Oil Gas Offshore Safety Case (Risk Assessment)

Author: Prakash Bahadur Thapa

Memorial University,
St. John‟s, NL, Canada, A1B 3X5
Email: pbt750@mun.ca; Tel: +1(709) 330-8666

1.0 Hazard Identification and Risk Assessment

1.1 Management of Risk

It is one the example of the offshore oil gas contruction and operaction projects objectives
to ensure that all its activities are managed in a manner that ensures the health and safety
of all personnel and protection of the environment.

In this report I try to clarify the entire student and my college actually what is the safety
requirements in to oil gas industry, I read all the previous study and research report
everybody always simulation and try to solve the mathematical solve never they don‟t
mantion what is the requairment of safety in the industry but this report is very different
from the other I try to explain different about the safety and manage the Risk.

In this small report I try to explain what are the actual requirements in the industry to
manage the best safety in the work places in this report I am not focuses the academy
because after academy all the student target is industry that‟s why in this small report I
focused the industrial requirements not academic requirements.

This is achieved through the management of risks resulting from:

 Major accident hazards, which have the potential to affect a significant proportion
of the offshore workforce and the integrity of the installation itself.

 Hazards resulting from the company‟s day to day operational activities.

 Occupational health hazards relating to the working environment.

The following sections describe the management of the risks associated with these
hazards.

1.2 Management of Major Accident Hazards

All major accident hazards associated with activities involving the have been assessed
and are summarised within this Section of the Safety Case. A combination of qualitative
and quantitative analysis has been used to assess the consequences and likelihood of
such hazards.

1
The nature, likelihood and consequences of potential major accident hazards have been
developed by external risk specialists. This has allowed for the identification of technical
and operational risk reduction measures that reduce the probability of a major accident or
minimise their consequences should they occur.

An overview of the methodology applied to the risk assessment process and the overall
risk results are summarised. The assessment is a systematic review of the hazards that
can arise during operations and a determination of the effectiveness of the management
and hardware systems in place to prevent, control and mitigate them.

The ALARP levels (required standards) are set out in terms of the arrangements that are
already in place and the remedial actions that have been identified and considered
necessary to achieve an acceptable baseline level of safety.

This should not be considered to be an all-encompassing and fully comprehensive review

(depending on the contract it may involve different activities) but does provide the basis for
an on-going risk elimination/reduction process, which can promote better understanding
and awareness of risk management in operational activities.

1.2.1 Management of Operational Hazards

It is a legislative requirement and a requirement of the project HSE Management System

that a detailed work place assessment of activities/tasks performed on board is carried out
to determine the hazards (or potential hazards) associated with the company‟s operational
activities. It is essential to assess each worksite and job from the standpoint of practical
knowledge of the tasks to be undertaken, the equipment to be used and the skills
required.

Therefore, it is critical that such assessments are conducted by appropriately experienced

persons (employees, subcontractor or client personnel), who have knowledge of the
conditions that prevail, or could prevail, at a specified worksite during a particular activity
or combination of activities.

By reviewing the various task elements that make up a job, those that could result in an
accident can be identified, as well as the safeguards necessary to control or mitigate the
risk for each stage of the work. This is a risk assessment but, when carried out for a
particular worksite task, it becomes task specific and is termed a Job Safe Analysis (JSA).

2
The JSA documents the analysis of a task based activity focusing on the safety critical
aspects and controls and clearly identifies:

 Hazards encountered within a job.

 Safety equipment (including LSA) required when doing the job.

 Control measures to reduce and control the risks from each hazard.

Where risk cannot be engineered out or reduced by substitution, then suitable control
measures (safe systems of work) shall be put in place, e.g. permit to work. Where such
control measures are implemented, it is essential that they are correctly maintained and
used properly.

The JSA shall be utilised as the basis for job plans and worker briefings during toolbox talk
meetings. These are held to ensure that the job is understood (including the need to work
safely and protect the environment), that work practices and tools are appropriate and that
adequate supervision is available.
1.2.2 Management of Occupational Health Hazards
In addition to task risk assessment, there is also the need to protect the health of all
employees, including subcontractor personnel. There are a number of occupational
health hazards associated with normal operating activities that are common throughout all
workplaces. These fall within the following four main categories:
 Chemical hazards.

 Physical hazards, such as noise, lighting, etc.

 Ergonomic hazards, such as manual handling, display screen, etc.

 Biological hazards (from sewage, clinical waste, etc.).

The occupational risk assessment process starts with the identification of potential health
hazards within the working environment. For each hazard present, an assessment is
undertaken to show whether control measures in use are effective in reducing the risk to
an acceptable level. Where the assessment shows the risks to be unacceptable, further
control measures must be selected and installed.

Appropriately experienced personnel undertake such occupational hazard identification

and assessment based on their knowledge of the worksite and the activities performed.
Where required, external specialist advice or assistance is obtained to carry out such
assessments or take measurements (for example, noise surveys).

3
Where the risk assessment identifies the need for further control measures, the following
accepted „hierarchy‟ of measures is considered:

 Elimination or substitution.

 Physical or engineered controls.

 Procedural controls.

 Life Saving Appliances.

Where lifesaving appliances (LSA) is required, the company shall supply employees
working on board with the appropriate LSA. The LSA supplied will conform to appropriate
international standards. It shall be the responsibility of supervisors on board the rig to
ensure both that individuals are adequately trained in the correct use of the LSA and that it
is maintained and stored properly.

1.3 Major Hazard Analysis and Risk Assessment

1.3.1 Major Hazard Identification

Hazards can pose either a direct risk to persons or an indirect risk, as a result, for
example, of loss of technical functions or installation integrity. Hazard identification forms
the basis of any risk assessment. If the hazards are not adequately identified, the risk
assessment will be incomplete. To identify possible causes of accidents or precursors that
may lead to accidental events, it is necessary to use information derived from industry
experience. It is also necessary to ensure that small hazards are not overlooked. Only
after due consideration of the consequences of the hazard and its potential for escalation
should small hazards be discounted.

Whilst all potential accidents should be considered, the focus, in terms of identifying those
hazards that it is appropriate to assess quantitatively, is on identifying major hazards. In
this context, major hazards are commonly accepted as being fire and explosion events,
and other accidental events that have the potential to result in multiple fatalities, either in
the immediate area of the event or because they have the potential to escalate and result
in fatalities outside the immediate area. Other accidental events are categorised as
occupational hazards and affect one or a small number of personnel (e.g. trips, falls and
electrocution).

4
1.3.1.1 Description of the Hazard Identification Process

There are three different conditions in which the installation is expected to operate:

 Accommodation platform stand-alone.

 Accommodation platform connected to "cold" installation (hydrocarbon free).

 Accommodation platform connected to "hot" installation (with hydrocarbon).

The risk assessment for the has been performed on the basis that the installation is
connected to a “hot” installation, as in this mode of operation the may be exposed to
hazards originating on the adjacent installation (AI), in addition to the hazards that it may
be exposed to when in stand-alone or hydrocarbon free combined operations.

Hazard identification is performed based on reviewing major hazards that have been
identified as a result of many years of similar operations experience. The results of the
hazard identification process are recorded in a register of identified hazards.

The hazards identified are summarised in Table 1, which also identifies those that have
been „screened out‟ based on a preliminary assessment and will therefore not be carried
forward for detailed risk assessment.

Hazard Description Hazard discounted?

Fire or explosion on A process hydrocarbon release (loss of No
AI containment) event on an AI that ignites and
causes a fire/explosion and subsequently affects.
Flammable gas A release of flammable gas on an AI resulting in a No
release on AI gas cloud that may drift towards.
Toxic gas release A release of toxic gas on an AI that may drift No
on AI towards.
Smoke from Smoke from a fire on an AI that subsequently No
adjacent installation affects.
Blowout An uncontrolled release of well fluids. It can occur No
on an adjacent installation at the drill floor, BOP,
riser, choke and kill lines, at the seabed or
underground from one reservoir to another. As for
process releases, a blowout may have the
potential to affect the as a result of fire,
explosion, smoke, flammable gas or toxic gas.
Above sea riser An above sea oil or gas release from a riser on an No
releases from AI. This may occur on a cellar deck or below the
adjacent installation AI. As for process releases, an above sea riser
release may have the potential to affect the as a
result of fire, explosion, smoke, flammable gas or
toxic gas.
Subsea riser A subsea oil or gas release from a riser on an AI. No
releases from A subsea riser release may have the potential to
adjacent installation affect the as a result of a sea fire, smoke,
flammable gas or toxic gas.

