evolution of design tools for arctic subsea pipelines. Proceed-
ings of the offshore technology conference, paper 27374-MS, 11 pp. https://doi.org/10.
4043/27374-MS.
Paulin, M., Cocker, J., Humby, D., & Lanan, G. (2014). In Trenching of pipelines for protection in
ice environments.Proceedings of the offshore technology conference, paper 24606-MS, 8 pp.
https://doi.org/10.4043/24606-MS.
PHMSA. (2017). Pipeline incident 20 year trends. Pipeline Hazardous Materials Safety
Administration. https://www.phmsa.dot.gov/data-and-statistics/pipeline/pipeline-
incident-20-year-trends.
PMI. (2004). A guide to the project management body of knowledge (PMBOK guide). Project
Management Institute, ISBN: 978-1935589679, 589 pp.
Praill, S. (2016). In Municipal Risk Assessment Tool (MRAT).Proceedings of the CSCE-NDM-
561, 6 pp.
Pulici, M., Trifon, M., & Dumitrescu, A. (2003). In Deep water sealines installation by using the
J-lay method - The blue stream experience. Proceedings of the international society of offshore and
polar engineers, paper I-03-088 (pp. 38–43).
Qazi, A., Quigley, J., Dickson, A., & Kirytopoulo, K. (2016). Project complexity and risk
management (ProCRiM): Towards modelling project complexity driven risk paths in
construction projects. International Journal of Project Management, 34(7), 1183–1198.
https://doi.org/10.1016/j.ijproman.2016.05.008.
Reason, J. (1998). Achieving a safe culture: Theory and practice. Work and Stress, 12(3),
292–306. https://doi.org/10.1080/02678379808256868.
Reason, J. (2000). Safety paradoxes and safety culture. Injury Control & Safety Promotion, 7(1),
3–14.
Reid, D., Dekker, M., Paardekam, A. H. M., & Lewis, K. (2014). Deepwater development
non-technical risks—Identification and management, Proceedings of the international
society of offshore and polar engineers. paper SPE-170739-MS, 14p. https://doi.org/
10.2118/170739-MS.
Robertson, J. L. M., Smart, D., & Al-Hassan, T. (1996). Offshore north sea pipeline and riser
loss of containment study (PARLOC)—Applications and limitations in the assessment of
operating risks. Journal of Offshore Mechanics and Arctic Engineering, 118(2), 115–120.
https://doi.org/10.1115/1.2828819.
Royer, P. S. (2000). Risk management: The undiscovered dimension of project manage-
ment. Project Management Journal, 31, 6–13.
Samosir, L. T. M., Popineau, D., & Lechon, A. (2013). In Implementing a deepwater pipeline
management system.Proceedings of the offshore technology conference, paper 24133-MS, 9 pp.
https://doi.org/10.4043/24133-MS.
Schronk, L., Biggerstaff, G., Langmaid, P., Aalders, A., & Stark, M. (2015). In Lucius project:
Export oil and gas pipeline development and execution.Proceedings of the offshore technology con-
ference, paper 26006-MS, 17 pp. https://doi.org/10.4043/26006-MS.
Shemwell, S. M., & Brooks, D. M. (2014). High reliability management in process industries:
Sustained by human factors. PennEnergy, 5, 2014. November.
Singh, M. (2009). A methodology for risk-based inspection planning of oil and gas pipes
based on fuzzy logic. Engineering Failure Analysis, 16, 2098–2113.
Singh, R. (2017). Pipeline integrity—Management and risk evaluation (2nd ed.). . Elsevier. ISBN:
978-0-12-813045-2.
Singh, B., & Poblete, B. (2015). Offshore pipeline risk, corrosion, and integrity management. In
R. Winston Revie (Ed.), Oil and gas pipelines: Integrity and safety handbook (pp. 727–757).
John Wiley & Sons. Chapter 49. https://doi.org/10.1002/9781119019213.ch49.
Sutton, I. (2014). Process risk and reliability management. Gulf Professional Publishing. ISBN:
978-0128016534, 798 pp.
Thodi, P., Khan, F., & Imtiaz, S. (2016). In Arctic pipeline integrity management using real-time
condition monitoring.Proceedings of the offshore technology conference, paper 27372-MShttps://
doi.org/10.4043/27372-MS, 12 pp.
Thodi, P., McQueen, M., Paulin, M., & Lanan, G. (2012). In Arctic pipeline integrity manage-
ment using risk based integrity modeling. Proceedings of the offshore technology conference, paper
23844-MS, https://doi.org/10.4043/23844-MS.
Titti, F. M., Dafne, S., Del Baldo, L., & Pasini, M. (2011). In Integrity management during
offshore pipeline lifetime.Proceedings of the offshore mediterranean conference, paper 2011-031,
12 pp.
324 Shawn Kenny
Tohara, K. (2007). Lessons learned and risk management. International Journal of Performability
Engineering, 3(1), 61–73.
Tsang, A. H. C. (1995). Condition-based maintenance: Tools and decision making.
Journal of Quality in Maintenance Engineering, 1(3), 3–17. https://doi.org/10.1108/
13552519510096350.
Tsuru, E., Asahi, H., & Ayukawa, N. (2006). In Improved collapse resistance of UOE line pipe with
thermal aging for deepwater applications. Proceedings of the international society of offshore and polar
engineers, paper I-06-041. (pp. 187–194).
Turner, J. R. (2009). Handbook of project-based management: Leading strategic change in organiza-
tions (4th ed.). McGraw-Hill. ISBN: 978-0071821780.
UK HSE. (2014). Offshore pipeline integrity management—Operational guidance for inspectors. UK
Health and Safety Executive.
UK HSE. (2016). Offshore statistics & regulatory activity report 2016. UK Health and Safety
Executive, 18 pp.
UK OGIA. (2013). Decommissioning of the pipelines in the north sea region 2013. UK Oil and Gas
Industry Association Limited, 52 pp.
Vanhoucke, M. (2016). Integrated project management sourcebook: A technical guide to project sched-
uling, risk and control. Springer International Publishing. ISBN: 978-3319273723, 283 pp.
Vaughan, D. (2016). The challenger launch decision: Risky technology, culture, and deviance at
NASA, enlarged edition. University of Chicago Press. ISBN: 978-0226346823, 620 pp.
Watson, P. (2016). Performance-based regulation at Canada’s national energy board. National
Academy of Science, Transportation Research Board, 12 pp.
Wenman, T., & Dim, J. C. (2012). Pipeline integrity management. Society of Petroleum
Engineers. Paper SPE-161948. 16 pp. https://doi.org/10.2118/161948-MS.
Willcocks, J., & Bai, Y. (2000). In Risk-based inspection and integrity management of pipeline sys-
tems. Proceedings of the international society of offshore and Polar engineers, paper I-00-151. (pp.
285–293).
Williams, T., & Samset, K. (2010). Issues in front-end decision making on projects. Project
Management Journal, 41(2), 38–49.
Woodson, R. D. (1990). Offshore pipeline failures. Berkeley: University of California, 74p.
Zacharatos, A., & Barling, J. (2005). High-performance work systems and occupational safety. The
Psychology of Workplace Safety, pp. 203–222.
Zacharatos, A., Barling, J., & Iverson, R. D. (2005). High-performance work systems and
occupational safety. Journal of Applied Psychology, 90(1), 77–93. https://doi.org/
10.1037/0021-9010.90.1.77.
Zaman, V., & Mackay, M. (2014). Improving safety culture takes more than just compliance.
Pipeline & Gas Journal, 241(5)62,64-65.
Zhai, S., Chauvet, C., Azarinezhad, R., Zeng, J., & Priyadarshi, A. (2015). In Discussion of
pipeline leakage and hydrate formation risks associated in deepwater natural gas pipelines.Proceed-
ings of the BHR conference, paper 2015-H3, 22 pp.
Zhang, J., Zhang, Z., Yu, Z., Wu, W., & Chen, Y. (2014). In Building a target reliability adap-
tive to China onshore natural gas pipeline.Proceedings of the international pipeline conference, paper
IPC2014–33129, 8 pp. https://doi.org/10.1115/IPC2014-33129.
FURTHER READING
Caines, J., Lanan, G., Sturge, A., Georghiou, A., & Paulin, M. (2012). In Probabilistic methods
for ice gouge hazard analysis in the Beaufort Sea.Proceedings of the offshore technology conference,
paper 23730-MS, 9 pp. https://doi.org/10.4043/23730-MS.
Di Martino, E., Lo Nigro, A., & Kolios, A. (2017). In PIRM-DMS: A decision making tool for
pipeline integrity and risk management.Proceedings of the offshore mediterranean conference14 pp.
DNVGL-RP-C302. (2015). Risk based corrosion management. DNV GL AS36 pp.
EIA. (2016). Offshore oil production in deepwater and ultra-deepwater is increasing. Washington,
DC: U.S. Energy Information Administration. www.eia.gov.
McDonald, D. N., Sullivan, D. J., & Choi, H. S. (1998). In The next generation J-Lay system.
Proceedings of the society of petroleum engineers, paper 39848-SPE (pp. 173–183). https://doi.
org/10.2118/39848-MS.
Moss, M. A. (1985). Designing for minimal maintenance expense: The practical application of reli-
ability and maintainability. CRC Press. ISBN: 978-0824773144. 184 pp.
Thomsen, Å. K., & Leonhardsen, R. L. (1998). In Experience from operation, inspection and con-
dition monitoring of offshore pipeline systems on the Norwegian continental shelf. Proceedings of the
international society of offshore and polar engineers, paper I-98-104 (pp. 21–29).
Vitali, L., Candiracci, F., Crea, C., Bruschi, R., & Rott, W. (2012). In Nord stream project—
Pipeline safety against ship traffic related threats: Quantitative risk assessment approach. Proceed-
ings of the international society of offshore and polar engineers, paper I-12-240 (pp. 75–82).
CHAPTER EIGHT
Regulatory Context
Howard Pike1
Centre for Risk, Integrity and Safety Engineering (C-RISE), Faculty of Engineering, Memorial University,
St. John’s, NL, Canada
1
Corresponding author: e-mail address: p79hlp@mun.ca
Contents
1. The Development of International Conventions 329
1.1 International Convention for the SOLAS 329
1.2 International Convention for the Prevention of Pollution From Ships
(MARPOL) 330
1.3 International Safety Management Code 330
1.4 International Convention on Standards of Training, Certification, and
Watchkeeping for Seafarers 331
1.5 Code for the Construction and Equipment of Mobile Offshore Drilling Units
(MODUs Code) 332
2. The Development of Coastal State Regulation 333
2.1 United Nations Convention on the Law of the Sea 334
2.2 Evolution of Coastal State Regulation 341
3. The Regulators’ Lot 349
4. Industry Initiatives 353
4.1 IADC Safety Case Guideline 355
4.2 International Association of Oil and Gas Producers—Global Industry
Response Group 356
4.3 IOGP Standards Committee 360
5. Summary 360
References 362
Further Reading 364
Regulators, under unprecedented pressure, face a range of demands, often contra-

