OVERVIEW OF SOFTWARE

APPENDIX A

OVERVIEW OF SOFTWARE

Al.I Introduction

Quite extensive software tools have become available over the last 10 - 15 years. A brief overview over some of the main tools which are oriented towards offshore/oil and gas applications are presented in this appendix. These tools have been categorised into the following:

• Quantitative Risk Assessment software

• QRA Software tools for scenario and probability analysis

• QRA Software tools for consequence analysis

• Risk Management software

• Qualitative Risk Assessment software

• Reporting and Analysis of incidents and accidents

Brief summaries are presented as an overview, following by brief sections presenting some of the main characteristics of these products. These summaries have been prepared by the software vendors. Only those products are presented further, when response was received from the vendors.

The descriptions are structured as follows:

• Name and purpose of software

• Scope of software

• License conditions, pricing etc

It should be stressed that there is a large amount of general software tools for Computational fluid Dynamics (CFD) from many different suppliers. These have not been included in the presentations that follow throughout this appendix. Some of these may have quite valid applications during estimation of loads from fire or explosion, or for gas dispersion or oil slick movements. Because there are so many software tools available in this category, it becomes impossible to give an overview of all relevant tools. None of these are therefore included.

Software tools that are only directed at onshore usage are not included in the reviews, neither are tools for production/transport regularity analysis.

All software tools that are mentioned in the following are commercially available from the vendor as listed.

414 APPENDIX A

TABLE A.I. Overview of software for quantitative risk assessment

Software name

ASAP

COSAC

IRAP

NEPTUNE

OHRAT

ORCA

PLATO

RISK

SAFETI

Purpose

3D geometrical description and analysis of a fixed set of event trees

Risk assessment tool for early project phases of a field development for concept evaluation and screening


Successor to OHRAT

Offshore risk analysis

Off/Onshore Risk Calculation and Analysis

3D geometrical platform model, analysing explicitly development and timing of escalating hazards, fire, explosion and structural collapse

Comprehensive offshore quantitative risk assessment tool

Comprehensive QRA tool for Flammable, Explosive and Toxic Impact

A 1.2 Electronic Contacts

Contact

Aker Engineering, Oslo, Norway

Scandpower, Kjeller, Norway

British Gas, UK

DNV Software, H0vikILondonIHouston


VRJlDovre Safetec, Melbourne, AustralialTrondheim, Norway

Four Elements, London, UK

AEA Technology, Warrington, UK


The following is a listing of electronic contacts to the software providers:

•

• •

AEA Technology, Warrington, UK www.aeat.co.uk


British Gas, UK

Century Dynamics, Horseham, UK

DNV Software, H0vikILondonlHouston

www.akermaritime.no/

www.bgtech.co.uk

www.autoreagas.com

www.dnv.com

OVERVIEW OF SOFIW ARE 415

TABLE A.2. Overview ofQRA software tools for scenario and probability analysis

Software Purpose Contact name

BlowFAM Evaluation of blowout risk during Scandpower, Kjeller, specific well operations Norway

COAST Graphical pres. of information on Dovre Safetec, Aberdeen, shipping routes/vessel characteristics UK

COLLIDE Analysis of collision risk between Dovre Safetec, Aberdeen, vessels and platforms UK

DATABASE For storage, handling, and display of AEA Technology, MANAGER reliability analysis data Warrington, UK

EGRESS Mustering and evacuation simulation AEA Technology, for evacuation/rescue modelling Warrington, UK

LEAK Calculation of the frequency of leaks at DNV Software, an installation H!IlvikILondonIHouston

TABLE A.3. Overview of QRA software tools for consequence analysis

Software name Purpose

AutoReaGas CFD-based explosion simulation

FIREX Empirical prediction of main fire characteristics and responses

FLACS Explosion simulation

KAMELEON Fire calculation

MONA Advanced tool for simulation of single-comp. multiphase systems

OLGA Transient multi phase flow simulator for systems comprising flow lines, risers and process equipment.

SUPER- Thermal, 2D FEM program TEMPCALC

PHAST Windows-based toolkit for determination of consequences of accidental releases of hazardous material

USFOS Integrated Fire Analysis Tool

Contact



CMR, Bergen, Norway

SINTEF, Trondheim, N


Scandpower, KjeUer, Norway

Fire Safety Design, Lund, Sweden

DNV Software, H!IlvikILondonlHouston

SINTEF

416 APPENDIX A

TABLE A.4. Overview of software for qualitative risk assessment

Software name

DNVPro

PHAROS

VRJHazop Software

Purpose

Hazard recording and reporting tool, including four Process Hazard Analysis techniques; HAZOP, What IfIChecklist, FMEA and Preliminary Hazard Analysis

Integration of job hazard analysis process with the Permit to Work System

Assisting and documenting HAZOP studies

Contact


EQE, London, UK

VRJ, Melbourne, Australia

TABLE A.5. Overview of software for accident/incident analysis

Software name

ProSafe

Synergi

Purpose

Registration of information from unplanned occurrences, including analysis and reporting capabilities for trends and patterns to be defined

~egistration analysis and reporting of information from incidents, accidents and unplanned occurrences

•

•

Dovre Safetec, Aberdeen, UK

EQE, London, UK

•

Contact

EQE, London, UK

Pride, Stavanger, Norway

www.safetec.no

www.eqe.co.uk

www.fsd.se

www.erm.com

Fire Safety Design, Sweden



SINTEF, Trondheim, Norway


WS Atkins, Bristol, UK

www.scandpower.no

www.sintef.no/units/civillbygg/kteklusfos.htm

www.hutch.com.au/-vrj

www.wsatkins.co.uk

OVERVIEW OF SOFTWARE 417

TABLE A.6. Overview of risk management software

Software Purpose Contact name

Hazard Log Registration and management of WS Atkins, Bristol, UK Database hazards Management

PRISM Audit tool for Safety Management AEA Technology, Assessment of Safety Management Warrington, UK performance

Riskplot II Risk summation and presentation tool, Four Elements, London, including outputs of risk contours, F-N UK data, risk transects and a listing of dominant events

Sea_Net Provide information about UK license Dovre Safetec, Aberdeen, block restrictions and regulatory UK requirements

SORB ITS Computer system designed to support DNV Software, the analysis work related to Risk Based H0vik/LondonJHouston Inspection, RBI, for offshore topside systems

THESIS Management of major risks to people, EQE, London, UK the environment, assets and reputation by means of "bow-tie" graphical interface diagram

VRJHazardR Hazard documentation and assessment VRJ, Melbourne, egister Australia

A 1.3 Quantitative Risk Assessment software

Al.3.I. ASAP

Function

Vendor

Pricing



NOK 450.000,-Annual Maintenance Fee: 12,5% of licence cost

418 APPENDIX A

ASAP is a computer analysis package that calculates the risk related to hydrocarbon leaks, fires and explosions on oil and gas installations. Complex interactions in horizontal and vertical directions are taken care of by adjusting the models to 3 dimensional geometry. Scenarios such as gas and liquid jets followed by gas dispersion and fire development can be seen in 3D graphic, giving a good interpretation of the accident.

ASAP consists of a design package, physical and statistical models along with design interface models. The latter constitutes the connection between the physical models and the design. In the design package the user designs the geometry of the installation and the process flow diagram for equipment containing hydrocarbons. All the models are intelligent in the sense that they automatically adjust to the geometry and logic the user defines. This implies that design changes and concept development are catered for in a fast and consistent manner by the program.

A 1.3.2. COSAC

• Function

Vendor

• Pricing

Risk assessment tool for early project phases of a field deve-lopment for concept evaluation and screening


NOK 250,000.-, NOK 10,000.- (universities) Yearly maintenance fee NOK 50,000.-

COSAC is a computerised tool for efficient risk assessment in the early project phases of a field development.

COSAC analysis and results are tailor made for concept evaluation and screening. Its aim to increase the safety of new offshore developments by utilising 20 year of experience gained from risk analyses. Some of the main features of COSAC include reducing uncertainty, improving the quality and efficiency of early phase safety evaluations. COSAC provides a safety score for every risk factor associated with an offshore field development concept. A low score indicates safety concerns and/or lack of documentation of important safety issues. Therefore, a low safety score in COSAC puts these issues in focus. In addition the user is provided with information on how to resolve the problems identified by COSAC.

Al.3.3. IRAP

•

•

Function

Vendor

Pricing


British Gas, UK

Annual fee £14,000, first year; £9,000 subsequently

BG Technology have developed a suite of validated consequence and risk models for, amongst others, fires, smoke and explosions, which are used to develop a risk picture of an onshore or offshore gas or oil installation. It is a client-server application, with a powerful server at BG Technology running the models and the Windows client logging on from anywhere in the world. One innovative step has been the use of an ORACLE database, allowing data to be easily revisited and updated.

This software uses a 3D geometrical description, like PLATO, and calculates scenarios along the branches of a fixed set of event trees, invoking consequence and other models as


required. The program models the pre-ignition processes such as gas filling volume, and ventilation, the escalation is modelled as a single-stage branch in the event tree.

The package gives licensees the opportunity to use world-class technology in risk assessment and consequence modelling anywhere in the world. The licensee benefits from the client-server arrangement as they do not need a costly server and all administration tasks are handled centrally.

A1.3.4. NEPTUNE

• Function

• Vendor

• Pricing

Offshore Risk Analysis

DNV, H¢vik, Norway

Not decided yet

Neptune will be the successor to OHRAT (see below), and will be released in 1999. Neptune has all the key features of OHRAT, but the functionality and features have been significantly improved. The system architecture has been designed to give maximum flexibility with respect to system configurations (client/server, distributed solutions, data communication, and web solutions). Special attention has been given to allow users to incorporate new models. Neptune operates under MS-Windows NT and has tools like Excel (incl. Visual Basic) fully integrated.

Al.3.5. OHRAT

• Function

• Vendor

Pricing

Offshore Risk Analysis

DNV, H¢vik, Norway

Single user project license, 20,000 £. Annual fee including support and maintenance

OHRAT (Offshore Hazard and Risk Analysis Toolkit) is a product designated for offshore risk analysis. OHRA T comprises a set of consequence models (for release, dispersion, fire, explosion and other physical effects), a set of risk tools (event tree models, calculators, failure data), and the utilities required to link the models, transfer data, and analyse calculations. In general terms OHRA T can be viewed as a graphical programming language, where the computational structure is drawn as a flowsheet on the screen. All data, structures and actions are stored in an ORACLE database ensuring a transparent and auditable structure. OHRA T has been successfully used for a number of major oil instalIations, particularly to ystablish a base structure which can be used as a reanalysis model to assess sensitivities and explore design options. OHRAT operates under a UNIX environment.

Al.3.6. ORCA

• Function

• Vendor

Pricing

Off/Onshore Risk Calculation and Analysis

VRJ Melbourne, AustraliaIDovre Safetec, Trondheim, Norway

Not available

420 APPENDIX A

Risk assessment of offshore installations using traditional software is time consuming and expensive. Traditional software requires complex modelling and data input even for a simple concept study. Analysts need extensive training solely in the use of the software. The next generation of risk analysis software must deal with these issues. It needs to interface with management systems and be responsive in subsequent analyses to actual operations once an installation has been commissioned. ORCA (Off/Onshore Risk Calculation and Analysis) is being developed to meet these needs.

ORCA provides a quick and effective method of analysing and managing the entire risk profile associated with offshore installations, in particular FPSO's. It is also applicable onshore, as the methodology is generic and both onshore and offshore models are included.

ORCA is a Windows NT based application that is intuitive and easy to use, thereby minimising training and analysis time and reducing the likelihood of analyst error.

ORCA links hazards identified in the analysis directly to a Hazard Register, in which risk control recommendations can be logged and tracked. A risk matrix is provided that allows easy risk based hazard identification evaluations. The system has been developed so that a number of risk matrices are available to suit both design and operational circumstances.

Reports from the database are particularly useful to the management of the facility's entire risk profile. Operational incidents can be entered and linked to recognised hazards so feedback from operational experience can be incorporated into subsequent analyses. One of the most powerful features is its reporting capability, combining database reporting with very effective graphical plots overlaid on existing CAD drawings.

For each identified hazard ORCA can be used to perform a quantitative risk assessment (QRA). ORCA provides the tools to perform QRAs of Process Release, Working Hazards, Dropped Objects, ImportJExport (Risers and Pipelines) and Blowouts. The system allows the capturing of information for risk analysis of other non hydrocarbon hazards, such as accommodation and engine room incidents.

ORCA provides the functionality to identify generic hazards and allocate a semi quantitative risk ranking in terms of estimated likelihood and consequence. This risk ranking provides a comparative level of risk for Environment, Material Damage, Personnel and Production Loss in order to determine those hazards for which it is appropriate to perform a more detailed QRA. ORCA may be used to identify and document the details of individual hazards, their causes and consequences and the technical systems in place that provide preventive, detection and mitigating measures.

The total risk picture for the project is obtained. Specific reporting functions are available that allow different reports to be presented for specific organisational purposes. The total cost of operational risk can be analysed with this system.

Al.3.7. PLATO

• Function

• Vendor

• Pricing

3D geometrical platform model including representation of safety related engineering components and design features, analysing explicitly development and timing of escalating hazards, fire, explosion and structural collapse


£36,000 (leasing schemes also available) Optional annual maintenance: £3,000 per year (telephone support and free minor software revisions)


PLATO uses a 3D model of the platform in which all safety related engineering components and design features are explicitly represented. The development and timing of escalating hazards such as fire, explosion and structural collapse are simulated with automatic generation of scenarios where safety related components affect the outcome. Results can be processed not only for the overall level of societal and individual risk but also to determine the primary escalation mechanisms and key safety critical equipment. The primary benefits over event tree methods are modelling realism, auditability, explicit representation of geometry/time and ease of update for evaluation of design options or platform modifications.

A1.3.8. RISK

• Function

Vendor

Pricing

Comprehensive offshore quantitative risk assessment tool


Not available

RISK is a linked spreadsheet QRA model developed on EXCEL. It enables users to clearly identify the key stages of the risk assessment process and follow individual major hazard events from their initiation, through accident development, to the contribution they make to accident scenarios, TR Impairment, individual risk and PLL.

Key features of RISK are: Developed using industry standard spreadsheet software package (EXCEL). Is user friendly and can be interrogated by engineers without the need for formal training

• Is easy to tailor to meet specific project requirements. • Is transparent and focuses on key scenarios at an appropriate level of detail.

A 1.3.9. SAFETI

Function

• Vendor

• Pricing

Comprehensive QRA tool for Flammable, Explosive and Toxic Impact

DNV, H!/lvik, Norway

Single user perpetual license, 36,000 £. Optional separate agreement for support and maintenance

SAFETI (Software for the Assessment of Flammable, Explosive and Toxic Impact) is the most comprehensive and widely used onshore QRA package available. It is a Windows based system that provides a user friendly, industry standard method for quantifying major chemical risks. It enables analysis of the likelihood and severity of major hazards and makes use of the PHAST models to predict the consequence of major releases. By combining these with their frequencies and taking account of population location and density, along with ignition source location for flammable and explosive effects, a number of presentations of 'risk' are possible. These include risk contours, FIN curves, risk transects and risk ranking at specific points.

422 APPENDIX A

AI.4 QRA Tools for Scenario and Probability Analysis

A 1.4. I. BLOWFAM

• Function

• Vendor

• Pricing

Evaluation of blowout risk during specific well operations through assessment of approximately 300 elements, which influence the probability of a blowout


Licence condition: Price NOK 110,000 (oil companies) NOK 350,000 (engineering companies, consultants, etc.) Annual maintenance fee NOK 25,000.-

BlowFAM is a PC-tool for evaluation of blowout risk during specific well operations. BlowFAM has been developed in close co-operation with drilling/well intervention professionals in the participating companies. In addition, drilling specialists from several contractor companies have contributed.

The BlowFAM model has identified approximately 300 elements, which influence the probability of a blowout. Many of these are applicable for the whole well life while others are only relevant for a specific well phase, e.g. drilling of the well. These elements are rated in regard to their importance to the risk. Main risk contributors for a specific development can be identified and cost-efficient risk reducing measures may be implemented.

The BlowFAM model is also a valuable tool for communicating risk elements to the drilling professionals involved in the well operations.

A 1.4.2. COAST

•

• •

Function

Vendor

Pricing

Graphical presentation of information on shipping routes and vessel characteristics


Not available

COAST is an interactive system which graphically presents information on shipping routes and allows interrogation to identify vessel characteristics. It was developed by Safetec during 1995/96 in a project funded by UKOOA, HSE and DETR and successfully achieved its main objective which was to provide a comprehensive, up-to-date and easy to use database on shipping movements which could be used to assess risks between shipping and offshore installations in UK waters.

The system is based on more than 200 traffic surveys and each year a further 20-30 are undertaken to maintain the accuracy of the system.

In 1997 COAST was developed further under European sponsorship to cover all sectors of the North Sea and during 1998 a Gulf of Mexico system was released to assist in projects in this area.

COAST operates in Windows and presents the infromation on ARCS charts (computerised charts) to assist in interpretation of the information. A COAST license can be bought either a yearly or continual basis at a price depending on the number of users, the amount of data sets required and type of contract.

A1.4.3. COLLIDE

• Function

• Vendor

• Pricing

OVERVIEW OF SOFTWARE

Analysis of collision risk between vessels and platfonns


£4,000

423

COLLIDE is a collision risk tool which was developed by Safetec under the sponsorship of offshore Operators in the UK, Norwegian, Danish, Gennan and Dutch sectors to assist in the assessment of ship collision risk. The tool has the primary function of calculating the frequency and consequence of impact by shipping against any offshore structure.

The system provides models for assessing the risks associated with passing (merchant, tankers, fishing, standby, supply) and visiting traffic (alongside installations, standby, supply) and gives consideration to both drifting and powered collision scenarios.In 1996, COLLIDE was upgraded to accept input from the COAST database on shipping and has recently been independently validated for the UKCS.

The system operates in a Windows environment.