5
 Hazard Description Hazard discounted?
Fire on the The ignition and development of liquid or No
combustible solid fires, leading to generation of
heat and the products of combustion, such as
smoke and toxic fumes. This includes fires
involving, for example, fuel, oil, paints, paper and
gas cylinders.
Explosion on the A combustion explosion in air, either within a No – There is no
compartment, in the open or in a partially confined process or reservoir
area of the accommodation platform. hydrocarbon present.
However, a gas
release on an AI
could result in gas
build up and
subsequent
explosion.
Ship collision Collision of supply vessels or passing errant or No
drifting vessels.
Transportation Personnel are transferred between shore and the No
accident (when jacked up) either by helicopter or boat. A
transportation accident could result in many
fatalities.
Helicopter crash on The impact of a helicopter, either on or off the No
installation helideck of the installation, immediately before or
after landing or take-off.

Table 1: Initial Hazard Identification

Hazard Description Hazard screened
out?
Structural failure Loss of ability of the primary structural members No
or gangway to maintain its integrity. This may be
due to normal degradation or abnormal loads (for
example, fire/explosion).
Seismic hazard Earthquake hazards that could affect the structural No
integrity.
Extreme weather Extreme weather such as storm/wave conditions No
that could damage the installation.
Dropped objects Dropped loads and impact, moving loads and side No
(crane) impacts, snagged loads, crane pedestal collapse
or crane boom failure, crane boom collision.
Occupational Occupational hazards are present during all No. Occupational
hazard phases of operation. hazards are not
considered to be
major hazards, but
the risk associated
with occupational
hazards is assessed
in Section 4.3.2 to
provide a more
realistic
representation of
overall risk.
Table 1(continued): Initial Hazard Identification

Those hazards that have not been screened out are discussed further in Section 1.2.1.2.

6
1.3.1.2 Potential Major Accident Hazards Identified

For the purposes of this evaluation, the hazards associated as identified in Table 1, are
categorised as:

 Fires on the (FE).

 Marine/mechanical accidents (MM).

 Hazards relating to the Adjacent Installation (AI).

Where appropriate, the hazards identified in Table 1 have been subdivided to reflect the
range of possible accidents that may occur. Table 2 lists the hazardous events identified.
Care was taken in this process to ensure that the risks have not been subdivided to an
extent where major risks are represented by many small elements and hence excluded
from scrutiny.

Those hazardous events carried forward for detailed risk assessment are highlighted.

Fire Hazards Marine/Mechanical Hazards Adjacent Installation

Hazards
FE.1.1 Living/service space fire: MM.1.1 Helicopter transportation AI.1 Process release
galley accident: take-off/landing
FE.1.2 Living/service space fire: MM.1.2 Helicopter transportation AI.2 Blowout
cabins, offices or public spaces accident: in-flight
FE.1.3 Living/service space fire: MM.1.3 Helicopter crash: AI.3 Riser/pipeline release
laundry collision with the rig
FE.1.4 Living/service space fire: MM.2.1 Ship collision: passing AI.4 Subsea blowout
fire in helicopter administration vessel
FE.2 Engine Room fire MM.2.2 Ship collision: attendant
vessel
FE.3.1 Helicopter fire: crash and MM.2.3 Ship collision: collision
fire with AI on arrival
FE.3.2 Helicopter fire: refuelling MM.3 Dropped object/swinging
fire load
FE.3.3 Helicopter fire: engine fire MM.4.1 Structural failure:
on helideck Extreme weather
FE.4 Electrical fire MM.4.2 Structural failure:
Seismic events
FE.5 Machinery space fire MM.4.3 Structural failure:
primary installation structure
FE.6 Storage space fire MM.4.4 Structural failure:
gangway collapse

7
 Fire Hazards Marine/Mechanical Hazards Adjacent Installation
Hazards
FE.7.1 Open deck fire: fire in MM.5 Power failure
helifuel storage and distribution
system
FE.7.2 Open deck fire:
acetylene/oxygen storage
FE.7.3 Open deck fire:
container/skip fire
1
The risk associated with diesel fires is accounted for in the „Engine Room fire‟ hazard
assessment, because it is considered that the Engine Room is the most likely place for an
ignited diesel release to occur.

It is considered that the likelihood of ignition of releases of diesel in other areas of (for
example, from the main storage tanks in the hull or on to the Main Deck during bunkering
operations) is low. Table 2: Listing of Major Accident Hazards Identified

1.3.2 Risk Assessment Philosophy

As shown in Figure 1, risk assessment forms a key part of the overall hazard management
process, since its main purpose is to identify and assess risks so that can be adequately
managed. Guidance from the UK Health and Safety Executive stresses that the level of
effort devoted to risk assessment should be proportionate to the magnitude of the risks in
question.

In line with this guidance, PROJECT adopt a bow-tie type approach that attempts to
systematically identify a large number of potential hazards, regardless of the potential risk,
which can then be screened in order to focus further effort and assessment on the
hazards that contribute most to the risk.

The objective is to ensure that all hazards are identified and assessed, quantitatively
where appropriate. However, project also aims to assess the operational and human error
aspects through detailed HAZOP assessments.

Section 1.2.2.1 describes the methodology used to identify the hazards associated.
Those hazards that are not considered to present a significant risk to personnel are
discounted at this stage.

8
 Figure 1: Risk Management Process

1.3.2.1 Quantitative Risk Assessment Methodology

Quantitative risk assessment is a structured method of identifying and assessing major

accident hazards associated with an installation. Quantitative risk assessment uses and
provides information on the likelihood and consequence of potential accidents, and is an
essential input to decision-making during the life of an asset.

Key safety-related decisions include the identification of cost-effective risk reduction

measures and the demonstration that risks on the facility are ALARP. The quantitative risk
assessment methodology used to assess risks associated with involves the following key
stages:

1. Hazard identification.

2. Hazard event frequency analysis.

3. Consequence analysis.
4. Risk evaluation.
5. Assessment of risk.

9
Brief outlines of these stages are given in the following sections. The application of this
risk assessment process to is described in Section 1.2.2.2.

Stage 1 - Hazard Identification

Section 1.2.1 describes the methodology used to identify the hazards associated. Those
hazards that are not considered to present a significant risk to personnel are discounted at
this stage.

Stage 2 - Hazard Frequency Analysis

This stage of the risk assessment process involves assessing the frequencies at which the
identified major accident hazards are expected to occur. Hazardous event frequencies
are estimated by applying historical data, with allowance for installation-specific
circumstances as required.

Some of the hazardous events identified, such as ship collision, are a direct hazard to the
installation and contribute directly to risk. Other hazards, such as a gas release, require
further analysis, using techniques such as event tree analysis.

This is to enable the frequency of the sequences of events that result in the eventual
hazardous outcomes, such as jet fires or explosions, to be assessed.

Stage 3 - Consequence Analysis

Consequence analysis evaluates the physical effects of the hazards and hazardous
outcomes identified in Stages 1 and 2. It evaluates the response of structures and
systems to the hazard, and determines ways in which an event could escalate. It also
provides a basis for estimating fatalities that could occur as a result of the incident, either
immediately or whilst personnel are escaping to muster areas or evacuating the
installation.

Computer models that have been validated against large-scale test data are used to
model the hazardous events and their effects. These include models for pool fires,
explosions, jet fires, structural response and gas dispersion.

10
Stage 4 - Risk Evaluation

The frequency and consequence of each hazardous event are combined to form
measures of overall risk. For example, risk to life may be estimated as the statistical
number of fatalities per year that may result from the hazard.

Risk to each individual exposed may be expressed as the probability of fatal injury during
each year of exposure. The impact of scenarios in terms of asset damage and
environmental damage may also be considered.

