HSE Health & Safety

Executive

Review of the risk assessment of buoyancy loss (RABL) project

Prepared by BMT Fluid Mechanics Limited for the Health and Safety Executive 2003

RESEARCH REPORT 143

HSE Health & Safety

Executive

Review of the risk assessment of buoyancy loss (RABL) project

R.G. StandingBMT Fluid Mechanics Limited

Orlando House 1 Waldegrave Road

Teddington Middlesex

TW11 8LZ, UK

This report presents a review of the Norwegian ‘Risk Assessment of Buoyancy Loss’ (RABL) project, completed in 1988. RABL was undertaken in the aftermath of the Alexander L. Kielland and Ocean Ranger accidents. RABL’s stated purpose was to investigate causes of loss of buoyancy of semisubmersible drilling platforms, with the overall objective of developing an analytical procedure for consideration of buoyancy loss. This procedure was intended to be analogous to guidelines applied to fixed platforms in Norwegian waters.

RABL demonstrated that it is practical to carry out a risk assessment of buoyancy loss for semisubmersibles. The RABL methodology and procedure were considered to be robust and sensitive to differences between concepts, and RABL recommended that the new analysis methodology should be used to assess safety levels for new platform designs, or for existing platforms subject to changes in operational premises.

This report and the work it describes were funded by the Health and Safety Executive (HSE). Its contents, including any opinions and/or conclusions expressed, are those of the authors alone and do not necessarily reflect HSE policy.

HSE BOOKS

© Crown copyright 2003

First published 2003

ISBN 0 7176 2729 2All rights reserved. No part of this publication may bereproduced, stored in a retrieval system, or transmitted inany form or by any means (electronic, mechanical,photocopying, recording or otherwise) without the priorwritten permission of the copyright owner.

Applications for reproduction should be made in writing to: Licensing Division, Her Majesty's Stationery Office, St Clements House, 2-16 Colegate, Norwich NR3 1BQ or by e-mail to hmsolicensing@cabinet-office.x.gsi.gov.uk

ii

iv

EXECUTIVE SUMMARY

This report presents a review of the Norwegian ‘Risk Assessment of Buoyancy Loss’ (RABL) project, completed in 1988. RABL was undertaken in the aftermath of the Alexander L. Kielland and Ocean Ranger accidents. RABL’s stated purpose was to investigate causes of loss of buoyancy of semi­submersible drilling platforms, with the overall objective of developing an analytical procedure for consideration of buoyancy loss. This procedure was intended to be analogous to guidelines applied to fixed platforms in Norwegian waters.

RABL demonstrated that it is practical to carry out a risk assessment of buoyancy loss for semi­submersibles. The RABL methodology and procedure were considered to be robust and sensitive to differences between concepts, and RABL recommended that the new analysis methodology should be used to assess safety levels for new platform designs, or for existing platforms subject to changes in operational premises.

RABL found that the main hazards were ship collisions, ballast system failures and blowouts. Technical recommendations were made on each of these aspects.

RABL concluded that upper-deck reserve buoyancy (as required by NMD) provides a significant and essential margin of safety against moderate impacts from small vessels travelling at full speed. Loss of buoyancy from a column, following such a collision, was regarded as a ‘reasonably foreseeable’ event. These benefits must not be compromised, however, by structural damage to the deck/ column connection occurring at the same time as column failure. RABL’s findings suggest that the merits of upper-deck reserve buoyancy should be assessed again, to evaluate the likely practical benefits and difficulties of introducing such requirements for new platforms, or where existing rigs are converted for alternative use.

Key benefits of carrying out a risk-based assessment of buoyancy loss are:

• It provides a rational basis for considering different damage and flooding conditions (rather than the arbitrary damage areas and depths specified in traditional deterministic standards), for managing risks to personnel and to the rig itself, and for assessing the relative importance of different hazards.

• It quantifies the probabilities of occurrence of different accidental events, and their consequences (whereas traditional deterministic stability standards are concerned only with consequences of specified arbitrary damage events).

• It sets loss of buoyancy within the framework of quantitative risk assessment for the vessel and its operations as a whole.

The key question, however, is whether there is any pressing need to adopt risk-based stability standards. There seems to have been little pressure to change existing deterministic stability standards for semi-submersibles since RABL completed its work. There is no obvious evidence to suggest that rigs built to traditional stability standards are unsafe, and no obvious reason to subject the industry to the inconvenience and expense of change. Future developments therefore depend very largely on the industry and its regulators perceiving a pressing need for, and practical benefits from, such a change.

Practical difficulties will also undoubtedly emerge when risk-based procedures are used in earnest under real design conditions. The number of damage and flooding cases to be analysed, and the complexity of the analysis, require careful consideration before introducing new procedures, to ensure that the analysis is practical and not excessive.

A further key difficulty is that the RABL analysis and resulting risks were location-specific. It seems impractical to require MODU owners to re-analyse their unit before every rig move. It will therefore be necessary to develop a methodology for assessing risks based on a lifetime of use, rather than risks specific to one particular location.

RABL also recognised the vulnerability of any risk assessment procedure to lack of statistical data and to lack of insight about what are relevant and important failure modes. These are still issues of concern.

v

vi

Contents Page

Executive Summary ................................................................................................................................. v

1. Introduction ..................................................................................................................................... 11.1 Project Objectives............................................................................................................... 1

2. Scope of Work ................................................................................................................................. 32.1 RABL Project Reports........................................................................................................ 3

3. Background to the RABL Project.................................................................................................... 53.1 General ............................................................................................................................... 53.2 Key Events.......................................................................................................................... 53.3 Norwegian Initiatives ......................................................................................................... 6

4. Summary of the RABL Project........................................................................................................ 74.1 RABL Project Objectives ................................................................................................... 74.2 Safety Functions ................................................................................................................. 74.3 General Approach............................................................................................................... 94.4 Key Analysis Stages ........................................................................................................... 94.5 Case Studies...................................................................................................................... 124.6 RABL Conclusions and Recommendations...................................................................... 19

5. Related Issues ................................................................................................................................ 215.1 Probabilistic Stability Standards for Ships ....................................................................... 215.2 Damage Stability Standards for Passenger Ships and Cargo Vessels............................... 215.3 Tankers and FPSOs .......................................................................................................... 235.4 Jack-ups ............................................................................................................................ 235.5 Risk Acceptance Issues .................................................................................................... 245.6 Collision Frequencies ....................................................................................................... 25

6. Discussion...................................................................................................................................... 276.1 Comments on RABL and Ship Experience ...................................................................... 276.2 Key Factors Affecting Semi-Submersible Stability.......................................................... 276.3 Stability Calculations........................................................................................................ 286.4 Benefits and Practical Difficulties in Implementing Risk-Based Methods....................... 286.5 Reserve Buoyancy ............................................................................................................ 29

7. Conclusions ................................................................................................................................... 31

8. References ..................................................................................................................................... 33

Abbreviations and Notation.................................................................................................................... 37

Appendix A: Summary of RABL Project Reports ................................................................................ 39

vii

viii

Review of the Risk Assessment of Buoyancy Loss (RABL) Project

1. INTRODUCTION

BMT Fluid Mechanics Limited (BMT) was commissioned by the Health and Safety Executive (HSE) to review a series of reports [1 to 11] from the Norwegian ‘Risk Assessment of Buoyancy Loss’ (RABL) Project, issued in 1987 and 1988.

A full list of these and other references may be found in Section 8 on page 33 of this report.

The RABL Project was undertaken in the aftermath of the losses of the Alexander L. Kielland and Ocean Ranger in 1980 and 1982. RABL’s stated purpose was to investigate causes of loss of buoyancy of semi-submersible drilling platforms, with the overall objective of developing an analytical procedure for consideration of buoyancy loss. This procedure was intended to be analogous to guidelines applied to fixed platforms in Norwegian waters.

1.1 PROJECT OBJECTIVES

The original objectives of the present review study were defined to be as follows:

• To review a series of reports generated during the Norwegian RABL project (and related documents), in order to identify key issues affecting the assessment of semi-submersible stability;

• To assess the practical difficulties of implementing QRA methods for evaluating the stability of semi-submersibles, and of reconciling this approach with traditional prescriptive stability criteria;

• To review how risk-based stability assessment procedures are likely to impinge on other aspects of the design process, such as the evaluation of ship collision risks, fire and explosion risks, pollution risks, structural assessment issues, evacuation, escape and rescue, and human factors;

• To make observations on how a risk-based approach for assessing the stability of semi­submersibles might be developed in the medium to long term.

The first two objectives were met during the present study, as described in this report. The third objective was met by reviewing the way in which risk-based stability assessment procedures place demands on other aspects of the design process. Investigations into ship collision risks, fire and explosion risks, structural failure assessment, evacuation, escape and rescue, and human factors are thus pre-requisites for carrying out a risk-based stability assessment. The fourth objective was interpreted in terms of assessing the merits and feasibility of developing a risk-based stability approach.

1

2

2. SCOPE OF WORK

BMT’s main task was to review a series of RABL project reports [1 to 11] and related City University Conference papers [12 to 15], with a view to identifying issues that affect the assessment of semi­submersible stability. Key RABL project conclusions were reviewed, paying particular attention to conclusions about the practicality and difficulties of implementing risk-based procedures in design.

BMT also carried out a brief literature review to identify other key papers and reports, which were available in the public domain and relate to probabilistic and risk-based stability assessment. These documents related in particular to IMO probabilistic stability standards for ships, and risk assessment work for the HSE on jack-ups in transit.

2.1 RABL PROJECT REPORTS

The RABL project addressed the following issues:

• RABL report no. 1 [1] presents results from a review of past blowout incidents, and from model tests to evaluate the dynamic effects on a rig moored over a rising gas plume.

• RABL report no. 2 [2] describes an analysis methodology for assessing ballast systems, which was applied subsequently during RABL, and presents results from an initial ballast-system case study.

• RABL report no. 3 [3] presents an investigation into the frequency of collisions between ships and MODUs working on the Norwegian continental shelf.

• RABL report no. 4 [4] describes an analytical procedure for assessing the risk of buoyancy loss of a MODU following structural damage due to abnormal loads.

• RABL report no. 5 [5] investigates the probability that a mooring-induced accidental condition (i.e. tripping) will lead to capsize or sinking.

• RABL report no. 6 [6] presents the first of the two main case studies undertaken during RABL. Two different MODUs were investigated: the first for all hazards, and the second for ballast system failures only.

• RABL report no. 7 [7] presents the second of the two main case studies undertaken during RABL. A further two MODUs were investigated: the first for collisions, ballast system failures and fire/ explosions, and the second for ballast system failures only.

• RABL report no. 8 [8] is a synthesis report on the first phase of RABL, summarising analysis procedures, key results and conclusions from case studies performed up to that point.

• RABL report no. 9 [9] presents results from a follow-up investigation into a semi-submersible used as an accommodation platform (flotel).

• RABL report no. 10 [10] presents results from a further follow-up investigation into a semi­submersible used as a production platform.

• RABL report no. 11 [11] is a final summary report on the entire RABL programme, incorporating findings from the final two follow-up studies.

These eleven RABL project reports are summarised in Appendix A.

3

4

3. BACKGROUND TO THE RABL PROJECT

3.1 GENERAL

BMT’s present review study complements an earlier review for the HSE [16] of issues associated with the stability of semi-submersibles. The earlier review focussed almost exclusively on traditional deterministic stability standards, and excluded detailed discussion on risk-based methods. The practical difficulties of implementing risk-based methods in the short-term were noted, but the longer term benefits of placing stability assessment within a more rational and broader risk-based framework were recognised.

Probabilistic and risk-based procedures aim to quantify the risk of occurrence of events that may lead to loss of buoyancy, as well as the consequences of those events. Traditional deterministic stability criteria, in contrast, are concerned exclusively with ensuring the vessel’s safety after certain prescribed initiating events (i.e. specified damage and flooding conditions) have already taken place.

Probabilistic and risk-based procedures therefore have to address a far broader range of issues than traditional deterministic stability standards. The title of the RABL project refers to ‘buoyancy loss’ rather than stability, indicating the broader approach required. Storm damage, ship collision, ballast system failure, blowout, fire or explosion, or human error, for example, can all lead to buoyancy loss. The consequences also vary, depending on the severity of buoyancy loss. A small amount of flooding can result in the rig taking up an angle of heel, making it difficult for those on board to reach lifeboat stations or launch lifeboats, and affecting prospects for evacuation and escape. More severe damage and flooding can cause rapid sinking or capsize. Risks of all these different types of initiating events, together with consequential risks to personnel and rig, have to be considered.

Other related hazards and consequences may also have to be considered. Damage to a floating production unit can cause pollution risks. Although pollution risks are outside the remit of the HSE, the consequential risks of fire and explosion are of direct concern.

The benefits of probabilistic and risk-based methods have been widely recognised for many years, and probabilistic damage stability criteria have been developed for various classes of ships. Such methods enable risks from various sources to be compared, and the most important sources of risk to be identified, allowing decisions to be prioritised in a rational and cost-effective manner. Risk-based methods can also help when assessing research priorities, enabling scarce resources to be directed at issues that are likely to prove of most benefit.

The practical difficulties of implementing probabilistic and risk-based methods in vessel stability analysis have also been long recognised, however. Probabilistic methods are more complex to implement than traditional deterministic stability standards, because they have to consider many more damage conditions, and risks associated with complex combinations of events. Much of the detailed information needed to carry out such an assessment (such as the historical risks of certain rare events) is often lacking, or of uncertain accuracy.

Probabilistic and risk-based methods have nonetheless developed considerably since the RABL studies were completed, and are fundamental to the safety case approach adopted by the HSE and safety authorities elsewhere. It therefore seemed appropriate to re-examine the results from the RABL project, and to assess whether probabilistic and risk-based methods offer a practical means to carry out stability assessment work - either now or in the longer term.

3.2 KEY EVENTS

The Risk Assessment of Buoyancy Loss (RABL) Project was one of several initiatives by the Norwegian Maritime Directorate (NMD) following the loss of the Alexander L. Kielland in 1980 [17], and of the Ocean Ranger in 1982 [18, 19, 20]. Both accidents resulted in major loss of life (123 out of 212 on board the Alexander L. Kielland, and the entire 84-man crew of the Ocean Ranger), and subsequently led to major changes in the design of semi-submersibles, and in operating and regulatory practices worldwide.

5

The Alexander L. Kielland was a Pentagone-type design, and lost one of its five main support columns after failure of a horizontal bracing member in severe weather. The resulting massive loss of buoyancy led to capsize within about 30 minutes.

The Ocean Ranger was lost after a complex sequence of events, starting with breakage of a ballast control room window in heavy weather, malfunction of the ballast control panel, flooding of the forward ballast tanks, inability to empty these tanks because pump rooms were located at the stern of the vessel, errors by the crew in attempting to do so, and flooding of the chain lockers. Capsize took several hours, and a large number of crew members managed to evacuate by lifeboat or life-raft, but could not be rescued.

These and other accidents involving loss of stability of semi-submersibles are discussed further in BMT’s earlier review [16].

The issue of risk assessment of buoyancy loss for semi-submersibles has been brought into sharper focus by the recent loss of the P-36 semi-submersible floating production unit on the Brazilian Roncador Field in March 2001 [21]. Investigations indicated the following complex sequence of key events: over-pressure and rupture of an emergency drain tank (following earlier removal of a pump, insertion of blind flanges and valve leakage), leakage of gas and subsequent dispersion through ventilation ducts and opened hatches, gas ignition and explosion (killing 11 fire brigade members), automatic start-up of fire pumps causing flooding through a ruptured sea water pipe, progressive flooding of various tanks and compartments, submergence of chain locker hawse pipes initiating down­flooding. The unit had sufficient reserve buoyancy, however, to remain afloat for five days, allowing safe evacuation of all those who survived the initial explosion.

3.3 NORWEGIAN INITIATIVES

After the Alexander L. Kielland accident the NMD adopted a three-tier approach to stability standards. The first two tiers were the established intact and damaged stability philosophies, and the third was a requirement that the unit should withstand loss of buoyancy from either the whole or a major part of one column, but without any requirement to return to the upright position. The objective in this case was to allow the crew time to evacuate the unit. This requirement was expressed in terms of providing a maximum angle of heel after a large loss of righting moment, and a minimum level of reserve buoyancy above the damaged waterline. The concept of providing some level of reserve buoyancy, beyond that necessary to meet basic code requirements, has since been widely accepted [22]. The NMD’s proposals are not mandatory outside Norway, however, and International Maritime Organisation (IMO) Resolution A.651(16) [23] describes them as an ‘example’ of an alternative to the MODU Code 7o stability range and minimum righting arm requirements, applying only to units which have buoyant volumes contained in watertight upper-deck structures. NMD [24] requires all semi­submersible units to satisfy both their own conventional damage (based on a minimum area ratio) and reserve buoyancy criteria simultaneously.

The Norwegian Mobile Offshore Platform Stability (MOPS) project [25] considered alternative philosophies that might be adopted when developing future stability standards. While recommending no immediate changes to existing Norwegian regulations, MOPS recommended a move away from rigid prescriptive regulations to simple statements of aim, supported by non-mandatory guidelines. Such moves were considered likely to increase the overall safety of units, while encouraging stability to be integrated within an overall safety assessment. This general philosophy has now been embraced by various regulatory authorities, including the HSE.

MOPS considered that risk levels associated with different forms of damage should be further explored, and thus led directly to the RABL project, the aim of which was to develop an analysis procedure for defining accidental conditions and loads relating to buoyancy loss for mobile semi­submersible platforms. Criteria were also established for assessing whether a floating platform has satisfactory ‘floatability’ and stability.

6

4. SUMMARY OF THE RABL PROJECT

4.1 RABL PROJECT OBJECTIVES

None of the main RABL project reports contains a clear definitive statement of the project’s objectives. Appendix 1 of the final summary report [11] simply noted that the project’s main objective was to develop an analysis procedure for defining accidental conditions and loads related to loss of buoyancy for mobile semi-submersible platforms. A separate sub-contractor report [3] enlarged on this objective, stating that the purpose was to investigate various causes of loss of buoyancy of semi-submersible drilling platforms, with the overall objective of developing an analytical procedure for consideration of buoyancy loss. The aim was that this procedure should be analogous to guidelines for platform Concept Safety Evaluation (CSE), which were currently applied to fixed platforms in Norwegian waters. This overall objective was to be met in three ways:

i) by developing risk analysis methods for hazards affecting the seaworthiness of mobile platforms,

ii) by collecting data and establishing databases to supplement the methods and models developed,

iii) by carrying out case studies to demonstrate the methods and the use of the data.

4.2 SAFETY FUNCTIONS

The Norwegian Petroleum Act of 1985 defines three aspects of ‘total safety’:

• Personnel safety,

• Environmental safety,

• Safety related to investment/ production regularity.