A 1.4.4. DATABASE MANAGER

•

Function

Vendor

Pricing

For storage, handling, and display of reliability analysis data


Not available

Database Manager is a tailored database capable of hosting reliability and safety data. Data can be input or supplied by AEA Technology from its own databases. Database Manager then enable the data to be configured, searched and analysed, and presented in various reporting fonnats.

Data Manager facilitates file and data transfer to and from other databases. It accepts virtually unlimited data input, constrained only by hardware availability. It handles a wide variety of database taxonomies, including all major reliability database taxonomies.

A 1.4.5. EGRESS

Function

Vendor

Pricing

Mustering and evacuation simulation for evacuation/rescue modelling


Not available

The EGRESS code allows the movement of large numbers of personnel, such as when mustering on an installation, to be simulated. The platfonn layout is modelled as a matrix of interconnecting cells. The code covers both the physical movement and behavioural decision making of personnel. The output is graphical and the movement watched as a real-time graphical representation. It was developed as part of a joint industry project I the UK between AEA Technology, Shell, Texaco, Exxon, and the Health and Safety Executive.

The code has been used both offshore and onshore for the oil and gas and other industries to provide assessments of the movement of people during incidents.

424

AI.4.6. LEAK

Function

Vendor

• Pricing

APPENDIX A

Calculation of the frequency of leaks at an installation

DNV, H0vik, Norway

Not available

LEAK is a software tool which calculates the frequency of leaks at an installation, typically an oil platform. Each installation is broken down into a number of areas which.are themselves split into a number of segments each containing a list of equipment groups. Each equipment group is built up of base elements such as valves, flanges, pipes, etc. LEAK will calculate the leak frequency for the installation, area, segment or equipment group. The total frequency for each user defined category is reported together with each contributor. The model used expresses the frequency of a leak being larger than a certain size as a continuous function of the equivalent hole size diameter. The historical data used in the calculations is read from a database, enabling the most up-to-date data to be included.

A1.S QRA Tools for Consequence Analysis

A 1.5.1. AUTOREAGAS

• Function

Vendor

Pricing

Integrated CFD software tool for analysing combustion in flammable gas mixtures and subsequent blast effects.


Not available

AutoReaGas is a powerful interactive, integrated CFD software tool for analysing combustion in flammable gas mixtures and subsequent blast effects. Industrial applications of the software include risk and safety assessment of offshore platforms and onshore petrochemical and process plants, power plants, mining installations and transportation systems.

AutoReaGas can perform numerical simulation of gas cloud explosions including flame propagation, turbulence and the effects of objects in the flow field. The code can also simulate the propagation of resulting blast waves and their interaction with structures.

The software is jointly developed by Century Dynamics and TNO and successfully integrates many features of the well know REAGAS, BLAST and AUTODYN codes to provide a unique capability in one commercially available and supported code. The code has been, and continues to be, extensively validated against experimental data.

AutoReaGas is available as a Paid-Up License or as an Annual License and a Trial and Training is also available.

A1.5.2. FIREX

• Function

• Vendor

Pricing

Prediction of main fire characteristics and responses of fire scenarios based on empirical correlations

Scandpower, Kje\ler, Norway

PC-software NOK 45,000.-

OVERVIEW OF SOFfW ARE 425

The programme system FIREX is capable of predicting the main fire characteristics and responses of six fire scenarios:

• Pool fire in the open

Pool fire in enclosure

Fire on sea surface

• Jet fire

• Diffusive flare fire

FireballIBLEVE

FIREX is based on well-known prediction methods, which have been compared and verified towards experimental data. FIREX predicts:

Incident heat radiation onto targets not engulfed by the flames, as a function of the distance from the fire

• Heat flux to targets engulfed by the flames as a function of time from the onset of the fire

• Temperature response of steel structures as a function of time and degree and type of insulation

• Smoke production and visibility in smoke as a function of time from the moment of ignition

Pool fire hazard ranges

• Fireball hazard ranges

For pool fires in enclosures; ceiling temperature, development of hot gas

A1.5.3. MONA

Function

Vendor

Pricing

Advanced and general tool for simulation of single-component multi phase systems


To be discussed

MONA is an advanced and general tool for simulation of single-component multiphase systems. MONA can handle general network of pipelines and vessels and are capable of simulating thermal non-equilibrium conditions. MONA's ability to simulate water hammer and cavitation are validated against loops in Sweden and Germany.

A1.5.4. OLGA

•

•

Function

Vendor

Pricing

Transient multiphase flow simulator for systems comprising flow lines, risers and process equipment


Available as lease for a limited period or as a permanent license

OLGA is a simulator for transient multi-phase flow phenomena. OLGA can model a system comprising flowlines, risers as well as process equipment.

426 APPENDIX A

OLGA is more accurate in predicting pressure gradients, liquid hold-up, flow regimes and flow rates than competitive models and correlations. OLGA's ability to predict release behaviour from condensate pipeline (reflecting bottom topography), risers is of significant importance in risk analysis of offshore installations.

OLGA is verified and validated against more than 10,000 experiments at the TwoPhase-Flow test loop operated by SINTEF in Trondheim.

A 1.5.5. SUPER-TEMPCALC

• Function

• Vendor

• Pricing

Thermal, 2D FEM program

Fire Safety Design, Lund, Sweden

Not available

SUPER-TEMPCALC is a two-dimensional, thermal, finite element program. It is widely used in calculation of heat flow within structural members and building components. The program solves the two-dimensional, non-linear, transient heat transfer differential equation incorporating temperature-dependent material properties. Heat transferred by convection and radiation at the boundaries can be modelled as function of time. Heat absorbed by existing voids in the structure is considered. Features include:

• fast and user-friendly input/output procedures

• automatic mesh generation

• calculation in rectangular or cylindrical coordinates

• integrated material and exposure database

• graphical representation of results such as time-temperature curves

• isothermal plots and temperature gradients.

License is sold on a I-year basis. The pricing is dependent on what kind of activities the program is to be used for, for,example educational purposes or consultancy services.

A1.5.6. PHAST

• Function

• Vendor

• Pricing

Windows-based toolkit for determination of consequences of accidental releases of hazardous material

DNV, H~vik, Norway

Single user perpetual license, 12,000 £. Optional separate agreement for support and maintenance

PHAST (Process Hazard Analysis Software Tools) is a Windows-based toolkit, which determines the consequences of accidental releases of hazardous material. It examines the progress of a potential incident from initial release, through formation of a cloud, with or without a pool, to its dispersion. The program uses DNV's unique Unified Dispersion Model (UDM) to apply the appropriate entrainment and dispersion models as the conditions change and to integrate the relevant individual models such that the transition from one behaviour pattern to another is smooth, continuous and automatic. It is applicable to all stages of design and operation across a range of process and chemical industry sectors and may be used to identify situations which present potential hazards to life, property or the environment.

OVERVIEW OF SOFIW ARE 427

Al.5.7. USFOS

• Function Integrated Fire Analysis Tool

• Vendor SINTEF, Trondheim, Norway

• Pricing Unavailable

'Integrated Fire Analysis Tool' consists of following three interlinked codes: KAMELEON/FAHTS/USFOS. The codes may be used individually ('stand alone) or fully integrated.

Fire simulation (combustion) Name of Code : KAMELEON - Fire Advanced calculation (CFD) ofthe combustion process accounting for ventilation condi

tions, change in gas rates, evaporation of oil surfaces influencing the intensity of the fire, deluge models etc.

• Oil Pool Fire • Gas fires (flaring, accidental jet fires)

Used in commercial projects for more than 10 years.

Heat transfer within structural components Name of Code : FAHTS (Fire And Heat Transfer Simulations)

Price : NOK 25.000 for 3 month rent

Main Characteristics:

• Finite Element code with automeshing capabilities.

• Heat sources from simplified (HC) fires to advanced sources (utilizes the "Kame-leon Environmental Database" information).

• Internal radiation within hollow sections

• Advanced models of Passive Fire Protection

• 3D animation of results

• Compatible with SESAM, ABAQUS, SACS file formats

• Available on UNIX and PC


Mechanical Response of structures exposed to Accidental/oads (fire/explosion) Name of Code : USFOS (Ultimate Strength of Framed Structures)

Price : NOK 45.000 for 3 month rent

Main Characteristics:

• Nonlinear FE code accounting of geometrical non Iinearities as well as material non linearities (yielding, thermal expansion, thermal degradation of materials)

• Covering a broad class of accidental loads

• Compatible with SESAM, ABAQUS, SACS file formats

• A vailable on UNIX and PC


428 APPENDIX A

A 1.6 Qualitative Risk Assessment software

A 1.6.1. DNVPRO

• Function

• Vendor

• Pricing

Hazard recording and reporting tool, including four Process Hazard Analysis techniques; HAZOP, What IfIChecklist, FMEA and Preliminary Hazard Analysis

DNV, H~vik, Norway

Single user perpetual license, 1500 £. Optional separate agreement for support and maintenance

DNVPro is a Windows based hazard recording and reporting tool which includes four Process Hazard Analysis techniques in a single integrated product. The available techniques are HAZOP, What IfIChecklist, FMEA and Preliminary Hazard Analysis. Fully user customisable risk matrices, up to 10 by 10, are available for severity and likelihood ranking of consequence, safeguards and recommendations. Comprehensive recommendation management facilities are available to manage the multitude of recommendations arising from a typical HAZOP study. Other features include wizards to simplify complex tasks, file templates, timed backup and auto recovery, spell checker and all standard windows functionality such as cut, copy and paste, find and replace and drag and drop editing.

A 1.6.2. PHAROS

•

•

•

Function

Vendor

Pricing

Integration of job hazard analysis process with the Permit to Work System

EQE, London, UK

From £5,000 pa to £50,000 pa depending on the number of installations

Pharos is a powerful system that integrates the job hazard analysis process with the Permit to Work System controlling the planning and execution of hazardous activities. It incorporates many years of EQE's experience in the design and implementation of Permit to Work Systems and application of workplace hazard management processes.

The elements within the system include, Hazard Assessment and Job Hazard Analysis, Work Tracking & Coordination, (including interfaces with maintenance systems), and IsolationILockout control. The system enhances safety with reduced operational costs by the combination of risk assessment methodology and computer technology.

A 1.6.3. VRJHAZOP SOFfW ARE

•

•

•

Function

Vendor

Pricing

Assisting and documenting HAZOP studies


Not available

The VRJHazop is used for assisting and documenting Hazard and Operability Study meetings.


The software system was developed for improving the efficiency of undertaking Hazops. Traditionally Hazops can take a very long time and, quite often, the minutes of every meeting take even longer to be received by the members of the Hazop study team. The process of sorting through information, collating and referencing specific process and instrumentation diagrams (P&ID's) together with providing follow-up information requirements and close out loops, can quite often leave the Hazop process inadequate due to the lack of a coherent system to hold it all together. VRJ have developed the VRJHazop software to overcome these problems.

The VRJ Hazop assists in the conduct, recording and reporting of Hazops. It is intended that information be entered directly into the software during the meeting. A selection of reports can then be printed out as required.

The VRJHazop software system provides the following: • guideword and deviation menu items for petrochemical, OH&S and threat and

vulnerability evaluations; • ready recording of all action items; • a specific VRJ item data sheet format which allows recording of information in a

useful manner, • the provision of a special format for recording follow-up action by study team

members; • use of the P&IDs in software system, allowing each Hazop action item to be linked

to the relevant part/item o.f the P&ID; text search and retrieval capabilities;

• Hazop action item search and retrieval capabilities; • translation of the Hazop information into a management summary format.

At. 7 Reporting and Analysis of incidents and accidents

AI.7.1. PROSAFE

• Function

Vendor

Pricing

Registration of information from unplanned occurrences, including analysis and reporting capabilities for trends and patterns to be defined

EQE, London, UK

From £5,000 to £150,000 depending on the number of installations

ProSafe is a Safety & Loss Prevention system developed for the Oil & Gas industry. It captures information from any unplanned occurrence that causes, or has the potential to cause, harm to people, the environment, assets or a company's reputation. The information is then analysed and reports, (graphs, charts, text), produced. Its data mining capabilities enables trends and patterns to be defined that help focus the deployment of resources to prevent future loss.

Prosafe's embedded data dictionary enables companies to change the system to incorporate their own terminology and language. It is also scaleable enabling its use across many geographical locations or as a single departmental system.

430 APPENDIX A

A 1.8 Risk Management software

A 1.8.1. HAZARD LOG DATABASE MANAGEMENT TOOL

• Function

Vendor

• Pricing

Registration and management of hazards

WS Atkins, Bristol, UK

STG 7,500, plus tailoring for system I customer requirements (typically STG 3,000), for a one-off purchase

The WS Atkins Hazard Log Database Management Tool has been developed based upon the Safety Hazard I Risk Management requirements of UK MoD Defence Standard 00-56. It is currently in use on a number of UK MoD defence projects ranging from whole ship projects to shore-based facilities, as well as a tri-national (UKlFrancelItaly) naval defence communications project.

Furthermore, the Hazard Log Database has also been tailored for use on the Lewisham Extension to the Docklands Light Railway, and is proposed for a number of other civilian and defence projects in the UK, Europe and Asia.

The WS Atkins Hazard Log Database Management Tool is based in Microsoft Access 2, and can be run on PC or Network facilities.

The clear advantage of the Tool is that it provid~s a systematic and traceable means of managing system safety in accordance with a recognised standard process. It facilitates an effective approach to the management of safety risk reduction measures adopted and actions placed to provide the appropriate levels of confidence in the final safety justification.

WS Atkins are able to tailor the Database to the specific needs of the system application under assessment, and the needs of the managing authority.

Each copy of the Tool requires an individual licence. Where multiple use is required on a number of system element contracts for instance,

then pricing can be structured differently, and WS Atkins are open to discussion in these matters.

A1.8.2. PRISM

Function

Vendor

Pricing

Audit tool for Safety Management Assessment of Safety Management performance


Not available

PRISM is an audit tool that is designed to penetrate each level of an organisation using a structured and systematic methodology. The audit is involves both interviews and inspections to build up a picture of both the documented management systems and their implementation.

The code has been used both offshore and onshore for the oil and gas and other industries to provide assessments of the state of development of a company's Safety Management System.

A 1.8.3. RISKPLOT II

Function

• Vendor

• Pricing


Risk summation and presentation tool, including outputs of risk contours, F-N data, risk transects and a listing of dominant events


£7,900 for a single user licence

RISKPLOT is a risk summation and presentation tool. A regulatory version is currently being developed for UK HSE. Outputs include risk contours, F-N data, risk transects and a listing of dominant events. The risk for each scenario is calculated, accounting for:

• wind direction, speed and stability;

• the number of people affected in specified time periods;

• whether populations are indoors/outdoors, fixed (e.g. within dwellings) or mobile (e.g. motorists);

topographic effects (e.g. the presence of hills or cliffs); and

• whether event locations are at a fixed point, multiple points or distributed along a line source (e.g. pipeline).

• Function

Vendor

• Pricing

Provide information about UK license block restrictions and regulatory requirements


Not available

Ensuring that licence blocks are not purchased without prior information on the likelihood of gaining consent to site a structure in the area and the level of work required to satisfy the regulatory requirements.

Providing a means of estimating lead-times for applications to the regulators which vary depending on block sensitivity thereby reducing the likelihood of project delay.

The system presents a map of the UKCS license blocks and provides the most significant information on fishing activity, environmental sensitivity, shipping density, and proximity to pipelines and wellheads for each block.

The system operates in Windows and overlays the sensitivity information on ARCS charts (computerised nautical charts) to assist in interpretation of the information.

A license is bought for this system on a yearly basis at a price depending on the number of users and number of data sets required.

A1.8.5. SORBITS

• Function

• Vendor

Pricing

Computer system designed to support the analysis work related to Risk Based Inspection, RBI, for offshore topside systems

DNV, H!/lvik, Norway

Not available

432 APPENDIX A

SORB ITS is a computer system designed to support the analysis work related to Risk Based Inspection, RBI, for offshore topside systems. The system contains several linked databases for assessment of consequences and determination of probability for failure.

The system is based on DNV's methodology for RBI analysis. The methodology is being developed through several industry and internally sponsored projects. The system encapsulates DNV's experience and competence in Risk and Reliability, Materials Technology, Failure Analysis and Practical execution of NDTlInspection programmes are built into the RBI models.

The system calculates the consequence to personnel, environment, production loss and material damage for ignited and unignited leaks. Links to QRA as well as RAM analysis (or RAM-HAZOP) are provided to allow for import of key data. Consequences from material damage are based on data for typical repair costs of offshore installations which are incorporated in the system.

The probability of failure is based on models for the most common materials/services (damage mechanisms) offshore. Probabilistic analysis tools for analysing the effect of inspection efficiency (Probability of Detection), inspection frequency and coverage are incorporated as well as simplified models for inspection planning

The embedded databases support all commonly used tag numbering systems and is developed based on standard SQL language. The systems are NORSOK compliant.

A 1.8.6. THESIS

Function

• Vendor

Pricing

Management of major risks to people, the environment, assets and reputation by means of "bow-tie" graphical interface diagram

EQE, London, UK

From £4,000 pa per licence to £60,000 pa depending on the number of installations

Thesis is a system which assists companies in the analysis and management of their major risks to people, the environment, assets and reputation. The reports from Thesis can form part of a formal Health, Safety & Environmental Case, can be used for communication to personnel responsible for safety critical activities, and for day-to-day management of the facility.

It provides a structured approach for completing the risk management process and ensures that controls identified are linked to a company's business and to individuals' responsibilities.

The "bow-tie" graphical interface diagram provides an extremely useful representation of the risk management process that is readily understood at all levels in a company and also allows for simple data entry.

A 1.8.7. VRJ HAZARD REGISTER

•

Function

Vendor

Pricing

Hazard documentation and assessment


Not available

OVERVIEW OF SOFfW ARE 433

The purpose of the VRJ Hazard Register system is to:

Document hazards identified;

Assist in the process of assessing risks associated with hazards;

• Assist in the development of priorities and action plans for improving plant safety;

• Comply with current legislation requiring self regulation and risk analysis;

Track risk control recommendations.

It also allows easy access to summaries and reports of all hazards. Certain summaries prioritise the risk control recommendations according to the levels of risk assigned to each hazard and the cost effectiveness of the proposed risk control measures.