Stage 5 – Risk Assessment

Risk levels are compared against established criteria to determine whether they are
tolerable. Typically, this stage involves the identification and evaluation of risk reduction
measures, using cost-benefit analysis, to determine whether risks are ALARP.

1.3.2.2 Application of Quantitative Risk Assessment Methodology

A Quantified Risk Assessment (QRA) has been undertaken which integrates results from:

 Fire and Explosion Hazard Assessment (FEHA).

 Marine and Mechanical Hazard Assessment (MMHA).

 Egress, Temporary Refuge, Evacuation, Escape and Rescue Analysis

(ETREERA).

The FEHA identifies hazardous events on potential to result in gas release, fire and
explosion and assesses the frequencies of these events and discusses their development
and likely consequences. The FEHA also considers hydrocarbon releases on a
representative AI that could affect personnel.

The frequency of occurrence of marine and mechanical accidents is estimated in the

MMHA.

In the event of a major hazard, personnel will, in general, muster either within the TR, and
some of the major hazards considered in FEHA and MMHA may also result in a
requirement to evacuate the rig. The adequacy of the ETREER facilities provided is
assessed in the ETREERA in order to establish whether they are adequate and will be
available to perform their safety function when required. The ETREERA also estimates
the frequency of TR impairment.

11
The capability of the installation to withstand accidental events, together with
evacuation/escape preparedness, are analysed and demonstrated in the QRA in order to
summarise the total risk to personnel on the rig. The risk to personnel determined in the
QRA is expressed in the form of Potential Loss of Life (PLL) and Individual Risk Per
Annum (IRPA).

The QRA results are assessed against project corporate and regulatory criteria (defined in
Section 1.4.1) in order to determine whether the preventive and protective measures in
place reduce risk to persons to a level that is as low as reasonably practicable (ALARP).

1.3.3 Fire and Explosion Hazards

This section describes the assessment undertaken for fire events. The impact on the fires
and explosions originating on the AI is considered separately in Section 1.2.6.

The following fire hazards on are identified in the FEHA, and described in the following
sections:

 Living/service space fire.

 Engine Room fire.

 Helicopter crash and fire.

 Fire in helifuel storage and distribution system.

Each of these hazards is discussed in the following sections.

1.3.3.1 Living/Service Space Fire

There are a number of different possible fire scenarios that are usually classified as
accommodation or living space fires. Some of the more common hazard scenarios that
are relevant to listed below:

 Fire in the Galley: there are two principal fire concerns in the galley. These are a
cooking oil fire on the range and a fire in the extract ventilation ducting due to a
build-up of grease and oil deposits.

 Fire in Cabins, Offices or Public Spaces: the most common causes of fires in
recent years are malfunctioning electrical appliances and cellulosic goods such as
clothes and linen being placed adjacent to hot surfaces (such as light bulbs or

12
 heaters). Before the prohibition of smoking in cabins and offices, smoking was
also a major cause of small fires, but this risk has declined now that smoking is
only permitted in designated smoking areas.

Frequency Assessment

The calculation of the expected frequency of a living space fire is best made from an
analysis of the historical data.

A major incident occurred in the UK sector of the North Sea when the Fulmar platform
suffered a series of explosions in the living space area in 1991. The cause was an inter-
connection between the seawater systems used for gas cooling and for the
accommodation module. The incident caused a precautionary evacuation of non-
essential personnel.

Based on one serious living space fire accident in 6,980 unit years of the UKCS fixed and
floating installation experience between 1980 and 2007, reported and the frequency of a
significant living space fire is taken to be 1.43 x 10-4 per installation year.

Consequence Assessment

Experience suggests that fatalities due to living/service space fires are extremely unlikely.
However, such fires typically result in significant smoke generation and therefore, in order
to account for the possibility that sleeping personnel may not hear and respond to alarms
sufficiently quickly, one fatality is conservatively accounted for in the assessment.

The TR on is defined as the two accommodation modules (forward and aft). Any
significant fire inside the TR would, by definition, be classed as TR impairment.

In reality, however, most fire events would be confined to the immediate area, and would
not be expected to impair the muster areas or prevent the TR from performing its primary
role, namely to ensure the safety of personnel in the event of a major incident affecting the
installation and during any subsequent escape, evacuation and rescue.

For the purposes of this risk assessment it is therefore considered that 50% of living
space fires may escalate beyond the immediate vicinity and result in impairment of the
TR.

13
 1.3.3.2 Engine Room Fire

The five main generator sets which are located in the main engine room for the control the
fire. The emergency generator is located in the Emergency Generator Room, on top of
the accommodation module. In the event of main power failure the emergency generator
has the capacity to run on full load for 18 hours continuously.

Diesel fuel oil is stored in three tanks in the bottom hull. Fuel is pumped from the hull
tanks to the day tank via the fuel oil centrifuge. The clean fuel is stored in the day tank,
3
which has a capacity of 7.5m .

The fuel oil purifier and the deck transfer pump are located in the main engine room
adjacent to the service tank. Fuel oil supply from the day tank is hard-piped directly to the
main generators and boiler. Fuel for the emergency generator is transferred to its
individual tank as required by the fuel oil transfer pump.

In addition, small quantities of grease and other potentially flammable materials are stored
in the engine rooms.

Frequency Assessment

The data indicates that 23 engine room fire events, excluding very minor events, were
recorded on UKCS mobile installations between 1980 and 2007. Based on 2,000
installation years of experience, this equates to an engine room fire frequency of 1.15 x
10-2 per installation year.

Consequence Assessment

A common fire scenario in an engine room would be a pinhole leak of diesel oil fuel or
lube oil from a pressurised line forming a fine, flammable mist. The flammable cloud may
either immediately ignite by means of coming into contact with a hot surface directly, or it
could impregnate protective lagging over a period of time to the point at which the lagging
becomes flammable and may ignite.

Once ignition does occur, the heat from the small fire can cause rapid failure of the
leaking fuel line releasing larger quantities of fuel and thus feeding the fire. The
immediate consequences of the event can include a flash fire, significant heat generation,
smoke and toxic fumes.

14
Of the engine room fires recorded in none resulted in fatalities. However, to be
conservative, an average fatality rate within the engine room of 10% is assumed in the
event of a fire.

The walls of the main engine room are A60 fire rated and the ceiling is A0 fire rated.
Furthermore, the inventory available to fuel a fire is limited to diesel oil fuel supply (which
is provided with fuel cut-off valves). Therefore, in the event of a fire in the engine room,
the potential for escalation beyond the boundaries of the room and possible impairment of
the TR is considered to be limited.

Similarly, the Emergency generator Room is an A60 fire rated enclosure, excluding the A0
fire rated floor, and there is a limited fuel supply, which mean that a fire is unlikely to
escalate beyond the Emergency Generator Room.

If a fire in the engine room leads to loss of main power on the rig, the backup emergency
generator is able to maintain operations for 18 hours. If no repair is made within 18 hours
then numerous safety systems could become inoperable.

In this event, the installation may be down-manned as a precautionary measure, but this
would be done in an orderly fashion via gangway or helicopter and no fatalities would be
expected.

1.3.3.3 Helicopter Crash and Fire

Personnel are transferred between the shore and the installation by either helicopter or by
boat. For the purposes of this assessment it is assumed that personnel are transferred by
helicopter.

The helideck is located forward of the No.1 (fwd) leg at the same level as the top of the
accommodation modules. A fully fuelled helicopter generally contains in the region of one
tonne of aviation fuel. Therefore, if a helicopter‟s fuel tank is ruptured in the event of a
collision on the helideck, it is likely to result in a large hydrocarbon fire.There is no helpful
storage or other significant hydrocarbon inventories in the vicinity of the helideck.

A helicopter fire is assumed to be most likely to occur on the either as a result of a

helicopter crash during take-off or landing, or due to a refuelling incident. This section
discusses a helicopter crash resulting in a fire, while refuelling incidents are assessed in
Section 1.6.4.

15
Potential consequences for passengers on the helicopter in the event of a crash are
considered separately in Section 1.2.4.1.

Frequency Assessment

The frequency of a helicopter crash during take-off and landing is based on the number of
flight stages per year. The maximum POB is taken to be 318. These personnel are
assumed to work an offshore rotation of 3 weeks on, 3 weeks off (i.e. exposure of 0.5).
Assuming that, on average, 12 passengers are transferred per flight, there are
approximately 459 return flights per year (i.e. 918 flight stages per year).