dictory in nature: be less intrusive—but more effective; be kinder and gentler—but
don’t let the bastards get away with anything; focus your efforts—but be consis-
tent; process things quicker—and be more careful next time; deal with important
issues—but do not stray outside your statutory authority; be more responsive to
the regulated community—but do not get captured by industry.
Sparrow (2000)
#
328 Howard Pike
The regulators’ lot is not a happy one. Over the past 50 years, the search for
the causes of major accidents has spread steadily outward in scope and
backward in time to uncover increasingly deeper root causes. Frequently
featured in this extended causal fallout are the decisions and actions of the
regulatory authority (Reason, 1997).
Laws and regulations are major tools for protecting people and the
environment, if they are understood and practiced as intended. In 1984,
the Royal Commission on the Ocean Ranger Marine Disaster concluded that
the Ocean Ranger had a valid Booklet of Operating Conditions. However, the
document was deemed by the investigation to be of little use to onboard per-
sonnel. The manual was difficult to read, and the format did not reference
important subjects. In fact, former crew members testified that the manual
had been produced with the primary goal of fulfilling a regulatory require-
ment. The manual ignored user needs and capabilities thereby defeating
the regulatory intent and providing little value (Royal Commission, 1984).
There are two primary forms of offshore regulation, those involving flag
State and those involving coastal State. A flag State establishes rules and reg-
ulations for vessels that fly its flag and implements enforcement measures to
secure the observance of all applicable national and international regulations.
A coastal State has sole jurisdiction to regulate the exploration and exploi-
tation of resources in the coastal State’s waters. Therefore, such things as the
design and drilling of subsea wells are subject to the exclusive control of the
coastal State. The coastal State may also impose additional requirements on
the marine operations of a vessel or unit operating in its waters.
This chapter examines the difficult and complex role of the regulator in the
offshore environment where the regulatory complexities of offshore activity
exist, in part, because there are no simple answers to most legal questions. In
the 21st century protecting people and the environment has become an ever
more demanding task. How is a regulator to put laws and regulations in prac-
tice? Laws often do not include the details for compliance, and regulations
alone will not decrease the risks involved in offshore activity. Greater under-
standing and responsibility for the risks involved in offshore activity by those
who generate those activities is a path to increased offshore process safety.
The first section will deal with the evolution of flag State regulation. Next
the evolution of coastal State regulation will be discussed. The lot of the reg-
ulator will be examined. Then the contribution of those whose activity gen-
erates the risk in the offshore will be reviewed.
Regulatory Context 329
1. THE DEVELOPMENT OF INTERNATIONAL

CONVENTIONS
Prior to the establishment of the International Marine Organization,
most international conventions concerning maritime trade originated in a
private organization of maritime lawyers known as the Comite Maritime
International (International Maritime Committee or CMI). The CMI
was formally established in 1897 to promote the establishment of national
associations of maritime law and to ensure a structured relationship between
these associations. The CMI pursued unification of principles extracted
from various medieval maritime codes. CMI was responsible for the drafting
of numerous international conventions including The Hague Rules
(International Convention on Bills of Lading), the Visby Amendments
(amending The Hague Rules), the Salvage Convention, and many others.
The 1948 International Conference in Geneva adopted a convention
formally establishing the Inter-Governmental Maritime Consultative
Organization, or IMCO. The Convention entered into force in 1958
and the new Organization met for the first time the following year. IMCOs
first task was to adopt a new version of the International Convention for the
Safety of Life at Sea (SOLAS), the most important of all treaties dealing with
maritime safety. In 1982, the IMCO name was changed to the International
Maritime Organization, IMO.
The IMO has prepared numerous additional international conventions
concerning maritime safety including the Standards for Training, Certifica-
tion, and Watchkeeping (STCW); the International Regulations for
Preventing Collisions at Sea (Collision Regulations or COLREGS);
Maritime Pollution Regulations (MARPOL); and others. The international
conventions are enforced by the individual nations which are signatories,
either through their maritime authority, or through their courts.
1.1 International Convention for the SOLAS

SOLAS, in its successive forms, is generally regarded as the most important
international treaty concerning the safety of merchant ships. The first version
was adopted in 1914, in response to the Titanic disaster, the second in 1929,
the third in 1948, and the fourth in 1960. The latest SOLAS Convention
in force was adopted on November 1, 1974 and entered into force
330 Howard Pike
May 25, 1980. The latest amendment adopted safety measures for ships
operating in polar waters which came into force on January 1, 2017.
The main objective of SOLAS is to specify minimum safety standards
for the construction, equipment, and operation of ships. Flag States are
responsible for ensuring that ships under their flag comply with its require-
ments through inspections and surveys of ships, and a number of certificates
are prescribed by SOLAS to be issued as proof of compliance. Governments
that have signed onto the convention have the right to inspect ships of
other nations calling at its ports; this is known as Port State control.
1.2 International Convention for the Prevention of Pollution

From Ships (MARPOL)
MARPOL is the main international convention regarding the prevention of
pollution of the marine environment by ships from deliberate, negligent, or
accidental causes and is applicable to ships entitled to fly the flag of a Party to
the Convention, and ships not entitled to fly the flag of a Party, but which
operate under the authority of a Party. A ship is defined as a vessel of any type
whatsoever operating in the marine environment and includes hydrofoil
boats, air-cushion vehicles, submersibles, floating craft, and fixed or floating
platforms (International Maritime Organization (IMO), 2005).
MARPOL incorporates the International Convention for the Preven-
tion of Pollution of the Sea by Oil, which came into force in 1958 and
the 1973 MARPOL Convention adopted after the Torrey Canyon ran
aground in 1967, causing the largest oil spill ever recorded up to that time.
The combined instrument is referred to as the International Convention for
the Prevention of Marine Pollution from Ships, 1973, as modified by the
Protocol of 1978, and entered into force on October 2, 1983 (Annexes
I and II). In 1997, a Protocol was adopted to add a new Annex VI.
1.3 International Safety Management Code

The International Safety Management (ISM) Code is made mandatory by
Chapter IX, Management for the Safe Operation of Ships, of SOLAS for
all self-propelled vessels, including mobile offshore drilling units (MODUs),
over 500 gross registered tons. The ISM Code is an international standard
for the safe management and operation of ships, developed and promulgated
by the IMO to provide a vehicle for ship-owners to create their own programs
individually tailored to meet international standards for safety and pollution
prevention in the operation of vessels. Its primary goals include ensuring safety
at sea, preventing injury or loss of life, and avoiding damage to the environ-
ment and property (IMO, 2015).
The ISM Code does not create specific operating rules and regulations,
but provides a broad framework for vessel owners and operators to ensure
compliance with existing regulations and codes, to improve safety practices,
and to establish safeguards against all identifiable risks. It also sets forth the
safety management objectives that are recommended to be adopted by
companies. Recognizing that ships and MODUs operate under a wide range
of different conditions and environments, the ISM Code is based on general
principles and objectives.
Under flag State requirements vessels are required to have a safety
management system that is designed to develop and implement practices
and procedures for the safe operation of ships, protect against identified risks,
ensure a safe working environment, foster continuous improvement of
personnel safety management skills, and to prepare for emergencies related
to safety and environmental protection. As a structured and documented
system that enables company personnel to implement effectively the com-
pany safety and environmental protection policy, the safety management
system is unique to each company and/or vessel.
1.4 International Convention on Standards of Training,

Certification, and Watchkeeping for Seafarers
The 1978 STCW Convention was adopted on July 7, 1978 and entered into
force on April 28, 1984. It establishes basic requirements on training, certi-
fication, and watchkeeping for seafarers on an international level. Previ-
ously, such standards were established by individual governments, usually
without reference to practices in other countries, which resulted in widely
varied standards and procedures.
The STCW Convention was significantly amended in 1995 and 2010, in
response to a recognized need to clarify and bring the Convention
up-to-date. The 1995 amendments entered into force on February 1,
1997. One of the major features of the revision was that it converted the
technical annex into regulations and created a new STCW Code, to which
many technical regulations were transferred.
Another major change was the requirement under Chapter I, General
Provisions, and Regulation 7 Communication of Information for Parties
332 Howard Pike
to provide detailed information to the IMO regarding administrative mea-

sures taken to ensure compliance with the STCW Convention, including
education and training courses, certification procedures, and other factors
relevant to implementation. This represented the first time that the IMO
took measures to ensure compliance and implementation with a conven-
tion; generally, it had been the sole responsibility of the flag and coastal States
to ensure implementation and compliance with IMO conventions.
1.4.1 The STCW Code

The STCW Code expands upon the basic requirements contained in the
STCW Convention and outlines the minimum standards of competence
required for seagoing personnel. Part A of the STCW Code is mandatory,
while Part B is recommended and contains guidance intended to help Parties
implement the Convention and illustrates how to comply with certain
STCW Convention requirements.
The Manila amendments to the STCW Convention and STCW Code
were adopted, with major revisions, on June 25, 2010. The 2010 amend-
ments entered into force on January 1, 2012 and are aimed at bringing
the STCW Convention and Code up-to-date with developments since they
were initially adopted, and to address issues that are anticipated to emerge in
the foreseeable future.
1.5 Code for the Construction and Equipment of Mobile

Offshore Drilling Units (MODUs Code), 2009
1.5.1 Overview
The MODU Code, in its successive forms, provides standards for oper-
ational and personnel safety aboard MODUs that are equivalent to stan-
dards required by the International Convention for the SOLAS for ships.
The 1989 MODU Code was adopted by IMO Assembly Resolution
A.649 (16) and is applicable to MODUs built since May 1, 1991. The
1989 MODU Code superseded the 1979 MODU Code adopted by
Assembly Resolution A.414 (XI). Since its adoption in 1979, a number
of amendments have been made to the MODU Code, the latest version
of which was approved in 2009 and entered into force on January 1,
2012. These amendments were necessary as MODUs and their opera-
tions became more complex. Additionally, as lessons were learned from
accidents, changes were made with respect to structural fire protection
and lifesaving appliances.
Internationally, the MODU Code is not mandatory, and SOLAS

remains the principal governing convention of MODUs. The purpose of
the 1989 MODU Code is “to recommend design criteria, construction
standards and other safety measures for mobile offshore drilling units so as
to minimize the risk to such units, to the personnel on board and to the
environment.” The Code modifies, for units to which they apply, certain
requirements of SOLAS, but do not regulate the drilling of subsea wells
or procedures for their control.
1.5.2 IMO MODU Code Development

In the late 1960s and early 1970s, as drilling technology advanced that enabled
drilling further offshore and in deeper waters, floating units were developed.
These units were often towed between sites within different coastal State
jurisdictions. As technology progressed, propulsion began to be added to
MODUs and they became capable of moving independently between loca-
tions. With this development, the units were considered ships and, thus,
subject to SOLAS and the International Convention for the Prevention
of Pollution From Ships 1973, as modified by the Protocol of 1978
(MARPOL). While SOLAS traditionally applied to self-propelled ships,
the movement of these units internationally, often with personnel on board,
caused the IMO to develop deliberate standards of safety for MODUs.
The IMOs initial philosophy was that self-propelled MODUs should
have sufficient and capable regular marine personnel to crew the MODU
when moving between locations and that the life safety and fire protection
provided should be sufficiently robust, to the extent possible, to protect
against the hazards of the drill floor. As such, lifeboats, capsules, and other
lifesaving gear were required to accommodate the total number of
personnel on board. In addition, lifesaving equipment is required to be
duplicated at widely separated embarkation areas and redundant lifesaving
appliances are located on opposite sides of the MODU in order to account
for the possibility that one embarkation area may be inaccessible due to an
accident.
2. THE DEVELOPMENT OF COASTAL STATE REGULATION