The database may contain a number of modules (e.g. Dangerous Goods, Incident Analysis, Confined Space, Job Safety Analysis, Noise, etc.). The VRJHazardRegister system has been specifically designed in a manner that all hazards identified through these individual modules are entered into a central hazard register through Hazard Data Sheets'. The management system can be used for OHS, Environment, Production and Property Assessments.

Hazard data sheets store information about any identified hazard, including location, descriptions and risk control recommendations. Risk control routines through risk matrices and specific calculation routines have been specifically developed for the system.

The concepts of hazard identification and risk assessment are described in Section 2 (Hazard Management) of this document. A hazard may be "signed off" at any time to indicate that the process of risk control has been completed and that the hazard has been satisfactorily addressed.

The Hazard Register system has been produced in Microsoft Access. The cost depends on the number of users and the size of the organisation together with

the numoer of modules included.

APPENDIXB

NORSOK STANDARD

Risk and Emergency Preparedness Analysis

This appendix presents the NORSOK Standard for Risk and Emergency Preparedness Analysis, Z-013, thanks to kind permission has been granted by the NORSOK secretariat. This standard is the only of its kind with quite explicit requirements to the use of quantified risk assessments and risk acceptance criteria. The NORSOK standards represent a cooperation between the Norwegian oil and gas industry and its suppliers.

The full standard consists of a normative text and has a number of annexes. These annexes are not included in this book. The full standard may be accessed from the home page of the NORSOK organisation:

http://www.nts.no/norsok/

It should be noted that the text of the NORSOK standard has been reproduced unedited, implying that there are some slight differences in terminology and definitions between what is used elsewhere in this book, and in the following text from the NORSOK Z-O 13 standard.

FOREWORD

NORSOK (The competitive standing of the Norwegian offshore sector) is the industry's initiative to add value, reduce cost and lead time and remove unnecessary activities in offshore field developments and operations.

The NORSOK standards are developed by the Norwegian petroleum industry as a part of the NORSOK initiative and are issued jointly by OLF (The Norwegian Oil Industry Association) and TBL (Federation of Norwegian Engineering Industries). The NORSOK standards are administered by NTS (Norwegian Technology Standards Institution).

The purpose of this industry standard is to replace the individual oil company specifications for use in existing and future petroleum industry developments, subject to the individual company's review and application.

The NORSOK standards make extensive references to international standards. Where relevant, the contents of this standard will be used to provide input to the international standardisation process. Subject to implementation into international standards, this NORSOK standard will be withdrawn.

The following informative Annexes are attached at the back of this NORSOK standard (not included in this appendix):

Annex A Risk Acceptance Criteria

Annex B Analysis Of Causes And Consequences Of Various Accidents

Annex C Methodology For Establishment And Use Of Environmental Risk Acceptance Criteria

436 APPENDIXB

Annex D Relationship Between Risk And Emergency Preparedness Analysis

Annex E Cost Benefit Analysis

Annex F NPD requirements that are not complied with

Annex G Informative References

Introduction

The purpose of this standard is to establish requirements for effective planning, execution and use of risk and emergency preparedness analysis. Guidelines are provided in informative Annexes (not included in this appendix).

These Annexes are provided as supplementary information and check lists which may be used by personnel in charge of evaluation and analysis of risk and emergency preparedness. The emphasis has therefore been to provide useful information, rather than to reduce the volume of these Annexes.

Bl Scope

This NORSOK standard presents requirements to planning, execution and use of risk and emergency preparedness analysis, with an emphasis on providing insight into the process and concise definitions.

This NORSOK standard includes a number of requirements from which no deviation is normally permitted ('shall' statements). A preferred action is recommended in other cases ('should' statements).

When this standard is used in a way which implies deviation from a recommended course of action ('should' statements), the reasons for choosing this course shall always be stated.

The standard is structured around the following main elements:

• Establishment of risk acceptance criteria prior to execution of the risk analysis.

• The connection between the risk and emergency preparedness analyses, especially the integration of the two types of analysis into one overall analysis.

Planning, establishment of requirements and execution of analyses.

• Further requirements to use of risk and emergency preparedness analyses for different activities and life cycle phases.

The use of risk acceptance criteria and risk analyses in relation to working environment factors is not covered by this standard. The standard covers emergency preparedness analyses, establishment of emergency;preparedness as well as organising for emergency preparedness, while maintenance of emergency preparedness and further development are not covered by the standard.

This standard covers analysis of risk and emergency preparedness associated with exploration drilling, exploitation, production and transport of petroleum resources as well as all installations and vessels that take part in the activity. Operations and modifications of installations as well as decommissioning and disposal of these are also covered. The standard does not cover plants and pipelines onshore.

NORSOK: RISK AND EMERGENCY PREPAREDNESS ANALYSIS 437

B2 Normative References

The following standards include provisions which, through references in this text, constitute provisions of this NORSOK standard. The latest issue of the references shall be used unless otherwise agreed. Other recognised standards may be used provided it can be shown that they meet or exceed the requirements of the standards referred to below.

•

•

•

ISO 13702:

E&PForum:

HSE SI 199212885

HSE SI 19951743

Norwegian Shipowners' Association:

Petroleum and natural gas industries - Offshore production installations - Control and Mitigation of Fires and Explosions - Requirements and guidelines.

Guidelines for the Development and Application of Health, Safety and Environmental Management Systems.

A guide to the Offshore Installations (Safety Case) Regulations, UK Health and safety Executive, 1992.

Prevention of fire and explosion and emergency response on offshore installations (PFEER) Regulations, UK Health and Safety Executive, 1995.

Guidelines for application of risk and emergency preparedness assessment for Mobile Offshore Drilling Units. 1 (Is heing updated in 1998, and will in the future be issued as a DNV Recommended Practice.)

B3 Definitions and Abbreviations

83.1 Definitions

The list of definitions gives supplementary comments to selected terms. These comments present premises, amplifications, elaborations, etc. The list is arranged alphabetically and numbered. Further elaboration is given in informative Annexes A, C, D and E. (not included in this appendix)

3.1.1 Acceptance Criteria for risk

Criteria that are used to express a risk level that is considered acceptable for the activity in question, limited to the high level expressions of risk.

Risk acceptance criteria are used in relation to risk analysis and express the level of risk which the operator or owner will accept in the activity. The term is related to the high level expressions of risk. Requirements on lower levels are also relevant, see for instance Definition 3.1.14, relating to functional requirements to safety and emergency preparedness. In some studies on a lower level, general decision criteria relating to HES management are used.

3.1.2 Accidental event Event or chain of events that may cause loss of life, health, or damage to environment or assets.

The events that are considered in a risk analysis are acute, unwanted and unplanned. Planned operational discharges, such as to external environment, are usually not included in a risk analysis.

438 APPENDIXB

The tenn 'event' will have to be defined explicitly in relation to each analysis, in order to be consistent with the availability analysis, that is with production regularity.

3.1.3

3.1.4

3.1.5

ALARP (As Low as Reasonably Practicable)

Can

Defined situations of hazard and accident (DFU)

ALARP expresses that the risk level is reduced - through a documented and systematic process - so far that no further cost effective measure may be identified.

Verbal fonn used for statements of possibility and capability, whether material, physical or casual.

A selection of possible events that the emergency preparedness in the activity should be able to handle, based on the activity's dimensioning accidental events, and hazardous and accidental situations associated with a temporary increase of risk and less extensive accidental events.

Examples of less extensive accidental events may be man overboard situations, limited oil spills exceeding the stipulated discharge limits, occupational accidents etc.

Situations associated with a temporary increase of risk, may involve drifting objects, work over open sea, unstable well in connection with well intervention, 'hot' work, jacking up and down of jack-up installations, special operations and environmental conditions etc.

3.1.6

3.1.7

Dimensioning accidental events (DUH)

Dimensioning accidental load (DUL)

Accidental events that serve as the basis for layout, dimensioning and use of installations and the activity at large, in order to meet the defined risk acceptance criteria.

The most severe accidental load that the function or system shall be able to withstand during a required period of time, in order to meet the defined risk acceptance criteria.

It may be difficult to define the accidental load in relation to some types of accidental events, for instance in relation to filling of buoyancy compartments that may lead to capsizing or loss of buoyancy. In these cases, the basis of dimensioning is given by the dimensioning accidental events.

Dimensioning accidental events and dimensioning accidental loads are closely related. The establishment shall start with the completion of a risk analysis and the comparison of estimated risk with risk acceptance criteria. It must be assumed that the risk analysis has established alternative accidental events and associated accidental loads, and possibly also associated probability.

Tolerable damage or required functionality have to be defined in such a way that the criteria for dimensioning are unambiguous. The tenn 'withstand' in the definition may be explained as the ability to function as required during and after the influence of an accidental load, and may involve aspects such as:

The equipment shall be in place, i.e. it may be tolerable that some equipment is damaged and does not function and that minor pipes and cables may be ruptured. This may be relevant for electrical motors and mechanical equipment.

• The equipment shall be functional, i.e. minor damage may be acceptable provided that the planned function is maintained. This may be relevant for ESD valves, deluge systems, escape ways, main structural support system, etc.


• The equipment shall be gas tight. This may be relevant for hydrocarbon containing equipment.

3.1.8 Effectiveness analysis of safety and emergency preparedness measures

Analysis which shall document the fulfilment of functional requirements to safety and emergency preparedness.

Effectiveness analyses in relation to technical functional requirements for safety systems are carried out in relation to risk analyses. It is therefore a prerequisite that quantitative risk analyses in relation to design include quantitative analyses of escape, evacuation and rescue. Similarly, effectiveness analyses of emergency preparedness measures are done in connection with emergency preparedness analyses. The analysis shall be traceable and will normally - though not necessarily - be quantitative.

3.1.9 Emergency Preparedness

Technical, operational and organisational measures that are planned to be implemented under the management of the emergency organisation in case hazardous or accidental situations occur, in order to protect human and environmental resources and assets.

The definition focuses on the distinction between dimensioning of emergency preparedness and dimensioning of process (technical) safety systems (see also the definition of emergency preparedness analysis and establishment of emergency preparedness, as well as Annex D, not included in this appendix). Dimensioning of process safety systems is done in connection with the use of risk analysis, and minimum requirements by authority regulations, established practice, recognised norms, etc.

3.1.10

3J.ll

Emergency preparedness analysis

Environmental resource

Analysis which includes establishment of defined situations of hazard and accident, including dimensioning accidental events, establishment of functional requirements to emergency preparedness, and identification of emergency preparedness measures.

Includes a stock or a habitat, defined as: Stock A group of individuals of a stock present in

a defined geographical area in a defined period of time. Alternatively: The sum of individuals within a species which are reproductively isolated within a defined geographical area.

Habitat A limited area where several species are present and interact. Example: a beach.

For further discussion, see Annex C. (not included here)

3.1.12 Establishment of emergency preparedness

Systematic process which involves planning and implementation of suitable emergency preparedness measures on the basis of risk and emergency preparedness analysis.

440

3.1.13 Emergency preparedness organisation

APPENDIXB

The organisation which is planned, established, trained and exercised in order to handle occurrences of hazardous or accidental situations.

The emergency preparedness organisation includes personnel on the installation as well as onshore, and includes all personnel resources that the operator will activate during any occurred situation of hazard or accident. The emergency organisation is organised independently of the normal, operational organisation.

3.1.14 Functional requirements to safety and emergency preparedness

Verifiable requirements to the effectiveness of safety and emergency preparedness measures which shall ensure that safety objectives, risk acceptance criteria, authority minimum requirements and established norms are satisfied during design and operation.

The term 'effectiveness' in relation to these functional requirements shall be interpreted in a wide sense and include availability, reliability, capacity, mobilisation time, functionality, vulnerability, personnel competence. For further discussion, see Annex D (not included in this appendix).

3.1.15

3.1.16

Informative references

Main safety function

Shall mean informative in the application of NORSOK Standards.

Safety functions that need to be intact in order to ensure that personnel that are not directly and immediately exposed, may reach a place of safety in an organised manner, either on the installation or through controlled evacuation.

The main safety functions, including their required functionality, shall be defined for each installation individually in an unambiguous way.

Examples of main safety Junctions are main support structure, escape ways, control centre, shelter area (temporary refuge) and evacuation means.

3.1.17

3.1.18

3.1.19

3.1.20

May

Normative references

NORSOK

Risk

Verbal form used to indicate a course of action permissible within the limits the standard.

Shall mean normative (a requirement) in the application of NORSOK Standards.

Norsk Sokkels Konkurranseposisjon, the Competitive standing of the Norwegian Offshore Sector, the Norwegian initiative to reduce cost on offshore projects.

Expression of probability for and consequence of one or several accidental events.

Risk may be expressed qualitatively as well as quantitatively. The definition implies that risk aversion (i.e. an evaluation of risk which places more

importance on certain accidental consequences than on others, where risk acceptance is concerned) shall not be included in the expression of risk. It may be relevant to consider on a qualitative basis certain aspects of risk aversion in relation to assessment of risk and its tolerability.


3.1.21 Risk analysis Analysis which includes a systematic identification and description of risk to personnel, environment and assets.

The risk analysis term covers several types of analyses that will all assess causes for accidents and consequences of accidental events. Examples of the simpler analyses are Safe Job Analysis, FMEA, Preliminary Hazard Analysis, HAZOP, etc.

Quantitative analysis may be the most relevant in many cases, involving a quantification of the probability for and the consequences of accidental events, in a manner which allows comparison with quantitative risk acceptance criteria.

3.1.22 Safety objective Objective for the safety of personnel, environment and assets towards which the activity shall be aimed.

Safety objectives wi1l imply short or long term objectives that the operator/owner has established for his activity, while the risk acceptance criteria express the level of risk (in relation to the risk analysis) that is currently acceptable to the operator/owner.

The safety objectives shall as far as possible be expressed in a way which allows verification of fulfilment through an ALARP evaluation. Long and short term safety objectives form the basis for further development of the safety level and the tightening of the risk acceptance criteria as an element of the continuous improvement process and the HES management.

3.1.23 Shall

3.1.24 Should

B3.2 Abbreviations

Verbal form used to indicate requirements strictly to be followed in order to conform to the standard and from which no deviation is permitted, unless accepted by all involved parties.

Verbal form used to indicate that among several possibilities one is recommended as particularly suitable, without mentioning or excluding others, or that a certain course of action is preferred but not necessarily required.

AIR Average Individual Risk ALARP As Low As Reasonably Practicable DFU Defined situations of hazard and accident DUH Dimensioning accidental event DUL Dimensioning accidental load FAR Fatal Accident Rate FMEA Failure Mode and Effect Analysis HAZID Hazard Identification HAZOP Hazard And Operability Study HES Health, Environment and Safety IR Indi vidual Risk IRPA Individual Risk Per Annum ISO International Organisation for Standardisation. IEC International Electro-technical Commission. LEL Lower Explosive Limit

442

MIRA MODU NPD NTS OLF PFEER QRA RAC SJA TBL UEL VEC

APPENDIXB

Environmental risk analysis Mobile Drilling Unit Norwegian Petroleum Directorate. Norwegian Technology Standards Institution. The Norwegian Oil Industry Association. Prevention of Fire and Explosion and Emergency Response Quantitative Risk Assessment Risk Acceptance Criteria Safe Job Analysis Federation of Norwegian Engineering Industries. Upper Explosive Limit Valued Ecological Component

84 Establishment and Use of Risk Acceptance Criteria

84.1 General Requirements for Formulation of Risk Acceptance Criteria

Risk acceptance criteria illustrate the overall risk level which is determined as acceptable by the operator/owner, with respect to a defined period oftime or a phase of the activity. Annex A (not included in this appendix) presents a comprehensive discussion of aspects related to defining and using risk acceptance criteria.

The acceptance criteria for risk constitute a reference for the evaluation of the need for risk reducing measures and shall therefore be available prior to starting the risk analysis. The risk acceptance criteria shall as far as possible reflect the safety objectives and the particularities of the activity in question. The safety objectives are often ideal and thereby difficult to reflect explicitly.

The evaluations that form the basis for the statement of the risk acceptance criteria shall be documented by the operator/owner. Distinct limitations for the use of the risk acceptance criteria shall be formulated. Data that are used during the formulation of quantitative risk acceptance criteria shall be documented. The manner in which the criteria are to be used shall also be specified, particularly with respect to the uncertainty that is inherent in quantitative risk estimates.

The need for updating of risk acceptance criteria shall be evaluated on a regular basis, as an element of further development and continuous improvement of safety.

In order for the risk acceptance criteria to be adequate as support for HES management decisions, they shall have the following qualities:

• be suitable for decisions regarding risk reducing measures.

• be suitable for communication.

• be unambiguous in their formulation.

• be independent of concepts in relation to what is favoured by the risk acceptance criteria.

Unambiguous in the present context implies that they shall be formulated in such a way that they do not give unreasonable or unintentional effects with respect to evaluating or expressing of the risk to the activity. Possible problems with ambiguity may be associated with:


• imprecise formulation of the risk acceptance criteria,

definition of system limits to what shall be analysed, or

various ways of averaging the risk.

Another possible problem is that criteria that are principally different may be aimed at the same type of risk (for example risk to personnel expressed by means of FAR versus impairment risk for main safety functions) may not always give the same ranking of risk in relation to different alternati ves. More in-depth discussion of these aspects are presented in Annex A (not included in this appendix).

Transport between installations shall be included in the risk levels when this is included in the operations of the installations.

The results of risk assessments will always be associated with some uncertainty, which may be linked to the relevance of the data basis, the models used in the estimation, the assumptions, simplifications or expert judgements that are made.

Considerable uncertainty will always be attached to whether certain events will occur or not, what will be the immediate effects of such events, and what the consequences will be. This uncertainty is linked to the knowledge and information that is available at the time of the analysis. This uncertainty will be reduced as the development work progresses.

The way in which uncertainty in risk estimates shall be treated, shall be defined prior to performing the risk analysis. It is not common to perform a quantitative uncertainty analysis, it will often be impossible. Sensitivity studies are often preferred, whereby the effects on the results from changes to important assumptions and aspects are quantified.