Based on helicopter accident records and a breakdown of the flight stage in which
accidents have occurred the frequency of an accident occurring during a flight stage
(either during take-off or during landing) is taken to be 4.30 x 10-7.

The annual frequency of a helicopter crash during take-off / landing is therefore 3.95 x 10-4
per year.

Assuming that 50% of helicopter crashes on take-off/landing occur at the installation, the
expected frequency of a helicopter crash on the installation during take-off/landing is taken
to be 1.97 x10-4 per year.

Statistically, there is insufficient data to accurately estimate the number of crashes which
result in fire. Therefore, it is subjectively estimated that 50% of helicopter crashes on the
installation will result in fire and the expected frequency of a helicopter fire is taken to be
9.85 x 10-5 per year.

Consequence Assessment

If a helicopter‟s fuel tank is ruptured in the event of a crash on the helideck, it is likely to
result in a large fire, with significant heat and smoke. The duration of the fire will however
be limited by the amount of fuel in the helicopter‟s fuel tank, as there are no significant
hydrocarbon inventories in the vicinity of the helideck.

The helideck is always manned during helicopter take-off or landing and fire-fighting
equipment is provided at various locations close to the helideck. Therefore, a fire on the
helideck is likely to be quickly extinguished by the helideck crew.

However, ignited helifuel has potential to generate significant volumes of smoke, toxic
combustion products and heat. It is therefore considered that personnel in the immediate

16
vicinity of the fire could suffer major burns and it is assumed, for the purposes of the risk
assessment, that there is a 50% chance that a helicopter crash and fire on the helideck
would result in a fatality on the installation.

The helideck is separated from the accommodation/TR by the forward leg. Therefore, a
fire on the helideck, in the event of a helicopter crash, is unlikely to escalate to the TR.
Smoke resulting from a helifuel fire on the helideck is not expected to result in TR
impairment, because the natural buoyancy of the hot combustion products would carry the
smoke above the HVAC (heating, ventilation and air conditioning) inlets (located on the
roof of the aft accommodation).

Based on this discussion, a fire resulting from a helicopter crash is not expected to have
the potential to directly impair the TR.

1.3.3.4 Fire in Helifuel Storage and Distribution System

The equipped with helicopter refuelling facilities. Three helifuel tanks are positioned on a
purpose built platform, which is located on the starboard Main Deck forward of the fixed
accommodation module. The fuel is transferred by a pump unit to the dispensing cabinet
that is located on level 5 of the forward accommodation module. This assessment
considers the potential for the following ignited helifuel events:

 Fire fuelled by a release from a helifuel tank.

 Fire fuelled by a release from the helifuel pumping and distribution pipework during
refuelling.

 Fire as a result of a human error during refuelling.

The location of the helifuel tanks, with little open deck in the vicinity means that any
release from a helifuel tank will fall to the sea. Therefore, there is considered no potential
for a significant fire on the as result of a release from a helifuel tank.

In the event of a failure of a pump seal or the distribution pipework during refuelling,
helifuel could be released at the pump discharge pressure. A major failure of the
distribution pipework would cause the transfer pump to trip due to low discharge pressure.
In addition, there is an automatic shut-off valve between the pumping unit and the helifuel
tanks. The size of the release is, therefore, likely to be limited but any personnel in the
immediate vicinity of the fire could suffer major burns.

The helideck is located forward of the forward leg at the same elevation as the roof of the
accommodation, with a gap of approximately 15 metres between the helideck and the

17
front wall of the accommodation. Therefore, as there are no wide open areas on the Main
Deck in the vicinity of the forward leg, helifuel that spills off the helideck will fall into the
sea and there is considered no potential for a significant helifuel fire, other than on the
helideck.

The potential consequences of a refuelling fire on the helideck could be serious, since
refuelling operations take place whilst personnel are within the helicopter. In the event of
ignition, however, the helideck attendant would very rapidly control the fire and so multiple
personnel injuries are not foreseen as a credible outcome.

Frequency Assessment

The UK HSE‟s leak frequency database indicates that there has been one reported ignited
release of helifuel in the North Sea between 1992 and 2011 (4,921 platform years). This
gives a frequency of ignited helifuel release of 2.03 x 10-4 per year.

Consequence Assessment

A helifuel fire could generate significant volumes of smoke, toxic combustion products and
heat. It is therefore conservatively assumed that there is a 50% chance that a single
person will be fatally injured as a result of an ignited significant helifuel release.

However, as discussed in Section 1.2.4.3, a helifuel fire is not expected to cause fatalities
outside of the immediate area or have the potential to directly impair the TR.

1.3.4 Marine and Mechanical Hazard Assessment

The Marine and Mechanical Hazard Assessment (MMHA) assesses the risks from marine
and mechanical hazards, such as extreme weather, structural failure, falling objects,
collision and helicopter transportation.

The following marine and mechanical hazards have been quantified, and are described in
the following sections:

 Helicopter transportation accident:

o Take-off/landing.

o In-flight.

 Passing vessel collision.

 Structure failure:

o Extreme weather.

18
 o Seismic events.

o Primary installation structure.

o Gangway.

1.3.4.1 Helicopter Transportation

Personnel are transferred between the shore and the installation by either helicopter or by
boat. For the purposes of this assessment, it is assumed that personnel are transferred
by helicopter. The risk to personnel associated with helicopter transportation falls into two
categories:

 Crash during take-off/landing.

 Crash during flight.

Frequency Assessment

The expected frequency of a fatal helicopter crash takes into account the number of
stages flown per year, the number of hours flown per year, the probability of a crash
occurring per flying hour or flight stage and the probability that a crash will result in
fatalities.

Based on helicopter accident records and a breakdown of the flight stage in which
accidents have occurred the crash frequency during take-off or landing is taken to be 4.30
x 10-7 per flight stage. Similarly, the probability of an accident occurring in-flight is taken to
be 8.5 x 10-6 per flying hour.

In this report I take the example of the maximum POB of 318 and assuming an average of
12 passengers on a flight and a shift pattern of 3 weeks on, 3 weeks off, the risk
assessment assume that there are approximately 459 return crew change flights per year
(i.e. 918 flight stages). The mobile installation and may operate in various locations. For
this assessment a representative flying time of one hour per flight stage is assumed.

The probability of a helicopter crash resulting in a fatality is 0.17 and 0.2, respectively for
take-off/landing and in-flight accidents. Therefore, the expected annual frequency of a
fatal helicopter crash during take-off/landing is estimated to be 3.95 x 10-4 per year and in-
flight is 7.80 x 10-3 per year.

Consequence Assessment

Based on data provided passenger fatality rate are in a fatal helicopter accident is taken to
be 0.85 and 0.48 for in-flight and take-off/landing accidents, respectively.

19
Therefore, considering 12 passengers on board the helicopter, the assessment assumes
that a crash in-flight would result in 10.2 fatalities and a crash during take-off/landing is
considered to result in 5.76 fatalities.

1.3.4.2 Passing Vessel Collision

Collisions between passing vessels and offshore installations are relatively infrequent, but
they may be high energy with the potential to result in total loss of the installation.

Passing vessels include:

 Passing merchant vessels.

 Fishing vessels.

 Offshore support vessels associated with other installations in the area.

 Naval vessels.

 Offshore tankers.

Frequency Assessment

The expected frequency of passing vessel collisions is dependent on the location of the
installation, with a much higher probability of a collision if the installation is located close to
busy shipping lanes.

From OGP accident data based on historical experience of floating platforms in the UK
sector, the frequency for passing ship collisions with offshore installations of 2.2 x 10-3 per
platform year is assumed.

The indicates that 70% of passing vessel collisions was classed as “insignificant”, “near
miss” or “incident” and only 30% were classed as “accident”. Of these “accidents”, the
majority would not be of sufficient impact energy to cause significant structural damage
and hence threaten the integrity.

Ref. 12 also estimates a worldwide probability of a collision between a passing vessel and
an offshore installation resulting in total loss of the installation of 0.05.