The Norwegian Petroleum Directorate (NPD) requires that: ‘The platform design must be such that a design accidental event related to complete or partial (progressive) loss of buoyancy does not cause harm to personnel outside the area of the initial accident, or (for the partial loss) a danger to the platform integrity.’

The safety criteria and functions considered during the RABL programme were based on the ‘total safety’ concept, but placed primary emphasis on personnel safety. The design therefore had to ensure that rapid sinking or capsizing would not occur. Protection of the platform as an investment was considered to be a secondary priority. Environmental hazards were not considered.

A necessary survival period is needed to protect personnel as well as the installation itself, and five functional measures of platform safety were defined for this purpose. These so-called ‘safety functions’ were defined in relation to the effects of buoyancy loss, to match the concerns of the RABL project:

SF1: the platform shall remain in a floating condition for a period until external salvage assistance is possible (‘floatability’ function);

SF2: the platform shall remain in a condition with limited inclination so as to allow a safe evacuation, taking into consideration the accidental conditions that will exist on the platform (‘evacuation’ function);

SF3: at least one escape route shall be usable from central positions to a usable muster station for at least one hour after the accident (‘escape ways’ function);

SF4: the shelter area shall not be flooded until a safe evacuation has been completed (‘shelter area’ function);

SF5: safety control of marine and drilling operations shall not be lost until a safe evacuation has been completed (‘marine controls’ function).

Impairment of each of these safety functions was considered in relation to changes in the heel angle of the vessel over a period of time. Figure 1 illustrates typical relationships between safety functions and their limiting states. For example: impairment of the SF3 safety function does not occur provided the

7

inclination angle remains below a critical value (which RABL assumed to be 15o) for at least one hour. The intention in this case is to give sufficient time for personnel to escape safely. Other safety functions and associated durations are interpreted in a similar manner.

Figure 1: Illustrative relationship between safety functions and their limiting states.

The ‘floatability’ safety function is intended to ensure that the platform remains intact and afloat for long enough to obtain external salvage assistance, and is the only safety function concerned with protecting the installation itself. The platform may have to remain in this condition for a period of several days. This period should be not less than the time required to evacuate personnel.

RABL noted that this criterion could be interpreted simplistically as copying standard damage stability requirements, which determine maximum static heel angles associated with different combinations of failed compartments.

Loss of floatability may result in either capsize or sinking. These two scenarios were treated separately in the analysis where appropriate. RABL noted that it is possible to salvage a capsized platform, provided that it does not sink. For the purposes of RABL, however, it was assumed for simplicity that floatability is impaired if complete capsize occurs.

NMD requirements state that it should be possible to evacuate the platform in a safe and realistic manner within 15 minutes of the alarm being given. This time may be insufficient, however, to allow for seeking and assisting injured personnel. NPD requirements for production installations require that escape ways should be useable for one hour after an incident. RABL suggested that the time period associated with the ‘escape ways’ safety function should be sufficient to allow safe escape from all main areas, allowing for escape of injured personnel and control of the platform. This time period is both installation and location dependent. It will depend on available means of evacuation, possible external resources, distances to other installations and onshore, and other traffic in the area. Helicopters and lifeboats may be considered for evacuation. One hour was proposed [8] as the minimum time required for safe evacuation, unless particular circumstances justify a shorter period.

RABL assumed that personnel can only move safely and efficiently about the deck if the rig’s heel angle is less than 15o. This angle was therefore taken to be the upper limit for the ‘escape ways’ (SF3) safety function. Because this limiting angle is small, the frequency of impairment will often be highest for the SF3 safety function.

Safety functions were defined as functional requirements only. These general requirements have to be interpreted in relation to the design, layout and hazards present on the particular platform being analysed.

RABL report no. 10 [10] noted that a floating production unit operating on the Norwegian continental shelf falls under the jurisdiction of NPD. RABL did not concern itself with possible differences between the safety functions defined by NPD and those considered in the RABL project. The report noted, however, that the five safety functions considered by RABL covered a broader range than those

8

defined by NPD (escape ways, shelter area and support structure), and concluded that the RABL safety functions should be applicable to production units. The report also noted that RABL’s proposed cut­off limit (see Section 4.4.7) also matched that defined by NPD.

4.3 GENERAL APPROACH

The analysis approach developed during the RABL project was essentially the same as would be adopted in any risk assessment study. Key stages were summarised [11] as follows:

1. System description,

2. Hazard identification,

3. Definition of relevant accidental events,

4. Evaluation of consequences relative to the main safety functions,

5. Division into Design Accidental Events (DAEs) and Residual Accidental Events (RAEs),

6. Evaluation of RAE frequencies,

7. Comparison with cut-off limits,

8. Design load specification.

4.4 KEY ANALYSIS STAGES

4.4.1 System Description

The first stage, that of system description, is a relatively straightforward task. It involves preparing a general description of the system, limiting the extent of that system, identifying and describing system features that may be important for risk assessment.

4.4.2 Hazard Identification

The RABL programme was concerned with accidental loss of buoyancy through major ballasting failures, severe collisions or other high-energy related events. Attention was focussed primarily on severe events, although minor events with potential to escalate (and thereby become major events) were also considered. Hazards from the following initiating events were considered [8] to be applicable to large-scale buoyancy loss for semi-submersibles operating as drilling units in the North Sea and Northern Norway offshore areas:

• Subsea gas blowout,

• Ballast system failure,

• Collision with a ship or other installation,

• Mooring-induced heel,

• Dropped object or abnormal weight condition,

• Structural failure.

Structural failure events were further subdivided [8] into the following four categories:

• Burning blowout,

• Utility systems fire and explosion,

• Inherent structural failure,

• Extreme environmental loading.

The main part of the RABL programme was concerned with MODUs engaged in exploration drilling, appraisal and development drilling, but follow-up studies [9, 10] also considered hazards to accommodation and floating production units.

9

4.4.3 Definition of Relevant Accidental Events

The first stage in defining relevant accidental events is to develop a series of alternative accidental event trees. After the most relevant accidental event tree sequences have been identified, the next stage is to assess these event sequences in terms of their consequences and effects on the platform, and their frequencies of occurrence. The primary objective initially is to classify these accidental events into Design Accidental Events (DAEs), that the platform must be designed to withstand, and Residual Accidental Events (RAEs), which may impair one or more of the safety functions. These two types of events are treated separately in the analysis, as discussed in Section 4.4.5. Section 4.4.6 discusses the calculation of accidental event frequencies.

4.4.4 Evaluation of Consequences

There are two distinct stages in evaluating the risk of impairment of the safety functions: the first involves assessing the frequency of occurrence of the accidental event itself, and the second involves assessing the consequences of that event for the platform’s safety. A frequently-occurring accidental event is only significant for platform safety if it impairs one or more of the safety functions.

All accidental events and sequences therefore had to be assessed with regard to their consequences for platform safety. The RABL reports emphasised that the assessment of accidental effects was not part of the project’s work scope, and the analysis was therefore based on consequence models that already existed. These were found to be adequate for the purpose.

The assessment of accidental effects included traditional analyses, such as stability calculations and structural analyses, based on combinations of accidental events identified in the event trees. Certain event sequences had such severe and obvious consequences that the effects did not require further investigation. The analysis effort was therefore focussed on identifying critical conditions and loads that caused marginal impairment of the safety functions, and on the frequency of occurrence of those conditions.

4.4.5 Division into DAEs and RAEs

Accidental events that may lead to buoyancy loss are grouped into two separate classes, which are treated in two different ways in the analysis:

• ‘Design Accidental Events’ (DAEs) are events or conditions, the effects of which the platform must be designed to withstand. By definition, design accidental events do not impair any of the safety functions. A substantial amount of design analysis (e.g. structural and stability analysis) may be needed to identify critical design accidental events, and to ensure that the platform remains intact with no more than local damage.

• ‘Residual Accidental Events’ (RAEs) are events or conditions, the effects of which the platform is assumed to be incapable of withstanding. These events may cause impairment of one or more of the safety functions. No detailed design analysis is performed for these conditions. A risk analysis is performed instead, to ensure that the annual frequency of such events lies below an acceptable cut-off limit for each hazard category and for each safety function.

This approach keeps the design analysis within rationally defined limits, focussing on critical design conditions. At the same time it allows residual risks to the platform to be quantified.

RABL noted that there is often an element of iteration involved in the analysis process, especially in the classification of Design and Residual Accidental Events. Initial calculations may show that the risk associated with a particular hazard is so high that it has to be re-classified from a RAE to a DAE, or conversely that the risk is so low that the event may be considered a RAE rather than a DAE.

4.4.6 Evaluation of RAE Frequencies

RAE frequencies are estimated using standard risk/ probability procedures for combining frequencies in an event tree. Some of the frequency values used in the analysis are likely to be standard values, while others may be based on historical accident statistics combined with engineering judgement. Certain frequency values may have to be estimated subjectively, and may be little more than order-of-

10

magnitude estimates. Such estimates should generally err on the conservative side, thus overestimating some of the risks. Cut-off limits should therefore always be considered in relation to levels of uncertainty and conservatism in the underlying frequency estimates.

Accidental event frequencies are strictly only needed for Residual Accidental Events, although it is often appropriate to assess frequencies of all accidental events, on the grounds that it is not known initially which events will be classified as DAEs, and which as RAEs.

4.4.7 Comparison with Cut-off Limits

The RABL programme assumed that an acceptable cut-off limit for each hazard category and safety function would generally lie in the range 5×10-5 to 5×10-4 per platform year, with a central value equal to 1×10-4 per platform year.

Figure 2: Illustration of the use of cut-off limits.

Figure 2 illustrates the way in which these cut-off limits were applied. It shows the annual frequency of occurrence for each identified hazard category (e.g. ship collision, ballast system failure, blowout, etc.) A reduction in the frequency of occurrence of a particular hazard is regarded as imperative if the frequency is found to be greater than 5×10-4 per platform year, and must be considered if the frequency is greater than 5×10-5 per platform year. No reduction is necessary if the frequency is less than 5×10-5

per platform year, although some reduction in certain hazards may be worthwhile.

Finding an RAE frequency value above the cut-off limit does not necessarily mean that reduction measures will always have to be implemented - only that the feasibility of such measures must be assessed in relation to technical and economic factors (i.e. consistent with ALARP principles.) Impairment frequencies below the cut-off limit do not necessarily mean that no further actions can be implemented - only that they are voluntary.

The approach adopted in RABL [8] was to evaluate RAE frequencies against cut-off limits for each hazard and each safety function separately 1, this approach being consistent with principles used by NPD [26]. A very low value in one category must not therefore be used to compensate for a high value in another. It is necessary, however, to add together risks associated with all accidental events within a

There is clear justification for considering RAE frequencies for each safety function separately, because these functions provide different measures of platform safety, and the risk of impairment of every one of these measures must be low. The rationale for considering RAE frequencies for each hazard separately is not so obvious, however. RAE frequencies calculated in this way depend on the way in which hazards are classified, and it might be argued that the total risk from all hazards is more critical for overall platform safety than the risk from each hazard individually.

11

1

single hazard category, before comparing the total risk with the cut-off criterion. Thus risks from all types of vessel collisions have to be combined together, before making the comparison.

RABL noted [8] that life cycle risks may be estimated for fixed installations, but not for mobile units, because a mobile unit may operate anywhere in the world. The RABL assessment was therefore based on assuming that the rig carries out the same type of operation at one location for one complete year. This assumption should also be borne in mind when assessing the need for risk reduction measures.

4.4.8 Design Load Specification

The Design Accidental Events identified above are intended to form the design basis for the platform in cases where the safety evaluation is performed prior to detailed design. The initial DAE assessment assumes that certain loads and conditions can be tolerated by the platform systems and structure. The role of detailed engineering design is to ensure that these assumptions are correct. Detailed design must be in accordance with the safety standards assumed when carrying out the initial DAE assessment.

Details of design conditions considered during the RABL project are described in the case study reports.

4.5 CASE STUDIES

Case studies were performed on semi-submersible units designed to several different standards, operating at various locations on the Norwegian continental shelf, in order to demonstrate the analysis procedure, reveal areas of difficulty and uncertainty, discover the most important risk elements, quantify those risks and their sensitivity to platform location, design and operations. These case studies included:

• An initial study [2], to demonstrate the RABL analysis methodology for ballast system failures, on West Vision, a so-called ‘third-generation’ 2 drilling rig.

• A comparative study of two ‘second generation’ 2 units [6], based on Deep Sea Bergen and Treasure Scout. Deep Sea Bergen was built in 1982 to NMD regulations issued after the Alexander L. Kielland accident, with sufficient reserve buoyancy to withstand loss of buoyancy from a complete column. Treasure Scout was a Pacesetter platform, delivered in 1982 and subsequently converted to comply with NMD post-Alexander L. Kielland requirements. Both rigs had only one ballast pump room in each pontoon. Deep Sea Bergen was investigated for all hazards, and Treasure Scout for ballast system failures only.

• A further comparative study [7] based on the unconverted (‘first generation’ 2 ) version of Treasure Hunter and West Vision. Treasure Hunter was built in 1977, before NMD regulations were revised in 1982/3, with no reserve buoyancy and only one pump room in each pontoon. West Vision was representative of a ‘third generation’ 2 design, with reserve buoyancy and pump rooms at both ends of each pontoon. Treasure Hunter was investigated for collisions, ballast system failures and fire/ explosion, and West Vision for ballast system failures only.

• Follow-up studies [9, 10] investigated differences between semi-submersibles used as drilling rigs, accommodation and floating production units.

Supporting work was undertaken to assess the following aspects of the analysis:

• An initial evaluation of blowout risks and consequences [1];

2 ‘First generation’ units were designed and built according to regulations in force before the Alexander L. Kielland accident. ‘Second generation’ units were designed and built after the Alexander L. Kielland accident, from 1982 onwards, and complied with NMD regulations requiring reserve buoyancy within the deck structure (see Section 3.3). ‘Third generation’ units were designed and built after the Ocean Ranger accident, from 1985/6 onwards, with ballast rooms at both ends of each pontoon, and improved stability characteristics.

12

• An investigation [3] into risks of collision from different classes of ships (powered passing vessels, drifting vessels, and powered visiting vessels) at three alternative locations (Askeladden in the Troms area, Troll and Statfjord Fields);

• An assessment [4] of the risk of buoyancy loss following structural damage due to abnormal loads;

• An assessment [5] of the risk that a mooring-induced accidental condition (‘tripping’) will lead to capsize or sinking.

Key results and conclusions from these studies are summarised below.

4.5.1 Methodology

These case studies demonstrated that it was feasible to apply the analysis methodology developed during RABL to specific platform designs, and the results were reasonable. The methodology seemed robust enough to differentiate between different platform designs and concepts.

The risk associated with ballast system failures was reduced to a low level for a third-generation platform. In this case all significant hazards were associated with loss of structural integrity. Consequence calculations were therefore focussed primarily on structural aspects rather than stability issues [8]. Large uncertainties were found in some of the parameters in the structural response analysis, and the most appropriate way to reflect these uncertainties in the end results would be through the use of reliability analysis methods. One case study showed that this was feasible.

Stability assessment requirements were largely met by using information contained in conventional stability books.

The ballast failure frequency model was developed using an event/ fault tree approach. A new fault tree had to be constructed for each ballast system to reflect specific system features. Significant difficulties were found in modelling human factors, control systems and common mode failures, the first of which had the greatest impact on the results [8].

Figure 3: Residual risk levels for a typical second-generation MODU.

The case studies focussed primarily on three safety functions, in the following order of priority:

• The ‘escape ways’ safety function (SF3): based on whether the vessel’s inclination exceeded 15o

within one hour, making escape over the deck difficult;

13

• The ‘floatability’ safety function (SF1): based on whether the vessel’s inclination exceeded a critical angle at which stability was permanently lost, causing rapid filling, followed by sinking or capsize;

• The ‘evacuation’ safety function (SF2).

In one case study [6] all safety functions were assessed for ballast system failure only.

Figure 3 shows residual levels of risk for a typical second-generation semi-submersible drilling unit, built in 1982, engaged in exploration drilling at the Smørbukk Sør location [6]. Results are shown for the ‘escape ways’ and ‘floatability’ (SF3 and SF1) safety functions for all types of hazards. Ship collisions, burning blowouts and ballast system failures (for SF3) were the most critical classes of hazards in this case, with high levels of risk. Other risks were generally considered to be small.

4.5.2 Ship Collisions

RABL [3] found that the probability of a high-energy ship collision was higher than had previously been anticipated, and that there was a significant risk of severe damage in consequence. Special attention was therefore paid to quantifying ship collision risks. The analysis considered various sizes of powered passing vessels, drifting vessels and powered visiting vessels. It considered shipping routes and densities, effectiveness of watch-keeping, failure to take corrective action, the ‘plannability’ factor (i.e. the probability that the ship’s master will make plans in advance to avoid the platform), and platform-initiated recovery (i.e. the probability that the platform will alert the ship in time to prevent a collision).

Figure 4 shows annual frequencies of SF1 (floatability) impairment due to collisions from different classes of ships - for a ‘second-generation’ drilling unit operating at the Smørbukk Sør and Draugen locations [11]. Passing merchant vessels were the dominating risk factor at Draugen, because it was close to a route used by ore carriers. Even small changes in location were found to have a significant effect on risk levels.

Figure 4: Comparison between SF1 impairment frequencies through collision at the Draugen and Smørbukk Sør locations.

RABL [3] recommended various actions to reduce uncertainties in these estimates. These uncertainties related mainly to the possibility of last-minute evasive action, differences between permanent installations and MODUs (the latter not being marked on navigational charts), differences in navigational behaviour around stand-alone mobile units and units operating close to other installations,

14

the platform’s location relative to the shipping lane, and statistical uncertainties in traffic and other parameters.

RABL [8] suggested that the case study results have an uncertainty of about one order of magnitude, but noted that ship collisions would still be a significant risk factor, even if their frequency was reduced by one order of magnitude. Impact energies in the range 20 to 80 MJ were found to have the highest frequencies [8].

Upper-deck reserve buoyancy provided a survival capacity equivalent to an impact energy in the range 60 MJ to 70 MJ, whereas a rig without reserve buoyancy failed at 20 MJ to 25 MJ. Reserve buoyancy therefore provides a significant level of protection against visiting vessels (e.g. supply vessels typical of those in use at the time of RABL, colliding at high speed) 3. Collisions of this type occur with significant frequency. Upper-deck reserve buoyancy also protects against collisions by the smaller of the passing merchant vessels. No protection is possible against collision with larger merchant vessels, but the frequency of these collisions is low at most offshore locations.