The risk estimates shall as far as possible be considered on a 'best estimate' basis, when considered in relation to the risk acceptance criteria, rather than on an optimistic or pessimistic ('worst case') basis. The approach towards the best estimate shall however, be from the conservative side, in particular when the data basis is scarce.

B4.1.1. VERIFICA nON OF RISK ACCEPTANCE CRITER IA

Risk acceptance criteria may normally not be verified through direct observations, as the events are rare would require unrealistically long observation periods. Therefore, the risk acceptance criteria have to be verified in the following manner:

• Through verification that organisational, operational and technical assumptions that form part of the studies are in compliance with actual operating parameters.

• By monitoring trends for risk indicators as explained in Annex A (not included in this appendix).

Possible deviations between risk acceptance criteria and registered parameter values shall be handled in accordance with the company's procedures for deviations. A possible action is to update the· assumptions in the quantitative risk analysis, in order to identify the extent of the influence on overall risk.

Compliance with risk acceptance criteria through risk indicators or similar shall as a minimum be verified once a year.

B4.2 Decision Criteria

Risk acceptance criteria are related to high level expressions of risk. Criteria are also required in relation to more limited analyses, quantitative and qualitative, in order that

444 APPENDIXB

decisions may be made about actions and implementation of risk reducing measures. Such decision criteria shall be formulated on the basis of the purpose of the analysis, reflecting also the HES management system established by the operator or owner and the general principles for giving priority to risk reducing measures, see Section B5.!.4.

B5 Planning, Execution and Use of Risk and Emergency Preparedness Analysis

The requirements in this section are general and not connected to any particular life cycle phase. The phase specific requirements are given in Section B7. The description in Section B5 is mainly dealing with integrated risk and emergency preparedness analysis. Sections B6 and B7 present the conditions under which this is most relevant.

The E&P Forum document 'Guidelines for Development and Application of Health, Safety and Environmental Management Systems' gives guidance for HES management. Figure B5.! shows how risk and emergency preparedness analyses may be integrated into an HES management context.

Figure B5.1 Management feedback loop for use of risk and emergency preparedness analysis in HES management

SeeSct. 8.1.2 &8.1.3

See Set. 8.1.4

Figure B5.! Management feedback loop for use of risk and emergency preparedness analysis in HES management

BS.l General Requirements

B5.I.I. PURPOSE AND RESPONSIBILITY

The main purpose of using risk and emergency preparedness analyses is to formulate a decision-making basis that may contribute to selecting safety-wise optimum solutions and risk reducing measures on a sound technical and organisational basis. In order to achieve these objectives, the following general requirements to risk analyses apply:

• Assumptions must be identified, made visible and communicated to the users of the analysis results.


• The analyses must be targeted and carried out in a systematic way.

• They must be focused on identification of and insight into the aspects and mechanisms that cause risk.

• They must be carried out at an appropriate time, in order that the results of the studies can be timely taken into account in the relevant decision-making process.

It is required not to use the results in a decision-making context that goes beyond the limitations that apply to quantitative risk analysis in particular (see Section B5.3.3).

• The operator's or owner's responsibility shall be clearly defined (may be important for instance when operator is not involved in concept definition phase) with respect to the execution of the analyses and the implementation of their results.

• Experience has shown that users need to be actively involved in the risk evaluation in order for it to be effective.

The quality of the decision-making basis needs to be ensured, including insight into and knowledge about its use and limitations. Risk acceptance criteria need to be developed to ensure that the activity is carried out in a justifiable way.

• Knowledge must be accumulated about aspects that contribute to risk, in order to ensure that the risk level remains low and that accidental events are avoided.

B5.1.2. PLANNING AND EXECUTION OF RISK ANALYSES

Risk analyses shall be planned in accordance with the development of the activity, ensuring that the risk studies are used actively in the design and execution of the activity:

• Risk analyses shall be carried out as an integrated part of the field development project work, so that these studies form part of the decision-making basis for i.a. design of safe technical, operational and organisational solutions for the activity in question.

Risk analyses shall be carried out in connection with major modifications, change of area of application, or decommissioning and disposal of installations, as well as in connection with major changes in organisation and manning level. See Section B7.6.

Requirements to execution and use of risk assessment shall be formulated in a way which ensures that the quality of the decision-making basis is maintained. This implies that a number of aspects needs to be clarified before a risk analysis is started:

a) The purpose of the risk analysis has to be clearly defined and in accordance with the needs of the activity. The target groups for the results of the analysis have to be identified and described.

b) The risk acceptance criteria for the activity have to be defined, see Section B4.1.

c) The decision criteria for studies of limited extent need to be defined, see Section B4.2.

d) The scope of the study and its limitations need to be clearly defined. The appropriate method is chosen partly on this basis.

e) Preliminary statement on the types of analysis and the use of their results is made.

f) Operational personnel shall be included in the work to the extent necessary.

446 APPENDIX B

g) A listing shall also be made of relevant regulations, possible classification society rules and applicable standards and specifications that the operator/owner will use. This applies particularly to the building of new mobile units and floating production installations.

B5.1.3. PLANNING OF EMERGENCY PREPAREDNESS ANALYSES

It is important to place focus on emergency preparedness as an integrated part of the work at an early stage in a field development project, in order to avoid major and costly changes at a later stage. (See also Section B7.)

Therefore, when a risk analysis is carried out as a basis for emergency preparedness analysis, the following aspects shall be focused on:

a) DUH shall be identified and extensively described.

b) assumptions, premises and suppositions shall be identified and documented as a basis for establishing functional requirements to emergency preparedness.

The following aspects shall be clarified prior to starting the emergency preparedness analysis:

a) The purpose of the analysis shall be clearly defined and shall correspond to the identified needs of the activity. The target groups for the analyses and their results must be defined.

b) The scope of the analysis and its limitations must be dearly defined. The method is chosen on this basis.

c) When quantitative analyses are used, the data basis in the planning phase has to be as adapted as possible to the purpose of the study.

d) Operating personnel shall participate in the work to the extent necessary ..

e) The format of reporting and the documentation shall be suitable for ensuring an effective follow-up, control and development of the emergency preparedness.

All emergency preparedness requirements shall be satisfied for the DFU.

BS.IA. RISK REDUCING MEASURES

Factors which may cause an accidental event shall as far as possible be removed and that risk reducing measures shall be evaluated for possible implementation in order to reduce each identified risk element.

Risk reducing measures include both probability reducing and consequence reducing measures, including emergency preparedness measures. The risk reducing measures may be of a technical, operational and/or organisational nature. The choice of types of measures will normally be based on a broad evaluation, where risk aspects are in focus. Emphasis shall be put on an integrated evaluation of the total effect that risk reducing measures may have on risk. Possible coupling between risk reducing measures shall be communicated explicitly to the decision- makers, if alternative measures are proposed.

General principles for setting up priorities for risk reducing measures:

• Probability reducing measures shall be given priority over consequence reducing measures whenever possible.

• Layout and system design shall be suitable for the operations and minimises the exposure of personnel to accidental effects.


The choice of risk reducing measures shall furthermore take into account the reliability and the vulnerability of the risk reducing measures and the possibility of documenting and verifying the estimated extent of risk reduction. Consequence reducing measures (especially passive measures such as passive fire protection) will often have a higher reliability than probability reducing measures, especially the operational ones.

The possibility of implementing certain risk reducing measures is dependent on factors such as available technology, the current phase in the activity and the results of cost benefit analysis. The choice of risk reducing measures shall therefore be explained in relation to such aspects.

Operational or organisational measures may, in the operational phase, compensate for the limited possibilities that exist for making major technical modifications.

B5.2 Specific Requirements to Qualitative Risk Analysis

Examples of qualitative risk analyses are Safe Job Analysis, Failure Mode and Effect Analysis, HAZOP, 'Driller's HAZOP', Preliminary Hazard Analysis, and simple comparative studies, etc. The steps of a qualitative risk analysis are:

a) Planning of the analysis

b) System description

c) Identification of hazards

d) Assessment of each hazard

e) Identification of possible risk reducing measures

Fault Tree Analysis is sometimes carried out as qualitative analysis, i.e. without probability analysis. This is, however, an exception, and the applicable requirements are nevertheless presented in Section B5.3.

B5.2.1. PLANNING OF THE ANALYSIS General requirements to the planning of risk analyses are presented in Sections B5.1.1. and B5.1.2. Qualitative studies are usually carried out by a group of persons. Broad representation in the analysis group is important when several technical disciplines are affected by the analysis.

B5.2.2. SYSTEM DESCRIPTION There is less emphasis on formal system description in a qualitative risk analysis than in a quantitative risk analysis, see also Section B5.3.4.1t is nevertheless important to ensure that the group has a common understanding of the technical system being considered, including relevant operations.

B5 .2.3. IDENTIFICATION OF HAZARDS In a qualitative risk analysis, the identification of hazards shall be based on a broad review of potential causes of accidents, in order to ensure that the maximum number of hazards are identified.

B5.2.4. ASSESSMENT OF EACH HAZARD Assessment of each hazard is either done in combination with the identification of hazards, or separately in the next step. Again, it is important to stimulate the use of the total

448 APPENDIXB

experience of the group members. Experience from accidents and incidents from the company's own files and data bases and, from public data bases such as Synergi, shall be put to use. Possible causes of accidents shall a far as possible be identified, as a basis for identification of risk reducing measures.

B5.2.5. IDENTIFICATION OF POSSIBLE RISK REDUCING MEASURES Any qualitative risk analysis shall seek to identify possible risk reducing measures as a basis for ranking and decision. The principles for giving priorities stated in Section B5.1.4 shall as far as possible be followed.

B5.3 Specific Requirements to Quantitative Risk Analysis

B5.3.1. STEPS IN A QUANTITATIVE RISK ANALYSIS The elements in a quantitative risk analysis are presented in Figure B5.2, which shows four levels:

Inner level: risk estimation

Second level: risk analysis

Third level: risk evaluation

Outer level: HES management

Requirements to the risk analysis and the risk estimation are presented in the following text, sections B5.3.2 - B5.3.13. The formulation of the risk acceptance criteria will determine which of the requirements in sections B5.3.9 - B5.3.12 that are applicable.

B5.3.2. PLANNING OF QUANTITATIVE RISK ANALYSIS General requirements to the planning of risk analysis are stated in Section B5.1.1. Additional requirements to the planning of quantitative risk analysis are as follows:

a) When quantitative risk analysis is carried out, the data basis needs to be adapted as far as possible to the purpose of the study. Data bases (local, national and international) need to be considered in this context, as well as use of relevant experience (internal and external).

b) Prior to a decision to start a quantitative risk analysis, a careful consideration should be given to whether the data basis is sufficiently extensive to produce reliable conclusions.

c) Simple comparative studies may sometimes be carried out without an extensive data basis.

B5.3.3. LIMITATIONS OF RISK ANALYSIS Quantitative risk analysis has certain limitations that need to be observed during the planning of such studies. The limitations of a risk analysis should usually be stated explicitly.

Limitations on the use of risk analysis will result form the way the general requirements, such as presented in this NORSOK standard, are adhered to. The following are general aspects that usually imply limitations:

There has to be sufficiently broad basis of relevant data for the quantification of accident frequency or accident causes.


Figure BS.2 Risk estimation, analysis and evaluation

• The data usually refers to distinct phases and operations, which imply that the use of the data should not be made for other phases and operations.

• The depth of the analysis in the consequence and escalation modelling determines how detailed considerations that may be made for the systems and functions that are involved in the analysis.

The level of precision in the results shall not be more extensive than what is justifiable on the basis of the calculations, data and models which are available for the quantification of probability and consequence. This may imply that risk can not be expressed on a continuous scale when the estimation of either probability or consequence (or both) is based on categories.

BS.3.4. SYSTEM DESCRIPTION

The system description shall include:

• Description of the technical system, including the relevant operations and phases.

• Statement of the period of time to which the analysis relates.

• Statement of the personnel groups, the external environment and the assets to which the risk assessment relates.

• Capabilities of the system in relation to its ability to tolerate failures and its vulnerability to accidental effects.

450 APPENDIXB

BS.3.S. IDENTIFICATION OF HAZARD

Hazard identification shall include:

A broad review of possible hazards and sources of accidents, with particular emphasis on ensuring that relevant hazards are not overlooked.

A rough classification into critical hazards (as opposed to non- critical) for subsequent analysis.

• Explicit statement of the criteria used in the screening of the hazards.

Explicit documentation of the evaluations made for the classification of the non-critical hazards.

Possible tools for the hazard identification may be:

• Use of check lists and accident statistics,

• performance of HAZOP studies, HAZID, or similar,

experience from previous analyses.

The participation of operational personnel, offshore and onshore, is particularly important.

BS.3.6. ANALYSIS OF CAUSES AND FREQUENCY OF INITIATING EVENTS

Analysis of possible causes of initiating events should be preferred to assessment of initiating event frequency based on accident and failure statistics. The cause analysis gives the best basis for identifying measures that may prevent occurrence of these events and thus prevent accidents.

Possible tools that may be used for the analysis of causes of initiating events are:

• Fault Tree Analysis

Failure Mode and Effect Analysis.

Cause analysis and/or frequency data for initiating events should include contributions from human and operational {actors. Sometimes this may only be complied with indirectly (implicitly included in the experience data), but shall as far as possible be explicitly considered in a cause analysis.

The following requirements should apply when a frequency analysis has to be used:

• Data that are used have to be consistent with relevant operations and phases.

• The robustness of the data used shall be considered.

Both the data and the models into which the data are applied, shall be suitable in relation to the context of the study.

The extent of the data basis has to be sufficiently broad to produce robust conclusions.

The use of data should take account of possible trends if they can be substantiated.

Analytical models and computer codes used, have to be suitable for the purpose and have a resolution which is adapted to the objectives of the analysis. The models must also comply with the operator's/owner's requirements to input data, assumptions, etc.

BS.3.7. CONSEQUENCE AND ESCALATION ANALYSIS

This term is used in a wide sense, including both consequence modelling (i.e. estimation of accidental loads), modelling of escalation and estimation of response to accidental loads.


The distinction between cause analysis and consequence analysis may vary somewhat according to the purpose and the nature of the analysis.

A detailed consequence analysis usually consists of the following sub-studies:

• Leakage of inflammable substances

• calculation of release (amounts, rates, duration, etc.)

• calculation of spreading of leakages

• calculation of ignition potential

• fire load calculation

• explosion load calculation

• response calculation (sometimes this may be separate studies)

• Well blowouts (with respect to environmental loads)

• calculation of releases

• calculation of release duration

• spill drifting calculation

• calculation of environmental effects

• Well blowouts (non environmental effects)

• consequences related to ignition and subsequent effects are calculated as for leakages of inflammable substances

• External impact (collision, falling load, helicopter crash on installation)

.• calculation of energy distribution

• calculation of load distribution

• calculation of impulse distribution

• response calculation (may also be separate studies)

• Falling loads on subsea installations and pipelines

• consequence calculations as for external impacts in general

• Extreme environmental loads

• calculations are usually carried out by the relevant discipline as part of the analyses of structural design , and the results from these studies may be integrated into the risk analysis

• Loss of stability and buoyancy, catastrophic loss of anchor lines

• calculations are usually carried out by the relevant discipline as part of the marine studies, and the results from these studies may be integrated into the risk analysis.

Further details are presented in Annex Band C (not included in this appendix). Relevant tools for consequence modelling in relation to fire and explosion are:

• CFD-methods (Computational Fluid Dynamics)

• analytical methods

simulation methods (based on CFD or analytical methods).

Non-linear structural analyses are often used for external impacts, thereby making it possible to reflect structural reserve capacity beyond yield.

452 APPENDIXB

Qualified methods should be used, applying to analytical models, computer codes and data, which should be qualified by the operator/owner or by recognised institutions on his behalf. This may for instance be achieved through use of the 'Model Evaluation Protocol' established by the 'Model Evaluation Group' under the ED Commission.

Escalation analysis is closely integrated with consequence modelling and response calculation. Analysis or evaluation of safety systems forms part of the escalation analysis (see Section B5.3.8), in order to assess the possibility or the premises for maintaining control of the sequence of accidental events.

As far as possible, contribution to failure from human and organisational factors shall be explicitly analysed, together with the contribution from such failures to dependent failures.

The following analysis methods are the most relevant ones for the escalation analysis:

• Event Tree Analysis

• Fault Tree Analysis

• Simulation! probabilistic analysis.

B5.3.8. ASSESSMENT OF SAFETY CRITICAL SYSTEMS Analysis or evaluation of safety critical systems is an important part of the escalation analysis, and are also carried out as an assurance activity for these systems.

An escalation analysis should as a minimum include a classification of the safety critical systems based on vulnerability to accidental events. A comprehensive analysis shall include identification and analysis of mechanisms of failure ofthese systems and their dependencies, in relation to relevant accidental events. Emphasis shall be given to analysis of the total system and dependent failures shall be integrated in the analysis of the safety critical systems.

B5.3.9. Loss OF MAIN SAFETY FUNCTIONS The analysis shall include e'laluations of possible loss of main safety functions due to accidental loads, possibly by carrying out separate response studies. Main safety functions are discussed in Annex A, Sections A 1.1, A2.8 and A4.1.2 (not included in this appendix).

B5.3.1O. ESTIMATE RISK TO PERSONNEL The risk to personnel is often expressed as fatality risk, sometimes also as risk in relation to personal injury. The following fatality risk contributions are often estimated separately:

immediate fatalities

• escape fatalities

• evacuation and rescue fatalities.

It may also be considered to split the fatality risk contributions into areas according to where the fatalities occur. Fatality calculations may include:

• response of personnel to accidental loads

• heat radiation

• toxic gas, smoke, etc.

• blast/impulse loads

• probabilistic simulation of evacuation and rescue operations.


An estimate of the number of personnel injured in accidents is often required as input to emergency preparedness analysis. This may imply that the consequence analysis for personnel is extended to include injuries.

B5.3.II. ESTIMATE ENVIRONMENTAL RISK

The following steps form part of an environmental risk assessment:

• Establish the distribution of release duration.