Based on this discussion it is assumed that 10% of passing vessel collisions with the
may exceed the structural design capacity of the installation, resulting in the need for the
installation to be evacuated.

In addition, during combined operations, the adjacent installation may provide protection
to depending on the origin and path of the passing vessel. It is assumed that this will
reduce the frequency of passing vessel collisions with the by a third.

20
Therefore, the total frequency of passing ship collisions of sufficient impact energy to
require an evacuation of the installation is taken to be 1.47 x 10-4 per year.

Consequence Assessment

It is considered in the risk assessment to be highly unlikely that a ship collision will result
in any immediate fatalities unless there are personnel in the vicinity of the point of impact
who are unaware of the impending collision. High energy impacts of a powered passing
vessel with the installation may however result in significant structural failure, requiring the
installation to be evacuated.

Fatalities may occur if it is deemed necessary to evacuate the installation, but this is only
likely if the hull or legs are damaged. This is likely to occur if the incident coincides with
severe weather conditions when evacuation may entail a significant level of risk, especially
as personnel may be required to escape direct to sea due to the installation collapsing too
rapidly for personnel to use the evacuation systems.

It is highly unlikely that a passing vessel collision would occur without any prior warning as
the emergency response and rescue vessel (ERRV) is equipped with radar and the
adjacent installation may also be equipped with radar. In the event that sufficient warning
exists, personnel would muster and then evacuate over the gangway bridge to the
adjacent installation.

Following a high energy ship collision that occurred without warning (assumed to be 10%
of high energy collisions), it is assumed that evacuation via TEMPSC would not be
possible and that personnel would evacuate directly to sea and subsequently require
rescue by ERRV.

Accounting for this, and the potential for personnel to become trapped in the
accommodation modules or on the machinery deck in the event of rapid collapse of the
installation, a fatality rate of 50% is conservatively assumed for personnel on board the
at the time of impact.

21
1.3.4.3 Structural Failure

Structural failure occurs when an installation loses its ability to support the topsides as a
result of operational and environmental loading. Possible causes of structural failure
include:

• Corrosion.

• Fatigue.

• Construction defects.

• Design errors.

• Aging asset.

Structural failure of a floating installation without hydrocarbon receiving and processing

facilities generally occurs in combination with severe weather.

Structural failure may also occur simply because the installation is exposed to seismic or
environmental conditions more severe than those that the installation was designed to
survive. Extreme weather and seismic events are discussed separately in Sections 1.2.5.4
and 1.2.5.5.

In addition, the gangway that connects to the adjacent installation in combined operations
may fail, with the potential to cause fatalities.

Primary Installation Structure

The primary structure of consists of the 3 legs and the upper hull. Collapse of any of
these structures could lead to the rapid collapse of the installation.

Frequency Assessment

The worldwide between 1980 and 2005, mobile installation structural accidents (excluding
towing accidents) have only resulted in fatalities for incidents classified as total loss of the
unit. There have been no structural accident events on the UKCS that have resulted in
total loss of a mobile installation.

Indicates that, for 18,748 unit-years worldwide between 1980 and 2005, there were 7
incidents involving mobile units recorded that resulted in total loss. This gives a frequency
of total loss for mobile units of 3.73 x 10-4 per year.

22
Consequence Assessment

If structural failure were to occur as a result of loss of integrity it would be likely to be a

slow progressive event, allowing controlled evacuation of the installation. Rapid collapse
of the installation is most likely to occur in conjunction with another hazardous event such
as extreme weather. The potential consequences are also significantly higher if structural
failure occurs during a period of extreme weather.

Structural failure is unlikely to directly result in immediate fatalities, but may result in
fatalities in the event of total loss, requiring evacuation of the installation. Total loss of the
installation is most likely to occur if structural failure coincides with severe weather
conditions.

The number of evacuation fatalities that could be expected in severe weather is

dependent upon the means of evacuation, which in turn depends upon the time assumed
to be available before collapse occurs. It is assumed that:

 In 10% of cases evacuation would be by helicopter and a fatality rate of 1% is

assumed.

 In 75% of cases evacuation by helicopter would not be possible, either due to

weather conditions or impairment of the helideck, and evacuation would be by
lifeboat. In this case a weather-averaged fatality rate of 5.5% is assumed based
on evacuation fatality data.

 Rapid collapse of the installation occurs in the remaining 15% of cases.

Personnel would escape by jumping into the sea and would subsequently require
rescue by emergency response rescue vessel (ERRV). Based on evacuation
fatality data a weather-averaged fatality rate of 21.9% is assumed in this situation.

Gangway Collapse

When operating in combined mode with another installation, the jack-up is normally
positioned with the aft face closest to the adjacent installation. It is then connected to the
adjacent installation by means of either one or two gangway structures. Access to the
gangway is restricted in poor weather conditions.

Collapse of the gangway could occur as a result of structural overloading, loss of strength,
fire or explosion event on the adjacent installation or extreme weather.

23
Frequency of Gangway Failure

A failure frequency of 0.023 per year is estimated for portable bridges between flotels and
fixed platforms, based on historical data. However, it is considered less likely that bridges
between fixed installations will collapse and this value is therefore reduced by a factor of
10 (to 2.3 x 10-3 per year) for use in this assessment.

Consequence Assessment

It is assumed that most failures would not result in immediate collapse and that personnel
on the bridge would normally be able to vacate the bridge prior to collapse. The
probability that personnel are unable to vacate the bridge before collapse is subjectively
assumed to be 0.1.

It is also conservatively assumed that an average 0.5 crew members are present on the
gangway at any time and that personnel remaining on the gangway at the time of collapse
would be fatally injured.

1.3.4.4 Extreme Weather

Severe weather conditions generate significant winds and waves, which may impair the
structural integrity of the installation. Offshore installations are designed to withstand
reasonably foreseeable wind and wave forces.

However, there is still the potential for structural failure in the event of extreme weather,
especially when this occurs in conjunction with any existing design defects, corrosion or
damage due to aging.

The is designed to withstand wave heights up to approximately 28m and wind speeds up
to 100 knots (51.5m/s).

Frequency Assessment

Based on wind and wave return periods for the Northern North Sea and accounting for a
5% design safety margin, the annual frequency of total loss due to extreme weather is
taken to be 5 x 10-5 per year.

Consequence Assessment

It is assumed in the risk assessment that the project will, if extreme weather is forecast
and time allows, initiate a precautionary down-manning of non-essential personnel either
by means of the gangway bridge to the adjacent installation or by helicopter, with 10
essential personnel remaining on the vessel. It is conservatively assumed that all

24
personnel who remain on the vessel are fatally injured as a result of the total loss of the
vessel.

1.3.4.5 Seismic Events

Seismic events can generate significant forces, which may impair the structural integrity of
the installation. Offshore installations are designed to withstand reasonable foreseeable
seismic events.

However, there is still a small possibility of a severe seismic event occurring that exceeds
the installation‟s design capacity.

Frequency Assessment

The level of ground acceleration required to cause collapse of a typical jacket platform is
estimated to be 0.6g, where g is the acceleration due to gravity (9.81 m/s2).

However, lower ground accelerations could cause localised structural damage or damage
to equipment on board, potentially resulting in loss of containment of fuel or other
hazardous chemicals.

For the purpose of this assessment, it is considered that the operates in a region of the
North Sea that is estimated in a report on seismic hazard mapping to experience a
seismic event resulting in a maximum ground acceleration of 2.4 m/s 2 (0.25g) with a return
period of 10,000 years.

It is assumed, for the purposes of the risk assessment, that the frequency of an
earthquake that would result in platform collapse is one order of magnitude lower than that
of an earthquake of 0.25g acceleration, i.e. 1.00 x 10-5 per year.

It is further assumed that in 10% of cases, such an earthquake results in rapid platform
collapse with insufficient time for evacuation.

Consequence Assessment

In the event of an earthquake that results in localised structural damage or damage to

equipment, it is assumed that evacuation would not be possible for all personnel and that
the majority would evacuate directly to sea. On this basis, a 50% fatality rate is
conservatively assumed in the risk assessment.

Should an earthquake result in rapid platform collapse, the risk assessment conservatively
assumes that, given the speed and severity of the structural failure, all personnel are
fatally injured.