Admiralty law is distinguished from the Law of the Sea, which is a
body of public international law dealing with navigational rights, mineral
rights, jurisdiction over coastal waters, and international law governing
334 Howard Pike
relationships between nations. In 1945, President Harry S. Truman,

responding in part to pressure from domestic oil interests, unilaterally
extended United States jurisdiction over all natural resources on that nation’s
continental shelf—oil, gas, minerals, etc. This was the first major challenge
to the freedom-of-the-seas doctrine. Other nations soon followed suit.
2.1 United Nations Convention on the Law of the Sea

The United Nations Convention on the Law of the Sea (UNCLOS) is a
treaty regarding protection of the marine environment and various maritime
boundaries. The 17th century principal of the freedom-of-the-seas doctrine
limited national jurisdiction over the oceans to a narrow 3-mile belt of sea
surrounding a nation’s coastline. This principal prevailed until the mid-20th
century, when it became apparent that an international agreement was nec-
essary to determine how ocean resources were to be regulated and par-
titioned. UNCLOS was adopted as an unprecedented attempt by the
international community to regulate all aspects of the resources of the sea
and uses of the ocean such as navigational rights, territorial sea limits, eco-
nomic jurisdiction, legal status of resources on the seabed beyond the limits
of national jurisdiction, passage of ships through narrow straits, conservation
and management of living marine resources, protection of the marine envi-
ronment, marine research, and procedures for settling disputes among
nations (United Nations, n.d.).
UNCLOS was opened for signature on December 10, 1982 in Montego
Bay, Jamaica. This marked the culmination of more than 14 years of work
involving participation by more than 150 countries representing all regions
of the world, legal and political systems, and the spectrum of socio-
economic development. At the time of its adoption, UNCLOS embodied
in one instrument traditional rules for the uses of the oceans and at the same
time introduced new legal concepts and regimes, and addressed new
concerns. UNCLOS also provided the framework for further development
of specific areas of the law of the sea.
UNCLOS entered into force on November 16, 1994, 12 months after
the date of deposit of the 60th instrument of ratification or accession. Today,
it is globally recognized as the overarching regime dealing with all matters
relating to the law of the sea.
As of June 2016, 168 members of the United Nations have signed and
ratified UNCLOS. An additional 14 UN member states have signed the
Convention but have not ratified it. There are 15 United Nations member
and observer states which have neither signed nor acceded either the
Convention or the Agreement. Although the United States helped shape
the Convention and its subsequent revisions, and signed the 1994 Agree-
ment on Implementation, it has not signed the Convention over objections
to Part XI of the Convention.
Under international law, one of the rights of a country is the right to con-
trol waters offshore. As reflected in the ULCLOS, international law
recognizes four offshore zones that give rights to an adjacent country: the
territorial sea, the contiguous sea, the exclusive economic zone (EEZ),
and continental shelf. They are measured from a baseline either drawn using
the coastline or the outermost points of archipelago islands. Fig. 1 is an illus-
tration of the offshore zones.
Archipelagic states are states that are composed of groups of islands
forming a State as a single unit, with the islands and the waters within
the baselines as internal waters. Under this concept (archipelagic doctrine),
an archipelago shall be regarded as a single unit, so that the waters around,
between, and connecting the islands of the archipelago, irrespective of
their breadth and dimensions, form part of the internal waters of the State
and are subject to its exclusive sovereignty. A baseline is drawn between
the outermost points of the islands, provided that these islands are close
to each other. All water inside this is called archipelago waters. The State
has full sovereignty over these waters very much similar to the internal
waterways, and foreign vessels are allowed innocent passage through archi-
pelago waters.
Originally, the territorial sea recognized as the water area seaward from
the low water mark of a country to a limit of 3 nautical miles (the distance a
cannonball could be fired from shore). In other words, 3 miles was the
distance that could be protected effectively by a country from its shoreline.
Today, the limit of territorial sea has been extended by international law to a
distance not exceeding 12 nautical miles from the baseline. The law
recognizes the territorial sea as part of the territory of the adjacent country,
as if it were essentially land territory.
The contiguous zone is a further offshore zone recognized under inter-
national law. The contiguous zone shall not exceed 24 nautical miles from
the baseline. The contiguous zone includes the territorial sea, but the zone
beyond 12 nautical miles is not considered part of the land territory of the
adjacent country. International law does permit the country to enforce
336 Howard Pike
National airspace
International airspace
High seas
Archipelagic
Contiguous zone baselines
24 nm
Archipelagic
Territorial sea waters
12 nm
Coastal
Exclusive economic zone baselines
200 nm
Continental shelf
(from 200 to 350 nm,
depending on special conditions)
Islands of the archipelago
May be enclosed in archipelago
International baseline, all bays and rivers considered
seabed internal waters.
If archipelago baseline does not exist,
then the coastal baseline is used.
Fig. 1 Marine zones as defined by UNCLOS. Recreated by authors from Batongbacal, J., &
Baviera, A. S. P. (2013). The West Philippine Sea—The territorial and Maritime Jurisdiction
Dispute from a Pilipino Perspective—A Primer. The Asian Center and Institute for
Maritime Affairs and Law of the Sea, University of the Philippines.
certain laws in this zone, such as those pertaining to customs and excise,
taxation, immigration, and sanitation.
The EEZ is the third major offshore zone recognized under International
Law. The EEZ extends to a distance of 200 nautical miles from the baseline
of a country and includes both the territorial sea and the contiguous zone.
Within the EEZ a country enjoys the exclusive right to explore and to
exploit the natural resources of the seabed and subsoil of the ocean floor.
The EEZ is tied to the continental shelf in an attempt to recognize the desire
of countries that border on the ocean to benefit from exploiting the
resources of the shelf.
The continental shelf of a coastal State comprises the seabed and subsoil
of the submarine areas that extend beyond its territorial sea throughout
the natural prolongation of its land territory to the outer edge of the con-
tinental margin, or to a distance of 350 nautical miles from the base-
lines from which the breadth of the territorial sea is measured where the
outer edge of the continental margin does not extend up to that distance
(UNCLOS).
2.1.1 South China Sea Arbitration

As a result of overlapping territorial claims, the South China Sea is one of the
most politically sensitive regions in the world. China is asserting sovereignty
over a vast maritime area in the South China Sea but there are also claims by
Vietnam, Taiwan, Malaysia, Brunei, and the Philippines. The United States
has become involved, challenging China’s claim and has been conducting
freedom of navigation exercises. Several tense standoffs have already threat-
ened to throw the area into conflict, including in 2012 when the Philippines
Navy intercepted several Chinese fishermen off Scarborough Shoal. During
the 1970s and 1980s, China and Vietnam used force several times, resulting
in dozens of deaths and several sunken ships (CNN, 2016).
The South China Sea is a semienclosed sea in the western Pacific Ocean,
spanning an area of almost 3.5 million square kilometers. The South China
Sea lies to the south of China, to the west of the Philippines, to the east of
Vietnam, and to the north of Malaysia, Brunei, Singapore, and Indonesia.
The South China Sea is a crucial shipping lane, a rich fishing ground, home
to a highly biodiverse coral reef ecosystem, and believed to hold substantial
oil and gas resources. The southern portion of the South China Sea is also the
location of the Spratly Islands, a constellation of small islands and coral reefs,
existing just above or below water. Long known principally as a hazard to
navigation and identified on nautical charts as the “dangerous ground,” the
Spratly Islands are the site of longstanding territorial disputes among some
of the States around the South China Sea (PCA Case No. 2013-19)
(Permanent Court of Arbitration (or Registry), 2016).
In January 2013, the Philippines launched an arbitration case against
China pursuant to Part XV, and Annex VII of UNCLOS. Both the Philip-
pines and China are parties to UNCLOS, the Philippines having ratified it
on May 8, 1984, and China on June 7, 1996. UNCLOS addresses a wide
range of issues and includes as an integral part a system for the peaceful
settlement of disputes. This system is set out in Part XV, which provides
for a variety of dispute settlement procedures, including compulsory arbitra-
tion in accordance with a procedure contained in Annex VII. China refused
to take part in the case and, under the terms of the UNCLOS, was well
within its legal right. China has rejected the tribunal’s authority to rule
on the case. It is also important to note the tribunal had no jurisdiction to
decide any issues over the sovereignty of islands and rocks in the South
China Sea. UNCLOS only deals with control of the waters surrounding
them (The Guardian, 2016).
338 Howard Pike
For the purposes of the South China Sea dispute, an important part of
UNCLOS are the definitions of what constitutes land features. An island
controlled by a country is entitled to a territorial sea of 12 nautical miles
as well as an EEZ of up to 200 nautical miles (370 km). A rock owned by
a State will also generate a 12-nautical mile territorial border but not an
economic zone under UNCLOS, while a low-tide elevation grants no ter-
ritorial benefits at all. It also explains why countries have laid claim to islands
and reefs in the South China Sea to legitimize their claims.
Although the case was raised by the Philippines, it will affect all the coun-
tries as it effectively questions China’s all-encompassing “nine-dash” demar-
cation line, a dotted marker in Chinese maps that stretches deep into the
South China Sea.
2.1.1.1 The Philippine Submission

The Philippines made some 15 submissions to the Tribunal containing
numerous claims against China. The Tribunal summarized those claims into
the following four categories:
First, the Philippines asked the Tribunal to resolve a dispute concerning
the source of maritime rights and entitlements in the South China Sea. The
Philippines sought a declaration that China’s rights and entitlements must be
based on UNCLOS. The Philippines argued that China’s claim to rights
within the “nine-dash line” marked on Chinese maps exceeded the entitle-
ment that China would be permitted by UNCLOS.
Second, the Philippines asked the Tribunal to resolve a dispute con-
cerning the entitlements to maritime zones that would be generated under
UNCLOS by Scarborough Shoal and certain features in the Spratly Islands
claimed by both the Philippines and China. The Philippines sought a dec-
laration that all of these features did not generate entitlement to an EEZ or to
a continental shelf.
Third, the Philippines asked the Tribunal to resolve a series of disputes
concerning the actions of China in the South China Sea including:
• Interfering with the exercise of the Philippines’ rights under UNCLOS;
• Failing to protect and preserve the marine environment by promoting a
harmful fishery; and
• Inflicting severe harm on the marine environment by constructing
artificial islands.
Fourth, the Philippines asked the Tribunal to find that China had aggravated
and extended the dispute during the arbitration by restricting access to
Second Thomas Shoal and further engaging in construction of artificial

islands in the Spratly Islands.
2.1.1.2 China’s Counter Arguments

China had consistently rejected the Philippines’ recourse to arbitration and
had neither accepted nor participated in the proceedings. While China did
not file formal statement, it had articulated its position in public statements
and in diplomatic notes both to the Philippines and to the Permanent
Court of Arbitration which served as the Registry for the arbitration. On
December 7, 2014, China’s Foreign Ministry published a “Position Paper
of the Government of the People’s Republic of China on the Matter of
Jurisdiction in the South China Sea Arbitration Initiated by the Republic
of the Philippines” (China, 2014). In its Position Paper, China argued that
the Tribunal lacks jurisdiction because (a) “The essence of the subject-
matter of the arbitration is the territorial sovereignty over several maritime
features in the South China Sea, which is beyond the scope of the Conven-
tion and does not concern the interpretation or application of the
Convention”; (b) “China and the Philippines have agreed, through bilateral
instruments and the Declaration on the Conduct of Parties in the South
China Sea, to settle their relevant disputes through negotiations. By unilat-
erally initiating the present arbitration, the Philippines has breached its
obligation under international law”; and (c) the disputes submitted by the
Philippines, “that subject-matter would constitute an integral part of
maritime delimitation between the two countries, thus falling within the
scope of the declaration filed by China in 2006 in accordance with the
Convention, which excludes, interalia, disputes concerning maritime
delimitation from compulsory arbitration and other compulsory dispute
settlement procedures” (China, 2014).
As the verdict got closer, China spoke out, saying the case went beyond
the jurisdiction of UNCLOS and insisted on multiple occasions that it
would not acknowledge the court’s decision. Additionally, China ramped
up its campaign to assert its historical rights in the region with state news
agency Xinhua publishing almost daily articles outlining its views (The
Guardian, 2016).
2.1.1.3 Decision
On October 29, 2015, the Tribunal issued its Award on Jurisdiction and
Admissibility addressing the objections to jurisdiction set out in China’s
340 Howard Pike
Position Paper, as well as other questions concerning the scope of the