• Simulation of the drifting of oil spill for relevant scenarios.

• Estimate the effects on environmental resources.

• Estimate restoration times.

The risk to the environment shall be expressed as follows:

For each Valued Ecological Component separately

• On an annual basis for continuous activities

For activities that have a duration shorter than a year, the basis of the risk calculation shall be the duration of the activity.

Further discussion is presented in Annex C (not included in this appendix).

B5.3.12. ESTIMATE RISK FOR ASSET DAMAGEIPRODUCTION DISRUPTION

The following additional steps are carried out in order to estimate the risk for asset damage and deferred production:

• Establish the distribution for duration of accidental events (often an extension beyond the period of exposure of personnel)

• Calculate response in the form of equipment and structures.

Further details are presented in Annex E (not included in this appendix).

B5.3.13. DOCUMENTATION

The documentation of a quantitative risk analysis should include the following: • Statement of objectives, scope and limitations

Description of the object of the analysis, the phases and operations that the analysis is valid for, the categories of accidental events that are covered and the dimension of risk. The descriptions should preferably be accompanied by drawings or similar. Statement of the assumptions and premises on which the study is based. Description of the analytical approach used.

• Extensive presentation of results in relation to objectives, scope and limitations. The presentation shall include the main contributions to the risk levels.

• Presentation of the sensitivity in the results with respect to variations in input data and crucial premises. Description of dimensioning accidental events and dimensioning accidental loads. Presentation of conclusions from the study.

• Presentation of possible measures that may be used for reduction of risk. The results shall be expressed in a way that make them useful to all relevant target

groups, including the work force. This may imply that different result presentations may be required for different groups.

454 APPENDIX B

B5.4 Specific Requirements to Emergency Preparedness Analysis

B5.4.1. SCOPE OF ANALYSIS

Emergency preparedness measures include measures directed at containing spills from minor or major releases. The basis for establishing the oil spill contingency including technical, organisational and operative measures (such as amount of booms and their storage location, dispergents, etc.) forms part of the emergency preparedness analysis efforts.

Dimensioning of the installation's capacity (including external vessels' capacities) for treatment of injured personnel is also part of the emergency preparedness analysis.

Operational limitations, to the extent that they are documented in procedures, instructions, etc. are taken into account when operational and environmental conditions are defined. Assumptions may have to be done, if the analysis is carried out prior to the formulation of such procedures. Any assumptions made in this respect shall be verified at the earliest possible convenience.

B5.4.2. STEPS IN EMERGENCY PREPAREDNESS ANALYSIS

Figure B5.3 presents the steps of emergency preparedness analysis and establishment of emergency preparedness, in relation to Input from the quantitative risk analysis. The starting point of the presentation is the integrated risk and emergency preparedness analysis, and it shows how the work may be carried out step by step in a field development project. This applicability is limited to dimensioning accidental events.

The steps of the emergency preparedness analysis are briefly described in Sections B5.3.2 - B5.3.5.

B5.4.3. IDENTIFICATION OFDFU

Defined situations of hazard and accident include the following event categories:

• Dimensioning accidental events (DUH), defined through quantitative risk analysis,

• Situations associated with temporary increase of risk,

• Less extensive accidental events, including acute cases of illness.

Dimensioning accidental events shall be defined through quantitative risk analysis as shown in Figure B5.3. The other event categories shall be established on the basis of:

Events that have been experienced in comparable activities.

• Accidental events that appear in quantitative risk analysis without being identified as dimensioning accidental events, as long as they represent separate challenges to the emergency preparedness.

• Events for which emergency preparedness exists according to normal practice.

When defined situations of hazard and accident are being established, it will be important to include events that may mainly cause damage to assets without risk to personnel, such as damage to pipelines and subsea production systems ..

The description of dimensioning accidental events from the quantitative risk analysis shall be detailed. In the description of situations associated with temporary increase of risk, or less extensive accidental events, the following shall be included:

• A general description of the situation in terms of duration and extent.

• The number of persons that may be threatened or injured, as well as environmental resources and assets that may be threatened or damaged.


• Operational and environmental conditions that may be present when these accidental events occur.

8nergency preparedness analySs

ES:abli5tlm ent of emergency preparedness

Em.prep. analysis process

Figure B5.3 Risk and emergency preparedness analysis

When dealing with not normally manned installation, distinctions also have to be made between those DFU that relate to personnel being present and those that relate to the installation being unmanned.

It is always possible to imagine combinations of circumstances that may have very unfortunate consequences. Quite different emergency preparedness requirements may be needed if such extremely remote combinations shall be taken into account. The most unlikely combinations of operational and environmental conditions will consequently be disregarded with respect to definition of defined situations of hazard and accident. The events to be included in the defined situations of hazard and accident are those that may reasonably be foreseen ..

Choice of DFU shall be documented, in particular in relation to why they are considered to make a representative selection, and also those events that may have been omitted.

Further discussion in Annex D (not included in this appendix).

456 APPENDIXB

B5.4.4. INFORMATION FROM QUANTITATIVE RISK ANALYSIS Information and results from quantitative risk analysis shall form part of the emergency preparedness analysis. Such information shall include:

• Description ofthose DUH for which organisational and operational measures shall be established.

• Time requirements that have to be satisfied.

Required capacity, effectiveness and protection of systems that form part of the emergency preparedness.

• Assumptions on the success or suitability of emergency preparedness measures (such as assumptions on the possibility of assisting injured personnel on the installation or after initial escape).

Further details are included in Annex D (not included in this appendix).

B5 .4.5. ESTABLISH FUNCTIONAL REQUIREMENTS Functional requirements to emergency preparedness measures shall be:

• Easy to understand

• Explicit and measurable

• Realistic.

The basis for establishment of the functional requirements is indicated by Figure B5.3, and includes results and premises from risk analysis, Design Accidental Events and Loads.

Functional requirements shall be established in relation to competence of personnel and the following emergency phases:

• Alert

• Danger Limitation

• Rescue

• Evacuation

• Normalisation

The functional requirements must be specified in a way which will allow them to be validated.

B5.4.6. IDENTIFICATION OF MEASURES AND SOLUTIONS Measures and solutions to be considered in an emergency preparedness analysis are:

• Organisational and operational measures related to dimensioning accidental events, possibly also technical measures not included in the risk analysis.

Technical, organisational and operational measures related to less extensive accidental events as well as to temporary increase of risk.

The principles stated in Section B5.1.4 shall be used for giving priority to the risk reducing measures.

The basis for the identification of possible measures and solutions is i.a. knowledge about internal and external emergency preparedness resources, which therefore shall be described or referred to. All relevant resources within the following categories should be considered:


• Unit resources

• Area resources

• External resources.

B5.4.7. EFFECTNENESS ANALYSIS

The effectiveness of technical emergency preparedness measures may usually be documented through reliability or vulnerability studies. For the organisational or operational measures, the following methods may be applicable:

• Results of training

• Experience from exercises

• Calculation of capacities, response times, or similar.

It may be relevant to optimise the effectiveness on the basis of documented results. This is discussed in Annex E (not included in this appendix).

B5.5 Competence of Analysis Personnel

Requirements as to the competence of personnel carrying out and evaluating the risk and emergency preparedness analysis shall be defined.

The analysis team for a quantitative (or an extensive qualitative) risk analysis shall have special competence in risk analysis methods and relevant consequence modelling, as well as relevant project and operational competence. The latter may include, when such activities are analysed, competence within fabrication and installation activities, relevant marine and manned underwater operations.

For emergency preparedness analysis, personnel having competence in emergency preparedness analysis as well as in project and operational work shall be included in the analysis team. Risk analysts should also participate, in order to facilitate the integration of risk and emergency preparedness analyses.

B5.6 Use of Results of Risk and Emergency Preparedness Analysis

Documentation of risk shall be formulated in the following manner:

• The information shall be understandable to all involved, decision-makers as well as operating personnel. The results ,nd associated assumptions are to be presented in such a way that the decision-makers get a correct and balanced overview of the basis for the decisions to be made.

• Important assumptions and premises shall be stated explicitly, so that they may be evaluated and accepted.

When an analysis is carried out by external consultants, the operator or owner shall prepare his own assessment ofthe study's conclusions and recommendations. This document shall include plans for implementation of risk reducing measures, including emergency preparedness measures.

Assumptions and premises stated in the overall risk analyses (those that are carried out in order to compare results against risk acceptance criteria, see Definition 3.1.1) at an early

458 APPENDIXB

stage of the design, shall be included as functional requirements for safety and emergency preparedness measures for later phases of the design project.

Documentation from risk and emergency preparedness analysis shall specify such functional requirements, in a way that makes them suitable for being used as dimensioning requirements.

Results of emergency preparedness analyses are primarily used for establishment of emergency preparedness, including emergency preparedness plans and training and exercise plans.

In addition, the results of the risk and emergency preparedness analysis shall be used for: • Selecting optimum solutions between available alternatives. • Designing risk reducing measures, including emergency preparedness measures. • Documenting risk acceptability of the chosen solution.

Designing basis for preventive safety measures. • Carrying out cost benefit studies relating to improvement of safety and emergency

preparedness. Preparing procedures for operations having critical importance for safety.

The format of the risk acceptance criteria will influence strongly the presentation of risk results. The presentation of result of a quantitative risk analysis shall further be comprehensive, allowing good insight into the mechanisms of risk causation.

The following documentation shall be available prior to start-up or operation of the installation/operation:

• Documentation of the measures that have been or will be implemented as a consequence of the analysis.

• Description of the risk and emergency preparedness analyses that are planned to be carried out or updated for the installation in the subsequent life cycle phase, as part of the overall HES management documentation.

• Description of plans for the verification of studies.

85.7 Verification of Functional Requirements and Risk Acceptance Criteria

Verification that functional requirements to safety and emergency preparedness systems are met in the operational phase may be achieved through monitoring trends for risk indicators as explained in Annex A (not included in this appendix), which should be monitored as a minimum once per year.

Possible deviations between functional requirements and registered parameter values shall be handled in accordance with the company's procedures for deviations. A possible action is to update the assumptions in the quantitative risk analysis, in order to identify the extent of the influence on overall risk.

86 Risk and Emergency Preparedness Analysis for Mobile Units

86.1 General

This phase includes drilling of exploration, appraisal and production wells from mobile drilling unit (MODU) as well as interventions and operations in subsea production systems. The purpose of the analyses is:


• Risk analysis

To evaluate if risk levels are in accordance with risk acceptance criteria for the operations in question, and in relation to the installation involved on the specific location and to the specific well conditions.

• Optimisation of drilling and well intervention programs and activities.

• Decisions as to the need for and extent of further risk reducing measures.

• Emergency preparedness analysis

• Establishment of emergency preparedness, including updating of emergency preparedness analysis for the actual installation in relation to location and well specific conditions.

The target groups for the studies are the operational onshore organisation having the responsibility for the planning and management of drilling and well operations, possibly including the rig owner's onshore organisation, as well as management and workforce on the installation and personnel having emergency preparedness planning responsibility.

The studies will normally be limited to the mobile installation involved in the operations, possibly including nearby vessels and installations, if the distance is such that accidental effects may affect them (or vice versa). Experience has shown that the personnel conducting the study must have extensive knowledge about relevant systems and operations.

B6.2 Requirements to Risk and Emergency Preparedness Analysis

The operator or owner shall ensure that risk and emergency preparedness analyses for mobile installations meet the requirements to production installations, as stated in Section B6 and in Sections B7.1 - B7.5 of this NORSOK Standard. The studies shall be conducted in a manner that would satisfy the requirements stated by NPD as well as in the UK Safety Case and PFFER regulations.

The following studies shall normally be available for any drilling and well intervention operation:

Risk analysis for the mobile installation, updated in accordance with the technical and operational status of the installation.

Environmental risk analysis (either as separate study or integrated into overall risk analysis) in relation to relevant operations and exposed environmental resources.

Emergency preparedness analysis for the installation with similar status with respect to operations and preparedness, including oil spill contingency.

• Vulnerability analysis for safety critical systems.

Overall risk and emergency preparedness analysis focusing on specific aspects for the equipment to be used, planned operations and location specific conditions.

• Detailed blowout risk studies reflecting actual reservoir conditions, operational procedures and equipment to be used

Detailed risk studies of operations [other than possible blowout scenarios] and equipment to be used.

Studies of mobile installations may be conducted according to the revised 'Guidelines for application of risk and emergency preparedness assessment for Mobile Offshore Units'

460 APPENDIXB

issued by the Norwegian Shipowners' Association (these Guidelines will be issued in an updated version in 1998 as a DNV RP - Recommended Practice), or in another way as long as the requirements of the present NORSOK standard are satisfied.

B7 Risk and Emergency Preparedness Analysis in Life Cycle Phases

This section is based on the general requirements outlined in the previous section and defines their implications for risk and emergency preparedness analysis in each life cycle phase .. The use of risk acceptance criteria in the various life cycle phases is not discussed, this is presented in Annex A (not included in this appendix).

B7.1 Analyses in Development and Operations

The table below presents an overview of the main analyses to be conducted during development and operations, including their timing and main objectives.

The requirements to analyses related to life cycle phases are discussed in the subsequent sections. A precise definition of each life cycle phase has not been made. The contents of each phase has undergone changes lately, and general definitions hardly exist. The phases which may overlap, are grouped together for the sake of argument, without any attempt to make clear distinctions. A brief statement of the objectives of the studies are included in the beginning of each section. This is included in order to state what contexts the studies are intended for, thus giving the background to the requirements stated.

ISO 13702 'Petroleum and natural gas industries - Offshore production installations -Control and Mitigation of Fires and Explosions - Requirements and guidelines' states requirements to risk assessment and implementation of measures in order to control risk in relation to fire and explosion on offshore installations. These requirements are relevant for development and operation.

B7.2 Feasibility Study and Conceptual Design Phases

This section covers phases of feasibility studies and conceptual design work. Risk and emergency preparedness analysis are usually carried out separately in these phases. The main objectives of these studies are:

• Risk analysis • Comparison and ranking of field development concepts, possibly also including

qualitative evaluations.

• Optimisation of chosen concepts.

• Identification of potential for achieving an acceptable solution or extra costs required to do so.

• Assess whether the risk level of a given concept is in accordance with risk acceptance criteria, or whether the concept has the potential to meet these criteria.

• Identify all major hazards.


Emergency preparedness analysis

• Identification of possible emergency preparedness aspects linked to the field development that may require extra costs to achieve an acceptable solution, or which may affect or imply special design requirements.

The target groups for the studies are decision-makers in relation to the field development concept.

Table B7.1 Summary of main risk and emergency preparedness analyses

Analysis Timing Main purpose

Early risk analysis

Concept risk analysis

Analyses in connection with design change proposals and the detailing of the concept Total risk analysis (TRA) (reflects all the design change analyses)

TRA updates

Risk analysis of critical operations, including Safe Job Analysis (SJA)

Emergency preparedness analysis including effectiveness analyses of emergency preparedness measures

Early planning phase Before decision to proceed

When layout drawings and PFD's have been made. After decision to proceed, before submission of PDO After concept risk analysis

When layout drawings, P&ID's for process and safety systems have been made. Before approval of project's budget frames, after submission of PDO. Verify and confirm DULs. Operation

Planning of the operations (covers all phases, the analyses can be included in concept risk analysis or TRA) In relation to all preceding studies.

Comparisons of alternatives, assessment of compliance with overall risk acceptance criteria. Identification of concept features which can be cost driving if the risk acceptance criteria are to be met Assessment of compliance with acceptance and design criteria. Establishment of design accidental loads (to the extent possible).

Evaluate how changes etc. affect risk. As for concept risk analysis.

Verification of design and check of compliance with overall risk acceptance criteria (provide the assumptions for safe operation). Establish effectiveness requirements from assumptions and premises in analysis. Update due to experience, modifications etc. Identification of hazards and possible risk reducing measures, to achieve safe job performance

Basis for design of the emergency preparedness

A special case occurs when a pipeline system is being developed, or if alternative transportation means are considered, such as export by pipeline or tanker. Such projects require

462 APPENDIXB

their own evaluations in relation to feasibility ofthe project and concept design. The purpose of the analysis are in this case:

• Risk analysis

Comparison and ranking of alternative transportation alternatives or routing alternatives for pipelines

• Comparison of alternative locations for riser or compressor platforms.

• Optimisation of chosen transportation system, including pipeline routing.

• Identification of potential for or extra costs that may be required in order to achieve and acceptable solution.

Assess whether the risk level of the concept is in accordance with risk acceptance criteria, or whether the concept has the potential in order to meet these.

• Emergency preparedness analysis

• Identification of possible emergency preparedness aspects relating to the field development that may require extra costs in order to achieve an acceptable solution, or which may affect or imply special design requirements.

All relevant installations that are part of the production system, including mobile units and vessels that are involved in the operations, are comprised by the studies. It is particularly important at this stage to focus on non-traditional safety and emergency preparedness aspects. If relevant the need for manned underwater operations in all phases of the activities, shall be evaluated and consequently be comprised by the studies.

The need for data as a basis for quantitative studies is not particularly extensive in these phases.

The following applies with respect to timing of the studies:

Quantification of risk to personnel should be done at the earliest possible stage.

Dimensioning accidental events shaH be identified at the earliest possible stage, preferably in the concept design phase.

Initial emergency preparedness analysis shaH be carried out in the conceptual design phase.

Assumptions and premises on which the studies are based have to be documented extensively, as input to subsequent detailed risk and emergency preparedness analyses.

B7.3 Engineering Phases

Pre-engineering and detailed engineering phases (or combinations) are included in this section. Risk and emergency preparedness analysis should to the largest possible extent be carried out as an integrated analysis, with the foHowing objectives.

• Assess the risk level of the selected concept and its accordance with risk acceptance criteria.

Identify dimensioning accidental events as basis for design of safety and emergency preparedness systems.

Verify assumptions made in studies conducted in previous phases.

Identify assumptions and premises as weH as updated dimensioning accidental events as input to the establishment of emergency preparedness.


• Decide about the need for and the extent of further risk reducing measures.

• Initial establishment of technical, operational and organisational emergency preparedness for the part of DFU that is outside the dimensioning accidental events.