25
1.3.5 Hazards Relating to the Adjacent Installation

As well as events originating on the , the FEHA considers hydrocarbon releases (process
releases, riser releases and blowouts) on a representative adjacent installation (AI) that
may have the potential to impact personnel.

These events are designated with event IDs “AI”. In the event of a hydrocarbon release
on the AI, there are a number of hazardous scenarios of concern. These are as follows:

 Formation of a large flammable gas cloud.

 Jet fire.

 Flash fire.

 Explosion.

 Sea surface pool fire.

If there is H2S present on the AI, an unignited release also has the potential to present a
toxic hazard to personnel. When operating in combined mode with another installation, the
normally positioned with the aft face closest to the AI and the hull jacked-up clear of the
sea surface. It is then connected to the adjacent installation by means of one or two
gangway structures.

For the purposes of this assessment, it is assumed that the length of the gangway(s) is
40m and therefore the separation between the AI is approximately 35m. This separation
minimises the impact on the of hydrocarbon hazards occurring on the AI, and means that
in general it is only large releases that are considered to pose a risk to personnel on the
rig.

Frequency Assessment

From the QRA, the total expected frequency of a hydrocarbon event originating on an
adjacent installation that has the potential to affect personnel is 0.165 per year. This
includes both ignited and unignited events.

Consequence Assessment

The consequence of an outcome of a hydrocarbon release is determined by:

 Modelling the physical conditions produced by the event.

 Assessing the impact of those conditions on personnel, in terms of potential

statistical fatalities, or the TR, in terms of the probability of impairment.

26
DNV‟s software package PHAST is used to model representative fire characteristics
(flame lengths and heat flux contours) and gas dispersion (in terms of Lower Flammable
Limit (LFL) contours and toxic gas contours).

The results of the modelling are then used to estimate the impact on personnel on the of
hydrocarbon release events on the AI, taking into account the potential for:

 Personnel on the deck to be affected by a fire or associated heat radiation.

 Personnel to be affected by an explosion or flash fire, in the event that a

flammable gas cloud ignites on the deck.

 Flammable gas to enter enclosed spaces on the subsequently ignite, resulting in

an explosion that could cause both fatalities and significant structural damage.

 Personnel to be exposed to potentially fatal toxic gas concentrations.

 The fact that may decide to evacuate the installation in the event, for example, that
an unisolated jet fire is impinging on the aft wall of the TR or toxic gas is detected
on the .

1.3.6 Occupational Hazards

In addition, whilst it is recognised that occupational hazards are not a major hazard, the
risks are accounted for in order to allow a more realistic assessment of risks faced by
personnel.

Occupational accidents include a wide variety of accidents associated directly with an

individual‟s work activities. They include trips, falls, falling overboard, electrocution,
mechanical impacts, burns, etc. Occupational accidents do not have the potential to
cause fatalities outside the immediate vicinity and, in most cases, will cause no more than
a single fatality.

The risk due to occupational accidents is estimated in a different way to the risk due to the
major accident hazards. Occupational risk is normally expressed in terms of a Fatal
Accident Rate (FAR), defined as the number of fatalities per 100 million (10 8) hours of
exposure.

Based on HSE data for 1999 to 2011, the average FAR for personnel is taken to be 1.4
per 108 hours offshore.

27
1.4 Results of Risk Assessment

1.4.1 Basis of Quantified Risk Assessment

Major hazards pertaining to identified, and frequencies estimated, in the FEHA and
MMHA. The FEHA considers fire and explosion events originating both on the and on
the AI, and the MMHA addresses marine and mechanical hazards, such as extreme
weather, structural failure, falling objects, collision and helicopter transportation.

The Quantified Risk Assessment (QRA) considers the major hazards identified in the
FEHA and the MMHA, and assesses the potential consequences of those hazards.

The assessment of the major hazards identified is described in Sections 1.2.4 to 1.2.6.
The QRA presents risks to personnel in terms of:

 Individual Risk Per Annum (IRPA): a measure of the annual risk to an individual
based on an installation, calculated based on the proportion of time spent in
different areas of the installation and the proportion of time spent offshore each
year („exposure‟).

 Potential Loss of Life (PLL): the average number of fatalities per year on the
installation. For each hazard identified, PLL is calculated as:

PLL = Hazard Frequency (per year) x Potential Fatalities.

In the QRA, judgements have been made to estimate the likely number of statistical
fatalities arising from each of the hazards considered. To ensure a conservative analysis,
pessimistic judgements have been made where there is uncertainty in the data used,
ensuring that worst case scenarios are considered in the assessment. In each case, the
basis of the risk analysis is stated.

An immediate fatality (which is occurring local to an event, for example due to immediate
thermal effects of a fire) is accounted for, as well as any fatalities that occur during an
evacuation of the installation, should it be required as a result of the event.

To estimate the consequence of an identified accident scenario, it is necessary to account

for the number of personnel exposed to the hazard. In this report I take the example of
the maximum manning level of 318 personnel on board.

These personnel are categorised into four worker groups and the number of persons on
board in each of the worker groups considered is shown in Table 3.

Group Number of

28
 Personnel
Management 8
Hotel Services 20
Operations/Mainten 18
ance
Guests/Visitors 272
Total 318
Table 3: POB by Worker Group
Table 4 shows the average number of personnel assumed in the QRA to be in each area.
It also shows the (assumed) probability that an individual from each worker group is
located in a specific area at any time.
Area Average Probability of Personnel in Area
Personnel Management Hotel Operations Guests
in Area Services
Living/Services
192.9 0.946 1.000 0.678 0.563
Spaces
Engine Room 1.28 0.023 0.000 0.061 0.000
Other Machinery
1.13 0.000 0.000 0.063 0.000
Spaces
Open Deck 3.81 0.031 0.000 0.198 0.000
Adjacent
118.9 0.000 0.000 0.000 0.437
Installation
Total 318 1.000 1.000 1.000 1.000

Table 4: Personnel Distribution

1.4.2 Individual Risk Per Annum

Individual risk per annum (IRPA) is a measure of the risk to an individual on the
installation during one calendar year.

Individual risk figures for representative „worker groups‟ are calculated taking into account
the estimated proportion of time that an individual in each group spends in each location
on the installation, as well as the proportion of the year spent offshore (referred to as
„exposure‟). The representative worker groups considered are:

 Management.

 Services.

 Operations.

 Guests.

29
It is assumed that the installation operates a shift pattern of 3 weeks on, 3 weeks off and
therefore the IRPA is based on an exposure of 0.5. It is expected that, depending on
where operates, some personnel may work a 5 week rota (2 weeks on, 3 weeks off
equating to an exposure of 0.4).

However, a six week rota has conservatively been used in this assessment. In addition to
the risks from the major hazards, the IRPA also includes a contribution from occupational
risk.

This contribution is calculated based on the FAR of 1.4 per 108 hours offshore given in
Section 1.2.7 and the total number of hours spent on the installation per year. The IRPA
for each of the defined worker groups is given in Table 5.

Worker Group Individual Risk

per Annum
Management 1.47 x 10-4
Hotel Services 1.10 x 10-4
Operations 2.06 x 10-4
Guests 1.00 x 10-4
Average 1.08 x 10-4
Table 5: Individual Risk per Annum (IRPA)

Figure 2 presents the IRPA breakdown for each of the major hazards and for occupational
hazards estimated for each of the defined worker groups, as well as an overall average.

30
 IRPA Breakdown
Living/Service Spac
Fire
1.00E+00 Engine Room Fire
9.00E-01
8.00E-01 Helicopter Crash F
7.00E-01
6.00E-01 Helifuel Fire
5.00E-01
4.00E-01 AI Process Release
3.00E-01
2.00E-01 AI Blowout
1.00E-01
Figure 2: IRPA Breakdown

1.4.3 Potential Loss0.00E+00

of Life AI Riser Release
Hotel Services

Guests
Management

Average
Operations

The breakdown of the PLL by major hazard is presented in Table 6 and Figure 3. In
addition to the risks from the major hazards, the installation PLL also includes a Release
AI Oil Riser
contribution from occupational risk.