Tribunal’s jurisdiction.
In its Award, the Tribunal unanimously concluded that the Tribunal was
properly constituted in accordance with Annex VII; that China’s
nonappearance in the proceedings did not deprive the Tribunal of jurisdic-
tion; that the Philippines’ initiation of the arbitration did not constitute an
abuse of process; that there was no indispensable third party whose absence
deprives the Tribunal of jurisdiction; that the 2002 China–ASEAN
Declaration on Conduct of the Parties in the South China Sea, the joint
statements of the Parties referred to in paragraphs 231–232 of this Award,
the Treaty of Amity and Cooperation in Southeast Asia, and the Convention
on Biological Diversity, do not preclude, under Articles 281 or 282 of
UNCLOS, recourse to the compulsory dispute settlement procedures avail-
able under Section 7 of Part XV; and that the Parties exchanged views as
required by Article 283.
The Tribunal acknowledged that China did not accept the decisions in
the Tribunal’s Award on Jurisdiction and had stated that the Award was
null and void, and had no binding effect on China. The Tribunal also
acknowledged that China continued to assert publicly that the Tribunal
lacks jurisdiction for the same reasons set out in China’s Position Paper of
December 7, 2014.
On July 12, 2016, the Tribunal issued its South China Sea Arbitration
Award. In its Award, the Tribunal unanimously concluded that China’s
claims to historic rights, or other sovereign rights or jurisdiction, with
respect to the maritime areas of the South China Sea encompassed by the
relevant part of the “nine-dash line” exceed the geographic and substantive
limits of China’s maritime entitlements under UNCLOS and were without
lawful effect. In addition, it concluded:
• That Mischief Reef and Second Thomas Shoal were low-tide elevations
and did not generate entitlements to a territorial sea, EEZ, or continental
shelf;
• That Subi Reef, Gaven Reef (South), and Hughes Reef were low-tide
elevations and did not generate entitlements to a territorial sea, EEZ, or
continental shelf, but may be used as the baseline for measuring the
breadth of the territorial sea;
• That Scarborough Shoal, Gaven Reef (North), McKennan Reef,
Johnson Reef, Cuarteron Reef, and Fiery Cross Reef were rocks that
could not sustain human habitation or economic life of their own, within
the meaning of Article 121(3) and accordingly they generated no
entitlement to an EEZ or continental shelf;
• That Mischief Reef and Second Thomas Shoal were within the EEZ and
continental shelf of the Philippines; and
• That Scarborough Shoal had been a traditional fishing ground for
fishermen of many nationalities and that China has, through the opera-
tion of its official vessels at Scarborough Shoal from May 2012 onward,
unlawfully prevented fishermen from the Philippines from engaging in
traditional fishing at Scarborough Shoal.
Legally, the Permanent Court of Arbitration’s decision is binding and there
may be implications diplomatically for China if they refuse to abide by it.
However, there is no military option to enforce the ruling—United Nations
troops will not be forcing China off the artificial islands on Fiery Cross or
Mischief Reef (CNN, 2016).
2.2 Evolution of Coastal State Regulation

The evolution of the coastal State regulation can be traced by following the
development of the petroleum resources in the Gulf of Mexico and offshore
California. Unfortunately, it is an account of learning by accident. As acci-
dents occurred and the industrial technology evolved, so too did
the regulatory system. The account of this development has been taken
principally from the National Commission on the BP Deepwater Horizon
Oil Spill and Offshore Drilling Report to the President (National
Commission, 2011). It highlights the regulatory challenges of managing
the risks associated with the activities of a dynamic industry that is constantly
testing the bounds of technology.
As with many things associated with the offshore there are no easy
answers to the question of the start of offshore oil and gas development.
In 1896 wells were first drilled from piers off Summerland, California. By
1900 beaches in the Summerland area displayed clusters of piers up to
1200 ft. in length from which exploration wells were successfully drilled.
The state of Louisiana began issuing leases in the Gulf of Mexico in
1936. The first free-standing platform in the ocean was built in 1937 by
Brown and Root for two independent firms, Pure Oil and Superior Oil,
in 14 ft. of water a mile and a half from shore on Gulf of Mexico State lease
No. 1. In March 1938, a well drilled from the platform discovered what
would be called the Creole Field. With almost no guidelines on the wind
and wave forces that a hurricane might exert on the platform, designers used
onshore design standards to estimate wind forces on this offshore structure
(Pratt, 2014). These discoveries were still within what was known at the
time as the 3-mile territorial sea. Notwithstanding there were no
342 Howard Pike
international agreements that addressed the rights to the various minerals on

areas outside the 3 mile territorial limit, exploration continued further from
shore and in deeper water.
By 1945 the Federal government took an interest in the resources
offshore and President Harry Truman proclaimed federal authority over
the subsoil of the US continental shelf. California, Texas, and Louisiana
ignored the proclamation and continued to lease offshore land. The federal
government took those States to court and the Supreme Court ruled against
California in 1947 and against Louisiana and Texas in 1950, declaring that
the federal government had paramount rights over the individual States’
rights of ownership. After significant congressional and Presidential debate,
the Submerged Lands Act, passed in 1953. Two months later the Outer
Continental Shelf Lands Act was passed which gave states control 3 nautical
miles out from the shoreline, except for Texas and western Florida which
were given 9 nautical miles due to historic claims. The outer continental
shelf seaward of state lands was claimed by the federal government
(National Commission, 2011).
The Outer Continental Shelf Lands Act states that the Secretary of the
Department of Interior, the Secretary of the Department that includes the
Coast Guard, and the Secretary of the Army shall enforce safety and
environmental regulations promulgated pursuant to the Act. Each federal
department may, by agreement, utilize, with or without reimbursement,
the services, personnel, or facilities of other federal departments and agencies
for the enforcement of their respective regulations. This has resulted in a
series of agreements between the various departments.
The primary safety regulator is the Department of the Interior. The
agency within this department has changed over time, but during the early
period was the Conservation Division of the US Geological Survey (USGS).
The USGS between 1958 and 1960 issued OCS Orders 1–5, requiring
procedures for drilling, plugging, and abandoning wells, determining well
producibility, and the installation of subsurface safety devices. The
early orders did not specify design criteria or detailed technical standards.
While they did not have any explicit testing requirements, the equipment
was required to be installed and operational. Companies had interpreted
the requirement for the equipment, but they believed that they did not have
to test any to see if it worked.
The United States Coast Guard is responsible for enforcing regulations
relating to the safety of life for offshore oil and gas operations. For fixed
platforms the focus is on fire fighting, emergency lighting, escape, and aban-
donment. For floating structures, it also includes hull integrity, ballast
control, marine systems, and crewing.
A step change in offshore drilling came in January 1962, when the Blue
Water 1 under lease to Shell Oil, spudded a record-setting offshore well in
297 ft. of water in the Gulf of Mexico. This was at least three times deeper
than wells drilled by other mobile drilling units, such as submersibles and
jack-ups which used more conventional land-based drilling techniques. It
was the first use of what came to be known as a semisubmersible drilling unit
(Priest, 2014).
On December 27, 1965, the jack-up drilling rig, Sea Gem, capsized
approximately 36 nautical miles (67 km; 42 mi) off the coast of Lincolnshire,
United Kingdom. The crew had finished drilling a well and were in the
process of moving the rig to another drill site approximately 2 nautical miles
(3.7 km; 2.3 mi) away. When the rig was lowered, two of the legs collapsed
causing the equipment and people to slide off and into the frigid North Sea.
The Sea Gem was originally a 5600-ton steel barge, converted to function as
a drilling unit by British Petroleum in 1964. The barge consisted of 10 steel
legs which would raise the barge 15 m (49 ft.) above the sea level. It also
included a helipad, living quarters for the crew of 34 and a drilling derrick
with associated drilling equipment.
The industry tends to evolve their standards on the basis of experience.
The loss of the Sea Gem focused concern on the structural integrity of
MODUs and led to the development of classification rules. It was not until
1968 that a ship classification society developed rules to govern the design
and construction of MODUs.
On January 28, 1969, Union Oil Company of California (Unocal) expe-
rienced a blowout on Platform A in the Dos Cuadras Offshore Oil Field 6
miles off Santa Barbara County, California. The blowout released an
800-square-mile slick of oil that blackened an estimated 30 miles of
California beaches and soaked sea birds in oil. Unocal had obtained a waiver
from the OCS Order 2 from the USGS with their field drilling rules that
governed casing requirements. The well was drilled to its total depth of
3479 ft. with only 239 ft. of conductor casing installed with the rest being
open hole. When the drill pipe was pulled out of the well a suction was
created and the well began to flow. The crew was able to shut-in the well
with blind rams on the blowout preventer (BOP). However, the pressure at
the bottom of the conductor casing was sufficient to breakdown the
344 Howard Pike
formation in the open-hole section and cause a flow outside of the conduc-
tor casing to the surface (Arnold, 2015). The 11-day blowout spilled an
estimated 80,000 barrels of oil. It generated intense opposition to offshore
oil activity in California setting the stage for the passage of the National
Environmental Policy Act (National Commission, 2011).
The initial investigation after the Santa Barbara blowout showed that the
OCS Orders for drilling were not adequate. In August 1969, USGS issued
revised Orders 1–5 and a new Order 6 and 7. Order 6, Completion of Oil
and Gas Wells, required that wellhead equipment be rated and pressure
tested for shut-in pressures and that casing pressure between the production
casing and the next casing should be tested and repaired if there is sustained
pressure. Order 7, Pollution and Waste Disposal, required that spills of a
substantial size or spills where the size cannot be determined be reported
immediately and established that the leasee had the obligation to pay for
any cleanup operations (Arnold, 2015).
The industry protested the new outer continental shelf regulations, but
further accidents in the Gulf undermined its case. In February 1970, Chev-
ron’s Platform C in Main Pass Block 41 blew out and caught fire. Chevron
was fined $1-million for failing to maintain subsurface safety valves and other
required safety devices. This was the first prosecution under the 1953 Outer
Continental Shelf Lands Act. In December, Shell suffered a major blowout
on its Platform B in the Bay Marchand area, killing four workers and seri-
ously burning and injuring 37 others. Investigators attributed the accident to
human error resulting from several simultaneous operations being per-
formed without clear directions about responsibility. It took 136 days to
bring 11 wells under control, at a cost of $30 million. The failure or leaking
of subsurface safety valves contributed to the size of the conflagration.
On October 30, 1970, USGS issued new Orders 8, Platforms and Struc-
tures, and Order 9, Pipelines, specified requirements for pipeline design,
shut-in valves, and check valves.
In June 1972, Order 5 was revised to require the installation of surface
controlled subsurface safety valves (SCSSVs) on all new wells and any old
wells when the tubing had to be pulled. Industry felt that existing SCSSV
designs were not reliable and the frequency of testing and maintenance of
these downhole valves would cause production disruptions and potential
safety problems.
In response, the industry began drafting a new set of American Petro-
leum Institute (API) “recommended practice” guidance documents for
the selection, installation, and testing of safety devices, as well as for platform
design. API formed the Offshore Safety and Anti-Pollution Equipment