Case study results [7] for a ‘first-generation’ rig showed that a collision from any class of ship could lead to ‘two-compartment’ damage, causing a heel angle greater than 15o, and therefore impairment of the ‘escape ways’ (SF3) safety function. A collision from a ship with a displacement greater than about 1,100 tonnes would most probably lead to rig capsize (i.e. impairment of the ‘floatability’ safety function, SF1).

The two case studies found relatively little difference [8] between ‘escape ways’ impairment frequencies for ‘first’ and ‘second-generation’ rigs (Treasure Hunter and Deep Sea Bergen). Impairment frequencies for these two rigs, when engaged in exploration drilling at the Troll West location, were 2.7×10-2 and 2.0×10-2 per platform year respectively.

Calculations showed [8] that a collision sufficiently severe to cause structural failure of a column of the ‘second-generation’ rig was also likely to cause openings in the upper deck structure large enough to cause flooding within one hour, thereby impairing upper-deck reserve buoyancy and the SF1 safety function.

Case study results [8] indicated that the impairment frequency for the SF1 (floatability) safety function was between 1.9×10-3 and 1.7×10-2 per platform year, depending on location. A value of 2.3×10-3 was indicated by WOAD worldwide accident statistics. These values also fell within the (very broad) range indicated by an earlier JP Kenny study. 4

The final RABL report [11] noted that, although collision frequencies were high for mobile platforms, they were significantly lower for semi-submersibles used as accommodation (flotel) or production units. The main reason was that producing installations (including the installation to which the flotel is attached) are marked on navigation charts. There is an additional source of collision risk for a flotel, however: that of drifting into the fixed platform, following mooring line failure. The resulting risks were assessed to be small on a third-generation platform, because most modern platforms have significant thruster capacity, which can counteract the effects of multiple mooring line failure.

4.5.3 Ballast System Failure

The second main contributor to risk, for second-generation and earlier rigs, proved to be ballast system failures. Table 1 compares frequencies of impairment of the ‘escape ways’ safety function (SF3) due to ballast system failures for all four case study platforms [8].

3 The RABL analysis assumed a 2,200 tonne visiting vessel colliding head-on at 15 knots, having an impact energy in the 60 MJ to 70 MJ range. Reserve buoyancy will only provide protection against a large modern platform supply vessel colliding at low to moderate speeds.

4 BMT’s review study [16] suggested that it is over-simplistic to compare collision frequencies predicted by RABL with total MODU accident statistics, without considering the causes of those accidents. Collisions seemed to be a minor factor in the accidents considered in [16].

15

There were some inconsistencies in the analyses applied to these four platforms. Secondary effects of fires, explosions and collisions on the ballast system were included in some cases, but not in others. The results nonetheless indicate only small differences between impairment frequencies for the ‘first generation’ and ‘second generation’ units, all of which had a single pump room at one end of each pontoon. The ‘third generation’ design showed a significant reduction in risk associated with ballast system failure. This improvement was partly the result of having two pump rooms, fore and aft, in each pontoon, but also partly due to the higher level of flexibility and redundancy in this system. Redundancy, in particular, had a clear influence on risk levels.

Table 1: Impairment frequencies for the ‘escape ways’ safety function (SF3) due to ballast system failures.

Platform Type 5 Frequency per platform year

Treasure Hunter (unconverted) Deep Sea Bergen Treasure Scout West Vision

First generation 1.0×10-3

Second generation 1.8×10-3

Second generation 1.2×10-3

Third generation 1.0×10-5

The West Vision case study [7] also showed that:

• Human maloperation of the ballast system, combined with single component failure, was probably the most critical combination of failure conditions;

• Corrective actions could prevent the platform from reaching its critical heel angle, because of operational flexibility and tolerances built into the system design;

• Operational and survival draughts for West Vision were identical. Impairment frequencies would be higher on a platform where the ballast system has to be activated to go from operational to survival draught in severe weather.

It was found necessary to take the detailed layout and design of each particular ballast system into account, including possible combinations of failure conditions. FMEA alone would not be sufficient for this type of assessment.

Differences between the stability characteristics of the four platforms (i.e. which accidental flooding conditions the platform could tolerate without excessive heeling) also had a significant effect on impairment frequencies.

Impairment frequencies for an accommodation or production unit, due to ballast system failures, were considered likely to be approximately the same as for a drilling unit, assuming an identical vessel and ballast system [11].

4.5.4 Fire, Explosion and Blowout

Blowout (including consequent risks of explosion, fire and loss of buoyancy) turned out to be the third main contributor to impairment risk.

Total blowout frequencies during exploration and development drilling worldwide were found [1] to be 7.2×10-3 and 2.1×10-3 per well year respectively. These frequencies increased to 2.4×10-2 and 7.3×10-3

respectively per platform year. Annual frequencies for exploration drilling were considered to be so high that a detailed analysis of consequences was recommended.

When consequences were taken into account, RAE frequencies for impairment of the ‘escape ways’ safety function (SF3) due to blowout were reduced to 7.4×10-4 and 1.7×10-6 per platform year for Deep Sea Bergen and Treasure Hunter respectively [8]. Differences between these two results seem to have

5 See footnote on page 12.

16

been due partly to differences between the structural capabilities of the two platforms, and partly due to differences of opinion in the two case study analyses.

Blowouts often have very severe consequences that cannot be designed against. The only effective ways to reduce risk are therefore either to reduce the frequency of blowout, or to reduce the risk of exposure to the consequences of blowout. The first (and most cost-effective) priority is therefore to prevent blowout in the first place. The second is to ensure that the platform can re-locate quickly in the event of blowout.

Model test investigations showed that reduced fluid density and up-welling posed little direct threat to the stability of a semi-submersible moored above a rising gas plume [1]. The main hazards were associated with ignition of the gas or oil, creating a long-lasting fire, possibly combined with an explosion. These hazards clearly depend strongly on field and reservoir characteristics.

A mobile platform has an advantage over a fixed platform, because it can re-locate, thereby escaping burning oil and gas on the sea surface. Experience on the Norwegian continental shelf nonetheless indicated that reliable re-location may be a problem [11].

Blowout is clearly not a hazard for an accommodation platform, but is a significant hazard for a production unit with wells directly beneath the unit. Statistics showed, however, that blowout frequencies are somewhat lower during the production phase than during exploration drilling.

A number of other fire and explosion hazards were also considered during RABL. These included hydrocarbon leaks from utility systems, or from process systems, risers and pipelines on production units. Risks were generally found to be less than those from blowout. Process system fires would be located mainly on upper decks, and would have limited potential to cause major structural problems. Riser leaks, however, especially from flexible risers without subsea isolation, were considered to be a significant hazard [11]. They could cause a long-lasting and severe fire, threatening platform integrity.

4.5.5 Other Hazards

Other hazards listed in Section 4.4.2 were generally found to be of minor importance (see Figure 3). Falling loads, mooring-induced heel (‘tripping’), inherent structural failures and extreme environmental loads all came into this category. Some of these hazards might become more significant, however, if risk levels associated with collisions and ballast system failures are reduced.

4.5.6 Stability Analysis Findings

The consequence analyses undertaken during RABL were based largely on standard hydrostatic stability and structural analysis procedures. The hazards of interest were considered to be those associated with damage stability conditions. Intact stability was not considered to be an issue. Righting (GZ) and heeling moment arm curves contained in ordinary stability books largely served as the basis for evaluating impairment of safety functions. The analysis considered the possibility of multi-compartment damage, in addition to one-compartment damage conditions specified in the IMO MODU Code [27]. All except the oldest rig (Treasure Hunter) complied with current Norwegian (NMD) regulations [24], and were designed to survive much higher levels of damage than are specified in the MODU Code, having sufficient reserve buoyancy in the upper deck to withstand loss of buoyancy from any one column.

Relevant findings from the case studies [6, 7] were as follows:

1. The first-generation rig, Treasure Hunter, had not been designed to withstand major loss of buoyancy from a single column. Analyses undertaken by RABL found that:

• Filling one of the forward ballast tanks or a machinery/ pump room caused the rig’s heel angle to exceed 15o in the absence of wind, causing impairment of the ‘escape ways’ safety function (SF3),

• Filling any one of certain other ballast tanks was also unacceptable in severe weather,

• Filling of other single tanks might be critical, depending on wave motions,

17

• Unintentional filling of two or more tanks was unacceptable. This could result in flooding of the chain lockers, and further filling of compartments through air pipes, threatening the ‘floatability’ safety function (SF1).

2. All of the other three rigs had been designed to current NMD regulations, and one-compartment filling never caused the heel angle of any of these three rigs to exceed 15o, although it sometimes came close to this value.

3. In all three cases, several combinations of two-compartment flooding in a strong (50 knot) wind led to impairment of the ‘escape ways’ safety function (SF3).

4. In the case of Deep Sea Bergen, filling of more than two tanks was not considered, as it was concluded that the platform could not tolerate this level of filling without exceeding the critical heel angle.

5. Treasure Scout was more robust against two-tank filling than Deep Sea Bergen. The probability of exceeding the critical 15o heel angle on Treasure Scout was 0.44, considering all combinations of two flooded ballast tanks, and taking into account the possibility of flooding more than two tanks.

6. Although the initiating event frequency for ballast system failures on Treasure Scout was slightly higher than for Deep Sea Bergen, resulting impairment frequencies for all safety functions on Treasure Scout were significantly lower, because of this rig’s greater robustness against flooding. The difference between impairment frequencies was relatively small for the ‘escape ways’ (SF3) safety function, and greatest for the ‘floatability’ (SF1) safety function.

7. System flexibility was found to be essential in cases where there was only one ballast pump room in each pontoon. Stability characteristics were also very important, however, defining accidental flooding conditions that the platform could withstand without incurring excessive heel.

8. RABL strongly supported Norwegian regulations [24] requiring reserve buoyancy in the upper deck. This issue is discussed further in Section 4.5.7.

4.5.7 Reserve Buoyancy

RABL [8] noted that the most likely mode of failure, following a major ship collision, was structural failure of a column, and recommended that damage stability standards should address this scenario.

A structural investigation [6] on Deep Sea Bergen investigated the benefits of having deck reserve buoyancy. The RABL synthesis report [8] concluded that a platform with reserve buoyancy could survive impacts with energies up to about 65 MJ, whereas the same platform without reserve buoyancy would fail at around 22 MJ. This result was based on calculations which showed that a semi­submersible shell structure could absorb impacts in the 20 MJ to 25 MJ range without suffering indentations greater than 1.5m (the maximum depth of damage specified in traditional damaged stability standards). At 60 MJ to 70 MJ the structural integrity of the column as a whole, and of the deck-structure connection, became doubtful.

Probabilities of exceeding the 22 MJ and 65 MJ survival thresholds were estimated [8] at two different locations (high and low traffic densities). At the low traffic density location (ignoring low-speed attendant vessels) there was 98% probability of exceeding the 1.5m penetration depth, given that collision occurs, whereas there was only 66% probability of exceeding the reserve buoyancy limit. Corresponding values for the high traffic density location were 98% and 22% respectively.

Case study results indicated, however, that a significant part of the deck volume could be flooded in the same incident as the column, due to failure in the connection between the deck and column, largely negating the benefits gained through having reserve buoyancy in the deck. Some form of watertight division between the deck and column was therefore suggested [11] to ensure that reserve deck buoyancy remains effective, and this solution was regarded as being both practical and relatively cheap.

The case study concluded that reserve buoyancy in the deck structure, as required by NMD [24] regulations (see Section 3.3), provides a significant and necessary increase in the safety margin for

18

such platforms [8]. Collisions were found to be the only type of accident, however, where the risk level was sufficiently high to show a demonstrable need for reserve buoyancy.

4.6 RABL CONCLUSIONS AND RECOMMENDATIONS

RABL report no. 11 [11] summarised the project’s final conclusions and recommendations. The analysis methodology and procedure were considered to be robust and sensitive to differences between concepts, and it was recommended that the new analysis methodology should be used to assess safety levels for new platform designs, or for existing platforms subject to changes in operational premises.

RABL nonetheless recognised the vulnerability of any risk assessment procedure to lack of statistical data and to lack of insight about what are relevant and important failure modes. Risk assessment has become more firmly established, and accident statistics more available, since the RABL work took place, but the limitations of the historical record and lack of insight are still major concerns.

RABL found that the main hazards were ship collisions, ballast system failures and blowouts. Technical recommendations [11] included the following:

• Collision risk requires the greatest attention, particularly focussing on collision prevention measures. These might include warning systems and extended exclusion zones in specific cases. The report also recommended further studies to define true collision risk levels.

• Reserve buoyancy in the upper deck was regarded as essential to protect the platform against ship collisions, and should be made as effective as possible, to withstand moderate collisions with a small vessel travelling at full speed. The design should also prevent, as far as possible, loss of reserve deck buoyancy following structural failure of a column. Loss of reserve deck buoyancy after such failures might be avoided quite simply and cheaply.

• Having ballast rooms at all four corners of the rig significantly reduced risk levels. Such systems also provide important benefits in terms of redundancy and flexibility. It is important, however, to arrange the system so that human failure cannot easily lead to a critical condition.

• Risk assessment was recommended, in addition to FMEA studies on ballast systems, because FMEA studies are not capable of assessing failure combinations adequately.

• The most effective way to reduce risks associated with blowouts is to reduce their frequency of occurrence. Risks associated with fire and explosion can be reduced by maximising the probability of being able to relocate the platform quickly following a blowout.

• Risks associated with semi-submersibles used as accommodation units were generally similar to those associated with mobile drilling units, and the same recommendations applied.

• The main additional recommendation for a floating production unit was to prevent long-lasting gas fires caused by pipeline or riser leaks, especially where flexible gas export risers are used. Subsea isolation of the leak is particularly worthwhile.

19

20

5. RELATED ISSUES

5.1 PROBABILISTIC STABILITY STANDARDS FOR SHIPS

The approach developed by RABL for semi-submersible units has been paralleled by developments in probabilistic stability standards for ships. The practical difficulties experienced in developing, gaining acceptance for, and implementing these standards are relevant to the discussion on developing probabilistic standards for semi-submersibles.

The International Maritime Organisation (IMO) has long recognised the deficiencies of traditional deterministic ship stability standards, and started a programme of work to develop ‘rational’ criteria in the late 1960s. This was recognised to be a difficult task, however, because there is no simple relationship between a ship’s parameters and its ability to survive all possible dangerous situations that it may encounter during its life.

Kobylinski [28], reviewing the history of the IMO’s attempts to develop ‘rational’ criteria, noted that the word ‘rational’ means different things to different people. Research efforts have therefore diverged in many different directions. The development of probabilistic stability standards was part of this broad range of activities. An IMO working group had recommended long-term theoretical and experimental investigations, including measurements on board ships, and indicated that it was unrealistic to expect to achieve results in the short term. The present state of knowledge on the physics of capsize was regarded as inadequate. Research was to be encouraged to better understand ship motions in confused seas and capsizing phenomena, and the identification of parameters influencing capsize.

Noting, however, that operational factors (including human factors) have been responsible for 80% to 90% of casualties at sea, Kobylinski [28] now considered that the best way forward was likely to be through a combination of operational measures, including advice to masters, education and training, together with the adoption of Formal Safety Assessment (FSA) methods. This methodology should include risk evaluation using probabilistic methods, and might involve calculating a risk function in selected conditions considered to be dangerous.

Strong arguments have been put forward in favour of developing probabilistic stability standards for ships, and numerous papers have been published on this topic, many at a series of Conferences on the Stability of Ships and Ocean Vehicles. The fifth such conference in 1994 featured a special workshop on the probabilistic approach to stability standards. The word ‘probabilistic’ has been interpreted in different ways by different researchers, however. Attempts have been made to develop probabilistic models of the environment, of the ship’s characteristics and behaviour, human factors, and the hazards experienced over its lifetime. Kobylinski [28] noted that the complexities of non-linear behaviour of even fairly simple mathematical models make the results very difficult to interpret in terms of probabilities of capsize. He believed that none of these approaches is likely to be practical or realistic at present or in the near future, and concluded that existing criteria adequately serve the design purpose, although they cannot assure absolute safety.

Svensen [29] nonetheless argued for the adoption of probabilistic methods, on the grounds that they are less arbitrary than deterministic standards, and provide a more objective measure of the vessel’s survival capability in case of damage. Events having a higher likelihood carry a heavier weight, and events with a very low probability of occurrence have a smaller influence on the results. Deterministic concepts of rule damage of a predefined size do not always reflect real life.

The challenge is to come up with a probabilistic standard that is practical to use, is sufficiently rigorous to manage important risks, is applicable to a sufficiently wide class of vessels, and gives sufficient freedom to achieve efficiency and economy in design.

5.2 DAMAGE STABILITY STANDARDS FOR PASSENGER SHIPS AND CARGO VESSELS

Probabilistic damage stability standards for passenger vessels were first introduced by IMO in 1967 as an alternative to the deterministic requirements of SOLAS-60. IMO Resolution A.265(VIII) for passenger ships [30], adopted in 1973, took the probability of survival after collision as a measure of

21

the ship’s safety in the damaged condition, taking both one-compartment and multiple-compartment damage into account. The criteria defined in Resolution A.265(VIII) may still be used for passenger ships, as an alternative to the stability standards in SOLAS 2001 [31], which remain deterministic. Probabilistic subdivision and damage stability standards for cargo ships have, however, already been incorporated into Part B-1 of SOLAS 2001 [31].

These probabilistic stability standards compare a so-called ‘Attained Subdivision Index’, A, with a ‘Required Subdivision Index’, R. The ‘Attained Subdivision Index’ is defined as A = ∑ s p , where i i

pi represents the probability of flooding of a given compartment or group of compartments, and si represents the probability of survival with that given damage. The Attained Index has to take into account all possible sizes of damage, and each damage condition is weighted according to the probability that such damage can be expected. Specified formulae for calculating R and pi depend on the number of passengers carried and lifeboats available (in the case of passenger ships), the subdivision length of the ship, and the locations and lengths of compartments. Survivability is measured in terms of the parameter si , calculated from properties of the residual stability curve.

The SOLAS-90 standard came into force in 1990, following a number of passenger ship casualties. Svensen [29] noted, however, that both SOLAS-90 and existing IMO probabilistic standards, such as Resolution A.265(VIII), have several major shortcomings when applied to passenger Ro-Ro vessels. Flooding of the car deck does not have to be considered, and cargo shifting is not considered as a risk. Svensen recommended that any new standard for passenger Ro-Ro vessels should be based on the probabilistic approach, and should include major risks such as flooding of the car deck and cargo shift. It should also aim to manage residual risks, so as to prevent rapid capsize in damage conditions where the vessel does not survive, so that the number of fatalities is kept as low as reasonably practical.