This contribution is calculated based on the FAR of 1.4 per 108 hours offshore given in
Section 1.2.7 and the total number of hours worked per year.

Figure 4 shows the percentage contribution from each major hazard and from
occupational hazards to the total PLL.

Type of Event Hazardous Event PLL

-4
Fire on the Living/Service Space Fire 1.43 x 10
-3
Engine Room Fire 1.47 x 10
-5
Helicopter Crash and Fire 4.94 x 10
-4
Helifuel Fire 1.02 x 10
-3
Subtotal 1.76 x 10
-3
Release on the Process Release 1.90 x 10
-4
Adjacent Installation Blowout 2.73 x 10
-4
Above Sea Gas Riser Release 6.92 x 10
-7
Oil Riser Release 7.44 x 10

31
 -3
Subtotal 2.87 x 10
-2
Marine and Transportation Accident 1.63 x 10
-3
Mechanical Hazards Passing Vessel Collision 1.46 x 10
-3
Structural Failure 7.29 x 10
-2
Subtotal 2.51 x 10
-2
Occupational Occupational Hazards 3.90 x 10
-2
Subtotal 3.90 x 10
-2
Overall Total 6.87 x 10
Table 6: Potential Loss of Life

Figure 3: PLL Breakdown

Figure 4: PLL Contribution

From Figure 4 it can clearly be seen that the single largest contributor to the total PLL is
occupational risk, which accounts for approximately 57% of the total PLL. Transportation
accident accounts for approximately 24% of the PLL, with structural failure contributing a
10.6%. These three hazards account for 91.6 of the risk.

32
1.4.4 Frequency of Temporary Refuge Impairment

The primary goal of the Temporary Refuge (TR) is to ensure the safety of personnel in the
event of a major incident affecting the installation and during any subsequent escape,
evacuation and rescue.

In fulfilling this, the TR‟s main function is to provide a place where personnel can muster
without undue risk, whilst having access to such communications, monitoring and control
equipment as is necessary to ensure their personal safety, and from which, if necessary,
safe and full evacuation can be effected.

The ETREERA estimates the frequency with which fire and explosion hazard events
identified in the FEHA are likely to impair the TR.

The MMHA considers the possibility of the identified marine and mechanical hazards
impairing the TR, but concludes that there are no marine or mechanical hazard events
that have the potential to impair the TR, other than those events that would result in total
loss of the installation.

From the ETREERA, the TR impairment frequency due to gas release, fire and explosion
hazards is 1.08 x 10-4 per year.

The TR impairment frequency due to gas release, fire and explosion hazards is 1.08 x 10-4
per year, which equates to less than 1 in every 9,300 years. The highest frequency of TR
impairment for a single event is 7.15 x 10-5 per year for living/service spaces.

1.5 Risk Reduction and ALARP Justification

1.5.1 Risk Acceptance Criteria

In accordance with current standard industry practice the project adopts criteria for
assessing the tolerability of risk to personnel and to the integrity of the TR.

Tolerability of risk to personnel is generally judged based on the following three „regions‟
(as shown in Figure 7), the boundaries of which are defined by target levels of safety
(TLS):

 An upper „intolerable‟ region within which the risk is considered to be unacceptable

and further safety measures must be implemented.

 A lower „broadly acceptable‟ region within which the risk can be considered to be
broadly acceptable and there is no need for consideration of further safety
measures.

33
  An intermediate (ALARP) region between these upper and lower regions, where
the risk is considered tolerable only if it is demonstrated to be „As Low As
Reasonably Practicable‟ (ALARP), that is, if it can be shown that no further
credible risk reduction measures could be implemented cost-effectively.

Target levels of safety relating to risk to personnel are usually expressed in terms of
individual risk per annum (IRPA), which is a measure of the annual risk to an individual
working on the installation.

The corporate risk acceptance criteria used project to determine whether the levels of risk
associated with the design and operation are both tolerable and acceptable are
summarised in Table 9 and Figure 7. Table 9 also gives the maximum allowable
frequency of all hazardous events with the potential to impair the TR.

Risk Indicator PROJECT Risk

Acceptance
Criteria
Maximum Tolerable Individual Risk Per 1 x 10-3
Annum
Acceptable Individual Risk Per Annum 1 x 10-5
Maximum Tolerable Temporary Refuge 1 x 10-3
Impairment Frequency Per Annum
Table 9: PROJECT Risk Acceptance Criteria

Risk reduction Intolerable High Risk

required
Zone A
1 x 10-3

Tolerable only if
risk reduction is
impractical or if its ALARP
cost is grossly
disproportionate to Zone B
the improvement
gained
1 x 10-5

Assess/control
Zone C
the risk

Low Risk

Figure 7: Individual Risk Acceptance Criteria

34
1.5.2 Comparison of Results with Risk Acceptance Criteria

The total TR impairment frequency estimated of 1.08 x 10-4 per year is well below the
maximum tolerable TR impairment frequency of 1 x 10-3 per year (Table 9). Comparison of
the IRPA values in Table 5 with the TLS in Section 1.5.1 indicates that the average IRPA
falls below the intolerable level, and within the ALARP region defined by the TLS.

For risks in the ALARP region, project risk acceptance criteria require further
demonstration to provide evidence that risk is, in fact, ALARP. Only if risk is
demonstrated to be ALARP, may it be considered tolerable.

ALARP demonstration is achieved through a process of identifying potential measures to

reduce risk. Each potential measure is then subject to an assessment to determine
whether it achieves effective risk reduction at reasonable cost and is practicable to
implement.

ALARP demonstration is not a single, post-design, pre-operational assessment. Rather, it

is an integral part of an installation‟s hazard management process. This is because new
knowledge, or the advent of new technology, may mean that risk reduction measures that
are not reasonably practicable at one stage in the life-cycle may become so at a later
stage.

It is necessary, therefore, to review risks periodically to ensure that they remain ALARP. It
is also necessary to review an installation‟s ALARP status on the advent of any significant
changes or additions to the installation or process.

Section 1.4.3 describes the general ALARP demonstration process followed the project.
Sections 1.4.4 and 1.4.5 outline how this process is applied for operations

1.5.3 ALARP Demonstration Process

Figure 8 illustrates a general approach to risk-based ALARP demonstration.

35
 Identify
Main Risk Contributors

ALARP
Workshop

Company Standards
Policies & Philosophies

Project Team Identify

Risk Reduction Measures

HSE Guidelines

Screening/Cost Benefit
Analysis

Risk Reduction Measures

for Implementation

ALARP Demonstration

Include in
Operations Safety Case

Figure 8: ALARP Assessment Process

The first stage in the process is to identify the main contributors to risk from the QRA, and
to identify and document the existing safeguards in place that reduce the risks from those
major contributors.

This approach enables resources to be directed towards those areas where they are likely
to provide the greatest benefits, in terms of risk reduction.

Once the major risk contributors and existing safeguards have been identified, an ALARP
workshop is held to review the adequacy of the existing safeguards, and to identify
additional technically feasible safeguards that it may be possible to implement cost-
effectively. This workshop is generally performed as a team-based meeting.

If any practicable safety measures are identified by this exercise, they are assessed to
determine whether they are „reasonably practicable‟. That is, whether they are cost-
effective in terms of the risk reduction that could be achieved. If identified measures are
found to be „reasonably practicable‟, they must be implemented in order to ensure and
demonstrate that risks are ALARP.

36
The project to use Cost Benefit Analysis (CBA) as a key tool in marginal cases for
determining whether potential risk reduction measures should be implemented in order to
ensure that risks are ALARP.

CBA will typically be performed in the case of risk reduction measures that have a
significant cost attached to them. Risk reduction measures with a low cost, for example
changes in procedures, and may be implemented without undertaking CBA.

1.5.4 Demonstration of ALARP

Defence against major hazards starts from the identification and understanding of the
major hazards relevant to the installation.

Therefore, the following all contribute to the demonstration that risks are reduced to, and
maintained at, a level that is ALARP:

 The HSE management system is adequate to ensure that the design and
operation of the installation is safe.

 The potential major accident hazards associated with the rig and the risks to
personnel thereon have been identified, understood and assessed.

 The risks associated with these major hazards have been shown to be below the
level defined by the project as intolerable.