Committee to write specifications and recommended practices for the
14 series of API documents. Prior to 1975, the subjects covered were
SCSSVs (14A&B), process safety sensors and controls (14C), piping systems
(14E), electrical systems (14F), and firefighting systems (14G). When the
OCS Orders were replaced by regulations, the API-recommended practices
were adopted into and incorporated by reference in 30 CFR 250, the section
of the Code of Federal Regulations.
In 1969, the industry initiated the annual Offshore Technology Confer-
ence in Houston, Texas, which became an important forum for publishing
and sharing technical information that led to safer designs and operations.
Design and equipment problems were steadily being solved.
The industry’s safety record in the Gulf improved significantly after the
new regulations and practices were introduced; the reported incidence and
rate of fatalities and injuries decreased, as did the rate of fires and explosions.
During the 1970s and 1980s, the frequency of blowouts did not decline
significantly, but there was a drop in the number of catastrophic blowouts,
and fewer casualties and fatalities were associated with them.
In March 1980, the Alexander Kielland capsized killing 123 of the 212
people on board. It was built as a drilling rig but was being used to house
offshore workers at the Ekofisk Field in the Norwegian North Sea. The
Norwegian government responded to the loss of the Alexander Kielland
by transforming its approach to industry operations. Under the new regime,
rather than relying solely on prescribed operational and safety standards, the
government required the industry to demonstrate thorough consideration of
the risks associated with the structures and operations that sufficient safety
and risk management systems were in place. By shifting the burden of dem-
onstrating safety to the operator, the regulator would instead “consent” to
development activity (National Commission, 2011).
Meanwhile back in the United States, a Commission on Fiscal Account-
ability of the Nation’s Energy Resources concluded in July 1981 that the oil
and gas industry was not paying all the royalties it rightly owed, and the
government’s royalty recordkeeping was in disarray. It called for a complete
overhaul, including a wholesale reorganization of Interior Department
responsibility for overseeing royalty collection from federal and Indian lands
(National Commission, 2011).
In January 1982, the US Secretary of the Interior created the Mineral
Management Service (MMS), aiming from the outset to promote domestic
energy supplies by expanding drilling on the outer continental shelf. The
346 Howard Pike
new agency combined, in one entity, authority for regulatory oversight with
responsibility for collecting revenues obtained from lease sales and royalty
payments.
In July 1988, the Piper Alpha production platform operating 120 miles
northeast of Aberdeen, Scotland, exploded and collapsed, killing 167 people
including two rescuers. As in Norway after the Alexander Kielland, the Piper
Alpha accident and the subsequent investigation led by Lord Cullen had an
impact on United Kingdom regulation. The previous prescriptive regula-
tory approach evolved into one with a requirement for companies to
demonstrate to the regulator that they had undertaken a thorough assess-
ment of risks associated with an activity and they had adequate safety and
risk management systems to manage those risks.
On March 19, 1989, a platform operating in the South Pass Block 60 off
the Louisiana coast caught fire, destroying the platform and killing seven
people. An MMS investigation concluded that the uncontrolled release of
liquid hydrocarbons resulted from poor management of a repair operation
saying that not only was there an absence of detailed and coordinated plan-
ning for the project, there was a lack of oversight over contractor activities.
After South Pass Block 60, MMS convened an internal task force to
review its offshore drilling inspection and enforcement program. That same
year, they also commissioned the Marine Board of the National Research
Council to make recommendations for overhauling MMSs regulatory
program to best fulfill its safety mission at current levels of staffing and
budget (NRC, 1990).
In January 1990, the Marine Board issued its report “Inspection Alter-
natives for Outer Continental Shelf Operations.” This report pointed out
that both industry and the MMS had been concentrating their efforts on
compliance to the regulations which focused on equipment and safety
systems. Industry was developing an “attitude of compliance.” As long as
they were in compliance with the regulations and passed an MMS inspection
they were by their definition safe. Yet the accident history showed that the
causes of deaths, fires and explosions, and spills had little to do with failure of
safety systems to operate as designed or failure to have the proper equipment
in place. The “majority of accident events occurring on the OCS in a rep-
resentative year (1982) were related to operational and maintenance proce-
dures or human error that are not addressed directly by the hardware-
oriented PINC list.” The PINC list was a list of Potential Incident of
Noncompliance which was used by MMS inspectors to test compliance
to a specific regulation. The report concluded the MMS should “place its
primary emphasis on detection of potential accident-producing
situations—particularly those involving human factors, operational proce-
dures, and modifications of equipment and facilities.”
Five days after the South Pass Block tragedy in March 1989, the Exxon
Valdez ran aground in Prince William Sound, spilling an estimated 11 million
gallons of crude oil on the Alaskan shore. The government was still preoc-
cupied with cleanup duties in Prince William Sound and to a nation attuned
to demands for requiring double-hulled tankers when the Marine Board
delivered its report. Congress enacted the Oil Pollution Act of 1990, but
failed to implement any of the regulatory recommendations identified by
the Marine Board. However, the MMS continue to work to improve reg-
ulatory oversight. Under the new Act and a supplementary Presidential
Executive Order, the MMS was given the added charge of overseeing off-
shore pipelines and oil-spill response planning and prevention (National
Commission, 2011).
In 1990, the Occupational Safety and Health Administration (OSHA)
published its intention to establish a proposed standard, “Process Safety
Management of Highly Hazardous Chemicals” (PSM). This was a result
of accidents in chemical process plants and refineries including the 1984
Bhopal, India, incident resulting in more than 2000 deaths and the 1989
Phillips Petroleum Company, Pasadena, TX, incident resulting in 23 deaths
and 132 injuries. A final rule was published in 1992. However, OSHA had
no jurisdiction offshore in OCS waters (Arnold, 2015).
After OSHA adopted PSM, API then Published Recommended Practice
750 which defined the elements required for refineries to meet the intent of
PSM. In 1993, API RP 75 “Safety and Environmental Management Pro-
grams on the Outer Continental Shelf (OCS) Operations and Facilities”
(SEMP) was published in the hope that MMS would adopt it rather than
a version of OSHA’s PSM. In 1993, a companion document to SEMP
was also created by API, RP 14J Recommended Practice for Design and
Hazards Analysis for Offshore Production Facilities. This was referenced
in SEMP as a guideline for addressing the specifics of the Hazards Analysis
element and the proper use of HAZOPs. For a more complete chronology
of the development of SEMS see Chapter 4, “U.S. Offshore Safety Regula-
tion Pertaining to Safety Culture” of the Transportation Research Board
of the National Academics special report 321, Strengthening the Safety Culture
of the Offshore Oil and Gas Industry (TRB, 2016).
348 Howard Pike
On April 20, 2010, a blowout occurred on the Transocean Deepwater

Horizon rig. It was in the process of temporarily abandoning the Macondo
well for BP in Mississippi Canyon 252 in 5100 ft. of water. The ensuing
explosion and fire led to the loss of 11 lives, the sinking of the rig and
the worst oil spill in US history. Approximately 4 million barrels of oil
flowed from the well during a period of 87 days until the well was finally
capped on July 15. Production casing had been set and cemented. The
negative pressure test showed that the cement job was not adequate but
the results had been misinterpreted by the crew. The first indications that
the well was flowing were available 50 min before the blowout but were
overlooked or ignored. The blind shear rams on the BOP were activated
after the explosion but did not totally close.
Those simply tracking the statistics could point to a better record in the
offshore area. Between 1992 and 2006, 39 blowouts had occurred compared
with 87 from 1971 to 1991. There was a significant decrease in fatalities and
injuries with only one fatality and two injuries from 1992 to 2006, compared
with 25 fatalities and 65 injuries during the previous period, 1971–91. Most
of the blowouts during 1992–2006 had occurred in water depths of less than
500 ft. with only six occurring in water depths greater than 500 ft. Of the
39 blowouts during the period between 1992 and 2006, 5 occurred on plat-
form rigs, 22 occurred on jack-ups, and only 6 were on semisubmersible rigs.
Cementing had been a contributing factor in 18 of the 39 blowouts between
1992 and 2006 (Izon, Danenberger, & Mayes, 2007). For further analysis of
the cementing problems see case study in Box 4-1 Chapter 4, U.S. Offshore
Safety Regulation Pertaining to Safety Culture, of the Transportation
Research Board of the National Academics special report 321, Strengthening
the Safety Culture of the Offshore Oil and Gas Industry (TRB, 2016).
The industry had focused on personnel protection metrics and had
convinced themselves they were doing what needed to be done. Just as with
Piper Alpha, the Macondo well blowout was a high consequence rare event
which no one thought could ever happen. However, on the Macondo well,
there were mistakes made in the planning and implementation of the
abandonment operation in the days prior to the accident and there were
mistakes made on the rig the day of the accident (Arnold, 2015).
Not long after the tragedy, its repercussions shifted to the MMS. Nine-
teen days after the rig sank, the Secretary of the Interior announced his
intention to strip MMSs safety and environmental enforcement responsibil-
ities away from its leasing, revenue collection, and permitting functions, and
to place the former within a “separate and independent” entity. The con-
sequences of the Macondo well blowout had extended all the way back
to the regulator with the fallout a fundamental change in the regulatory
structure (National Commission, 2011).
3. THE REGULATORS’ LOT