• Initial establishment of operational and organisational emergency preparedness for dimensioning accidental events.

The target groups for the studies are the decision-makers related to the field development, engineering management, engineering disciplines, relevant representatives of the workforce, as well as personnel being responsible for the planning and implementation of emergency preparedness.

The risk and emergency preparedness analyses cover relevant installations that form part of the production system, including mobile units and vessels that are involved in the operations, possibly also nearby vessels and installations if they are close enough to be affected by accidental effects. Further the need for manned underwater operations during all phases of the activities shall be evaluated. Emphasis should be set to make an assessment to what manned underwater operations the concept entails and to whether suitable technical solutions exists for the implementation of the concept in conjunction with contingency aspects.

In these phases, the need for data as a basis for quantitative studies will be quite extensive and cover a wide range of systems, reflecting the wide need for studies of vital systems and equipment. The requirements are equally comprehensive to the competence of personnel involved in the execution as well as the review of the studies. Finally, the requirements to analytical inodels and software are correspondingly extensive. The general requirements are stated in Sections BS.I and BS.2. Meeting these requirements is of great importance during the engineering phases, due to the extensive analytical work.

Qualitative studies like FMEA and HAZOP, etc. are often more extensive than quantitative studies.

The following applies with respect to timing of the studies:

Quantification of personnel risk from feasibility study or concept design phases is updated and continued throughout the engineering phases.

• After completion of the conceptual design phase possibilities for improving the risk level significantly are limited. Therefore, acceptable solutions have to be found at this stage. However, the possibilities for increasing the risk are numerous also after the concept design phase.

Updated emergency preparedness analysis shall be carried out in the detailed engineering phase.

• The final updating of risk and emergency preparedness analysis shall be carried out towards the end of these phases:

• Update quantitative risk analysis reflecting the chosen solutions and systems.

• Carry out the final emergency preparedness analysis.

• Document the results from the emergency preparedness analysis in a suitable way, for all dimensioning accidental events and DFU, possible causes and effects of accidents for use in the operational phase.

• Qualitative studies shall be conducted continuously during these phases.

464 APPENDIXB

It is essential that assumptions and premises for the studies are clearly documented for the following purposes:

• Basis for subsequent updating of emergency preparedness analysis and establishment of emergency preparedness.

• Basis for establishment of emergency preparedness information.

Basis for follow-up in subsequent fabrication and installation phases.

• Basis for follow-up in the operational phase.

The presentation of results from HAZOP studies shall include an overview of the responsibilities and a time schedule for the implementation of recommendations from the studies.

The requirements to result presentations are quite extensive and detailed in these phases, reflecting the extensive and varied contexts in which the result documentation is used. The quality of the studies will largely depend on close communication with all relevant disciplines in the project.

B7.4 Fabrication and Installation Phase

This phase covers the fabrication of equipment and structures, hooking up, towing of modules, installation, commissioning and start-up preparations.

The risk and emergency preparedness analysis should as far as possible be an integrated one, with the following objective:

• Analyse particular aspects of the fabrication and installation that may entail loss of or severe damage to the entire installation and/or risk to personnel.

Determine the emergency preparedness level for the fabrication and installation work.

The target groups for the studies are operational personnel having responsibility for the installation work, management and workforce on the installation, as well as personnel being responsible for the planning and implementation of emergency preparedness.

The studies will not be limited to the production installations, but will include all installations and vessels engaged in the installation and hook- up operations. They may also include nearby installations and vessels, if they are close enough to be affected by accidental effects.

The data basis for any quantitative risk analysis in these phases is often limited, since many of these operations are unique for the current project. Qualitative analyses will often be predominant, quantitative analysis may be done when sufficient data basis exists.

It may be a necessary to update the risk and emergency preparedness analysis made during the engineering phases, if the installations have been significantly changed during fabrication and installation.

B7.5 Operational Phase

This.phase includes normal operation, inspection, maintenance and limited modifications. The need for integrated risk and emergency preparedness analysis is determined by the extent of modifications. The objective of the studies is:


• To update risk and emergency preparedness analysis in order to ensure that they reflect relevant technical and operational aspects.

• To ensure that the risk level is kept under control.

• To ensure that operational personnel are familiar with the most important risk factors and their importance for an acceptable risk and emergency preparedness.

• To ensure that risk aspects in connection with ongoing operations and work tasks are being assessed and that necessary risk reducing measures are implemented.

• To ensure that the risk level is monitored according to updated risk analysis data bases, tools, methods and experience.

Qualitative studies shall be carried out when planning and preparing for work tasks that have vital importance for the operational safety.

The target groups for the studies are operative onshore organisation having responsibility for the planning and management of the operations, management and workforce on the installation, as well as personnel being responsible for the maintenance of the emergency preparedness.

The studies will not only be limited to the production installation, but will also cover nearby vessels and installations, if they are close enough to be affected by accidental effects.

The data basis for quantitative studies will in general be the same as for the engineering phases, but will in addition include data generated during the operation of the installation as well as new and updated knowledge and experience. Risk indicators as outlined in Annex A (not included in this appendix) are of particular importance in this context.

Requirements to the competence of the personnel who carry out and evaluate the quantitative risk and emergency preparedness analysis, their underlying assumptions, analytical models and computer codes, as well as result presentations, are the same as for the engineering phases. There are few specific formal requirements to the use of Safe Job Analysis, but it is important that the workforce and other operational personnel are actively involved in the work.

Updating of risk and emergency preparedness analyses shall identify needs for further risk reducing measures such as emergency preparedness measures, or in order to identify new areas for particular attention in the safety and emergency preparedness work of the activity.

Studies shall be updated in connection with major modifications or changes to area of application and also on the basis of:

• Experience from accidents that have occurred,

• Organisational changes,

• Changes to regulations.

The updating of analyses includes La. updating of:

a) The installation and operations in accordance with the development of the activity.

b) Assumptions and premises that the earlier analysis has been based on, and possibly further development (of these).

c) Whether risk associated with special operations or new equipment that are being planned, has been assessed at an earlier stage.

d) The data basis in the light of to new experience, new knowledge or changes in the data bases that have been used, including revision of experience data from own operations.

466 APPENDIXB

e) The methodology which is used.

f) The analysis results in the light of possible changes to the operator's/owner's risk acceptance criteria for the installation or operations.

The operator/owner shall formulate minimum requirements to the frequency of updating of the quantitative risk analyses and emergency preparedness analysis, unless technical or operational circumstances in the meantime have necessitated more frequent updating.

B7.6 Modification and Reuse

A modification project will normally include the following phases, study phase, engineering, fabrication, installation, completion and operation. If the modification is very large compared to the existing use ofthe installation (reuse) the project should be treated as a new building project. Risks, risk acceptance and emergency preparedness shall address all phases involved.

The target groups for the studies are decision-makers in relation to the modifications, engineering personnel as well as operational management personnel and the workforce, in addition to personnel being responsible for updating and maintenance of emergency preparedness.

The studies will include all relevant installations engaged in the production system, including mobile units and vessels that may be involved in operations, possibly also nearby vessels and installations, if they are close enough to be affected by accidental effects.

During the study phase the feasibility of the planned modifications shall be assessed with respect to safety and risk acceptance. For smaller modifications this may be a qualitative risk analysis, while for larger modifications quantitative concept risk analysis as described in Section B7.1 and B7.2 may be required. For modification of process systems a HAZOP is required.

During engineering phases an integrated risk and emergency preparedness analysis shall be carried out as described in Section B7.3. However, it is sufficient to update only the parts of the existing analysis for the installation that is affected by the modification.

A separate integrated risk and emergency preparedness analysis shall be made for the time period when the modification work takes place on the installation.

In both of these analyses the additional risks from the modification work shall be added to the existing risk level on the installation and be compared to the risk acceptance criteria for the installation in question. DFU, DUH and DUL for the installations shall be updated and be applied for further design of safety systems and emergency preparedness for the modified installation.

For smaller modifications when it is obvious that the risk acceptance criteria will be met a qualitati ve risk and emergency preparedness analysis is sufficient also in engineering. The quantitative effect of the modification on the risk level may then be calculated at the regular updating of the quantitative risk and emergency analysis for the installation.

The analyses should identify operations were Safe Job Analysis should be carried out. The following special aspects shall be considered if they are relevant:

• increased number of personnel onboard during modification work

increased number of personnel in hazardous areas

risks associated with simultaneous operations during installation, modification and commissioning


use of hot-work during modification work offshore contra use of flanges

• effect of habitats for hot-work

• dropped objects

• temporary unavailability of safety systems for modification work

• effect of modifications on ESD-system and process safety

• increase in number of leak sources and explosion loads due to more equipment

• human error.

Otherwise the studies shall satisfy the general requirements to risk and emergency preparedness analysis given in this standard. An environmental risk assessment shall be included, if oil spill risk is involved.

B7.7 Decommissioning and Disposal

This phase includes preparations for and execution of decommissioning and disposal activities in relation to production installations. The contents of this phase corresponds to the work in the fabrication and installation phases, see Section B7.4. When preparing for decommissioning and disposal, there will usually be more emphasis on deliberations and comparison of alternative solutions. The following aspect shall therefore be emphasised in addition to what is mentioned in Section B7.2:

Studies that compare alternative solutions with respect to risk and emergency preparedness.

There is often a so-called 'cold' phase, without hydrocarbons, between decommissioning and disposal, often entailing considerable deviations from regulations, as equipment and systems are removed or deactivated. The most important risk aspects are often connected to the following preparations for the 'cold phase':

• use of divers,

• use of underwater cutting devices,

manned operations in relation to heavy lifts and cutting operations.

Emergency preparedness in this period shall be determined according to a separate emer-gency preparedness analysis, where the following DFU shall be addressed as a minimum:

Helicopter crash on the helideck or within the installation's safety zone

Acute medical case

Ship collision

• Man-over-board

Occupational accidents

Further requirements are described in Section B7.4.

References

AEA (1997). Hydrocarbon Release Statistics Review, AEA Technology Report 16189000/01, January 1998

Amdahl, J. et at (1995). Ultimate Collapse of Offshore Structures exposed to Fire, Proceedings of the 14th International Conference on Offshore Mechanics and Arctic Engineering, OMAE 1995, Copenhagen, June 18-22,1995. ASME

American Iron and Steel Institute (1979). Fire-safe structural steel, A design Guide, Washington, 1979

AME (1993). Loss of containment incidents, PARLOC, AME report, February 1993

API (1997). Guide for Pressure Relieving and Depressuring Systems, RP 521, American Petroleum Institute, 15.3.1997

API (1976). Recommended Practice for the Design and Installation of Pressure-Relieving Systems in Refineries. Part 1 - Design, API Recommended Practice 520. Washington 1976

Bea, R. and Moore, W. (1994). Reliability based Evaluations of Human and Organisation Errors in Reassessment and Requalification of Platforms, OMAE 1994, Houston, February 27 - March 3, 1994. ASME

Bea, R. (1995). Quality, Reliability, Human and Organisation Factors in Design of Marine Structures, Proceedings of the 14th International Conference on Offshore Mechanics and Arctic Engineering, OMAE 1995, Copenhagen, June 18-22, 1995. ASME

Berg Andersen, L., A ven, T., Maglione, R. (1996). On Risk Interpretation and the Levels of Detail in Quantitative Blowout Risk Modelling, 3rd International Conference on Health, Safety and Environment in Oil and Gas Exploration and Production, New Orleans, June, 1996, SPE paper 35967

BHP (1998). Griffin Venture Engine Room Incident Report, Document No OOTG-ROO-3008, Rev. 0, 5.2.1998

Colbj~rnsen, A (1978). Local loads on prestressed cylinder shells. Calculation method. (in Norwegian only) FCB, SINTEF Report STF65 F78021 , Trondheim

Cornell, A. and Bandyopadhyay, K. K. (1996). Should we relax Seismic Criteria for Shorter System Exposure Times? Pressure Vessels and Piping conference, ASME Montreal, July 21-26,1996

COWIconsult (1995). Pipe Survivability Upon Fire, Report no 26448-TR-0001, July, 1995

Cox, A. W., Lees, F. P. and Ang, M. L. (1991). Classification of hazardous locations, Institution of Chemical Engineers

DNV (1981). Causes and consequences of fires and explosions on offshore platforms, Statistical survey of Gulf of Mexico data, DNV Report 81-0057, 22.1.1981

Dn V (1981 b). Technical Note - Fixed Offshore Installations - Impact Loads from Boats, TN-202, Oslo 1981

DNV (1993). Causes and consequences of fires and explosions on offshore platforms, Statistical survey of Gulf of Mexico data, DNV Report 93-3401, 1993

DNV Technica (1992). Calibration of HC Leak Frequency and Ignition Probability Data, Prepared for E&P Forum, 20.2.1992

470 REFERENCES

DNV (1998). WOAD, Wold wide Offshore Accident Database, DNV, 1998

DNV. (1998b). Ignition Modelling, Time Dependent Ignition Probability Model, DNV report 96-3629, Revision No 04, 20.2.1998

DNV. (1998c). Benchmark of lIP Ignition Model against Experience Data, DNV report 98-3290, 9.10.1998

Dovre Safetec AS (1994). Collide II, Reference Manual, Rev 2, March 1994

Dovre Safetec AS (1996). Coast Database, 1996 Rev. 1, www.safetec.nolsoftwarelcoast.html

Dovre Safetec AS (1999). Safetow software, 1999, www.safetec.nolsoftwarelsafetow.html

Eknes, M. L. (1996). Escalation Scenarios initiated by Gas Explosions on Offshore Installations, Dr.ing. Thesis, Faculty of Marine Technology, NTNU, Trondheim, October 1996

Eknes, M. L. and Moan, T. (1996). Modelling of Escalation due to Explosion, OMAE'96, Florence, 16-20 June, 1996

Elf Petroleum Norway (1998). Health, Safety and Environment, Annual report for 1997, Stavanger, April, 1998

E&P Forum. 1986. Ocean Ranger Task Force Report, Report no 7.21134, December, 1986

E&P Forum, 1994. Guidelines for the Development and Application of Health, Safety and Environmental Management Systems, E&P Forum, July 1994

E&P Forum, 1996. Quantitative Risk Assessment, Datasheet Directory, E&P Forum Report No 11.81250, London, October 1996

ERA (1998). Fire and Explosion Engineering, Offshore Installations - Conference Proceedings, 1 December 1998, ERA Report 98-0958, Leatherhead, December 1998

Fay, L. A. (1969). The Spread of Oil Slicks on a Calm Sea, Department of Mechanical Engineering, Massachusetts Institute of Technology, Cambridge, Massachusetts, May 16, 1969

Fire-safe Structural Steel (1979). A Design Guide. American Iron and Steel Institute, Washington 1979

Gowan R.G. (1978). Developments in Fire Protection of Offshore Platforms - 1. Applied Science Publisher Ltd. London 1978

Hasegawa K. and Sato K. (1977). Study on the Fireball following Steam Explosion of nPentane. 2nd Intern. Symposium on Loss Prevention and Safety Promotion in the Process Industy, Heidelberg, September, 1977

Haugen, S. (1991). Probabilistic Evaluation of Frequency of Collision between Ships and Offshore Platforms, Dr.ing. Thesis, Division of Marine Structures, NTNU, MTA-report 1991 :80

Henderson, Y. and Haggard, H. W. (1943). Noxious Gases, 2nd Ed., Reinhold Publishing Co.

Henley, E J and Kumamoto, H (1981). Reliability Engineering and Risk Assessment, Prentice Hall Inc.