 Effective and appropriate prevention and protection measures have been

identified and provided to manage risks to a level that is as low as reasonably
practicable.

 These measures are verified as suitable and adequate for purpose throughout the
life of the installation by means of the Verification Scheme.

 Effective means of egress, evacuation and escape are available to provide a good
prospect of escape and, where necessary, rescue and recovery.

 If required, project evaluates potential additional risk reduction measures using

Cost Benefit Analysis (CBA).

The sections below describe the ALARP demonstration undertaken, as part of an overall
demonstration of compliance with relevant statutory provisions.

However, there are also other regular processes performed to ensure that:

 Already established control measures are, and remain, in place.

37
  Established control measures are maintained in good working order and repair,
are dependable and effective when required and are able to perform as intended.

 Risks are periodically reviewed to determine whether further controls are required.

The exampleproject has a continuous system for identifying risk reduction measures
through safety meetings and safety committees, internal and external inspections and risk
assessment exercises (HAZID, HAZOP).

Items and recommendations from these activities that are not immediately resolved are
put on the remedial action list for further assessment and cost benefit assessment.

1.5.4.1 Main Risk Contributors

From Section 4.3.3, the main contributors to the total PLL are:

 Occupational Hazards.

 Transportation Accident.

 Structural Failure.

Concentrating on the major risk contributors ensures that resources are directed to
reducing risks in those areas where they are likely to provide the greatest benefits in terms
of risk reduction.

As discussed in Section 1.2.1, occupational hazards are considered in the risk

assessment because, although they do not constitute a major accident hazard, it is
recognised that their contribution to risk is significant. The causes of such hazards are
many and varied, and the risks associated with them are controlled mainly through the
implementation of HSE Management System procedures.

Therefore, the focus, in undertaking an ALARP review, should be on identifying potential

additional risk reduction measures for major accident hazards.

1.5.4.2 Identification of Risk Reduction Measures

Additional measures are identified during ALARP review meetings, taking account of
industry best practice, advances in technology and new knowledge, as well as
incorporating lessons learnt from other platforms and advice from regulatory authorities.

Potential additional risk reduction measures are selected accounting for the hierarchy of
prevention before control, mitigation and protection, with the last resort of emergency
response by muster and rapid evacuation or escape.

38
This hierarchy is based on recognised good industry practice. For existing installations,
opportunities for elimination and substitution are limited, but are still considered.

Multiple risk controls are considered to provide „layers of safety‟. Engineering controls are
selected in preference to procedural controls where it is reasonably practicable to do so,
and LSA is never used as the only control for a hazard.

The following measures have been implemented during the refurbishment programme
undertaken in 2012 to ensure that risks to personnel working on remain ALARP:

 Technical specifications complied with relevant statutory provisions and industry

best practice.

 The updated guest accommodation with modern twin bed cabins meets the latest
HSE standards for minimum space, comfort, noise, etc.

 The forward accommodation has been completely refurbished.

 The Public Address and alarm system has been upgraded to ensure full
redundancy.

 The Fire and Gas System has been upgraded.

 HVAC systems for the accommodation unit have been upgraded.

Periodic ALARP reviews are also undertaken at regular intervals to identify and evaluate
risk reduction measures for major risk contributors.

1.5.5 ALARP Summary

Based on the ALARP assessment undertaken, it is concluded that:

 The potential major hazards of the installation and the risks to personnel thereon
have been identified, understood and assessed.

 The risks associated with these major hazards have been shown to be below the
level defined by the project as intolerable.

 Effective and appropriate design measures to ensure the prevention and

mitigation of the major accident hazards have been identified and implemented to
ensure risks are reduced to a level that is as low as reasonably practicable.

 Effective means of egress, evacuation and escape are available to provide a good
prospect of escape and, where necessary, rescue and recovery in the event of a
major accident.

39
  Procedures are in place to ensure safe working practices are implemented and
that facilities are maintained and fit for purpose.

 No further additional design measures have been identified that will reduce the
risks to personnel further where the costs are not grossly disproportionate to the
risk reduction that can be achieved.

1.6 Results and Conclusion

1.6.1 Individual Risk per Annum

The IRPA levels for each of the four worker groups are between 1.00 x 10-4 and 2.06 x 10-
4
, significantly below the intolerable level for individual risk of 1.00 x 10-3 from project
acceptance criteria.

The operations worker group has the highest level of individual risk, primarily due to
exposure to hydrocarbon releases on the adjacent installation. However, as the IRPA risk
is dominated by occupational risk, which is the same for all worker groups, there is little
difference in the IRPA between the four worker groups.

1.6.2 Potential Loss of Life (PLL) per Annum

The total PLL is approximately 0.0687 per year. The single largest contributor to the total
PLL is occupational risk, which accounts for 57% of the PLL. Helicopter transportation
also accounts for 24% of the PLL, with Structural Failure contributing a further 10.6%. TR
Impairment Frequency

The only events that are considered to have the potential to impair the ETREER facilities
are accommodation fires or hydrocarbon releases on the adjacent installation, which could
lead to impairment of the TR. The frequency of TR impairment is conservatively
estimated to be:

 7.15 x 10-5 per year for fires.

 3.60 x 10-5 per year for hydrocarbon releases on the adjacent installation.

The total TR impairment frequency is 1.08 x 10-4, which equates to less than 1 in 9,300
years. This frequency of TR impairment is well below the maximum tolerable TR
impairment frequency of 1 x 10-3 per year (defined in Table 9).

1.6.3 Summary

It is PROJECT‟ judgement that the methodologies described and the results shown in this
section of the Safety Case demonstrate that project has reduced the risk on the to a

40
level that is as low as reasonably practicable and that project is committed to continue a
process of continuous life-cycle assessment of the major hazards to which the is
exposed. This has been achieved by the following process:

a) Identifying hazards.

b) Analysis and quantification of hazards through both qualitative and quantitative

assessments.

c) Continuous identification of risk reduction measures through a number of

systematic processes.

d) Calculation of the cost benefit for identified risk reduction measures.

e) Assessment of the cost-effectiveness of risk reduction measures in light of

acceptance criteria.

f) Implementation of risk reduction measures, where appropriate.

1.7 Emergency Systems Survivability Analysis

1.7.1 Introduction

The Emergency Systems Survivability Analysis (ESSA) identifies the emergency systems
to assess their vulnerability to major hazards identified in the Fire and Explosion Hazard
Assessment (FEHA) and Marine and Mechanical Hazards Assessment (MMHA). These
systems are assessed in order to confirm that they are able to carry out their safety
function under the conditions in which they are required.

1.7.2 Scope of Analysis

The objective of the analysis is to establish whether the identified emergency systems will
survive major events on the installation so as to be able to carry out their emergency
functions when required. The ESSA provides validation of the survivability criteria of the
installation Performance Standards.

The study is limited to the analysis of each emergency system with regard to its ability to:

 Prevent escalation.

 Enable escape and evacuation.

 Protect the TR.

41
In order to ensure that these requirements are met for all major accident scenarios,
analysis is undertaken to determine:

 The vulnerability of the installed system to defined accidental events for which it is
required to provide protection or mitigation.

 The extent of fail-safe action within the system.

 The extent of redundancy of components within the system.

In the event of the analysis finding that a system is vulnerable, is not fail safe and has no
design redundancy, a qualitative assessment of risk is made.

1.7.3 Systems Analysed

The essential systems analysed within the ESSA are:

 Fire and gas detection and control system.

 Active fire protection.

o Fire water systems.

o Inert gas systems.

o Helideck fire fighting system.

o Fixed dry powder systems.

o External fire-fighting system.

o Initial fire-fighting system.

 Passive fire protection.

 Emergency shutdown systems.

 Heating ventilation and air-conditioning systems.

 Collision detection and warning systems.

 Emergency power.

 Emergency lighting.

 Emergency communication systems.

42
 1.7.4 Results of Analysis

The analysis demonstrates that, on the whole, due to their design, location, redundancy in
the systems and backup systems provided, the emergency systems are able to carry out
their safety function under those conditions under which they are required.

Therefore, it is considered that, as far as practicable, the design of the emergency

systems should ensure that they are able to carry out their safety function when required.

43