The regulators lot is not a happy one. Not only are they rarely loved by
those they regulate, they are now more likely to carry some of the blame for
catastrophic accidents. As illustrated by the Macondo well blowout in the
Gulf of Mexico, the search for the causes of a major catastrophe has spread
steadily outward in scope and backward in time to uncover increasingly
deeper contributions. Frequently featured in this extended cause search
are the decisions and actions of the regulatory authority. Increasingly the
public is demanding a proactive approach to safety performance where safety
is not learned by accident. The difficult and complex role of the regulator in
risk management is examined.
Legislators have long regulated the safety of industries engaged in
hazardous activities to protect the health and safety of people, preserve
the environment, and secure the conditions for an innovative and prosper-
ous economy. A number of regulatory tools, offering various advantages and
disadvantages depending on circumstances, can be used to achieve that
purpose. While safety regulation cannot prevent all harmful incidents,
regulators need to have confidence that the regulatory tools chosen are well
suited to the specific circumstances. They must also be able to explain their
actions to those legislators and to the public (TRB, 2012).
Past experience has traditionally played a large part in improvements in
safety and in regulatory development. A clear perception and understanding
of what that experience has been is required to learn from it. The offshore
industry has become increasing complex with organizational arrangements
that can foster a dilution and diffusion of responsibility and of accountability
of all the participants, designers, builders, owners, operators, contractors,
and regulators. However, any measure that shifts the onus for maintaining
safe work practices to the company directly concerned represents an enor-
mous plus in the struggle to limit the occurrence of catastrophic accidents.
The responsibility is then upon the company to take close, continuing, and
proactive interest in all the varied factors affecting the safety of their activ-
ities. The challenge has always been for industry to accept that responsibility.
350 Howard Pike
Without a firm legislative requirement for accountability for their actions

and responsibility to maintain safe work practices, the regulator will con-
tinue to carry far too much of the burden for safe workplaces.
The safety of any facility is not determined just by the quality of its
operating manuals and the reliability of its equipment. Other major factors
include management’s safety policy, and the training and attitudes of per-
sonnel who manage and operate the facility. In companies that are subject
to inspection by government or other authorities, the company can grad-
ually drift to the point of view that the responsibility for safety lies with
the government and its inspectors. An attitude develops that the comp-
any’s responsibility and objective is simply to pass the inspection,
an attitude referred to as a compliance mentality but compliance does
not equal safety.
Legislation and rulemaking related to safety have over time evolved to
produce a mix of regulatory designs. Among those regulatory design choices
are prescriptive regulations which contain technical specifications for design,
construction, maintenance, and operations that are highly detailed and
narrowly targeted. Other regulations mandate certain capabilities and give
operators discretion on how to meet them, such as in the training of their
personnel. Even broader-based regulations call on companies to establish
comprehensive risk management programs, most notably to identify, assess,
and manage the risk of the hazards associated with their activities.
The varied collection of regulatory designs governing safety can create
challenges for regulatory enforcement. The regulator may monitor a comp-
any’s compliance with well-defined requirements by reviewing documents
and conducting field inspections. However, conformity with standards that
are more generalized can require judgment on the part of the regulator’s
enforcement personnel and trust in the operator’s ability and willingness
to comply. Regulations that require safety management programs are
referred to as performance-based or goal-oriented, because they give oper-
ators flexibility to customize their programs to circumstances and to concen-
trate on enhancing the performance of their internal risk management
actions, as opposed to “checklist” compliance with specifications having
industry-wide application. However, goal-oriented regulations do not
include details for compliance. Leaving little guidance as to how the
regulations are to be put into practice.
Regulators are increasingly being called upon to make decisions on
potential hazards and their risks in an environment characterized by
complexity, uncertainty, and imperfect information. This challenge is
compounded by the fact that the hazards that form those risks can often
have both beneficial and harmful consequences. The public is demanding
ever-greater levels of protection against an expanding range of potential
hazards, while the industry is asking for a predictable business environment.
Regulators therefore need a process for resolving problems and making
decisions in a principled, consistent, and transparent manner (Smart
Regulation, 2004).
Risk management can be a systematic approach to setting the best
course of action under uncertainty by identifying, understanding, assessing,
prioritizing, acting on, and communicating about potential threats. Risk
management is based on a rational- and evidence-based approach to
decision-making that can deliver better results over time. It should be rec-
ognized that risk cannot be eliminated totally, but it can be managed in such
a way as to mitigate or reduce harm to the greatest extent possible and
practical. The activities of a dynamic industry that is constantly testing the
bounds of technology, combined with rapidly and widely disseminated
information about real and perceived risks, means that the function of risk
management has become more important for regulators, particularly those
working in offshore regulatory regimes.
The assessment of risk was effective captured by Kaplan and Garrick
when they proposed answering three questions (Kaplan & Garrick, 1981):
• What can go wrong?
• How likely is it?
• What are the consequences?
The risk management framework for regulation includes the following steps:
identification of the issue, what can go wrong; assessment of the level, how
likely is it, and severity of risk, what are the consequences; development of
the options; the decision; implementation of the decision; and an evaluation
and review of the decision. At each step of the process, communications and
consultation activities, legal considerations need to be considered in effective
risk management strategies. Decisions made behind closed doors of what
is in the best public interest are no longer acceptable. The need to be trans-
parent in the decision-making and involve the public in a meaningful way is
of paramount importance. The regulator’s ability to communicate with and
engage the public and other parties is a critical success factor in sustaining
trust in the regulatory system (Smart Regulation, 2004).
The regulatory process can be constrained by the relations existing
between the regulatory body and the regulated company. These in turn
can lead to relationships based more upon bargaining and compromise than
352 Howard Pike
threats and sanctions. Companies tend to be highly selective in their trans-

actions with external organizations, and especially with regulators. The
information they pass outward gets filtered (Reason, 1997).
Regulators, for their part, attempt to penetrate the boundaries of those
they regulate by requesting certain kinds of information and by making
periodic site visits. But these strategies can only provide isolated glimpses
of the company’s activities. Size, complexity, the peculiarities of organiza-
tional jargon, the rapid development of technology, and, on occasions,
deliberate obfuscation all combine to make it difficult for the regulator to
gain a comprehensive and in-depth view of the way in which the company
really conducts its business.
In an effort to work around these obstacles, regulators tend to become
dependent upon the regulated company to help them acquire and interpret
information. Such interdependencies can undermine the regulatory process
if they are not managed. The regulator’s knowledge of the nature and sever-
ity of a safety problem can be manipulated by what the regulated company
chooses to communicate and how material is presented.
However, regulators have found that engagement with the industry is
more productive than threat of punishment, although they need to maintain
the threat of punishment if needed. Bad relations consume limited resources,
take up valuable time and are often counterproductive, particularly when
the internal sources of information dry up.
Most technological operations, even very complex ones, are relatively
simple in comparison to the task of maintaining safe working conditions.
Safety is a dynamic nonevent that depends crucially upon a clear understand-
ing of the interactions between many different underlying processes. The
long-term safety benefits of being forced to grapple with these enormously
difficult issues are undoubtedly greater than any number of purely technical
fixes. In this regard, the process of dealing with these difficult issues is more
valuable than the result.
While there can be little doubt that this legislative drive toward goal-
oriented regulation definitely has the right objective when it comes to
reducing the likelihood of catastrophic accidents, its benefits for the regula-
tor are less certain.
Traditionally, regulators worked to ensure compliance with safety rules
laid down by its legislative authority. No matter how fragmented, obsoles-
cent, or externalized those rules were, they nonetheless represented an
agreed standard, at least at that time, against which to determine whether
or not a particular work practice or hazardous activity was in violation of
a regulation.
In the new goal-oriented climate, regulators are still required to look out
for deviations, but of a different kind. They must inspect for departures
from a safety management plan that can be expressed in far more general
terms, that can vary widely from company to company, and for which
they must take some direct responsibility. Since it would not exist as a
frame of reference had the regulator not accepted it in the first place. Spot-
ting, monitoring, and sanctioning violations were difficult enough in the
past, not only do they have to police compliance with a variety of safety
management plans, they also need a very clear idea of what constitutes an
adequate safety management plan.
In order to judge the adequacy of a safety management plan in something
other than a cursory checklist fashion, regulators are now required to have a
comprehensive appreciation of all the factors contributing to both individual
and process accidents. While the physical origins of the individual accident
were largely enshrined in prescriptive legislation, the various ways in which
human, technical, and organizational factors can combine to produce the
process accident are still not fully understood since each catastrophic acci-
dent seems to throw up a fresh set of causes.
The situation for the regulatory authority would become even more
difficult should one of its regulated companies suffer a catastrophic accident.
The subsequent investigation could turn up one of two things; either that
the company’s performance was in compliance with its safety management
plan, or that the accident was due in part to failure to follow the safety
management plan. The former could be judged as stemming from short-
comings in the regulator’s evaluation of the safety management plan and
it should not have been accepted in the first place. While the latter is likely
to be viewed as a failure of regulatory surveillance (Reason, 1997).
Damned if they do and damned if they do not.
4. INDUSTRY INITIATIVES
Most regulatory regimes place the responsibility on the company for
the safety of its activity. That creates an onus for the company to take close,
continuing and proactive interest in the hazards associated with their
activities. However, many companies have been content simply to satisfy
the regulator rather than conduct rigorous internal assessments. For the most
part, industry has typically chosen to react to government actions rather than
identify and address emerging safety issues proactively.
While traditionally industry has been too passive in assessing risks and
cooperating on safety issues, some progress has been made through their
354 Howard Pike
industry associations. With the long history of oil and gas industry in the
United States, it is not surprising that the first industry associations were
established there.
The API was established on March 20, 1919. API is an advocate for the
oil and natural gas industry to the public, the various levels of government
and the media. It negotiates with regulatory agencies, represents the industry
in legal proceedings, participates in coalitions, and works in partnership with
other industry associations.
One of its first efforts was to develop a program for collecting industry
statistics. As early as 1920, API began to issue weekly statistics, beginning first
with crude oil production. The report was shared with both the government
and the media and later expanded to include crude oil and product stocks,
refinery runs, and other data.
Its second effort was the standardization of oil field equipment. During
World War I, drilling delays resulted from shortages of equipment at the drill
site, and the industry attempted to overcome that problem by pooling
equipment. The program reportedly failed because there was no uniformity
of pipe sizes, threads, and coupling. API began developing industry-wide
standards, and the first standards were published in 1924. API maintains
nearly 700 standards and recommended practices covering all segments of
the oil and gas industry. Much of this work has been the foundation of
ISO standards for the oil and gas industry.
The International Association of Drilling Contractors (IADC) was
founded in 1940 to work for improvements in drilling and completions
technology, for health, safety, and environmental practice and training,
and to advocate for drilling contractors in the regulatory and legislative
process. IADC’s key operational activities, include KSA (knowledge, skills,
and abilities), well-controlled training, Health, Safety, and Environment
(HSE) Case Guidelines, IMO, and ISO Jack-up Site Assessment Standard.
IADC’s HSE Case Guideline is of particular interest and is discussed later.
The International Association of Oil and Gas Producers (IOGP) was
established in 1974 at the E&P Forum, in London, UK to develop effective
communications between the upstream industry and an increasing network
of international regulators. In 1986, IOGP began to address the interna-
tionalization of upstream engineering standards (discussed later). In July
2010, IOGP established the Global Industry Response Group (GIRG) to
identify, learn from, and apply the lessons of Macondo and similar well
accidents. The work of GIRG is summarized later.
4.1 IADC Safety Case Guideline