Work undertaken by organisations from a number of North-West European countries, following the Estonia and Herald of Free Enterprise accidents, led to the so-called ‘Stockholm Agreement’ [32], which now applies to all UK Ro-Ro passenger ships in certain classes, and to non-UK ships when they are in UK ports. This standard is still based on SOLAS-90 deterministic procedures, however.

Svensen [29] and Rusås [33] describe the objectives and work scope of a North-West European project ‘Safety of Passenger/ Ro-Ro Vessels’. The primary aim of this project was to devise proposals for new design requirements leading to improved safety for new vessels, paying special attention to damaged and flooded conditions. The project group recognised early on, however, that other risks should be considered in an overall risk assessment. In particular, it was considered important to ensure that other risks were not increased as a consequence of design changes made to increase vessel stability.

The IMO SLF Committee is currently revising Chapter II-1 of the SOLAS standard, with the aim of harmonising the subdivision and damage stability provisions for passenger and cargo ships. It is understood that the new standard is likely to be based on the probabilistic ‘Attained Subdivision Index’ approach, and will take account of results from the EU ‘HARDER’ research project. The Committee aims to complete its work in 2003, and the revised chapter is planned to take effect in 2006.

5.2.1 Reported Problem Issues

Several authors have reported difficulties in applying IMO probabilistic standards, such as resolution A.265(VIII). Compared with traditional deterministic procedures, greater effort is needed to carry out the analysis, and significantly more damage cases have to be considered. Real vessels may require thousands of damage cases to be considered, and only the use of special-purpose programs makes this feasible [34].

Koelman et al. [35] cited further difficulties. The large number of damage cases proved to be a major problem when designing the vessel and finding the maximum allowable KG, because of the amount of re-analysis that was necessary. Gaining approval was reported to be a problem, because of the amount of re-analysis that had to be performed by the approving body, and the vast quantity of results that had to be submitted for approval. The authors noted that the standard formulae sometimes gave negative probabilities of occurrence, and the sum of all probabilities was not one. The method for handling multi-compartment damage sometimes led to inconsistencies. The authors also noted that the

22

probabilistic method is entirely based on the concept of side damage, whereas only 12% of casualties in 1993 had been caused by side damage. A number of simplifications to the rules were suggested.

Jensen et al. [36] noted the following difficulties: how to establish realistic probability distributions for the location and extent of damage, how to extend the procedure to cover grounding as well as side collisions, realistic criteria for the probability of surviving given damage, definitions of the probability of damage to compartments and groups of compartments, definitions of compartment permeabilities, and the description of water ingress.

Vassalos and Tuzcu [37] noted the present confusion and uncertainty in the present regulatory regime, especially for passenger Ro-Ro vessels, and the bewildering choice of alternative damage stability­related standards available to the designer. They then sought to demonstrate and quantify the link between deterministic and probabilistic damage stability regulations, and performance-based standards, by focussing on the ‘safety equivalence’ concept.

5.3 TANKERS AND FPSOS

Oil tankers are subject to both SOLAS stability regulations and MARPOL [38] marine pollution regulations, but there is on-going discussion about the applicability of MARPOL, SOLAS and Load Line requirements to FPSOs (Floating Production, Storage and Offloading systems) and FSUs (Floating Storage Units). One view is that FPSOs and FSUs should be regarded as floating platforms rather than oil tankers or cargo ships, but others consider that this classification might endanger the marine environment [39].

When operating in UK waters an FPSO or FSU has to comply with HSE Safety Case regulations. Safety Case regulations require a suitable and sufficient quantified risk analysis of all major accident scenarios.

Dyer [40] reviewed the standards applicable to FPSOs and FSUs, noting that there is a need to balance environmental and safety risks. It is not always easy to cope with conflicting requirements, however, especially as these requirements are often specified by different regulatory authorities. Dyer recommended that a probabilistic assessment should be made of pollution risks, considering different levels of damage and spill rates, using procedures similar to those used to calculate the ‘Attained Subdivision Index’ in a probabilistic damage stability analysis. In this case a ‘Pollution Index’, E, was defined as E = ∑ v p , where pi is the probability that i adjacent compartments are damaged, and vi isi i

the theoretical outflow of oil from the i compartments under consideration. Dyer noted, however, that there are major differences between levels of damage specified by MARPOL, SOLAS, the IMO MODU Code, UK and Norwegian national stability standards.

Karsan et al. [41] presented a quantitative risk assessment study on an FPSO operating in the Gulf of Mexico. This study had been undertaken as a Joint Industry Project to demonstrate the acceptability of FPSOs in the Gulf of Mexico, to identify accidental events and FPSO components with high risks of environmental pollution, loss of life or financial loss, and to recommend practical risk-reducing measures. This investigation covered a broad range of hazards, but did not specifically address loss of buoyancy.

5.4 JACK-UPS

Noble Denton [42] undertook a quantitative risk assessment of a representative North Sea jack-up rig move, in order to determine the risks to the jack-up itself and to personnel. The jack-up was found to be vulnerable to four types of hazards when afloat: flooding, collision, structural damage (due to excessive motions and wave action) and grounding. It was found to be vulnerable to two further types of hazards when on site: weather damage (e.g. inadequate air gap) and punch-through. The majority of fatalities and major accidents were likely to be associated with towing. Bad weather was the largest individual factor contributing to fatalities and major damage, and improved weather forecasting techniques could reduce the fatality potential by about 30%. Various other risk-reduction measures were also proposed.

23

This investigation addressed a broad range of risks and their consequences. Hazards resulting in loss of buoyancy or capsize included: ballast system failures; failures of sea-fastenings, derrick or substructure; design, planning, operational and weight control errors; loss of watertight integrity; excessive weather; tug, tow-line or jacking system failures; fire and collision.

5.5 RISK ACCEPTANCE ISSUES

Konovessis and Vassalos [43] outlined a procedure for integrating quantitative risk assessment into the design framework for passenger ships, and applied this procedure to three different upgrading arrangements for a passenger Ro-Ro vessel.

A key issue is the level of risk that is tolerable both to the individual and to society. Although IMO has no established explicit risk acceptance criteria, a paper submitted to IMO [44] has proposed the following criteria for risks to an individual person on board a ship:

• Maximum tolerable risk for crew members: 10-4 per year,

• Maximum tolerable risk for passengers: 10-5 per year.

The same paper proposed the use of a so-called ‘F-N’ curve for determining tolerable ‘societal’ risks to passengers. The proposed criteria for passenger Ro-Ro vessels are reproduced in Figure 5. F represents the frequency of occurrence of N fatalities in one incident. The tolerable number of fatalities therefore reduces as the number of fatalities increases. Two orders of magnitude reduction is risk is seen as necessary if the number of fatalities increases from 1 to 100. In this figure risks are classified as either ‘negligible’, ‘ALARP’ or ‘intolerable’.

Figure 5: Proposed F-N acceptance criteria for passenger Ro-Ro vessels (from [43]).

Konovessis and Vassalos noted that environmental risks and property loss also have to be considered in the overall assessment. The vessel must also meet a number of other design criteria, such as achieving a specified carrying capacity, a certain speed with minimum installed power, passenger comfort and performance requirements.

24

Cost-benefit was assessed using the ‘Implied Cost to Avert a Fatality’ (ICAF), which represents the net annual cost of the measure divided by the reduction in the annual fatality rate. The authors noted that measures with an ICAF less than £2m per fatality averted are generally considered to be cost-effective. Measures in the £2m to £50m per fatality averted should be considered if individual or societal risks are high in the ALARP region. Measures with costs above £50m per fatality averted are not normally considered unless individual or societal costs are intolerable. The authors concluded that any decision taken without considering appropriate trade-offs between different aspects of the problem would result in an incomplete solution.

5.6 COLLISION FREQUENCIES

The RABL case studies found that ship collisions were the dominant hazard for MODUs operating on the Norwegian continental shelf. Follow-up studies were recommended to reduce uncertainties in the collision risk model.

Spouge [45] described one such follow-up study for locations on the UK Continental Shelf, and presented sample results. He noted that no ship-platform collision on the UKCS has ever caused a platform to collapse. There have nonetheless been four major collision incidents, where the vessels Gisna, Marag Mette, La Paloma and Irving Forest struck fixed or mobile platforms on the UKCS. The first incident involved a collision with the semi-submersible Sea Quest. In the last incident the vessel collided with a jack-up, which reportedly came close to collapse. All vessels were under power, and had suffered some kind of watch-keeping failure. There have also been several incidents where large ships drifted close to platforms. Another 29 incidents were noted worldwide, including four that caused total loss of the platform, and two involving loaded tankers, where the cargos ignited causing severe damage. Collisions were therefore seen to be a significant hazard, requiring careful evaluation under the platform’s Safety Case.

Commenting on the RABL work, Spouge noted that improved shipping traffic data had become available through the European COST-301 programme [46]. There were growing indications that the collision model used during the RABL project over-predicted the risks. The UK Department of Energy subsequently commissioned Technica to update this collision model (known as CRASH), to calibrate it against actual collision experience, and to make it available to the industry.

This new version of CRASH was used [45] to predict collision frequencies for all 119 platforms in the UK and Irish sectors installed before 1990. Predicted collision frequencies varied between 10-7 per year to 0.12 collisions per year. The highest frequencies were for platforms in the Southern North Sea, near busy traffic lanes, where new platforms were located in gaps between existing established platforms. Vessels tend to use these gaps in order to avoid established platforms. The average predicted collision frequency was 8.7×10-3 per platform year. The total collision frequency for all 119 platforms was 1.0 per year. 2.8% of the risk was, on average, from drifting vessels. The collision frequency for mobile platforms was predicted to be ten times higher than for fixed platforms of a similar size at the same location, because mobile platforms are not marked on navigation charts.

Spouge noted that that the amended CRASH model would be slightly conservative for predicting risks in later life for platforms installed since 1987. He also noted that the presence of platforms changes the shipping lanes - and would eventually make the CRASH database out of date.

Haugen and Vollen [47] described work undertaken during the ‘Collide’ project, aimed at developing a more realistic model for the process leading up to a vessel passing a platform, and the probability of collision. Risk reduction measures were also reviewed. Phase I of ‘Collide’ considered the Norwegian continental shelf, and Phase II extended the study to the entire North Sea. Few results are presented, and it is not possible to make comparison with results from the RABL work.

Incident statistics recorded in the HSE’s ‘Ship/Platform Incident Database’ have been analysed recently, and key results were presented by Boothby [48]. The mean collision incident frequency, based on all reported incidents to semi-submersibles operating on the UKCS between 1975 and October 2001, was 0.24 per year, and the frequency of incidents to semi-submersibles resulting in moderate or severe damage was 0.049 per year. No incidents to semi-submersibles from passing vessels were reported during this period. The paper concluded that there is a significant statistical risk

25

of collision, and that it is ‘reasonably foreseeable’. Most collision risks are from attendant vessels, within management control. The paper noted that HSE and UKOOA have initiated a work group to draw up industry guidelines for the management of collision risk, and that these guidelines will be published by UKOOA.

26

6. DISCUSSION

6.1 COMMENTS ON RABL AND SHIP EXPERIENCE

The probabilistic methods and principles developed for semi-submersibles during the RABL Project have not been developed further into a regulatory framework. International and Norwegian stability requirements for MODUs are still based firmly on traditional deterministic procedures, and there seems to be no obvious pressure from any quarter to change this situation.

This situation contrasts with that for ships, where the international regulatory position is now very confused. There have been strong pressures from some quarters to introduce probabilistic damage stability standards, and there is now a bewildering range of alternative stability assessment procedures (both deterministic and probabilistic) available to designers of passenger and cargo ships. IMO is currently aiming to harmonise the regulations for passenger and cargo vessels, based around the probabilistic approach.

Procedures developed during the RABL project and IMO probabilistic damage stability standards for ships have a common aim of providing a more rational basis for assessing risks and consequences of buoyancy loss resulting from failure of various combinations of compartments. There are several key differences between the RABL and IMO approaches, however:

• There is little obvious physical basis for the formulae defined in the IMO standards, and no obvious relationships with real lifetime probabilities of flooding and survival. RABL procedures aim to quantify impairment risks explicitly, whereas IMO procedures are based on a so-called ‘Attained Subdivision Index’. This Index is compared with a target parameter based on the ship’s subdivision length, and this parameter has no obvious connection with lifetime or annual risk.

• The IMO formulae appear in fact to have more in common with traditional rule-based methods than with a goal-setting, risk-based approach.

• RABL considered all hazards that may lead to loss of buoyancy, whereas IMO probabilistic criteria focus primarily on damage due to collisions.

• RABL considered a number of alternative measures of safety (five Safety Functions). IMO procedures generally address vessel survival only.

• RABL considered the frequency of impairment for a MODU operating at a single location for an entire year, whereas a risk analysis for a ship has to consider its entire voyage life. It is not obvious how to quantify lifetime risks in a rational manner for a vessel engaged in worldwide trade.

An area of difficulty, at least for ships, has proved to be the level of complexity and number of damage cases that have to be considered. A very broad range of hazards had to be considered in the RABL analysis, also leading to a very complex analysis. Major risk and structural assessment studies were needed to quantify risks associated with the two main hazards (collisions and ballast system failures).

6.2 KEY FACTORS AFFECTING SEMI-SUBMERSIBLE STABILITY

The RABL investigations identified three primary initiating hazards for MODUs operating in Norwegian waters: ship collisions, ballast system failures and blowouts.

The risk from ship collisions varied significantly, depending on the rig’s location in relation to ship traffic routes, and whether it lay near a fixed installation marked on navigation charts. Uncertainties in collision risk estimates, and collision risk prevention measures warrant further investigation.

The risk from ballast system failures depended on the number and layout of pump rooms (e.g. whether the rig had only one or two pump rooms in each pontoon), on the design of the system against human failures, and on the stability characteristics of the vessel. Having four pump rooms provided important redundancy and flexibility benefits.

27

The most effective risk-reduction measure against blowouts was to reduce the occurrence of blowouts themselves. Risks associated with fire and explosion can be reduced by ensuring that the platform can be relocated quickly following a blowout.

Long-lasting fires caused by pipeline or riser leaks were found to be a hazard for semi-submersible floating production units.

These hazards caused significant risks of impairment to both the ‘escape ways’ and ‘floatability’ safety functions. The ‘escape ways’ safety function was a measure of the ability of personnel to use escape routes to muster stations following an accidental event. The ‘floatability safety function was a measure of the ability of the rig to remain afloat for long enough to allow salvage assistance.

RABL regarded reserve buoyancy in the deck as an essential form of protection against collision from a small vessel travelling at full speed. Reserve buoyancy should be made more effective, however, by preventing failure between the connections between the deck and main columns.

6.3 STABILITY CALCULATIONS

RABL did not question the principles underlying traditional stability analysis procedures, based on static wind heeling moment and still-water righting moment curves. It simply placed these calculations within an overall risk analysis framework. The stability calculations were therefore identical to those performed during a traditional stability analysis, although additional damage conditions (e.g. several compartments flooded simultaneously) had to be considered. RABL reported that the information contained in standard stability books was generally sufficient for this purpose.

Large numbers of damage conditions (possibly running into thousands) reportedly have to be considered when carrying out a probabilistic stability analysis of a ship. RABL, by contrast, seems to found it necessary to analyse only a small number of additional damage cases, possibly because:

• A third-generation or later rig, complying with current Norwegian or IMO stability standards, is capable of sustaining one-compartment flooding without impairment of any of its safety functions.

• Relatively stringent limiting conditions were applied to impairment of the ‘escape ways’ safety function (the heel angle should remain less than 15o for at least one hour). Various combinations of two-compartment flooding exceeded this limit.

• Two-compartment flooding seems generally to have been the highest level of damage considered during the RABL studies. Higher levels of damage were generally assumed to impair the ‘escape ways’ safety function, and therefore did not require a stability analysis.

• Third-generation and later rigs, complying with Norwegian reserve buoyancy requirements, should be capable of sustaining loss of buoyancy from one column without impairing the ‘floatability’ safety function. Structural analysis, rather than stability analysis, was the primary tool used to assess major damage of this type.

• RABL efforts were concentrated primarily of the ‘escape ways’ and ‘floatability’ safety functions. Other safety functions were considered in less detail, or not at all.

It is not clear whether these assumptions would be adequate when carrying out a real rig design, or whether they were simplifications introduced to meet the less onerous objectives of the RABL JIP. A broader range of flooding and damage conditions might have to be considered in cases where rigs do not comply with Norwegian reserve buoyancy requirements, increasing the number of damage cases and the amount of stability analysis required.

6.4 BENEFITS AND PRACTICAL DIFFICULTIES IN IMPLEMENTING RISK-BASED METHODS

RABL considered the analysis methodology and procedures developed during the project to be both robust and practical, and recommended that this methodology should be used to assess safety levels for new platform designs or those subject to changes in operational premises.

28

Key benefits of carrying out a risk-based assessment of buoyancy loss are:

• It provides a rational basis for considering different damage and flooding conditions (rather than the arbitrary damage areas and depths specified in traditional deterministic standards), for managing risks to personnel and to the rig itself, and for assessing the relative importance of different hazards.

• It quantifies the probabilities of occurrence of different accidental events, and their consequences (whereas traditional deterministic stability standards are concerned only with the consequences of specified arbitrary damage events).

• It sets loss of buoyancy within the framework of quantitative risk assessment for the vessel and its operations as a whole.

Risks associated with buoyancy loss can thus be set in the context of risks associated with fire and explosion, environmental pollution, structural failure, mooring and DP failure, evacuation, escape and rescue issues, and many other aspects of design. Some form of risk analysis, though possibly not at the detailed level required for assessment of buoyancy loss, will generally be needed as part of the Safety Case submitted to the HSE, to ensure that risks are ‘as low as reasonably practical’.

Key difficulties in implementing risk-based stability standard for semi-submersibles are likely to be:

• The greater level of complexity, and the greater number of damage cases considered during the risk-based assessment, compared with traditional deterministic stability procedures (although the number of additional cases considered by RABL does not seem to have been excessive).

• The location-specific nature of the RABL analysis and calculated risk levels. It seems impractical to require MODU owners to re-analyse their unit before every rig move.

• Significant levels of uncertainty in some of the values used in the analysis.

There are likely to be further practical barriers hindering the introduction of risk-based methods for assessing buoyancy loss:

• The lack of any obvious pressing need for change. There is no obvious evidence to suggest that rigs built to traditional stability standards are unsafe, and no obvious reason to subject the industry to the inconvenience and expense of change.

• Higher costs associated with the greater analysis effort required to implement risk-based methods.

• The high level of cohesion, co-ordination and management commitment needed to bring together the necessary information on many different design and operational issues and hazards.

• A natural reluctance to embrace change in a traditionally conservative industry.