REFERENCES 471

Holen, J. and Magnussen, B.F. (1990). KAMELEON FIRE E-3D - A Field Model for Enclosed Pool Fires. SINTEF Report STF 15 F9001 O. SINTEF - Applied Thermodynamics, Trondheim, Norway

H~yland, A. and Rausand, M. (1994). System Reliability, Theory, Models and Statistical Methods, John Wiley & Sons, New York, 1994

IEEE (1984). IEEE Guide to the Collection and Presentation of Electrical, Electronic and Sensing Component Reliability Data for Nuclear Power Generating Stations, Wiley 1983, ISBN 0471807850

Ireland, R. D. (1991). Determination by R. D. Ireland, Sherif Principal of Grampian, Highland and Islands, in Fatal accident Inquiry into the death of timothy John Williams on board Ocean Odyssey, 8.11.1991

ISO (1999). Control and Mitigation of Fires and Explosions on Offshore Production Installations - Requirements and Guidelines, International Standards Organisation, ISO 13702: 1999(E)

Kenny J. P. (1988). Protection of Offshore Installations Against Impact, Background Report, prepared for Department of Energy, on 88 535, 1988

Kirwan, B. and Ainsworth, L. K. (1992). A Guide to Task Analysis, London, Taylor and Francis, 1992

Kirwan, B. (1994). A Guide to Practical HRA. London, Taylor and Francis, ISBN 07484-0111-3

Kje~y, H. and Straube, P (1983). Impacts and Collisions Offshore, Project Summary, DNV Report No 83-0375, Veritas, H~vik

Kviterud, A. (1994). Boat Collisions - Phase I (in Norwegian only) NPD Report 94-50, May 1994

Kviterud, A. Tesdal, K. and Nilsson, K. (1995). Low Energy Vessel Collisions on the Norwegian Continental Shelf, Proceedings of the 14th International Conference on Offshore Mechanics and Arctic Engineering, OMAE 1995, Copenhagen, June 18-22, 1995. ASME

Karstad, O. and Wulff, E. (1983). Safety Offshore (in Norwegian), Universitetsforlaget, 1983, ISBN 82-00-06584-7

Lees, F. P. (1996). Loss Prevention in the Process Industries, Second Edition, ButterworthHeinemann, 1996

Lloyd's List (1995). 'Estonia' pushes lives lost to six-year high, 20.9.1995

Lord Cullen (The Hon) (1990). The Public Inquiry in the Piper Alpha Disaster, HMSO, London, November 1990

Lydersen, S. (1992). Risk picture - personnel transportation, SINTEF Memo, 1992

Morris, M.I., Miles, A. and Cooper J. P. S. (1994). Quantification of escalation effects in Offshore Quantitative Risk Assessment. Journal of Loss Prevention, 7:4, 337-344

Nesje ,J. D. (1999) Risk Assessment Technology and its Application to Tanker Based Floating Production Storage and Offloading (FPSO) Systems, OTC Paper 10998, OTC, Houston, May 1999

472 REFERENCES

Nielsen, D. S. (1976). The Cause Consequence Diagram as a basis for quantitative Accident Analysis, Report M-1374, RIS0 National Laboratory, Denmark

NOU (1981). Alexander L. Kielland Accident, NOU Report 1998: 11, Oslo, 1981

NOU (1986). West Vanguard Accident, NOU Report 1986:16, Oslo, 1986

NOU (1997). About the SAR Helicopter Service (in Norwegian only), NOU Report 1997:3, Oslo, 1997

NPD (1980). Guidelines for conceptual evaluation of platform design, Norwegian Petroleum Directorate, Stavanger

NPD (1984). Regulation of Structural Design of Loadbearing Structures ... , 29. October 1984, Norwegian Petroleum Directorate, Stavanger

NPD (1990). Regulations Relating to Implementation and Use of Risk Analysis in the Petroleum Activities, 4.12.1990, Norwegian Petroleum Directorate, Stavanger

NPD (1992). Regulations Relating to Explosion and Fire Protection ofInstalIations in the Petroleum Activities, 7.2.1992, Norwegian Petroleum Directorate, Stavanger

NPD (I 992b). Regulations Concerning Load Bearing Structures, 7.2.1992, Norwegian Petroleum Directorate, Stavanger

NPD (1992c). Regulations Relating to Emergency Preparedness in the Petroleum Activities, 18.3.1992, Norwegian Petroleum Directorate, Stavanger

NPD (1992d). Regulations Relating to Load Bearing Structures in the Petroleum Activities, 7.2.1992, Norwegian Petroleum

NRC (1975). Reactor Safety Study, WASH 1400, 1975

NTS, 1996 NORSOK Technical Safety, Design Principles, NORSOK Standard S-DP-OOl, Rev.2, January, 1996

NTS (1998). Risk And Emergency Preparedness Analysis, NORSOK Standard Z-013, Rev.l, March, 1998

NTS (l998b). NORSOK Standard for Design of Steel Structures, NORSOK Standard N-004, Rev.l, December, 1998

NTS (1999). NORSOK Standard; Regularity Management and Reliability Technology, Z-016 Rev. 1, January, 1999

OLF (1996). Analysis of Gas Leaks on the Norwegian Continental Shelf 1991-1995 (Norwegian only), The Norwegian Oil Industry Association, Stavanger, 22.4.1996

Opstad, K. and Guenette, C. (1999). Fire on the Sea Surface, Ignitability and Sustainability under various Environmental Conditions. Sixth International Symposium on Fire Safety Science (lAFSS), Poitiers, France, 5-9 July 1999

OREDA (1997). Offshore Reliability Data Handbook, 3'd Edition, 1997

Reliability Analysis Centre (1991). NPRD, Nonelectronic Parts Reliability Data, 1991

Ripley, B. D. (1987). Stochastic simulation Wiley N. Y, 1987

REFERENCES 473

Rosenberg, T. and Nielsen, T. (1995). Blowout Risk Modelling, Proceedings of the 14th International Conference on Offshore Mechanics and Arctic Engineering, OMAE'95, Copenhagen, June 1995

Sandvik, P. (1988). Hydrodynamic Effects from Subsea Gas Blowouts, Appendix 2 to RABL project report No 1, SikteC A/S, Report No ST-87-RR-007-02, 3.2.1988

Saubestre, V., Khalfi, J-P., Paygnard, J-C (1995). Integrated Fire Analysis: Application to Offshore Cases, Proceedings of the 14th International Conference on Offshore Mechanics and Arctic Engineering, OMAE'95, Copenhagen, June 1995

Sax, N.!. (1984). Dangerous Properties ofIndustrial Materials, Van Nostrand Reinhold Co., New York, 6th Edition, 1984

Schofield, S. L. (1993). A Framework for Offshore Risk Criteria, HSE, Safety Analysis Unit, Offshore Safety Division, Liverpool, February 1993

SCI (1998). Blast and Fire Engineering for Topside Systems, Phase 2, SCI Publication No 253, Ascot, UK, 1998

SINTEF (1990). Helicopter Safety Study, SINTEF Report STF75 A90008, 1.11.1990

SINTEF (1992). Handbook for Fire Calculations and Fire Risk Assessment in the Process Industries, SINTEF/Scandpower, 1992

SINTEF (1993). FIREX Reference Manual, SINTEFINBL

SINTEF (1996). Integrated Fire Analysis of Offshore Structures - Development and Verification of analysis procedures, SINTEF Report STF22 A96714, Trondheim, April, 1996

SINTEF (1998). Blowout database, Safety and Reliability Department, SINTEF, 1998

SINTEF (1998b). Fire on Sea Phase III Home page from SINTEF, Fire Research Laboratory, 1998

Soma, H, 1995. Computer Simulation for Optimisation of Offshore Platform Evacuation, Proceedings of the 14th International Conference on Offshore Mechanics and Arctic Engineering, Proceedings of the 14th International Conference on Offshore Mechanics and Arctic Engineering, OMAE'95, Copenhagen, June 1995

Stamatis, D. H. (1995). Failure Mode and Effect Analysis: FMEA from Theory to Execution, American Society for Quality, 1995, ISBN 087389300X

Stensaas, J. P. et, ai, (1986). Studies of pool fires in a room of dimensions 1 m x 1 m x 2m. SINTEF report STF25 F86003. Norwegian Fire Research Laboratory, 1986, Trondheim, Norway

S0rgard, E. et al. (1997). A Stepwise Methodology for Quantitative Risk Analysis of Offshore Petroleum Activities, SPE/UKOOA European Environmental Conference, Aberdeen 15-16 April, 1997

UK HSE(1992). Safety Case regulations, Health and Safety Executive, HMSO, 1992

UK HSE (1992b). Tolerability of Risk from Nuclear Power Stations, HMSO, 1992

UK HSE (1995). Prevention of Fire and Explosion, and Emergency Response regulations, Health and Safety Executive, 1995

474 REFERENCES

UK HSE (1997), Offshore Hydrocarbon Releases Statistics, Health and Safety Executive, 1997, Report OTO 97 950, December, 1997

UK HSE (1998), Development of the Oil and Gas Resources of the United Kingdom, Health and Safety Executive, 1998

US Army Corps of Engineers (1975). US Army Corps of Engineers Manual EM 1110-345-415 - Design of Structures to resist the Effects of Atomic Weapons, 1975

US Department of the Interior (1991). Accidents Associated with Oil and Gas Operations, (MMS Events File) Minerals Management Service, OCS Operations, 1956-1990

Vesely, W. E. et at. (1991). NUREG-0492, Office of Nuclear Regulatory Research, U.S. Nuclear Regulatory Commission, Washington DC 20555, 1981

Vinnem, J. E. (1988). Risk Assessment of Buoyancy Loss, Summary Report, SikteC A/S Report No ST-87-RF-024-01

Vinnem, J. E. (1996). Risk Acceptance Criteria for Temporary Phases, Journal of OMAE, Volume 118, 204

Vinnem, J. E. et at (1996b). Efficient Risk Management: Use of Computerized QRA Model for Safety Improvements to an Existing Installation, 3rd International Conference on Health, Safety and Environment in Oil and Gas Exploration and Production, New Orleans, June, 1996, SPE 35775

Vinnem, J. E., Haugen, S., Bjilrresen, R. (1 996c). Risk Assessment of Production and Storage Tankers, Journal of Offshore Mechanics and Arctic Engeneering, Vol. 188, August, 1996

Vinnem, J. E. (1997). On the Sensitivity of Offshore QRA Studies, ESREL'97, Lisboa, June, 1997, 745-754, Pergamon

Vinnem, J. E. (1997b). Environmental Risk Analysis of Near-Shore Wildcat Well, Approach to Rational Risk Acceptance Criteria, SPElUKOOA European Environmental Conference, Aberdeen 15-16 April, 1997

Vinnem, J. E. and Vinnem, J. E. (1998) Risk Levels on the Norwegian Continental Shelf, Preventor Report 19708-03, 25.8.1998

Vinnem, J. E. (1998). Blast Load Frequency Distribution, Assessment of Historical Frequencies in the North Sea, Preventor Report 19816-04, 26.11.1998

Vinnem, J. E. (1999). Requirements to Standby Vessels; Phase 1 - Survey of current Practice (Norwegian only), OLF report, 1999

Vinnem, J. E. and Hauge, S. (1999). Operational Safety of FPSOs, MP3; Riser Failure due to Inadequate Response to Rapid Wind change, Main Project Report, NTNU, Trondheim, Norway

0stby, E., Berg, M. and Festjily. B (1987). Risk Assessment of Buoyancy Loss, Ballast System Failures and other Faulty Weight Conditions, Veritec Report 87-3451, June, 1987

0ien, K. et at. (1997). Risk Level Indicators for Surveillance of Changes in Risk Level, ESREL'97, Lisboa, June, 1997, 1809-1818, Pergamon

Subject Index acceptability of installation risk, 63

acceptable environmental risk, 61

accident. v. 2. 6. 7, 10. 12-15. 17-20. 24. 25, 37. 41-43.45-47.50,53.55-58,66.69-72.79,83. 86,87.90.91,99.101-110.112.113,115.120, 123. 124, 126-129, 135-137. 140, 151-153, 156. 159-161, 166-168. 173, 174. 176-178, 180, 181, 184-186, 190. 193. 197,206.213. 214.233,243.245.246.259,262,271.277. 278,280,283.293. 295, 316-318. 325-328. 330. 332. 339. 341-343. 345, 346. 348-352. 360-362, 364. 372-375. 379. 386. 390-392. 394. 395. 402, 404-406, 408-410, 412. 416. 418, 421. 438-441. 448. 450. 454, 455, 470-472

accident in loaded condition, 14, 50. 87. 129, 151. 156. 166, 186.283.293,391.392,394,

·395.404,409,450

accumulated frequency, 20, 21

active fire and explosion protection. 140

AIR. 10.15-19.24-26.30-32.48.50,52-54,124.125, 143. 145, 162, 175, 187. 194. 217-221. 223-226, 231, 236. 246-250. 256. 260, 272-274.319,320,328,329.342,360.371, 402,403.441

air diving, 187

ALARP, 6. 10,49,55,58,59.61,63,74, 194.204, 238,239,334-339.348,357.370.438,441

ALARP principle, 49, 336

ALARP zone. 61

alternati ve mustering. 169-171

analysis of critical risks, 77, 82

asset risk. 14.21,23,34.85.335,344

assumption, 58. 120. 123, 141. 156. 157, 160, 161. 221.222.227.282.287.293,298.301

attendant vessel, 41. 44. 280, 283. 299

availability. 23, 35, 49. 77. 82. 84. 87. 88. 92, 96, 97, 105. 120, 127.135. 136. 156. 173. 178. 184. 185. 190. 196-198.203,204.302,360.361. 363.367.373.379.382,387.412,423.438. 440

avoidance and position-fixing, 291

bad weather conditions, 103, 104

BFETS,2, 10, 189.216.219,230,241.255,260.264, 273

blowdown. 10. 15,76.1\8.123, 136, 138,200,207, 230,357-360

Bl1JVVfam, 78, 415, 422

blowout, 10,25,32-35,65,66,72,76,78-80,85,87, 88,100-102,104,107,112,122-125,148,149, 154, 171, 174, 177-180,205,206,213,214, 218,242,266,318,322,326. 32cj, 332, 382, 388,397,400,406,415,422,459,469,473

burning blowout, 80, 177, 179

short duration blowout, 205

buoyancy compartment. 81

cargo tanks. 391. 395-398. 400. 404. 405. 408. 411

cause analysis. 68-71. 78. 450. 451

CBA. 10.335.337,339.341.342.344,345

check lists, 70, 109,436.450

Chi-square distribution, 39, 93

COLLIDE. v, 81, 283-286, 295, 296, 312, 393, 415, 423.470

collision, iv, 3, 23, 35, 36, 71. 76, 81, 86, 89, 90.100, III, 157. 167. 178, 188, 190. 199.200.211, 213. 235. 278-290, 293-307, 309, 310. 312-315,329,330,332,377,378,387,397. 400,402,407,409,411,412,415,423,451, 467,470

ARPA, 10,301

bracing collision, 313

bracing impact, 314, 315

central impact, 298, 300

collision probability, 211. 278, 281

collision resistance, 283, 301

collision risk study, 100.284

contact point on vessel. 300

corner column collision, 313

corner column impact, 314

drifting speed, 297, 298

external impact, 23, 190, 451

external offshore traffic, 283

glancing blow, 89, 286, 300, 315

glancing collision. 313 lateral distribution, 291, 302

merchant vessel. 89, 280, 281, 296. 299, 305, 306, 376-378

powered collisions, 284, 285

probability of platform being known, 290, 303

push-over, 314, 315

RACON, 12,294

rotation of vessel, 300

route based traffic, 288

ship initiated recovery, 285, 293-295

traffic category, 281. 282. 285, 296

vessel category, 281-283. 285, 291

vessel traffic. 81.96, 283, 303 columns, 90, 103, 104, 190,253.300,307,317,323,

326-328, 332

combustion reaction, 215, 217

comparative studies, 63. 78, 356,447,448

Concept Safety Evaluation. I, 10. 100.396,399

condensate, 131,210,222,236.374.426 conditional probability, 15, 110, III. 119-121, 134,

136, 138, 158, 159,202,203.257,276,292, 314,315,323.343

476 SUBJECT INDEX

consequence analysis, 10,68,69, 100, 127, 149, 196, 211,215,245,413,415,424,451,453

consequence category, 21, 33, 34

control centre, 57, 177, 440

control room, 64,103,106,136,146,175,176, 190, 326,328,329,362,389

Cost Benefit Analysis, 10,62,334,335,340,346,349, 353,436,447

cost of reinforcement, 270

critical temperature, 141

crude oil carrier, 395

CSE, I, 10

cumulative function, 30

DAE, 10, 56, 233

DAL,IO

damage, iv, 3, 5, 7,8, 14,20-22,33-35,37,56-63,76, 81,85,89,90,101,102,105,107,125,127, 135-137, 139-141, 143-145, 147, 149, 150, 165,167,178,190,193,202,204,211,212, 239,240,245,261,271,277-280, 283, 299, 300, 304, 305, 314-318, 320-322, 325, 333-335, 341-343, 345-351, 357, 359, 360, 364,382,392-394,396,398,404,411,412, 420,432,437,438,453,454,464

data sources, 87, 91, 95, 96

decision to evacuate, 153

decommissioning, 55, 98, 393, 436, 445, 467

depressurisation, 79, 80, 129, 198, 233

design basis, I, 72, 99, 206, 208, 259

DFU,IO,354,438,441,446,455,463,466,467

dimensioning fire, 231-235

DP-system, 284, 407

dropped load, 189, 196,211

dropped objects, 81-83,100,126,211,212,300,316, 317,324,368,377,387,397,420,467

ecological component, 12,442,453

EER, 10, 153,155,157,158,179

Ekofisk Bravo, 10 I, 102

Emergency Preparedness Analysis, v, 5, 7, 8, 50, 62, 166, 335, 354, 355, 368, 435, 436, 439, 444, 446,453-467,472

Emergency Quick DisConnector, 10

environmental risk, 3, I I, 14, 22, 51, 55, 61, 85, 146, 148, 149,398,405,435,442,453,459,467, 474

environmental risk analysis, II, 146,442,459,474

damage based analysis, 147

exposure based analysis, 147

source based analysis, 147

environmental spills, 58, 84

EQDC, 10,390,406

escalation, iv, 6, 7, 10, 15, 57,69,72,83, 86, 105, 106, 112, 113, 115-121, 124, 127, 128, 135, 137-139, 154, 158, 159, 164, 167, 196, 197, 200,206,207,213,214,230,237,242,245, 257, 258, 263, 271, 272, 276, 277, 332, 359, 365,367,379,390,397,401,405,419,421, 449,450,452,470,471

escape, iv, 7, 8, 10, 14-16,20,24,32,37,49,50,57, 64, 67, 77, 80, 84, 92, 100, 102, 103, 106, 113-115, 124, 143-146, 152, 153, 158, 160-162, 164, 166-172, 174-177, 179, 185, 206, 224-226, 318, 330, 392, 396, 400, 402, 407,408,410,438-440,452,456