Drilling contractors were finding it challenging to satisfy the diverse require-
ments in the offshore landscape with differing operating and business envi-
ronments, coastal State regulations, and numerous regulatory authorities
impacting their activities. IADC developed the Guideline to assist drilling
contractors prepare and review their Health Safety and Environment man-
agement system (IADC, 2015). While many coastal State regimes use differ-
ent terminology, the IADC for consistency refers to it as the HSE Case
Guideline. The Guideline reflects the
• Trend toward integrating the management of Health Safety and Envi-
ronment (HSE), and
• Requirements of the ISM Code and those of many coastal States which
address environment in the same way as health and safety
The Guideline identifies and addresses specific coastal State regulatory
requirements but is not an authoritative interpretation of each coastal State’s
regulatory requirements. Where questions of regulatory requirements are
identified, the drilling contractor is directed to confirm their application
with the relevant Regulator.
It is important to note that while the HSE Case is a stand-alone docu-
ment for the drilling contractor. It is intended to also provide a foundation
for bridging or interfacing documents from all parties involved with the dril-
ling project. These bridging arrangements should address site-specific and
project-specific conditions and requirements, such as:
• Potential environmental effects resulting from loss of containment;
• Client’s oil spill response planning and assessments of effectiveness;
• Well intervention and response planning—capping stacks, relief wells,
etc.;
• Allowable persons-on-board (POB);
• Seabed limitations; and
• Combined operations.
The Guideline is divided into six Parts which may be used by the drilling
contractor to develop an effective HSE Case for HSE Management
Assurance:
Part 1—Introduction/External Stakeholder Expectations.
Part 2—Describes the drilling contractor’s Management System and pre-
sents the HSE management objectives that demonstrate assurance that
HSE risks are reduced to a tolerable level. The methods of achieving
the HSE management objectives are considered in Part 4.
356 Howard Pike
Part 3—MODU Description and Supporting Information—describes

the equipment and systems necessary to meet the HSE management
objectives described in Part 2 and to fulfill the requirements of the dril-
ling contractor’s Scope of Operations.
Part 4—Risk Management—describes the Risk Management Process
for assuring that the risks associated with a drilling contractor’s Scope
of Operations are reduced to a level that is tolerable to the drilling con-
tractor and other stakeholders. The Risk Management Process con-
siders the HSE management objectives described in Part 2 and the
systems and equipment described in Part 3. Any gaps related to the
HSE Management Objectives in Parts 2 and 3 that are identified in Part
4 must be addressed in the drilling contractor’s Management System.
Controlling the level of risk includes the role Part 5 (Emergency
Response) and Part 6 (Performance Monitoring) play. In addition,
the Risk Management Process needs to comply with requirements
of the IMO’s ISM Code.
Part 5—Emergency Response—describes the HSE management objec-
tives for emergency response to incidents and to mitigate the conse-
quences (severity) identified in Part 4 and the measures to recover.
Part 6—Performance Monitoring—describes arrangements for monitor-
ing to ensure that the risk management measures identified in Part 4 are
implemented, maintained, and effective at the workplace.
4.2 International Association of Oil and Gas Producers—Global

Industry Response Group
The IOGP established the GIRG to improve the industry’s well incident
prevention, intervention, and response capabilities. They formed three
teams to focus specifically on prevention, intervention, and response:
• To provide recommendations on how to improve well engineering
design and well operations management therefore reducing the likeli-
hood and impact of future well incidents;
• To study how to improve capping response and readiness in the event of
an incident and the need for and feasibility of global containment
solutions; and
• To study more effective and fit-for-purpose oil spill response prepared-
ness and capability.
In May 2011, the GIRG reported its recommendations for each of these
teams.
Prevention improving well safety relied on renewed efforts in four key

areas:
• Creation of an industry-wide well control incident database;
• Assessment of blow-out-preventer reliability and potential improve-
ments to this equipment;
• Improved training and competence and more focus on human
factors; and
• The development and implementation of key international standards
pertaining to well design and well operations management.
To drive these improvements, IOGP established a new Wells Expert
Committee (WEC), which set up a dedicated task force for each of these
priorities (IOGP WEC, 2016).
Intervention; the Macondo well blowout reinforced the necessity of being
prepared. It led to the creation of the Subsea Well Response Project
(SWRP). SWRP, a consortium founded by nine upstream companies,
designed and built a comprehensive capping system—complete with subsea
dispersant capability—designed for use in waters as deep as 3000 m.
Four capping and dispersant capabilities systems are now available to the
global industry via subscription to Oil Spill Response Limited (OSRL). The
intervention system capabilities consist of four capping stack toolboxes and
two subsea dispersant hardware toolboxes. The four capping systems,
including two 18 3/400 10k stacks with ancillary equipment, are designed
to a standard configuration, with common pipework, valves, chokes, and
spools. This ensures maximum adaptability to every situation, wherever
and whenever the system might be needed.
The subsea dispersant hardware toolboxes contain equipment for clear-
ing debris, closing existing BOPs, and subsea application of dispersant at a
flowing subsea BOP.
Subsea dispersant capabilities create safer surface working conditions for
response personnel, allowing a well to be shut-in while at the same time
accelerating dispersion of oil in the water column.
The entire system is designed to be readily transportable by sea and/or air
from one of four OSRL operated strategic base locations in Europe, Africa,
South America, and Asia Pacific.
Oil Spill Response, the Macondo well blowout taught the industry a great
deal not the least about improved ways to deal with a major oil spill. To
consolidate this learning and to stimulate new research, the GIRG
recommended the formation of an Oil Spill Response Joint Industry Project
(OSR-JIP). The GIRG identified 19 recommendations, which were
358 Howard Pike
addressed via the OSR-JIP which is managed by IPIECA on behalf of IOGP

in recognition of its long-standing experience with oil spill response matters.
When IPIECA was set up in 1974 the acronym stood for the International
Petroleum Industry Environmental Conservation association. In 2002,
recognizing that this no longer accurately reflected the breath and scope
of the association’s work, IPIECA stopped using the full title. The associa-
tion is now known simply as IPIECA, the global oil and gas industry
association for environmental and social issues.
Together, the two organizations are cooperating with key stakeholders
in Europe and around the world. These include the European Maritime
Safety Agency, SWRP, the API, the Marine Spill Response Corporation,
and a number of IOGP and IPECA standing committees and related JIPs.
The OSR-JIP has prepared 12 research reports, 10 technical reports,
and 24 good practice guidelines under 5 categories: strategy, planning,
people, response, and impacts. These reports are all available on www.
oilspillresponseproject.org website.
Strategy
• OSPR: An Introduction to Oil Spill Response (Good Practice)
• Tiered Preparedness and Response (Good Practice)
• Response Strategy Development Using NEBA (Net Environmental
Benefit Analysis) (Good Practice)
• Incident management System for the Oil and Gas Industry (Good Practice)
• The Global Distribution and Assessment of Major Oil Spill Response
Resources (Technical Report)
Planning
• Guidelines on Oil Characterization to Inform Spill Response and
Decision-making (Technical Report)
• Oil Spill Risk Assessment and Response Planning of Offshore Opera-
tions (Technical Report)
• Regulatory Approval of Dispersant Products and Authorization for
Their Use (Technical Report)
• Contingency Planning for Oil Spill on Water (Good Practice)
• Sensitivity Mapping for Oil Spill Response (Good Practice)
People
• Volunteer Management (Technical Report)
• Oil Spill Training (Good Practice)
• Oil Spill Exercises (Good Practices)
• Oil Spill Responder Health and Safety (Good Practice)
• Mutual Aid Indemnification and Liability (Technical Report)
Response
At Sea Containment and Recovery
• The Use of Decanting during Offshore Spill Recovery Operations
(Technical Report)
• At Sea Containment and Recovery (Good Practice)
Dispersants
• At Sea Monitoring for Surface Dispersants (Technical Report)
• Dispersant Supply and Logistics (Technical Report)
• Dispersants: Surface Applicants (Good Practice)
• Dispersants: Subsea Applications (Good Practice)
• CEDRA: Testing Subsea Dispersant Injection at Laboratory Scale
(Research Report)
• SINTIF: Subsea Dispersant Effectiveness Bench Scale—Protocol
(Research Report)
In Situ Burning
• Guidelines for the Selection of In-Situ Burning Equipment (Technical
Report)
• CEDRE/INERIS: Preparation of an Information Document of In-Situ
Burning Residues (Research Report)
• In-Situ Burning of Oil Spills (Good Practice)
Oiled Wildlife
• Wildlife Response Preparedness (Good Practice)
• Global Oiled Wildlife Project: Final Report (Research Report)
Shoreline and Inland Cleanup
• A Guide to Shoreline Cleanup Techniques (Good Practice)
• A Guide to Oiled Shoreline Assessment (SCAT) Surveys (Good
Practice)
• Oil Spills: Inland Response (Good Practice)
Surveillance, Modeling, and Visualization
• ACTIMAR: A Review of Models and Metocean Databases (Research
Report)
• ACTIMAR: Recommendations on Validations Techniques (Research
Report)
• Battelle: Capabilities and Uses of Sensor-Equipped Ocean Vehicles for
Subsea and Surface Detection and Tracking of Oil Spills (Research
Report)
• Oceaneering: Capabilities and Uses of Sensor and Video-Equipped
Water Borne Surveillance ROVs for Subsea Detection and Tracking
of Oil Spills (Research Report)
360 Howard Pike
• OGC and RDI: Recommended Practice for Common Operating

Picture Architecture for Oil Spill Response (Research Report)
Impacts
• Impacts of Oil Spills on Marine Ecology (Good Practice)
• Impacts of Oil Spills on Shorelines (Good Practice)
• Economic Assessment and Compensation for Marine Oil Spills (Good
Practice)
4.3 IOGP Standards Committee