• Difficulties in comparing safety levels for rigs designed using traditional stability standards with those designed using risk-based methods.

• Difficulties in understanding risk-based and probabilistic concepts.

• Difficulties in agreeing acceptable limits of risk (for individuals and groups of people, and for the rig itself), and in deciding whether a given level of risk should be regarded as acceptable, intolerable or ALARP.

• Difficulties in using such procedures during design, because of the large amount of re-analysis implied by any change to the design.

• Difficulties in obtaining approval from certification bodies, because of the complexity of the analysis, and difficulties of verification.

• Lack of existing standard computer software for analysing the large numbers of damage cases.

6.5 RESERVE BUOYANCY

The original objectives of this review study were to assess the practicality of, and likely benefits from, implementing risk-based stability standards for semi-submersibles. A further important issue came out

29

of the RABL work, however, which may have greater implications for platform safety than the implementation of risk-based stability standards.

RABL recommended that new semi-submersibles should be designed to Norwegian stability standards [24], which require reserve buoyancy to be provided in the upper deck. Assuming that the upper deck remains intact following major structural failure or flooding of a column, reserve deck buoyancy can provide a significant enhancement to platform safety, keeping the platform afloat for long enough to permit safe evacuation, and possibly long enough to permit salvage. RABL considered that the only type of incident where reserve buoyancy offers significant additional safety is a major ship collision, causing structural failure of a column. The P-36 accident [21] provides evidence to suggest, however, that there may also be benefits from reserve buoyancy following a major explosion and flooding.

The RABL case studies showed that, without the additional safety offered by reserve buoyancy, the ‘escape ways’ safety function could be impaired by flooding only two compartments, and that loss of buoyancy from a column following a ship collision is a ‘reasonably foreseeable’ event. Structural failure and loss of buoyancy from a column could result from a collision with anything larger than a small vessel travelling at speed.

These findings suggest that the merits of requiring upper deck reserve buoyancy should be assessed again, to evaluate the likely practical benefits and difficulties of introducing such requirements for new platforms, or where existing rigs are converted for alternative use. Any such requirements must ensure that reserve buoyancy remains effective after the initiating event, however, and is not compromised by structural damage to the deck/ column connection in the same incident that causes column failure.

30

7. CONCLUSIONS

RABL demonstrated that it is practical to carry out a risk assessment of buoyancy loss for semi­submersibles. The RABL methodology and procedure were considered to be robust and sensitive to differences between concepts, and RABL recommended that the new analysis methodology should be used to assess safety levels for new platform designs, or for existing platforms subject to changes in operational premises.

RABL found that the main hazards were ship collisions, ballast system failures and blowouts. Technical recommendations included the following:

• Collision risk requires the greatest attention, especially collision prevention measures. These might include warning systems and extended exclusion zones in specific cases. RABL recommended further studies to define true collision risks.

• Reserve buoyancy in the upper deck was regarded as essential to protect the platform against ship collisions, and should be made as effective as possible, to withstand moderate collisions with a small vessel travelling at full speed. The design should prevent, as far as possible, loss of reserve deck buoyancy following structural failure of a column. Failures leading to loss of reserve deck buoyancy might be avoided quite simply and cheaply.

• Having ballast rooms at all four corners of the rig significantly reduced risk levels. Such systems also provide important benefits in terms of redundancy and flexibility. It is important, however, to design the system so that human failure cannot easily lead to a critical condition.

• Risk assessment was recommended, in addition to FMEA studies on ballast systems, because FMEA studies are not capable of assessing failure combinations adequately.

• The most effective way to reduce risks associated with blowouts is to reduce their frequency of occurrence. Risks associated with fire and explosion can be reduced by maximising the probability of being able to relocate the platform quickly following a blowout.

• Risks associated with semi-submersibles used as accommodation units were generally similar to those associated with mobile drilling units, and the same recommendations applied.

• The main additional recommendation for a floating production unit was to prevent long-lasting gas fires caused by pipeline or riser leaks, especially where flexible gas export risers are used. Subsea isolation of the leak is particularly worthwhile.

RABL concluded that upper-deck reserve buoyancy (as required by NMD) provides a significant and essential margin of safety against moderate impacts from small vessels travelling at full speed. Loss of buoyancy from a column, following such a collision, was regarded as a ‘reasonably foreseeable’ event. RABL’s findings suggest that the merits of upper-deck reserve buoyancy should be assessed again, to evaluate the likely practical benefits and difficulties of introducing such requirements for new platforms, or where existing rigs are converted for alternative use.

Key benefits of carrying out a risk-based assessment of buoyancy loss are:

• It provides a rational basis for considering different damage and flooding conditions (rather than the arbitrary damage areas and depths specified in traditional deterministic standards), for managing risks to personnel and to the rig itself, and for assessing the relative importance of different hazards.

• It quantifies the probabilities of occurrence of different accidental events, and their consequences (whereas traditional deterministic stability standards are concerned only with the consequences of specified arbitrary damage events).

• It sets loss of buoyancy within the framework of quantitative risk assessment for the vessel and its operations as a whole.

The key question, however, is whether there is any pressing need to adopt risk-based stability standards. There seems to have been little pressure to change existing deterministic stability standards for semi-submersibles since RABL completed its work. There is no obvious evidence to suggest that

31

rigs built to traditional stability standards are unsafe, and no obvious reason to subject the industry to the inconvenience and expense of change. Future developments therefore depend very largely on the industry and its regulators perceiving a pressing need for, and practical benefits from, such a change.

Practical difficulties will also undoubtedly emerge when risk-based procedures are used in earnest under real design conditions. The number of damage and flooding cases to be analysed, and the complexity of the analysis, require careful consideration before introducing new procedures, to ensure that the analysis is practical and not excessive.

A further key difficulty is that the RABL analysis and resulting risks were location-specific. It seems impractical to require MODU owners to re-analyse their unit before every rig move. It will therefore be necessary to develop a methodology for assessing risks based on a lifetime of use, rather than risks specific to one particular location.

RABL also recognised the vulnerability of any risk assessment procedure to lack of statistical data and to lack of insight about what are relevant and important failure modes. Risk assessment has become more firmly established, and accident statistics more available, since the RABL work took place, but the limitations of the historical record and lack of insight are still major concerns.

32

8. REFERENCES

1. SikteC A/S, Loss of Buoyancy due to Blowout, SikteC report no. ST-87-RR-007-02, RABL report no. 1, 1988.

2. Veritec, Risk Assessment of Buoyancy Loss and Other Faulty Weight Conditions; PP3: Ballast System, Veritec report no. 87-3451, RABL report no. 2, 1987.

3. Technica, Risk Assessment of Buoyancy Loss; Project PP4 - Assessment of MODU Collision Frequencies, final report, RABL report no. 3, 1987.

4. SINTEF, Veritec, SikteC A/S, Risk Assessment of Buoyancy Loss; Structural Damage, SINTEF report no. STF71 F87034, RABL report no. 4, 1987.

5. Veritec, Mooring Induced Accidental Floating Condition, Veritec report no. 87-3125, RABL report no. 5, 1987.

6. SikteC A/S, Risk Assessment of Buoyancy Loss; Case Study 1, SikteC report no. ST-87-RR-009-02, RABL report no. 6, 1987.

7. Veritec, Risk Assessment of Buoyancy Loss; Case Study 2, RABL report no. 7, 1987.

8. SikteC A/S, Risk Assessment of Buoyancy Loss; Project Synthesis: Updated and Final Report, SikteC report no. ST-87-RR-013-02, RABL report no. 8, 1988.

9. SikteC A/S, Risk Assessment of Buoyancy Loss; Accommodation Platforms, SikteC report no. ST-87-RR-021-01, RABL report no. 9, 1988.

10. SikteC A/S, Risk Assessment of Buoyancy Loss; Production Platforms, SikteC report no. ST-87-RR-022-01, RABL report no. 10, 1988.

11. SikteC A/S, Risk Assessment of Buoyancy Loss; Summary Report, SikteC report no. ST-87-RF-024-01, RABL report no. 11, 1988.

12. Vinnem, J.E., and Haugen, S., Risk Assessment of Buoyancy Loss (RABL); Introduction to Analytical Approach, Intl. Conf. Mobile Offshore Structures, City University, London, September 1987.

13. Amdahl, S., Haugen, S., and Vinnem, J.E., Risk Assessment of Buoyancy Loss; Case Study 1, Intl. Conf. Mobile Offshore Structures, City University, London, September 1987.

14. Mørland, M., Risk Assessment of Buoyancy Loss; Case Study 2, Intl. Conf. Mobile Offshore Structures, City University, London, September 1987.

15. Vinnem, J.E., Risk Assessment of Buoyancy Loss (RABL), Summary of Programme Results, Intl. Conf. Mobile Offshore Structures, City University, London, September 1987.

16. BMT Fluid Mechanics Limited, Review of Issues Associated with the Stability of Semi­submersibles, report no. 44208r13, October 2000.

17. The Norwegian Royal Commission Report on the Alexander L. Kielland Disaster, 1981.

18. The Royal Commission on the Ocean Ranger Marine Disaster, Report no. 1, The Loss of the Semisubmersible Drill Rig Ocean Ranger and its Crew, 1984.

19. The Royal Commission on the Ocean Ranger Marine Disaster, Report no. 2, Safety Offshore Eastern Canada, 1985.

33

20. National Transportation Safety Board, Capsizing and Sinking of the U.S. Mobile Offshore Drilling Unit OCEAN RANGER off the East Coast of Canada, 166 Nautical Miles East of St. John’s, Newfoundland, February 15, 1982, Marine Accident Report no. NTSB-MAR-83-2, 1983.

21. Barusco, P., The Accident of P-36 FPS, Offshore Technology Conference paper no. OTC 14159, Houston, 2002.

22. Mills, P.J., Stoneman, G.S., and Wilson, T.B., Stability of Ships and Mobile Offshore Units. Recent Developments in Legislation, Lloyd’s Register Technical Association paper no. 7, 1991.

23. International Maritime Organisation, An Example of Alternative Stability Criteria for a Range of Positive Stability after Damage or Flooding for Column-Stabilized Semisubmersible Units, Resolution no. A.651(16), 1989.

24. Norwegian Maritime Directorate, Regulations for Mobile Offshore Units, 1999.

25. Norwegian Hydrodynamic Laboratories, Mobile Platform Stability. Project Abstract, MOPS report no. 22, NHL report no. 184491, project no. 520010.08, 1984.

26. Vinnem, J.E., and Hope, B., Offshore Safety Management, Tapir, 1986.

27. International Maritime Organisation, Code for the Construction and Equipment of Mobile Offshore Drilling Units (MODU Code), Consolidated Edition, 2001.

28. Kobylinski, L.K., Safety Against Capsizing - Road for the Future, Marine Technology 2000, XIX Scientific Conf. of Naval Architects and Marine Engineers, Szczecin-Dziwnówek, Poland, May 2000.

29. Svensen, T.E., A New Safety Standard for Passenger/ RoRo Vessels, WEGEMT Workshop: Damage Stability of Ships, DTU, Lyngby, October 1995.

30. International Maritime Organisation, Regulations on Subdivision and Stability of Passenger Ships as an Equivalent to Part B of Chapter II of the International Convention for the Safety of Life at Sea, 1960, Resolution A.265 (VIII), 1973.

31. International Maritime Organisation, SOLAS Consolidated Edition, 2001, Part B of Chapter II-1, Subdivision and Stability, 2001.

32. Marine Safety Agency, Agreement Concerning Specific Stability Requirements for Ro-Ro Passenger Ships Undertaking Regular Scheduled International Voyages between or to or from Designated Ports in North West Europe and the Baltic Sea, Merchant Shipping Notice MSN 1673 (M), 1997.

33. Rusås, S., Designing for a Second Line of Defence, DNV Forum, No. 2, pp. 16-18, 1997.

34. Lauridsen, P.H., Jensen J.J., and Baatrup, J., Ship Design Using Probabilistic Damage Stability Rules - a Sensitivity Study, Practical Design of Ships and Other Floating Structures, Elsevier, 2001.

35. Koelman, H.J., Damage Stability Rules in Relation to Ship Design, Proc. WEMT’95, pp. 45­56, eds. J.J. Jensen and V. Jensen, Danish Society of Naval Architecture and Marine Engineering, Copenhagen, 1995.

36. Jensen, J.J., Baatrup, J., and Andersen, P., Probabilistic Damage Stability Calculations in Preliminary Ship Design, Proc. Sixth Intl. Symp. on Practical Design of Ships and Mobile

34

Units (Prads’95), Vol. 1, pp. 1.565-1.577, eds. H. Kim and J.W. Lee, Soc. Naval Architects of Korea, 1995.

37. Vassalos, D., and Tuzcu, C., Safety Equivalence - Meaning and Implementation, 5th Intl. Workshop on Stability and Operational Safety of Ships, Trieste, paper no. 3.4.1, pp. 3.4.1-3.4.6, September 2001.

38. International Maritime Organisation, International Convention for the Prevention of Pollution from Ships, 1973, as Modified by the Protocol of 1978 Relating Thereto, MARPOL 73/78, Consolidated Edition, 2002.

39. International Maritime Organisation, Report to the Maritime Safety Committee and the Marine Environment Protection Committee, Sub-Committee on Bulk Liquids and Gases, paper no. BLG 7/15, July 2002.

40. Dyer, R.C., Regulations and Standards - MARPOL Design and Operating Requirements, E&P Forum, FPSO/FSU Workshop, Heathrow, June 1998.

41. Karsan, D.I., Aggarwal, R.K., Nesje, J.D., Bhattacharjee, S., Arney, C.E., Haire, B.M., and Ballesio, J.E., Risk Assessment of a Tanker Based Floating Production Storage and Offloading (FPSO) System in Deepwater Gulf of Mexico, Offshore Technology Conf. paper no. OTC 11000, Houston, 1999.

42. Noble Denton Europe Ltd., Quantified Risk Assessment of Jack-up Operations Afloat, HSE ref. OTO 98 045, August 1998.

43. Konovessis, D., and Vassalos, D., Design for Damage Survivability - Development and Application of an Optimal Design Procedure, Proc. 2nd Intl. EuroConference on High-Performance Marine Vehicles (HIPER’01), Hamburg, pp. 291-305, May 2001.

44. International Maritime Organisation, Decision Parameters Including Risk Acceptance Criteria, paper no. MSC 72/16, submitted by Norway, 2000.

45. Spouge, J.R., CRASH: Computerised Prediction of Ship-Platform Collision Risks, Soc. Petroleum Engineers paper no. SPE 23154, presented at the Offshore Europe Conf., Aberdeen, 1991.

46. Commission of the European Communities, COST-301 Shore-Based Marine Navigation Aid Systems, report no. EUR 11304, 1988.

47. Haugen, S., and Vollen, F., Risk of Collision between Vessels and Offshore Installations in the North Sea, Proc. Conf. Offshore Safety: Protection of Life and the Environment, Marine Management (Holdings), pp. 65-71, May 1992.

48. Boothby, G., Ship/ Platform Collision Risk in the UKCS: Current Levels and Management, International Conf. on Offshore Emergencies, Energy Enterprise, Aberdeen, June 2002.

49. Andreassen, R., Posisjonering av Plattformer og Skip, Kjettingbrudd NIF Conference, Fargernes, November 1993.

35

36

ABBREVIATIONS AND NOTATION

ALARP As Low As Reasonably Practical BMT BMT Fluid Mechanics Limited CSE Concept Safety Evaluation DAE Design Accidental Event DNV Det Norske Veritas DP Dynamic Positioning FMEA Failure Modes and Effects Analysis FSA Formal Safety Assessment FPSO Floating Production Storage and Offloading System FSU Floating Storage Unit GZ Righting arm parameter used in a stability analysis HSE The Health and Safety Executive ICAF Implied Cost to Avert a Fatality IMO International Maritime Organisation KG Height of the centre of gravity above keel level MARPOL IMO Regulations on Marine Pollution MODU Mobile Offshore Drilling Unit MOPS Mobile Offshore Platform Stability (Project) NMD Norwegian Maritime Directorate NPD Norwegian Petroleum Directorate QRA Quantitative Risk Assessment RABL Risk Assessment of Buoyancy Loss (Project) RAE Residual Accidental Event Ro-Ro Roll-on Roll-off vessel SF Safety Function SLF IMO Stability and Load Lines and Fishing Vessels Safety Sub-Committee SOLAS IMO Safety of Life at Sea Regulations UK United Kingdom UKCS United Kingdom Continental Shelf UKOOA United Kingdom Offshore Operators’ Association US United States WOAD Worldwide Offshore Accident Databank

37

38

APPENDIX A: SUMMARY OF RABL PROJECT REPORTS

RABL REPORT NO. 1

RABL report no. 1 [1] summarised results from investigations into the occurrence and effects of blowouts. A brief overall risk evaluation categorised different blowout events using event trees. The annual probability of blowout was considered (at this early stage of RABL) to be so high that careful consideration of possible blowout effects was recommended.

The risk of direct buoyancy failure, caused by the gas plume, was considered to be negligible. The main hazard was considered to be indirect, through severe structural failure due to either fire or explosion.

Appendix 1 of the report presents results from a MARINTEK study on frequencies of blowout. Significant differences were found in risks indicated by North Sea and worldwide data. Frequencies reported for the North Sea were very uncertain, however, because of the small number of incidents. As it was not possible to prove any significant reduction in blowout risk for the North Sea compared with the rest of the world, it was considered appropriate to base the analysis on the more conservative worldwide data for both exploration and development drilling. MARINTEK considered that there was probably significant under-reporting in the database of shallow gas blowouts outside the North Sea and possibly the US Gulf of Mexico.

The total blowout frequencies for exploration and development drilling worldwide were 7.2×10-3 and 2.1×10-3 per well year respectively. These frequencies increased to 2.4×10-2 and 7.3×10-3 respectively per platform year. Annual frequencies for exploration drilling were considered to be so high that a detailed analysis of consequences was recommended.

Appendix 1 suggests that three measures to reduce the consequences of blowouts should be considered:

• Design a better diverter system to take the oil/gas away from the platform,

• Make a reliable system to disconnect the rig from the well quickly, even with a fire on the rig,

• Be able to move the rig off station with minimum risk of ‘sparks’. (Dropping the anchor chain presents a high risk of sparks.)

Appendix 2 of the report discusses the hydrodynamic effects of a blowout. This part of the investigation involved a literature review and model tests at MARINTEK. The main conclusion from earlier investigations was that a stationary plume caused by a gas blowout does not present any significant risk of sinking or capsize to semi-submersibles due to buoyancy loss. Reported incidents where ships had sunk were probably caused by a combination of heeling moment and water-filling.