Escape analysis, 167

escape fatality, 168, 171

mustering phase, 153

mustering time, 145, 168

primary route, 169, 170

secondary route, 169, 170

escape ways and evacuation means, 392

ETA, 10,71

evacuation, iv, 8-10,14-17,20,24,49,50,56,57,64, 77,84,92, 100-103, 106-108, 112-115, 124, 143-146, 152-154, 156, 165, 167, 168, 170-179, 206, 304, 328, 330, 373, 376-379, 383,386, 392, 393, 396,401,406,408-412, 415,423,439,440,452,456,473

evacuation fatality, 177, 179

evacuation system, 57, 144, 145, 175-177

evacuation time, 146, 175, 176, 178

lifeboat evacuation, 146, 154, 174, 175

results from evacuation study, 178

scenarios that usually will require evacuation, 153

evaluation of risk, 9, 38, 440

eventlree analysis, 8, 10, 11,71,72,81, 110-112, 122, 177,241,452

exceedance diagram, 34, 35, 244, 257, 269

exploration drilling, 104, 118, 242, 316, 411, 436

explosion, iv, 3, 4, 6, 10, 11,49,69,72,76,79,80,82, 84,86,87, 100, 101, 104-107, 113, 114, 118, 120, 121, 123-126, 132-137, 139-141, 143, 145, 152, 153, 158, 159, 161-168, 170, 171, 180, 188, 192-195, 197-200,202-205, 209, 210, 212, 214, 216, 230, 231, 233, 236, 241-251, 254-263, 265, 266, 268, 269, 271-274, 276, 277, 333, 357, 359, 360, 364, 365, 367, 368, 370-372, 379, 387, 390, 394, 396,401,403-405,408,411-415,419-421, 427,437,442,451,460,467,470,472,473

cladding, 105,263,272-274,276,277

cladding removal, 274

drag coefficient, 320

explosion load, 79, 80,106, 162, 168,205,209, 231,254,258,451

SUBJECT INDEX 477

explosion overpressure, 76, 140, 143, 145, 162-164, 198,200,203,210,212,241,254, 256, 272, 276, 277, 357, 359, 360, 367, 404, 405

explosion relief, 140,261,263,274,390

explosion resistance, 231

explosion response, 143

explosion risk study, 100

flame acceleration, 250, 251

overpressure, 10, 76, 100, 105, 106, 136, 139, 140, 143, 145, 162-164, 198,200,203,210, 212, 217, 241, 243-245, 247, 249, 252-265, 267-277, 357, 359, 360, 364, 367, 392-394, 404,405

sources of blast loads, 266

exposed hours, 16

external ignition model, 131

falling object, 319, 320, 322

FAR, 6, 10, 15-17, 19,24-28,31,38,39,42-48,50, 52-54,58,64-67,71,72,77, 102, 109, 110, 112, 113, 115, 127, 128, 139, 141, 152, 154-157, 162, 186-188, 193, 195,207,216, 237, 252, 254, 255, 257, 259, 265, 286, 292, 303, 306, 332, 335, 343, 345, 346, 360, 370, 371, 374, 375, 377-384, 386, 388, 394, 400-402, 405, 438, 441-443, 446, 448, 450, 452,464

fatality analysis, 153, 168, 171, 177

analysis of immediate fatalities, 153, 162

Escape and evacuation risk study, 100

fatality risk, iv, I, 14, 15, 24-26, 28, 37,41,43,45,47, 50,51,63,64,77,84, 112, 151, 152, 154-157, 159,162,167,169,171,185,187,197,201, 357,361,376,379,385,386,396,452

fatality risk analysis, 77, 84

fatality risk assessment, iv, I, 14, 112, 151, 152

fire, iv, v, 2-4, 6,10, II, 15,37,49,56,57,63,67,69, 72,76,78-80,82,84,86,87,91,96,100,101, 104-108, 110, 112-127, 129, 133, 135-142, 144,145,152, 153, 158,161, 162, 164-167, 169-171,178,180,188-190,192-200,202-209, 211-228, 230-243, 245-248, 260, 263, 265, 272,274,304,314,315,317,321,346,347, 353, 356-362, 364-367, 370-373, 376, 377, 379-383, 385, 387, 388, 390-393, 396, 397, 401-405,407-416,418-421,424-427,437,442, 447,451,460,469-473

BLEVE,6, 10,80,141,215,216,425

carbon dioxide, 226

carbon monoxide, 143, 225

diffusive flare fire, 425

fire load, 37, 79, 80, 140,207,208,218,223, 451

fire on sea, v, 80,124,126,127,145,190,218,

220,221,223,224,425,473

fire response, 141, 233, 357

fire risk assessment, 100, 473

tirehall, 425, 470

tlammability limits, 215, 217, 246

flash fire, 137,247

tlash point, 215, 220

heat radiation, 143,220,425,452

heat transfer to an object, 216

jet fire, 116, 117, 153,209,216-218,403,405, 425

jet release, 249

mass flow rate, 224

oil slick fire, 218

pool fire, 125, 141, 142,209,216,218,219,236, 405,425,427

FIREX, 415, 424, 425, 473

fixed installation, 27, 28, 213, 218

Fi-Fi,IO

FLACS, 10, 100,255,257,273,274,415

tlare,42, 130, 132, 133, 136,263,358,373,389,403, 425

floating production, 2, 10, 11,27,65,81, 83, 136, 189, 190, 205, 206, 323, 330, 387, 388, 392-394, 446,471

tlotel, 28, 29,46, 102, 174, 181, 279

tlow rate, 87, 125, 129,206,210,224,254

FMEA, 3,10,70,331,416,428,441,463,473

foundering, 41 I, 412

FPPY,14

FPSO, 11,27,28, 172, 191,260,388,389,391-396, 398-400,402,406,407,471

FRC, II, 104, 180, 182-184

frequency assessment, 283

FfA, 11,70,71

functionality, 135, 363, 419, 420, 428, 438, 440

funnels, 390

f-N curve, 14, 30, 54

gascJoud, 123, 125, 127, 132, 154, 164,246-250,254, 256,257,267,269,272,274,396,424

generator, 92, 127, 128

generic data, 87, 92-96, 118, 295

geometrical mean consequence, 17

GIR,II,54

global failure, 299-30 I

group risk, II, 14, 17,24,31,32,48

hazard cxposure, 58, 67, 388

hazard identification, iv, 11,69, 70, 75, 76, 109, 110, 420,433,441,450

hazard overview, 396

478 SUBJECT INDEX

HAZID, 11,69, 109,441,450

HAZOP, 3, 11,70, 100,367,368,416,428,429,432, 441,447,450,463,464,466

HCLIP, II, 89

helicopter evacuation, 146, 173, 175

HES management, 4, 5, 74, 98, 107, 108,334,354, 362,370,437,441,442,444,448,458

HOF, 11,72,74, 83, 136,399,400

HSE, 2,4, 10, 11,48-50,88,89,91, 130, 132, 134, 144, 193, 194,260,342,345,355,356,360, 363,371,422,431,437,473,474

hull,28, 100, 145, 189,260,304,326,328,329,333, 389,390,392-394,404

ignition, 15,69,1,6,78,79,83, 87-89,91,92, 100, 104, 105, 113-115, 118-135, 148, 154, 159-162,164,165,167,171, 173, 197, 198, 200, 203, 209-215, 217-223, 230, 232, 241, 242, 246-250, 252-254, 256, 257, 260-264, 272, 365, 367, 372, 373, 376, 377, 388, 392, 395,397,402,404,405,419,421,425,451, 469,470

delayed ignition, I 13, 114, 124, 125, 219

greatly delayed ignition, 124, 125

ignition source, 92, 105, 125, 128,211,212,220, 247-250,254,256,373,395,421

ignition strength, 256

ignition temperature, 215

immediate ignition, 113, 114,123,124,218-220, 248

impact angle, 319, 320, 322

impairment, iv, 14, 19,20,32,34,48-50,52,58,63, 67,77,84,113,120,137,143-145,168,169, 177,194,197,198,271,330,331,390,397, 400,421,443

cut-off limit, 2, 57

frequency of impairment, 19,32,48,84, 331

impairment frequency, xvii, xviii, 20, 32, 34,50, 58, 63, 120, 397

impairment of escape ways, 20, 32, 144

impairment of main structure, 145

impairment of Temporary Refuge, 20, 144

impairment probability, 168

impairment risk, 14,32,52,197,400,443

safety functions, 2, 8, 20, 32, 48, 50, 52, 56, 57, 63,64,67, 76, 84, 120, 137, 143, 145, 146, 176,177,198,199,330,363,396,397,440, 443,452

Shelter Area, 5, 8, 10, 15,20,50,57,64,76,77, 80,84,105,144,146,153,166,168,174-177, 206,330,390,391,396,397,440

temporary blockage, 67

temporary impairment, 67

Temporary Refuge, 12, 15,20,49,144,146,166,

168,177,194,388,440

inert gas system, 391, 392, 394, 395

initial screening, 109

initiating events, 68-71, 78,110, III, 116, 117,399, 450

installation phase risk assessment, 100

installation specific data, 89,91-95, 118

instantaneous release, 219, 220

insulated steel, 228

internal ignition model, 131

jacket structure, 90, 278, 279, 300, 307, 308, 314

KAMELEON, 415, 427, 471

LCC, xviii, 11,339,344

leak,8, II, 15,37,72,79,80,88,89,92,94-96,100, 101,104-107,113,115-117,119-130,132-136, 144, 158-162, 164, 174, 179, 198,200-204, 206, 209-214, 218, 230, 241, 242, 249, 254-257,261,262,266,269,272,273,360, 367, 368, 370-372, 376, 377, 393, 395-397, 401,402,404-406,415,424,467,469

LEL, II, 248, 392, 441

local failure, 300, 314, 315

major accident, 43, 47,102,105,152,372,373,386

major hazard, 66,115,363,371,373,375,421

manhours, 16,28,38,42,43,45,47, 100

marginal angle, 312

material damage risk, 3, 14,34,62,63,202,204,239, 240,335,359,364

matrix presentation, 33

minor damage, 33-35, 278, 279, 393,438.

minor effect, 33, 60

Mobile Drilling Units, 22, 42-44,47,81, 156, 174, 190,242,332,392,411

modelling of fire escalation, 138, 359

moderate damage, 33

modification phase, 27, 28

MODU, 11,65,108,250,388,400,442,458

module support beam, 324

NMD, 11,331

non-essential personnel, 153, 177, 393

NORSOK, v,S, 11,47,48,50,51,58,60,62,68,97, 166, 191, 192, 209, 236, 300, 367, 432, 435-437,440,448,459,460,472

NPD, 1-4, 11,43,48,56,57,88,89,91,97,151, 191-194,231-234,236,265,266,363,366, 436,442,459,471,472

NPD regulations, 48, 234, 265, 266

NPV, 11,277,339,342,349,351,352

numerical simulation, 424

occupational accident, 66, 156

OREDA, 91, 92, 472

SUBJECT INDEX 479

overall risk level, 187, 364, 375,408, 442

oxygen, 143,215,224-226,246,372,395

passive fire protection, II, 15, 56, 86, 100, 119, 137, 138, 140, 189, 192, 193, 196,209,223,227, 230-232, 238, 239, 245, 346, 347, 353, 359, 366,405,427,447

personnel risk, 14, 22, 50, 52, 66, 67, 75, 204, 339, 364,388,406,463

PFEER,4, II, 194,36~,361,363-365,371,437,442

PFP,II,231,233,236,237,239,240

PHA,3, 11,70,109

pipeline failure, 213, 214

Piper Alpha, 2, 50, 88, 101, 105-107, 120, 121, 123, 1~1~1~1~1~lnl~I~I~ 224,245,271,371,379,471

platform design, 67, 265, 387, 472

platform specific modelling, 130, 139

platform topology, 297, 299

PLATO, II, 112, 127, 128,414,418,420,421

PLL, II, 14, 16, 17, 19,24-29,48,52,54, 158, 194, 201, 276, 277, 348, 349, 352, 361, 374, 375, 421

PLS criteria, 258

POB, 11,18,19,30,54,178

Preliminary Hazard Analysis, 3, 11,70, 109,416,428, 441,447

probability study, 77, 83

process accidents, 25, 32, 34, 35, 277, 398

process area, 138,265,267-270,272,274,275,371, 378, 381-383, 385, 386, 388-390, 397, 402, 403,407

process deck, 389, 397, 403, 404

process hazard study, 76

process leak, 10 I, 241

production delay risk, 14,398

public domain source, 90

pump room, 103, 133,330,331,392,396,403-405, 412

QRA, I, iii, iv, 1,3,4,12,14,24,30,36,37,68,71, 74,75,77,85-87,97-100,109,110,112,113, 115,122,127,133,134,138,151,161,162, 166, 188, 194,201,236-241,244,258,271, 273, 276, 334, 335, 337, 341, 344, 354-356, 359-361, 364-366, 368, 371, 373, 374, 384, 387, 399, 402, 410, 412-415, 420-422, 424, 432,442,474

qualitative scenario analysis, 169

quantification of risk, iii, 54, 59, 343, 462

RABL, 12,329-333,473

RAE, 12,56

real risk, 361

recovery time, 147, 148

regulatory requirements, 189, 417, 431

reliability, 9, 70, 82, 91, 92, 115, 118, 135, 136, 198, 208, 233, 262, 285, 303, 305, 357, 363, 367, 387, 406, 415, 423, 432, 440, 447, 457, 469-473

reliability analysis, 9, 70, 91, 92, 115, 136, 285, 387, 415,423,472

rescue, iv, 10-12, 14-16,57,77,84,92,100,102-104, 106, 108, 145, 146, 152, 153, 168, 172, 173, 177-185, 194, 195,328,378,401,410,412, 415,423,439,452,456

pick up, 108, 173, 182

rescue fatalities, 14, 15, 152, 177,452

rescue study, 178, 185

residual production phase, 28

Reynolds number, xvii, 320

riser and pipeline leaks, 116

riser failure, 213, 214, 326, 474

riser fire, 178 risk, I, iii-v, 1-28,30-38,41-56,58-68,70-72,74,75,

77, 82-86, 88, 89, 92, 96-98, 100, 104, 105, 108, 109, 111-113, 125, 126, 128, 129, 137, 139-141, 146-149, 151, 152, 154-160, 162, 165-167, 169, 171, 172, 177-179, 185-189, 191-197, 199-206, 211, 212, 230, 231, 233, 236, 239-241, 259, 261, 262, 273, 276-279, 281-289, 294-296, 301-303, 306, 307, 309, 310, 312, 316, 317, 330, 331, 334-339, 341-349, 351 , 353-361,363-388,391,393-400, 402-424,426,428,430-433,435-449,451-467, 469-474

dimensions of risk, 63, 84, 363

Risk Acceptance Criteria, 6-8, 12,24,37,41,47-52, 54,56,58,59,61-65,72,74,97,98,162,191, 195-197, 205, 334, 335, 354-357, 360, 361, 368, 369, 384, 435-438, 440-443, 445, 448, 457-462,466,474

risk acceptance criteria for temporary phases, 62, 63, 474

risk analysis, iii, iv, 1-4,9, II, 12,37,48,56,58,72, 74,77, 82, 84, 85, 88, 92,97,98, 104, 105, 108, 146, 165, 172, 188, 191-197, 199,200, 203, 354, 355, 360, 363, 368, 370, 371, 410-412,414, 419, 420, 426, 433, 436-439, 441-443, 445-448, 451, 453, 454, 456-466, 472-474

risk aversion, 13, 18,30,31,54,337,341,344,345, 440

risk estimation, 9, 18,23,53,68,72,74, 187,337, 372,374,376,448,449

risk level,S, 6, 9, 13,26,45,47,48,50, 51,53, 59, 62, 64,66,67,74,92, 156, 187, 191, 192, 194, 233,277,286,294,302,303,331,335-337, 344, 354-357, 360, 361, 363-376, 382, 384, 385,393,394,396,400,406,408,410,437, 438,442,445,460,462,463,465,466,474

risk monitoring, 371

480 SUBJECT INDEX

risk of material damage/production delay, 62

RRM, xviii, 12,337,342-344,347-349,352

Safety Case Regulations, 2, 4, 12,49, 193,355,356, 473

SAR, 12, 103, 172, 173, 175, 180-184,328,345,472

SBV, 12, 180

scenario based analysis, 162

Sea King, 172, 173, 175

sensitivity analysis, 85, 352

serious damage, 33, 34

shape coefficient, 320

shuttle tanker, 284, 312, 373, 382, 388, 391, 393, 396, 397,402,403,406,407

shuttling, 23, 28-30, 42,53, 175, 186, 187,291,292, 368

significant damage, 33, 34, 90, 212, 240, 279, 348-35 I, 360

significant effect, 60, 80, 124, 277, 358 SJA,3,12,442,461

slick thickness, 220, 222

small damage, 33

smoke, 49, 67, 76, 80, 96, 105, 106, 108, 118, 124, 1~1~1~1~1~1~lnl~l~ 215,223-226,265,361,390,418,425,452

smoke effects, 145,224

soot production, 144,225,226

spill risk, 58-60, 63, 66, 84, 398, 467

statistical simulation, 111, 153, 177, 255 steel jacket platform, 155,279,301

storage and offloading, 391, 471

stranding, 293,411,412

structural failure, 26, 62, 76, 82, 137, 143, 154, 177, 200,213,237,239,299,314,315,321,396

structuraJ failure study, 76 subsea equipment, 81, 321, 322

subsea gas leak, 266

sudden rupture, 125

suitability, 51-55,162,456

suitability for communication, 51 supply vessel, 90, 102,278,280,281,283,299,306 support structure, 57, 127, 145, 157, 189,212,213,

231,233,236,260,312,317,440

survivability, 82, 126, 135, 136,245,363,387,469

synthesis, 71, 185, 329, 330 system description, 77, 447, 449

system level, 110

tank intervention, 395, 404, 408, 409

tanker accident, 58

technological risk, 13

thermal effects, 145

thruster, 389, 396, 402, 407

thruster capacity, 389

towline, 35

toxicity, 144

TRA, I, 12, 100,461

trusses, 231, 237, 279, 307

turret, 191,388-391,394,396-398,400-405,407

UEL, 12, 126,248,392,442

UK Health and Safety Executive, 88, 156, 260, 280, 334,411,437

unacceptable environmental risk, 61

underwater production system, 12

uninsulated steel, 142

use of acceptance criteria, 63

use of design accidental events, 192 USFOS, 12,82,235-238,240,415,416,427

utility and marine systems, 392

VEC, 12, 34, 150, 442

ventilation, 130, 189, 197, 198, 209-211, 215, 224-226~ 231, 236, 250, 252,256,257,262, 263, 272-274, 356, 358, 360, 403, 405, 419, 427

vessel,6, 12,23,41,42,44,81,89,90,96,101-104, 108, 117, 125, 129, 141, 153, 179, 180, 182-184,208,211,218,231,250,251,278, 280-294, 296-308, 310-314, 316;· 317, 323, 326, 328, 332, 333, 373, 376-378, 382, 387-393, 396-398, 400-408, 410, 411, 415, 422,471

blind vessels, 282, 309, 310

VOC,I2,392

wellhead area, 133, 171,265,267-271 wellhead platform, 32, 34, 35, 100, 101, 265, 269,

370,399 West Vanguard, 101, 104, 174, 180,472

wireline operations, 118,373 WOAD, v, 12,34,88,90,91,243,278,320,470

workover, 78, 101, 118,318,373

Date post:	28-Nov-2021
Category:	Documents
Upload:	others
View:	12 times
Download:	0 times

OVERVIEW OF SOFTWARE

Documents