IOGP (International Association of Oil and Gas Producers) has supported
the internationalization of key standards used by the petroleum and natural
gas industries since 1986 (IOGP STDS, 2010). IOGP publishes an annual
update on the progress of standards development and adoption on its
website. IOGP’s position on standards has been to:
• promote development and use of ISO and IEC International Standards;
• ensure standards are simple and fit for purpose;
• use International Standards without modification wherever possible;
• ensure visibility of the international standard’s identification number,
whatever the method of publication;
• base development of standards on a consensus of need;
• avoid duplication of effort;
• minimize company specifications which should be written, where
possible, as functional requirements; and
• promote “users” on standards work groups.
The adoption of this approach is expected to minimize technical barriers to
trade, enable more efficient worldwide operations, and improve the techni-
cal integrity of equipment, materials, and offshore structures used by the
petroleum and natural gas industries.
5. SUMMARY
In summary there are no simple answers to the regulation of the
offshore. Each party in offshore activities have their own duties and respon-
sibilities. Whether operating under flag State or coastal State regulations,
operators of offshore installations are required to have a safety management
system that identifies the risks the activity will be exposed to and how those
risks are to be managed.
The history of accidents and spills in the Gulf of Mexico and elsewhere
in the world highlights the need for proactive approach to the control of
risks. This need is further highlighted by the introduction of new technologies
offshore, which bring their own sets of challenges, require specific training
and expertise, and often require greater collaboration among all workers on
the same installation or vessel. To protect workers, the environment, the
public, and the equipment, the industry and regulators need to work together
to define minimum standards for compliance and to facilitate the exchange of
information necessary to maintaining a strong safety performance.
It should be remembered that regulations themselves do not ensure safety
and maybe counterproductive in their consequence. Responsibility for
safety may become a complacent acceptance of rules and regulations, and
the evolving technology that is applied may be only as good as the rule
and the rule formulators. It can be argued there has been a great increase
in regulatory control without comparable discernible benefit. In activities
that are subject to checklist-style compliance inspections by government
authorities, passing the inspection comes to be seen as equaling safety. This
compliance mentality does not necessarily correlate with an increase in the
level of safety attitudes and actions on the part of the companies and
individuals involved in the actual operations.
Safety professionals have long understood that to increase safety in
complex industrial installations, organizations must manage safety with
the same principles of planning, organization, implementation, and investi-
gation that they use to carry out any other business function. Safety failures
in high-hazard industries can be catastrophic and lead to deaths and injuries,
environmental damage, and property loss. To prevent such failures, govern-
ments have begun to regulate the safety performance of these industries.
These safety regulations are often scrutinized after an incident, but their
effectiveness is inherently difficult to assess when their purpose is to reduce
catastrophic failures that are rare to begin with. Nevertheless, regulators of
high-hazard industries must have an informed and reasoned basis for making
their regulatory choices.
Safety regulators in high-hazard industries use different combinations of
regulatory designs. They need to determine whether their regulations are
well suited to the hazards associated with the activities and address relevant
safety risks. Trends in incident reports may not inform that determination if
the main concern is prevention of catastrophic incidents, which are inher-
ently rare. Certainly, there are statistics such as fatality rates, injury rates, and
362 Howard Pike
lost-time incidents that correlate with the level of what is often referred to as
“personal safety” or “worker safety” incidents. It is much harder to identify
similar statistics that correlate with “process safety.”
Offshore operations, equipment, and workplaces, as well as the work-
force and the relationships among operators, contractors, and subcontractors,
are complex. There can be no simple description of the “workplace” offshore.
Rather, workplaces offshore vary according to many factors, some of which
raise significant safety challenges.
Regulators are increasingly being called upon to make decisions on
potential hazards and their risks in an environment characterized by com-
plexity, uncertainty, and imperfect information. This challenge is com-
pounded by the fact that the hazards that form those risks can often have
both beneficial and harmful consequences. The public is demanding
ever-greater levels of protection against an expanding range of potential
hazards, while the industry is asking for a predictable business environment.
Regulators therefore need a process for resolving problems and making
decisions in a principled, consistent, and transparent manner.
Risk management is a systematic approach to setting the best course of
action under uncertainty by identifying, understanding, assessing, prioritiz-
ing, acting on, and communicating about potential threats. Managing the
related risk involves allocating limited regulatory resources. Risk manage-
ment is based on a rational-, deliberative-, and evidence-based approach
to decision-making that will deliver better results over time. It should be
recognized that risk cannot be eliminated totally, but it can be managed
in such a way as to mitigate or reduce harm to the greatest extent possible
and practical. Expanding knowledge and technical competence, combined
with rapidly and widely disseminated information about real and perceived
risks, means that the function of risk management has become more impor-
tant for regulators, particularly those working in offshore regulatory regimes.
If all parties work together then workable solutions can be found to these
complex problems with the commensurate reduction in risk and therefore
increase in offshore process safety. Let’s not continue to learn safety by
accident.
REFERENCES
Arnold, K. E. (2015). First-hand: History of operational safety awareness in the US Gulf of Mex-
ico 1964 to 2014: A personal recollection by Kenneth E. Arnold. http://ethw.org/w/index.
php?title¼First-Hand:History_of_Operational_Safety_Awareness_in_the_US_Gulf_of_
Mexico_1964_to_2014:_A_personal_recollection.
CNN. (2016). Philippines vs China: Why the South China Sea ruling may change Asia. http://
www.cnn.com/2016/07/04/asia/south-china-sea-un-case-explainer/index.html.
External Advisory Committee on Smart Regulation (Smart Regulation). (2004). Smart
regulation—A regulatory strategy for Canada—Report to the Government of Canada. http://
publications.gc.ca/collections/Collection/CP22-78-2004E.pdf.
Government of the People’s Republic of China. (2014). Position paper of the government of the
People’s Republic of China on the matter of jurisdiction in the South China Sea arbitration initiated
by the Republic of the Philippines (7 December 2014). available at www.fmprc.gov.cn/mfa_
eng/zxxx_662805/t1217147.shtml.
International Association of Drilling Contractors, (IADC). (2015). Health, safety and environ-
mental case guidelines for mobile offshore drilling units. http://www.iadc.org/iadc-hse-case-
guidelines/.
International Association of Oil and Gas Producers, (IOGP STDS, 2010). (2010). Position
paper on the development and use of International Standards. Report No. 381.
International Association of Oil and Gas Producers, (IOGP WEC, 2016). (2016). Wells expert
committee bulletin. Issue No. 2. http://www.iogp.org/bookstore/product/wells-expert-
committee-bulletin-issue-2/.
International Maritime Organization (IMO). (1978). International convention on standards of
training, certification and watchkeeping for seafarers (STCW). http://www.imo.org/en/
About/Conventions/ListOfConventions/Pages/International-Convention-on-
Standards-of-Training,-Certification-and-Watchkeeping-for-Seafarers-(STCW).aspx.
International Maritime Organization (IMO). (2005). International convention for the prevention
of pollution from ships (MARPOL), http://www.imo.org/en/About/Conventions/
ListOfConventions/Pages/International-Convention-for-the-Prevention-of-Pollution-
from-Ships-(MARPOL).aspx.
International Maritime Organization (IMO). (2009). Code for the construction and equipment of
mobile offshore drilling units (MODU CODE).
International Maritime Organization (IMO). (2015). International safety management
(ISM) code.
Izon, D., Danenberger, E. P., & Mayes, M. (2007). Absence of fatalities in blowouts encouraging in
MMS study of OCS incidents 1992–2006. Drilling Contractor July/August.
Kaplan, S., & Garrick, B. J. (1981). On the quantitative definition of risk. Risk Analysis, 1(1),
11–27.
National Commission. (2011). National commission on the BP deepwater horizon oil spill
and offshore drilling report to the President. In Deepwater—The gulf oil disaster and the
future of offshore drilling: Government Publishing Office (US). https://www.gpo.gov/
fdsys/pkg/GPO-OILCOMMISSION/pdf/GPO-OILCOMMISSION.pdf.
NRC. (1990). Marine board of the national research council committee on alternatives for inspection of
outer continental shelf operations. Washington, DC: National Academy Press.
Permanent Court of Arbitration (or Registry). (12 July 2016). PCA Case No. 2013-19, In the
matter of the South China Sea Arbitration—Before an Arbitral Tribunal Constituted under Annex
VII to the 1982 United Nations convention of the law of the sea. Between the Republic of the
Philippines and the Peoples Republic of China. https://pca-cpa.org/wp-content/uploads/
sites/175/2016/07/PH-CN-20160712-Award.pdf.
Pratt, J. A. (2014). Offshore at 60: Remembering the Creole field. Offshore. http://www.
offshore-mag.com/articles/print/volume-74/issue-4/60-years-of-offshore/offshore-
at-60-remembering-the creole-field-p1.html.
Priest, T. (2014). Offshore at 60: The blue water breakthrough. Offshore. http://www.offshore-mag.
com/1/volume-74/issue-10/offshore-at-60/offshore-at-60-the-blue-water-breakthrough-
full.html.
Reason, J. (1997). Managing the risk of organizational accidents. Hants, England: Ashgate
Publishing Limited.
364 Howard Pike
Royal Commission on the Ocean Ranger Marine Disaster. (1984). Royal Commission on the
‘ocean ranger’ marine disaster report one: The loss of the semisubmersible drill rig ocean ranger and its
crew. Ottawa, Canada: Minister of Supply and Services.
Sparrow, M. K. (2000). Regulatory craft. Washington, DC: Brookings Institute Press.
The Guardian. (2016). South China Sea dispute: What you need to know about the Hague court
ruling. https://www.theguardian.com/news/2016/jul/12/south-china-sea-dispute-what-
you-need-
to-know-about-the-hague-court-ruling.
TRB. (2012). Transportation research board of the national academy evaluating the effectiveness of
offshore safety and environmental management systems. Washington, DC: National
Academy Press.
TRB. (2016). Strengthening the safety culture of the offshore oil and gas industry. Washington, DC:
Transportation Research Board of the National Academies. Special Report 321.
United Nations, n.d., Division for ocean affairs and the law of the sea (UNCLOS).
A historical perspective. http://www.un.org/depts/los/convention_agreements/
convention_historical_perspective.htm.
FURTHER READING
Frawley, N. H. (2011). A brief history of the CMI and its relationship with IMO, the IOPC
funds and other UN Organizations. http://www.comitemaritime.org/Relationship-
with-UN-organisations/0,27114,111432,00.html.
Healy, N.J., n.d., Historical development of maritime law. https://www.britannica.com/
topic/maritime-law.
International Maritime Organization (IMO). (1974). International convention for the safety of life
at sea (SOLAS). http://www.imo.org/en/About/Conventions/ListOfConventions/
Pages/International-Convention-for-the-Safety-of-Life-at-Sea-(SOLAS),-1974.aspx.
Wiswall, F.L., n.d., A brief history—Comite maritime international/maritime law. http://
www.comitemaritime.org/A-Brief-History/0,27139,113932,00.html.

1 Methods in Chemical Process Safety - Vol 2 Offshore Process Safety

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

1 Methods in Chemical Process Safety - Vol 2 Offshore Process Safety

Uploaded by

Copyright:

Available Formats

Academic Press is an imprint of Elsevier

50 Hampshire Street, 5th Floor, Cambridge, MA 02139, United States

First edition 2018

Copyright © 2018 Elsevier Inc. All rights reserved.

For information on all Academic Press publications

Publisher: Zoe Kruze

research experience in the Department of Civil and Environmental

industries is discussed in Chapter 4. Chapter 5 provides an overview of the

Overview of Marine and Offshore

1. BACKGROUND AND HISTORICAL PERSPECTIVE

2 Til Baalisampang et al.

Overview of Marine and Offshore Safety 3

Because of continued recurrence of maritime accidents and public

4 Til Baalisampang et al.

Because of consistent problems at sea, diversity of regulations among dif-

Overview of Marine and Offshore Safety 5

Geneva Convention on maritime port regimes (Boisson, 1999). As a result,

Technological Safety of Safety of Prevention of

6 Til Baalisampang et al.

Cooperating international The International Maritime Conferences and International

Institutions Maritime Global Prevention of

Overview of Marine and Offshore Safety 7

Table 1 The Basic Domain of Safety at Sea

of shipping accidents reported in recently published statistical reports (Baltic

8 Til Baalisampang et al.

achieved through a culmination of improved technologies and regulations,

2. BACKGROUND AND HISTORICAL PERSPECTIVE

Overview of Marine and Offshore Safety 9

Table 2 Major Shipping Accidents and Subsequent Changes in Maritime Safety

10 Til Baalisampang et al.

wooden piers attached to the shore (National Academies of Sciences

Overview of Marine and Offshore Safety 11

12 Til Baalisampang et al.

Overview of Marine and Offshore Safety 13

In addition to this, new requirements related to process safety were enforced.

14 Til Baalisampang et al.

of Technology Assessment (OTA) (1985) presented a report on Arctic

Overview of Marine and Offshore Safety 15

concern about offshore safety (Pate-Cornell MEL, 1993). The resulting

16 Til Baalisampang et al.

Along the US coastline and OCS, no major accident was reported

Moving offshore Production continues to rise

18 Til Baalisampang et al.

Some statistical reports show that number of accidents, injuries, asset

Overview of Marine and Offshore Safety 19

3. PAST MAJOR ACCIDENTS: MARINE AND OFFSHORE

22 Til Baalisampang et al.

3.1 Major Marine Accidents

3.2 Major Offshore Accidents

Overview of Marine and Offshore Safety 23

Table 4 Major Marine Accidents

24 Til Baalisampang et al.

Table 4 Major Marine Accidents—cont’d

Overview of Marine and Offshore Safety 25

Table 4 Major Marine Accidents—cont’d

26 Til Baalisampang et al.

Table 4 Major Marine Accidents—cont’d

Overview of Marine and Offshore Safety 27

Table 4 Major Marine Accidents—cont’d

28 Til Baalisampang et al.

Table 4 Major Marine Accidents—cont’d

operations at the beginning of the latest Floating Liquefied Natural Gas

4. DATA AVAILABILITY FROM PAST ACCIDENTS

Overview of Marine and Offshore Safety 29