Model tests investigated the transient effect of a starting blowout on the platform’s dynamic behaviour. This investigation found that if the first burst of bubbles hits one of the rig’s corners, the pitch and roll motions could be considerable, but the platform deck would not be flooded in calm water, provided the blowout rate was within reasonable limits. No tests were performed in waves, which might increase the risk of deck flooding.

This study concluded that effects of buoyancy loss due to gas blowout do not represent a direct risk to the platform.

39

RABL REPORT NO. 2

RABL report no. 2 [2] described the development of a risk assessment model for evaluating ballast system failures and subsequent loss of buoyancy. The risk model was based on specific safety functions 6 necessary to protect personnel and platform integrity. These safety functions were related to platform inclination and draught.

The report included a review of past accidents to identify causes and understand the progress of accidental events. Literature reviewed included official investigation reports into the Ocean Ranger accident, the MOPS project, various FMEA analyses performed according to NMD requirements, and the Norwegian SPS (Sikkerhet på Sokkelen) project.

The safety evaluation model was based on the requirements of NMD and DNV for offshore mobile units. A standard event tree model was developed to describe accident scenarios that might threaten the safety functions. The event tree model was then used to calculate residual accidental event (RAE) 6

frequencies, which were then compared with established safety criteria. The methodology considered failure sequences involving technical and operational failures, together with high environmental loads.

The report noted that operational errors are caused partly by inadequate personnel training and procedures, and partly by inability of the system to handle abnormal conditions. It recommends use of FMEA analysis to ensure high redundancy and operational flexibility, as already required by NMD. Risk figures should also be quantified and evaluated against acceptance criteria.

Four safety functions 6 were considered at this stage of RABL: ‘floatability’, ‘evacuation’, ‘escape routes’ and ‘shelter area’. (The ‘marine controls’ safety function, noted in report no. 8 [8], seems to have been a later addition.)

The analysis in this report assessed the risk of failure of the ballast system only. The ballast water system was defined to include ballast water tanks, pumps, associated piping, valves and power supply, sensors and monitoring equipment, control and operation panels for pumps and valves, including signal transmission units. The boundary was drawn at the sea chest valves.

The report notes that the history of ballast system failures includes numerous examples where human operational failures have caused significant loss of buoyancy. The study did not consider human error as an initiating event. This issue should nonetheless be considered as part of the overall operational assessment.

Critical events have to be identified, and principles for classifying initiating events established. Critical events are related to unintended filling of ballast tanks or loss of ballast water, resulting in loss of buoyancy or abnormal list. A limited number of such events are described as top events, and are the basis for the event trees. Stability calculations are performed to evaluate the platform against safety criteria. These are intended to demonstrate the ability of the platform to withstand abnormal ballast conditions, and the effect of external forces that tend to incline and capsize it.

A case study was performed on a third-generation platform, West Vision, designed to comply with NMD stability requirements for offshore mobile units. This study showed that stringent stability demands in both the intact and damaged conditions reduced risks associated with failure of the ballast system. The ballast system was designed with a high degree of redundancy and operational flexibility. Results showed that two or more ballast tanks (or compartments) had to be filled in order to obtain an accidental situation that threatened any of the safety functions. The probability of critical ballast system failures was low (annual frequency below 10-4). Calculations confirmed that the maximum angle of heel of this rig never exceeded 15o with one compartment damage, as required by NMD criteria. Filling two compartments could cause the angle to exceed 15o, however, even in normal weather conditions. This would represent an abnormal event (i.e. RAE), requiring its frequency to be estimated.

6 Definitions of safety functions considered during the RABL project, together with other terminology (e.g. design and residual accidental events - DAEs and RAEs) may be found in the accompanying notes on RABL reports nos. 8 and 11.

40

An FMEA analysis revealed no single failure or incident that might result in unintentional emptying or filling of ballast tanks. Combinations of technical and/or human failures might cause critical situations, but these were considered unlikely because of the high redundancy and flexibility of the system. The possibility of human failure as an initiating event was not considered.

Survival and operating draughts are the same for this platform, and so the ballast system will not be operated in bad weather. Ballast system failure in extreme weather conditions was therefore considered to be unlikely.

Conservative (i.e. pessimistic) probability figures were used for basic events. Fail-safe valves are used on this rig, and closed if either the hydraulic pressure drops or the electrical control signal is lost. Separate hydraulic return lines from each valve reduce the probability of blocking several lines. Unintentional transport of water from one ballast tank to another will not cause critical heel, although this could happen, in principle, through maloperation of the system.

It was assumed that ballasting/ deballasting take place on average 12 times per year, that two tanks are emptied/ filled on each occasion, and that the functional test interval is the same as the average interval between operations of the ballast system (i.e. one month).

Human failures were quantified as follows:

• Initiation of critical system failure during normal operation: 0.001 per operation,

• Failure to correct a faulty situation: 0.01 per operation,

Conclusions from the fault tree analysis were:

• Top event frequencies were low, and the frequency of potential RAEs was far below the acceptance criteria. Ballast system failures did not contribute significantly to the total risk.

• Human maloperation, combined with single component failure, was probably the most critical combination of failure events.

• Corrective actions may interrupt critical inclination of the platform, but only if sufficient operational flexibility and tolerances are built into the design.

The frequency of critical system failures on West Vision was negligible, because an unacceptable inclination would only occur in a strong wind (> 50 knots), and it is not necessary to operate the ballast system on this rig in heavy weather. This frequency might be higher, however, on platforms that have to go from operational to survival draught in severe weather.

The study concluded that:

• A redundant system and its components should be designed according to NMD requirements,

• The system should have sufficient operational flexibility to handle abnormal ballast conditions,

• Operational procedures and training should cover handling of abnormal ballast conditions.

The event tree analysis showed that:

• The total RAE frequency was approximately 7×10-6 per year,

• Escape routes were most likely to be threatened (i.e. when the heel angle exceeds 15o).

The report concludes with an assessment of ‘other faulty weight conditions’, which include accumulated weight errors, snow and ice loads, failures in seafastenings, and failures in the fire-water system. Snow and ice loading were considered unlikely to lead to major stability problems in Norwegian waters. There was evidence from an incident on West Vanguard that, combined with other events such as fire and explosion, failure of the fire-water system could lead to increased heel. In isolation, however, failure of the fire-water system was not considered to be a significant issue. Failure in seafastenings was considered to be of minor importance. Simultaneous release of all the mooring

41

lines on one side of the rig could cause a transient heel of up to 5 degrees, but, in isolation, this would not lead to serious stability problems.

Accumulated weight errors might typically correspond to a reduction of 0.25m in the rig’s metacentric height, which, in isolation, does not represent a serious loss of stability, but might become important when combined with other factors. Attention should nonetheless be paid to the possibility of accumulated errors in weight reporting. Certain rigs pass through a low metacentric height condition when going from operational to transit draught, or vice versa, and in such cases erroneous weight reporting might lead to a negative metacentric height and a large heel angle. Although this is not a stability issue, and will not lead to loss of buoyancy, it is a safety risk because it may lead to panic among the crew.

The report’s conclusions noted that catastrophic accidents (mainly on older rigs) have occurred through a combination of ballast system failures, operator mistakes and lack of redundant buoyancy. The latest generation of mobile rigs for North Sea operations seemed to have sufficient redundancy and tolerances to handle inclination, however, even in the damaged condition. Stringent stability demands combined with a redundant and fail-safe ballast water system have reduced the risk of fatal accidents significantly.

The final recommendations suggested that efforts should be made to identify system failures that might lead to critical ballast operator errors. It was considered important to prepare procedures and establish a sound understanding of how to handle system failures during critical operations.

42

RABL REPORT NO. 3

RABL report no. 3 [3] presented results from a Technica study to assess the frequencies of ship collisions with MODUs working on the Norwegian continental shelf. The project did not consider the consequences of collisions (which were investigated separately under various case studies).

The objectives were:

• To develop a model to predict the frequency of ship collisions with mobile units, applicable at any location,

• To collect data on vessel traffic in Norwegian waters, so as to apply the model to this area.

The collision model had three main sub-models: powered vessel collision, drifting vessel collision, and powered visiting vessel collision. The vessel traffic data fell into three main groups: merchant ships, offshore vessels and fishing vessels.

Sample calculations were performed on an Aker H-3 MODU, carrying out either appraisal or exploration drilling, to demonstrate the use of the models, and to provide sample results for specific locations. Three locations were considered: Askeladden in the Troms area, the Troll field, and the Statfjord field.

The results showed that overall collision frequencies were significant, varying between 6.7×10-2 and 1.0×10-2 per year for exploration drilling at the three locations. These results cover all collisions, ranging from minor damage to loss of buoyancy. Contributions from different vessel types varied significantly between different areas. The risk of any specific level of damage (not considered in this study) will therefore vary between areas more than the overall collision risk.

The study concluded that a model had been developed to predict ship collision frequencies with mobile units, and that vessel traffic data had been collected to enable the model to be applied with confidence in Norwegian waters.

Although the study did not explicitly consider the consequences of collisions, some account nonetheless had to be taken of the effects of a collision in order to limit the study. A rig designed to the IMO MODU Code has to survive at least one-compartment damage, and NMD regulations require it to survive higher levels of damage, including loss of buoyancy from any one column. These factors were taken into account when defining the scope of the study and the vessels considered. Only vessels with potential to cause loss of buoyancy were therefore considered. Only a small proportion of such collisions, however, would be expected to actually result in loss of buoyancy.

Historical records show that the most likely vessel to collide with an offshore structure is a supply vessel (40%), with a passing merchant vessel the next most likely (25%). The report notes, however, significant variations in reporting levels. In many cases significant damage has to occur before an incident is widely reported. Platform collision frequencies also vary markedly from place to place. In some areas there is little risk, whereas in others substantial measures have to be taken to reduce risks to an acceptable level.

Previous work had been based on the judgements of experts in human factors and reliability, ship collision modelling and analysis, and marine traffic routing. This work had indicated that the most probable collision vessel types were: errant vessels, blind vessels or drifting vessels. Human error is a major contributory factor with errant and blind vessels. Drifting vessels depend only on engineering failure. Various human error scenarios had been considered.

The new study found that a more systematic framework was needed to address the human factors contribution. Further work was also needed to extend earlier collision modelling (for merchant vessels and fixed platforms) to other vessels and mobile units.

Major differences between models can come from the way in which the traffic is represented. Considerable inaccuracy can result if a traffic pattern consisting of routes is represented as an area density.

43

Three main types of factors have been found to be important: location-specific factors, rig/ platform specific features, and traffic behaviour. Location-specific factors include the density of traffic, environmental conditions and the type of location (e.g. open water or coastal, existing field with other platforms). Platform/ rig features include whether the platform is fixed or mobile, its size, anchoring system, drilling activity, transport logistics (e.g. number and size of supply vessels), and the collision avoidance measures in place. Traffic behaviour features include the vessel’s purpose (e.g. visiting or passing), bridge watch-keeping standards and reliability, propulsion/ steering system performance and reliability, which can be related to the vessel’s size.

Vessels were split into classes, depending on their type, size and purpose. Collisions from drifting fishing vessels were not considered, because collisions were not expected to have serious consequences. Powered visiting vessel collisions were treated separately from passing vessel collisions, because the factors influencing the collision are different.

The powered vessel collision model was developed from previous work using the CRASH model. It assumes that shipping is not distributed randomly, but travels along preferred routes, that vessels keeping an effective watch will only collide with the platform if disabled, but that a certain proportion will fail to keep effective watch. Two main classes of watch-keeping failure were identified: errant and blind vessels. Blind vessels only occur in bad visibility conditions with ineffective radar. Other human factors considered included ‘plannability’, watch-keeping failure for a significant period, and platform-initiated recovery. Lack of relevant data made the analysis of human behaviour difficult, and judgement and assumptions were necessary at several points.

The frequency of powered passing vessel collisions was expressed:

CF = N × Fd × P1 × P2 × P3

where:

P

CF = powered collision frequency (per year), N = total number of vessels on the route per year, Fd = fraction of vessels that will be heading for the platform,

1 = plannability factor (probability that the vessel does not plan for the presence

PP

of the platform/ MODU), 2 = probability of a watch-keeping failure without self-initiated recovery, 3 = probability of failure of outside-initiated recovery.

The simplicity of this equation belies the difficulty of selecting the probability values within it.

The drifting vessel collision model considers the following factors: the situation (e.g. where the platform is located, what service vessels are available), the traffic (including drift characteristics of vessels), causation factors (e.g. whether there is power available to operate the rudder), and consequences (whether the vessel is large enough and drifting fast enough to pose a threat).

The model for drifting vessel collisions has the form:

diameter collision CF = N n × P(breakdown) × P(wind) ×

length block where:

NCF = number of drifting vessel collisions per year from block n,

n = number of vessels per year in block n, P(breakdown) = probability of failure occurring, sufficient to cause drift, P(wind) = probability of wind direction from block n to MODU location,

diameter collision= ratio of vessel size to block size.

length block

44

This expression is summed over all blocks and wind directions.

The powered visiting vessel model relates to supply vessels, standby vessels and similar, which set a course directly for the unit. The vessel might fail to alter course or slow down, due to human or mechanical failure, or both. The collision may be at full speed and head-on.

This model did not consider the most common form of supply boat collision, when the vessel is manoeuvring close to the unit. Such collisions were considered unlikely to cause damage sufficient to cause loss of buoyancy.

Direct use can be made of historical data for this type of incident, because it is not location-specific and only depend on the average number of visits per year. The average collision frequency was found to be 1.4×10-5 per visit. It was estimated that 50% to 75% of such collisions would be full speed and head­on.

Vessel traffic density was found to be the single most important factor influencing the risk of collisions. This may be described in terms of defined routes (e.g. for merchant traffic) or area densities (e.g. for fishing vessels). Vessel momentum and energy are important factors in determining the consequences of a collision. Vessel behaviour is another key issue, covering its hydrodynamic and manoeuvring behaviour, its purpose and activities, and crew behaviour.

The collision frequency for a MODU operating at Troll was estimated to be about 3 times greater than for one operating at Askeladden, and about 5 times greater than for one operating at Statfjord. Merchant vessels were the highest source (86%) of risk at Troll. The risk from drifting vessel collisions was much less than from powered vessel collisions, and was in most cases negligible. The risk of fishing vessel collisions was high at all three locations, but the consequences of most such collisions would probably be small, due to the relatively small size and low speed of such vessels. The risk from visiting and passing offshore vessels was also significant at all three locations.

Various recommendations were put forward to improve the extent, quality and usefulness of the traffic data. Collision avoidance measures were also suggested.

The quantitative results from this study were applicable only at the locations in question. The techniques would be applicable elsewhere, however, and similar results might be expected in other areas of the North Sea and UKCS where similar levels of traffic density occur. Some of the data related to shipping routes that pass through UK waters and go to UK ports. The offshore vessel traffic related to specific fields in the Norwegian sector, including Valhall, Ekofisk, Ula, Frigg, Heimdal, Odin, Gullfaks and Statfjord.

Appendices to the report reviewed traffic in other oil-field areas of the world, historical experience of ship-platform collisions, environmental data and collision avoidance measures. The vessel collision model was also described.

45

RABL REPORT NO. 4

RABL report no. 4 [4] described an analytical procedure for assessing the risk of buoyancy loss for a MODU following structural damage due to abnormal loads. The report noted that definite conclusions about risks of loss of buoyancy, following structural damage due to abnormal loads, awaited completion of the case studies.

Emphasis was placed on describing methods consistent with a so-called ‘level 2’ risk assessment. The results can nonetheless largely be processed for a ‘level 1’ assessment. Simple hand-calculation methods were used during most of this investigation.

Abnormal structural loads may result from direct structural impact or as a consequence of a sequence of accidental events. There is a small probability of exceeding the design load due to direct structural impact, but there may be a significant probability of individual events occurring in the accidental event sequence. With proper design, however, the probability of the combined event leading to an abnormal load should be small.

Direct structural impact may result from abnormal environmental conditions, inadequate strength, abnormal collision loads, abnormal falling load impact or accidental moveable weight. Accidental event sequences may lead to fire/ explosion loads as a result of subsea blowouts burning at sea level, platform blowouts causing fire/ explosion on deck, or fire/ explosion inside the structure or utility systems.

The analysis approach was described, including event trees for structural damage. A distinction was made between two types of collapse: immediate collapse, within seconds or minutes of the abnormal load, and progressive collapse, which may take several hours. In the first case evacuation is not possible, whereas in the second there are better prospects for safe evacuation. The top event in each tree is an abnormal event, which is characterised in terms of kinetic energy, pressure-time or temperature-time relationships, for example.

The authors also distinguished between collapse of a sub-system (i.e. an individual member or group of members) and collapse of the total structure (i.e. the deck is immersed, either because the structure no longer supports the deck, or because of loss of hydrostatic stability).

The usual approach is to ensure that design accidental events have a frequency smaller than a specified value (e.g. less than 10-4 per platform year). The calculation of structural response to design accidental events is commonly carried out in a deterministic manner, where the result is either ‘fail’ or ‘not fail’. The authors note that this approach does not fit in with the event tree approach. Various possible ways to deal with this problem are outlined. Probabilistic methods may sometimes be used with simplified calculation methods. Alternatively a notional probability of collapse may be calculated by establishing the load at which collapse occurs, then assessing variations in the weather statistics, environmental loads and structural response.

The report outlined procedure for evaluating probabilities of initiating events. Scenarios considered included collisions, falling objects, explosions, fire, inadequate strength, extreme environmental loads, and accidental moveable weight. The explosions and fires scenarios were further sub-divided into blowouts, explosions in the substructure, superstructure fires, utility system fires and sea level fires.

Collision frequencies are dealt with elsewhere (RABL report no. 3 [3]). The authors noted that it is very difficult to assess the frequency of failure due to extreme environmental loads, because of the lack of historical failures.

Further work was recommended on probabilities of fire/ explosion following blowout, because of the high frequencies when based on Gulf of Mexico data. Further work was also recommended on frequencies of inadequate strength and abnormal environmental loads, because of the lack of historical data. Procedures for determining loads due to collisions, fires and environmental loading were considered adequate. Further experimental work on explosions, and work to characterise loads due to falling objects (cranes) and inadequate strength were recommended. Recommendations were also made about improvements in structural and progressive collapse analysis.

46

The report indicated that the immediate collapse analysis could be performed in a deterministic manner. A simple semi-deterministic approach was proposed for non-linear residual strength analysis. Other conclusions were:

• The RAE frequency due to falling objects will probably be so low for most platform concepts that it may be disregarded.

• Frequencies of explosions and fires in general are significant, and call for detailed assessment. Frequencies of fire/ explosion due to diesel fuel leakage are low, and RAE frequencies will probably be so low that they can be disregarded.

• Frequency data relating to inadequate strength and abnormal environmental loads are almost non­existent. There are indications, however, that the frequency of limited structural failures due to inadequate strength may not be negligible.

Appendices to the report described load and structural analysis calculation procedures, the event trees, and probability values used in these event trees.

47

RABL REPORT NO. 5

RABL report no. 5 [5] investigated the probability that a mooring-induced accidental condition (i.e. ‘tripping’) will lead to capsize or sinking.

The report concluded that tripping is very unlikely to cause capsize or sinking of a conventional semi­submersible drilling platform. Based on statistical analysis and engineering judgement the frequency was estimated to be in the range 10-7 to 10-6 per rig year. (WOAD data covers 1,603 rig years, and no such accidents have been reported.)

‘Tripping’ can occur following multiple line failure on the upwind side of the platform. In accordance with NMD regulations, the analysis did not consider the possibility of reducing heel by moving ballast.

The analysis considered the risk of mooring line failure due to ‘abnormal strength’ (e.g. weld defects in chains, or kinks in wires), abnormal environmental conditions, incorrect anchor handling, or accidental loads. Failure of the anchor itself was also considered.

The report assumed chain failure frequencies between 0.2 and 0.5 per rig year, based on data for chain manufactured before 1985. No statistics on wire rope failures were available. 7 The authors noted that anchor chains have failed in so-called ‘hard weather’, but these failures have mainly occurred in relatively moderate sea states, and several were associated with anchor handling. Structural failure on the rig itself (rather than failure of the mooring itself) and DP system failure were also considered.

If progressive failure of lines or anchors occurs, the period of time over which the failures develop is important. There may be enough time to avoid a critical situation, or to evacuate safely. Statistics indicated that more than 3 mooring lines failed in 1 out of 8 incidents in ‘bad weather’.

Disconnection of remaining mooring lines should be considered. This eliminates the possibility of heel due to tripping, but may increase the risk of collision or grounding. Quick-release systems may themselves fail. Riser damage or blowout may be a consequence, and also needs to be considered.

Even if the attempt to disconnect fails, there is still only a small possibility of tripping, and tripping situations have never been reported in practice. The rig’s heel angle could nonetheless increase after tripping, and additional factors to be considered include: ballast system failure, accidental shifting of deck loads, and flooding of compartments.

The report suggested criteria for when tripping should be considered. It was suggested that: (a) the rig should fulfil present NMD requirements with respect to anchor line failure, (b) the event tree chain needs to consider the actual rig design.

An appendix to the report estimated the heel angle due to tripping for two different units (Pentagone and twin-pontoon) in ‘survival’ conditions, under alternative assumptions about the loading. This heel angle was in the range 2 to 6 degrees.

More recent data [49] suggests that chain failure frequencies have reduced to around 1×10-2

per line year for chain manufactured since 1985. Recent data also suggests a slightly lower frequency of wire rope failures than chain failures.

48

7

RABL REPORT NO. 6

RABL report no. 6 [6] presented one of the two main case studies performed during the RABL project: on the Deep Sea Bergen (Aker H3.2) and Treasure Scout (Pacesetter). The first was investigated for all hazards, but the second for ballast system failures only.

The results showed that collision was the dominant hazard, influencing buoyancy directly through structural failure. Ballast systems failures were also a significant risk factor, in these two cases, where there was only one ballast pump room in each pontoon.

The comparative evaluation of ballast systems for the two platforms showed significant differences with regard to the ‘floatability’ safety function (i.e. the frequency of accidental events causing capsize).

Risks associated with each of the main hazards were presented in the report, relating to the floatability and escape ways safety functions for the Deep Sea Bergen operating at Smørbukk Sør.

Both platforms were found to have a high capacity to withstand accidental loads, although some improvements should be relatively easy and cost-effective.

The frequencies of initiating events were found to be fairly high. The largest uncertainties related to these frequencies, rather than to the evaluation of capacity and impairment probabilities. Further investigation of these uncertainties was recommended.

The analytical methodology functioned satisfactorily, although some of the assessments were performed in a simplified manner, due to limited resources. The report recommends that this methodology should be applied to both existing and new platform concepts.

All frequency assessments were based on an assumed exposure period of one year at a single location. The risk assessments were performed for three locations: Troll West, Draugen and Smørbukk Sør. Five safety functions were considered: floatability, evacuation, escape ways, shelter area and marine controls. The limiting state for the escape ways function was assumed to be a heel angle of 15o, after which personnel movement on deck becomes difficult.

Deep Sea Bergen Case Study

The Deep Sea Bergen was built in 1982, according to NMD regulations issued after the Alexander L Kielland accident in 1980, and was considered to comply with all current Norwegian authority requirements. It had sufficient reserve buoyancy to withstand loss of buoyancy from a complete column. It had only one ballast pump room in each pontoon, however, unlike more recent platforms, which have two.

Hazards considered were: mooring-induced heel, collision, burning blowout, superstructure fire/ explosion, substructure fire/ explosion, inherent structural failure, falling object, extreme weather impact, ballast system failure, subsea gas blowout, and accidental weight condition. These hazards were assessed individually, and procedures were developed to identify possible inter-dependencies and combinations of events. The most important combined event was ballast system failure in combination with other accidental events. Initiating event frequencies were taken mainly from work performed elsewhere in the RABL programme.

The evaluation of ballast system failures was based mainly on work performed for West Vision in report no. 2 [2]. This earlier report considered filling/ emptying of only one tank, however, whereas the follow-up work concentrated primarily on filling of two or more tanks. The initiating event frequency (i.e. frequency of heel greater than 15o) was estimated to be 2.3×10-3 for Deep Sea Bergen operating on Troll West. The frequency was location-dependent because of the threat of collision impacts. The result was found to be very sensitive to assumptions made about human error, which occurred in several places in the event tree. These frequencies were relatively high compared with equipment failures. Further studies of ballast failures should concentrate on this aspect in more detail.

49

The influence of other accidental events, that are not critical in themselves, but may damage the ballast system, thereby leading to a potentially critical situation, is also considerable. The result depends on collision frequency.

The technical failure that had the largest influence on the top event frequency was common-mode failure involving the hydraulic system, but this influence was very small.

Blowout probabilities were extracted from RABL reports nos. 1 and 4 [1, 4].

Collision frequencies were calculated using the Technica model described in RABL report no. 3 [3]. Troll West was selected as a high-risk location, and Haltenbanken as a lower-risk location. Draugen was selected as the representative area on Haltenbanken, but after assessing frequencies for this location it was found to be close to shipping routes for ore carriers from Narvik to European ports, and therefore had a high collision risk. A lower-risk location on Haltenbanken was therefore also selected: Smørbukk Sør. Moving the rig location by only a few kilometres could have a significant effect on collision risks.

Only powered collision risks were considered. Collision frequencies for drifting ships were in all cases less than 10-6 per year, except for passing offshore vessels at Troll. The energy level associated with drifting standby and supply vessels was so low that the risks could be disregarded.

Frequencies for fire/ explosion were based on data from Veritec. The frequency of fires in the pump room in the pontoon was 1.2×10-4 per platform year, and that of explosion in the pump room was 6×10-5 per platform year. RABL report no. 6 [6] had shown the frequency of a short-duration platform fire to be 7.7×10-4 per platform year, and the frequency of a long-duration platform fire to be 1.7×10-4

per platform year.

Abnormal loads/ strength. The frequency of failure of two bracings simultaneously was estimated to be about 10-4 per platform year.

Falling loads. A similar annual frequency was estimated for a severe hit on a pontoon by a falling object. A simple energy assessment concluded, however, that it was virtually impossible for a crane boom or pedestal to impair the pontoon sufficiently to cause loss of buoyancy. No type of event was found to be capable of flooding more than one compartment.

RABL report no. 5 [5] showed that the frequency of mooring induced heel, due to multiple mooring line failures, is very low. A further scenario was considered: release of anchor lines following a blowout, but with a few lines remaining attached on the leeward side in a strong wind. The following indicative frequencies of tripping situations were obtained: 2×10-4 per platform year for exploration drilling, and 7×10-5 per platform year for development drilling.

The risk that a severe accidental weight condition would result in loss of buoyancy was disregarded, because the moment was too small.

Particular emphasis was placed on ship collisions because: (a) the probabilities of collision were high, and (b) collisions have potential for directly impairing buoyancy members. Two situations were considered to be most relevant: collision against the columns, and collision against the vertical trusses running from the columns to the deck. In the operating condition the pontoons and horizontal bracing are deeply submerged, and will only be hit by large vessels with kinetic energies exceeding the credible absorption capacity of the platform.

The initial response of a column was found to be governed by local indentation. The load caused by indentation was likely to exceed the limiting collapse load in bending when the indentation was greater than the column radius. This was taken to be the failure criterion. At the same time severe plastic deformations were envisaged in the deck girders resting on the top of the column. Resulting cracks would lead to flooding. Even small cracks could lead to loss of stability within one hour. The total energy dissipated by a large column at the instant of collapse was predicted to be in the range 65 MJ to 75 MJ. The corresponding energy range for a small column was 35 MJ to 40 MJ.

50

Lower levels of damage were characterised by rupture of the shell plating in the collision area. This event was considered to correspond to one or two compartment damage.

Major explosions in columns may lead to loss of buoyancy, either by loss of structural integrity or by flooding due to rupture of the shell. Major explosions in the deck area above the columns may blow out the walls of the deck girders, and jeopardise the support of the column at the deck. The column may then be subject to progressive collapse, depending on the intensity of the wave forces. The effect of fire on the sea surface was also considered.

The ultimate load for deck failure in extreme weather was 3 times the 100-year design wave load, with a probability of failure estimated to be about 10-5 per year.

A damage stability analysis was performed to investigate the extent to which the platform could tolerate water filling without developing the critical heel angle. It was assumed that one-compartment filling would never lead to heel in excess of 15o. Damage stability calculations in the stability book for Deep Sea Bergen were used to reduce the amount of work necessary. Results showed that the platform has only a very limited tolerance for filling of two tanks. Three two-tank combinations were considered to be of particular interest. Filling these tanks, on their own, would not exceed the 15o

limiting condition, but the addition of a 50-knot wind would exceed this condition. Filling of more than two tanks was not considered, as it was concluded that the platform could not tolerate this level of filling without incurring critical heel.

The report discussed the distinction between RAEs and DAEs, and the five safety functions considered during this study. These are defined in accompanying notes on reports nos. 8 and 11. The analytical assessment was limited to the SF1 and SF3 (‘floatability’ and ‘escape ways’) safety functions, due to the limited resources that were available.

Results presented in the report include RAE frequencies for these two safety functions when in exploration and production drilling conditions, together with frequencies of impairment of the floatability and escape ways safety functions at the 3 platform locations. Contributions to these two safety functions for exploration drilling at Smørbukk Sør (n.b. with low traffic density) are also shown. Differences between frequencies for exploration and production drilling were generally small. Risk levels for escape ways were consistently higher than for floatability. Results were location-dependent, mainly due to differences in collision risk.

Collisions, blowout and ballast failures were the three dominant hazards. RAE frequencies for the dominant hazards were significantly in excess of the NPD criterion of 10-4 per platform year.

Impairment frequencies due to blowout risk can be reduced mainly by reducing the frequency of blowout itself. Results for West Vision [2] had earlier shown that having two ballast pump rooms in each pontoon (as on a third-generation or later platform) significantly reduces frequencies associated with ballast system failure. Reserve buoyancy did not provide much extra protection, because many of the structural failures were likely to cause flooding of the reserve buoyancy compartment. Additional compartmentation was suggested as a practical means to improve reserve buoyancy at relatively low cost.

These results indicated that the ‘inherent safety level’ for a rig based on post-1982 NMD regulations was between 5×10-4 and 10-3 per platform year. For the dominant hazards (collision, ballast failures and blowout) a complicating factor was that these scenarios might develop into uncontrollable conditions very rapidly.

Treasure Scout Case Study

The Treasure Scout was a Pacesetter platform, delivered in 1982, and later converted to comply with new NMD requirements after the Alexander L. Kielland accident. Two columns were added during the conversion. The ballast system was similar to that on Deep Sea Bergen, with one pump room in each pontoon and a central control room on the main deck. There were two ballast pumps in each pump room.

51

The earlier ballast system fault tree for Deep Sea Bergen was used wherever possible. On Deep Sea Bergen it was impossible to operate the system in such a way that water could be pumped from one tank to another. This removed one potential failure mode, but also reduced the system’s flexibility. Water could be pumped from one tank to another on Treasure Scout.

Treasure Scout could tolerate far more combinations of two tanks being filled that Deep Sea Bergen. In these cases, filling of two tanks did not necessarily cause the heel to exceed 15o. The calculations for Treasure Scout gave a frequency for the top event in the fault tree of 2.7×10-3 per platform year. This frequency was somewhat higher than for Deep Sea Bergen, but the level of uncertainty in both sets of results was considerable, and the difference was not considered to be statistically significant. It was considered difficult to draw final conclusions without a more detailed quantitative study.

The report compared impairment frequencies for the two platforms. Although the initiating event frequency for Treasure Scout was slightly higher than for Deep Sea Bergen, Treasure Scout was more robust against flooding. This meant that the impairment frequency was significantly reduced. The difference was smallest for the ‘escape ways’ safety function. The main difference was seen in the ‘floatability’ safety function. This meant that the more severe the event, the greater was the difference between the two platforms.

Neither platform had ballast pump rooms at both ends of each pontoon, as required by present-day regulations.

The results showed that system flexibility is essential, when there is only one pump room in each pontoon. Stability characteristics are also important, however.

52

RABL REPORT NO. 7

RABL report no. 7 [7] described the second case study performed during the RABL project. The report concluded that the procedures developed during RABL were generally adequate for assessing risk of buoyancy loss, but there was a need for further work on defining acceptance criteria for the safety functions, and establishing basic risk data used in the consequence analysis. There was a need for experts in several disciplines to be involved, so as to consider risks related to a range of hazards.

The platforms considered during this study were the unconverted version of Treasure Hunter and West Vision. Treasure Hunter was an Aker H3 design, representative of a rig built in 1977, before NMD regulations were revised in 1982/3. West Vision was representative of a third-generation design.

The Treasure Hunter study considered collisions, ballast system failures and fire/ explosion. The West Vision study considered ballast system failures only. The report summary presented results for Treasure Hunter during exploration drilling on the Troll and Draugen fields. Collision was found to be the dominant hazard, as a result of high collision frequencies established in RABL report no. 3 [3]. The report noted that some of these values were very uncertain. The most significant improvement relating to the ballast system was the improved stability characteristics of West Vision, combined with the fact that Treasure Hunter had only two pump rooms, whereas West Vision had four.

In view of the large risks from collisions, the report recommended use of guard boats, which were regarded as the only feasible solution.

Treasure Hunter Case Study

As previously, only powered collisions were considered. The analysis considered impacts against a corner column, against one of the outer horizontal bracing members, and against one of the outer vertical diagonal bracing members. The corner column completely failed when the energy of impact was 38 MJ, and was punctured when the energy was 5.6 MJ. Results showed that:

a) Collision between the rig and any of the listed ship categories led as a minimum to two­compartment damage, resulting in a heel angle of more than 15o. This resulted in impairment of the escape ways safety function.

b) Collision with a ship of more than 1100 tonnes displacement would probably lead to capsize, resulting in impairment of the floatability safety function.

Frequencies for impairment of the escape ways safety function due to collision were in the range 1.3 to 3.0×10-2, and frequencies for impairment of the floatability safety function were in the range 1.0 to 1.4×10-2 per platform year, depending on location and whether the rig was engaged in exploration or appraisal drilling.

Treasure Hunter was selected to demonstrate the applicability of the analytical model for estimating risks associated with ballast system failure. The ballast system was assumed to consist of ballast water tanks, pumps, piping and valves located in the propulsion machinery/ pump room, the hydraulic supply to operate the ballast valves, and the control/ monitoring system. The system boundary was drawn at the sea chest valves. Procedures for operating the ballast system were not available, and an analysis of human interventions was not performed.

A stability analysis had to be performed, because at the time the Treasure Hunter was built, the authorities did not require the platform to withstand an inclining moment in the damaged condition in heavy weather. The analysis considered the angle of inclination following unintentional filling or emptying of single ballast tanks. The effects of wind and waves were not taken into account. Filling of either a forward tank or machinery/ pump room exceeded the escape ways criterion (15o heel). When the effects of wind were considered, several single-tank conditions contributed to the risk. Previous studies had shown that wave-induced responses could also contribute significantly to the risk.

It was concluded that:

• Filling the pump rooms or forward water ballast tanks is an unacceptable event, in terms of impairment of escape ways,

53

• Filling one of certain other ballast tanks is an unacceptable situation in bad weather,

• Filling of other single tanks may be critical, depending on wave motions,

• Unintentional filling of two or more tanks is unacceptable. This could result in flooding of the chain lockers, and further filling of compartments through air pipes, threatening floatability.

The possibility of human error as an initiating event was not considered, but human maloperations in connection with corrective actions (e.g. failing to close an open valve) were considered.

Minor ballasting operations were not considered. Major ballasting operations were assumed to take place on average 12 times per year. Two tanks are emptied/ filled during each such operation (one per pontoon). The total RAE frequency for ballast system failures related to impairment of escape ways was estimated to be 1.0×10-3 per year.

The probability of flooding due to fire at various locations on Treasure Hunter was generally considered small/ negligible. Risks of capsize due to blowouts were also very small.

The report presented RAE frequencies for Treasure Hunter at Draugen and Troll. In general the differences between the two locations were found to be small, and there were only small differences in impairment of the safety functions for ‘escape ways’ and ‘floatability’ due to collision. The second result was due to the high level of energy to be absorbed in almost any collision. Most collision scenarios resulted in impairment of both safety functions.

West Vision Case Study

A ballast system study was performed on the West Vision. The angle of heel following one­compartment damage never exceeded 15o, as required by the criteria. A number of critical cases for two-compartment damage (i.e. heel angle exceeding 15o, even during normal weather conditions) were identified.

Frequencies of major ballasting operations were assumed to be the same as for Treasure Hunter. The functional test interval was assumed to be equal to the interval between operations of the ballast system.

Results showed:

• The frequency of filling of one or more ballast tank was estimated to be 7×10-4 per platform year.

• The frequency of potential RAEs (i.e. filling of two or more tanks) was far below the acceptance criteria.

• The reliability of the ballast system during other accidental conditions (e.g. fire/ explosion) was not considered.

• Human maloperation of the ballast system combined with single component failure is probably the most critical combination of failures.

• Corrective actions may be taken to prevent the platform reaching its critical heel angle, because of operational flexibility and tolerances built into the system design.

The report noted that the operational and survival draughts on West Vision are identical. The RAE frequency might be higher on platforms where the ballast system has to be activated in order to go from operational to survival draught.

The calculated RAE frequencies for ballast system failures related to impairment of the ‘escape ways’ safety function were approximately 1×10-5 per platform year.

54

RABL REPORT NO. 8

RABL report no. 8 [8] was the final synthesis report on the first phase of the RABL programme. It focussed on the analysis procedure, key results and conclusions from case studies undertaken up to that point. These case studies were based on one platform built after 1985/6, two platforms built around 1982 to 1983, and one platform from the late 1970s. It was assumed that any mobile platform will be designed to meet all requirements stipulated by NMD since January 1982, together with any common classification society rules. This principle applied to ballast system and intact stability requirements. Damage stability requirements varied between the four platforms, in order to illustrate the consequences for a platform that does not meet full present-day NMD requirements.

The case studies demonstrated that the analysis methodology was robust and sensitive to differences in platform concept design. The following aspects must, however, be given specific attention during the assessment:

• Probabilistic assessment of collision impact loads and responses;

• Ballast system failure frequencies in relation to stability characteristics;

• Inter-dependencies between different hazards, which may lead to combined adverse effects (extremely important for ballast system failures).

Although this report was based on other reports in the RABL series, it did not summarise any of them. The focus of this report was on use of the analysis procedures in practical platform evaluation, based on results and conclusions from the RABL programme as a whole.

The approach and principles adopted were based on those developed for ‘Concept Safety Evaluation’ of fixed platforms by the NPD. This general approach had been tailored to the specific needs of buoyancy loss of floating platforms. In particular accidental events were classified into Design Accidental Events (DAEs) and Residual Accidental Events (RAEs). Further information on these issues may be found below, and in accompanying notes on RABL report no. 11 [11].

Buoyancy loss due to subsea gas blowouts was found not to be a critical hazard. Ballast system failures and structural failure caused by a collision were found to be the dominant hazards leading to buoyancy loss. Collision risk was the most significant hazard, but there were uncertainties in the values used during this study. The probability of total structural failure of a column was considered to be so high that the reserve buoyancy requirement of NMD was seen to be an essential element of protection. The same conclusion would apply even if collision frequencies were reduced by one order of magnitude (the level of uncertainty in the present model data). Structural design should ensure that column structural failure does not impair the reserve buoyancy function.

The report noted that RABL was never intended to develop new regulations, or propose how existing regulations might be amended. It nonetheless indicated possible ways in which this might be done.

The terminology made an important distinction between ‘capsize’, resulting from an increase in heel angle until progressive filling occurs, and ‘sinking’, resulting from symmetric filling and causing a progressive increase in draught until buoyancy is lost, without significant inclination.

Analysis Approach

Details of the analysis methods may be found below, and in accompanying notes on RABL report no. 11 [11].

The analysis involved an assessment of frequencies for initiating events, together with an assessment of conditional probabilities for specific event sequences. The aspects requiring most effort were ballast system failure frequencies and collision frequencies. Other frequency models were more superficial.

Consequence assessments were also needed to evaluate the performance of the platform and its main safety functions. The scope of work for RABL did not include the development of models for assessing accidental effects, and so existing consequence models were used, these being considered

55

adequate for the purpose. The assessment of accidental effects primarily involved stability calculations and structural analysis.

This assessment considered accidental events and conditions defined in the event tree, some of which would have such severe consequences that they were not considered further. Critical considerations were therefore loads that caused marginal impairment, and the frequency of occurrence of conditions and sequences causing these marginally critical loads.

Hazard Definition

The report noted that the focus of the RABL programme was on accidental loss of buoyancy after a major ballasting failure, severe collision or other high energy event. It noted, however, if any minor event has the potential to escalate, and possibly cause a severe hazard, it needs to be addressed. Hazards that cause only marginal effects, such as minor contact between a platform and supply vessel, were considered never to impair the safety functions.

The relevant hazards considered in the RABL programme were associated with damage stability and associated conditions. Intact stability and conditions were not considered.

The main part of the RABL programme (i.e. the part of the programme covered by Report no. 8 [8]) considered hazards associated with semi-submersibles on location engaged in exploration drilling, appraisal and development drilling. It also concentrated on conditions typical of North Sea and Northern Norway offshore areas.

The following hazards were defined as applicable to large scale loss of buoyancy for semi­submersibles in drilling mode:

• Subsea gas blowout,

• Ballast system failure,

• Collision with a ship or other installation,

• Mooring induced heel,

• Dropped object/ abnormal weight condition,

• Structural failure.

Structural failure was further subdivided into:

• Burning blowout,

• Utility systems fire and explosion,

• Inherent structural failure,

• Extreme environmental load.

The report presented total loss frequencies for semi-submersibles, based on data from the WOAD database for 1970-1983. It was noted that the majority of platforms from which statistics have been generated had safety standards below present day rigs. Care is therefore needed when interpreting and using historical statistics to estimate future risk levels.

The blowout database reported total loss of two semi-submersibles due to blowout.

Safety Criteria

The report noted that the safety criteria did not distinguish between sinking and capsize, but these scenarios were treated separately where relevant.

It also stressed that the safety functions were defined as functional requirements only. The analysis will have to consider how these general requirements should be interpreted for any particular platform. Minimum requirements were established for two aspects:

56

• The minimum time required to carry out a safe evacuation,

• The maximum average heel angle at which safe evacuation is possible.

The ‘floatability’ (SF1) safety function is intended to ensure that the platform remains intact in the floating condition for long enough to obtain external salvage assistance, and is the only safety function concerned with protecting the installation itself. The platform may have to remain in this condition for a period of several days. This period should be not less than the time required to evacuate personnel.

The report noted that this criterion may be interpreted simplistically as copying the damage stability requirements of NMD, which will determine the maximum static heel angles associated with various combinations of failed compartments.

The report noted that revised guidelines were being developed by the NPD, considering functional requirements for stability, and the behaviour of the platform under dynamic as well as static loads. Dynamic analyses were not performed during the RABL case studies.

Loss of floatability may result either in capsize or sinking. It is possible to salvage a capsized platform, provided that it does not sink. For the purposes of RABL, however, it was assumed for simplicity that floatability would be impaired if complete capsize occurs.

The ‘evacuation’ (SF2) safety function requires that the platform shall remain in a controlled condition until a safe evacuation has been completed, taking accidental conditions on board the platform into account. It is both installation and location dependent The maximum heel angle should allow safe launching of lifeboats, and the waterline should not threaten the mustering area or the lifeboat itself. Shelter areas should be well defined, and should remain intact until safe evacuation is completed, taking account of the response time needed to obtain external assistance. Parameters that are important include time duration, inclination angle, rig draught, and motions due to wind and waves. Passage from the shelter area to the means of evacuation must be considered when evaluating the evacuation safety function. The time for safe evacuation will depend on the means of evacuation, possible external resources, distance to other installations and onshore, and on other traffic in the area. Helicopters and lifeboats may be considered for evacuation. A simplistic assumption might be to use a four-hour period, which should allow for evacuation by lifeboats or helicopter.

The ‘escape ways’ (SF3) safety function should ensure that at least one escape route from central positions to evacuation stations is available, and remains useable from central to mustering stations for a specified time after the incident. The escape should be to the shelter area, or to evacuation stations if there is no shelter area. Time should be allowed to seek and assist injured personnel, and for combating and mitigation actions.

Present NMD requirements state that it should be possible to evacuate the platform in a safe and realistic manner within 15 minutes of the alarm being given. This time does not allow for seeking and assisting injured personnel. Escape ways should therefore remain intact for longer than 15 minutes.

NPD requirements for production installations require that escape ways should be useable for one hour after an incident. The report suggested, however, that instead of specifying a one-hour limit, the functional requirement should be used. The time period should therefore be sufficient to allow safe escape from all main areas, allowing for escape of injured personnel and control of the platform. One hour should be regarded as the minimum time required.

The maximum heel angle at which personnel can move efficiently about the deck was defined as 15 degrees, based on discussions with parties in the RABL programme. This heel angle was considered to be close to the maximum angle for safe launch of lifeboats. Because this angle is small, the frequency of impairment will often be greatest for this safety function. The report suggested that RAE frequencies above the cut-off limit may sometimes be acceptable, after evaluation of all aspects.

The ‘shelter area’ (SF4) safety function requires that the shelter area should not be flooded during a DAE. The relevant time duration is that required for safe evacuation, such as four hours. The report notes that it is often not necessary to distinguish between the ‘escape ways’ and ‘shelter area’ safety functions.

57

The ‘marine controls’ (SF5) safety function requires that marine and drilling operations control functions should not be affected by progressive inclination until after necessary shut-down and shut-in functions have been completed. The minimum period should normally be the same as that required to evacuate the platform.

The intention is to ensure that control functions are not impaired by a non-critical event. Relevant marine control functions are the ballast system, DP system and anchoring system. Well control and shut-in systems will also have to remain intact. Control centres, power systems and routing of cables/ lines should all be considered. The interpretation of this safety function depends on the flooding of particular essential rooms, and depends strongly on platform layout.

The report showed typical relationships between heel angles and durations associated with these five safety functions.

DAEs and RAEs

Design accidental events (DAEs) are events and conditions on which design loads are based, and their use is part of the design process. Residual accidental events (RAEs) are used to ensure that the platform has a satisfactory safety level.

A DAE is one that will never impair any of the safety functions in any reasonably foreseeable condition. Design accidental loads are assessed for the most severe accidental condition which does not lead to impairment. Accident frequencies for DAEs are only of limited interest.

Formulae for estimating RAE frequencies were quoted in the report. These were essentially standard risk calculation formulae for combining frequencies in an event tree. The report noted that some frequencies are standard values, while others are based on historical accident statistics combined with engineering judgement. Some frequencies may have to be estimated subjectively. Cut-off frequencies should always be considered in relation to the uncertainties.

The approach adopted in RABL was to evaluate RAE frequencies versus cut-off for each hazard and each safety function separately. A very low value in one category cannot be used to compensate for a high value in another.

It is necessary, however, to add together risks associated with all accidental events within a single category, before comparing the total risk with the cut-off criterion. Thus risks from all types of vessel collisions have to be combined together, before making the comparison.

A risk value above the cut-off limit does not necessarily mean that reduction measures will have to be implemented - only that the feasibility of such measures will have to be assessed in relation to technical and economic factors (i.e. consistent with ALARP principles.) Impairment frequencies below the cut­off limit do not necessarily mean that no further actions can be implemented - only that they are voluntary.

The report noted that life cycle risks may be estimated for fixed installations, but not for mobile units, because a mobile unit may operate anywhere in the world. The assessment was therefore based on one specific year of operation only, assuming that it carries out the same type of operation at one location for this entire period.

DAEs form the design basis. Detailed design has to ensure that these loads and conditions will be tolerated by the platform systems and structure. The detailed design has to be in accordance with standards used when evaluating the platform concept.

The report notes that accidental event frequencies are strictly only needed for RAEs, but in practice it is often necessary to estimate frequencies for both DAEs and RAEs, because it is not always obvious which events will end up as RAEs and which as DAEs. The report also noted that frequency assessment in a risk analysis is often less accurate than in a reliability analysis. Uncertainties are often larger, and the results should be regarded more as orders of magnitude than as absolute values.

58

Case Study Experience

Overall experience from the four MODU case studies was discussed. These demonstrated that it is feasible to develop a design basis by applying probabilistic design methods. The report noted that ordinary stability books may to a large extent serve as a basis for evaluating the impairment of safety functions.

The ballast failure frequency model used a fault tree approach, and will have to be constructed for each ballast system to reflect specific system features. The most significant difficulties were found in modelling human factors, control systems and common mode failures, the first of which had the greatest impact on the results.

The case studies focussed on two safety function aspects:

• whether the rig’s inclination exceeded 15o, making escape over the deck difficult;

• whether the inclination exceeded a critical angle at which stability was permanently lost, causing rapid filling, followed by sinking or capsize.

Three broad safety categories were considered:

• when the rig’s inclination is less than 15o, and no safety function is impaired;

• when the inclination exceeds 15o within 1 hour, but remains below the critical angle for functions SF2, SF4 and SF5 for the initial 4 hours only, implying that SF1 and SF3 are impaired, but other safety functions are not impaired;

• when the inclination is as above, but remains below the capsize angle for a period of 2 to 4 days, implying that SF3 is impaired, but SF1, SF2, SF4 and SF5 are not impaired.

The following safety functions were then given primary attention: SF3, SF1 and SF2, in this order of priority.

In only one case study (no. 1, presented in RABL report no. 6 [6] - for ballast system failure) all safety functions were assessed. Inherent risk levels for this same case study were also presented.

The report also presented annual frequencies of impairment due to collision from different classes of ships at both the Smørbukk Sør and Draugen locations (the second with a much higher level of traffic). Merchant vessels were the dominating risk factor at Draugen.

The report noted that the impairment frequency for the ‘floatability’ safety function was between 1.9×10-3 and 1.7×10-2 per platform year, depending on location. A value of 2.3×10-3 had been indicated by the WOAD worldwide accident statistics. These values also fell within the very broad range (8×10-5 to 9×10-2 collisions per platform year) indicated by an earlier JP Kenny study.

Collision risk levels were found to be high, and the report recommended various actions to reduce sources of uncertainties in this area. The report suggested that the case study results have an uncertainty of about one order of magnitude, but noted that collision risk would still be a significant risk factor even if its value was reduced by one order of magnitude.

Damage Stability Requirements

The report recommended that the platform should be protected against a serious collision, and noted that the most likely mode of failure is structural failure of a column. Reserve buoyancy in the upper deck is intended to provide protection against this scenario. The report noted, however, that the results from the case study indicated that a significant volume of the deck could be flooded in the same incident as the column, due to failure in the coupling between the deck and column. Some form of watertight division was suggested.

59

Norwegian reserve buoyancy requirements were seen as a necessary aspect of safety protection for mobile platforms.

A more detailed study on the benefits of having deck reserve buoyancy was also reported (based on results from RABL report no. 6). A platform with reserve buoyancy could survive impacts with energies up to about 65 MJ, whereas one without reserve buoyancy failed at around 22 MJ. This result was based on calculations which showed that a semi-submersible shell structure could absorb impacts in the 20 MJ to 25 MJ range without suffering indentations greater than 1.5m (a level of damage similar to that assumed in international damaged stability standards). At 60 MJ to 70 MJ the structural integrity of the column as a whole, and of the deck-structure connection, was likely to be impaired.

The report compared the 22 MJ and 65 MJ survival thresholds with probability distributions of impact energy at two different locations (high and low traffic densities). At the low traffic density location (ignoring low-speed attendant vessels) there was 98% probability that the 1.5m penetration depth would be exceeded, given that collision occurs, whereas there was 66% probability of exceeding the reserve buoyancy limit. Corresponding values for the high traffic density location were 98% and 22%.

Comparisons

Comparisons were made between results from the four case studies for impairment of the ‘escape ways’ safety function (SF3).

There were significant differences between the first and second-generation designs, because only the later design had reserve buoyancy. The report noted, however, that some of the benefit of having reserve buoyancy would be lost through damage to the deck in a severe collision.

The third-generation design showed a significant reduction in impairment frequency associated with ballast system failure, as a result of having pump rooms fore and aft in each pontoon. A significant contribution to the differences nonetheless came from differences in stability characteristics.

Differences in layout and design of the ballast system were also important. Each particular system therefore required its own risk assessment to investigate combinations of failures. FMEA was not sufficient for this type of assessment.

Differences in risks associated with fire, explosion and blowout were associated with structural differences. The most cost-effective way to reduce the risk was nonetheless considered to be through reducing the risk of fire or explosion in the first place.

Impact energies in the range 20 MJ to 80 MJ were found to have the highest frequencies. Reserve buoyancy was sufficient to protect against dedicated vessels colliding at high speed (such collisions occur with significant frequency), and also protected against collisions by the smaller of the passing merchant vessels. The report concluded that reserve buoyancy provides a significant and necessary improvement of the safety margin. No protection is possible against collision with larger merchant vessels, but the frequency of these collisions is low at most offshore locations.

Collisions were found to be the only type of accident where the risk level was sufficiently high to show a demonstrable need for reserve buoyancy in the upper deck.

60

RABL REPORT NO. 9

RABL report no. 9 [9] presented results from an additional case study on a semi-submersible used as an accommodation platform. The analytical procedure developed for MODUs was applied to the accommodation platform, but some modifications to the hazard models were necessary. The main differences were:

• the additional risk of collision with the adjacent fixed installation,

• elimination of the direct risk from blowout at the flotel itself,

• reduction in the risk of collision from passing ships, because a fixed installation is marked on sea charts, and also because a flotel is ‘shielded’ behind the fixed platform from certain directions,

• accidental events on the fixed installation (e.g. blowout, fire/ explosion, dropped objects, collision, extreme environmental loads) may affect the flotel.

The risk of ballast system failure is almost unaffected by the change from a MODU to an accommodation platform. The ballast system on a flotel will generally be operated less frequently than on a MODU, however, reducing the risk for the flotel.

Indirect risks associated with events occurring on the fixed platform were considered in the analysis. Risks arising from a ship collision and extreme environmental loading on the fixed platform were considered to be low compared with the risks of direct collision/ environmental loading on the flotel itself. The only events considered to present significant risks were blowouts and fire/ explosion associated with activities on the fixed platform. Blowout is primarily of concern in relation to fire on the sea surface. Fire on the fixed platform will generally not threaten the integrity of the flotel.

There is a close relationship between collision with the fixed platform and extreme weather. This represents a combination of hazards. The additional risk associated with collision between the flotel and the fixed platform represented a very small addition to the total collision risk, however, for a modern flotel with significant thruster capacity.

It was assumed that anchor line failure is most likely when the flotel is in the storm position (typically 150m to 200m from the fixed platform), or moving to this position. A special fault tree was developed to model collision between the flotel and fixed platform, and the consequences. This took account of bad weather, DP failure, failure of one or more mooring lines, tripping, and tug assistance failure. The conclusion was that the collision frequency is 3.3×10-5 per platform year for a modern flotel with K4­type chain moorings and a DP system/ thrusters. The resulting annual frequency of global collapse of the flotel was estimated to be in the range 3×10-6 to 3×10-9, and therefore represents a low risk event.

Although not of concern to RABL, there were indications that the risk to the fixed platform (especially a jacket) may be more critical than the risk to the flotel.

Assuming that the annual frequency of ignited oil blowouts was 2.5×10-3, the annual frequency of a fire burning under the flotel was estimated to be around 10-4. A similar frequency was found for ignited gas blowouts. This value was considered significant. The estimated frequency of ignited oil riser leaks affecting the flotel was two orders of magnitude smaller, and the risk was considered to be negligible. The risk of a gas cloud forming around the flotel and igniting was of intermediate significance.

Based on results from earlier case studies on MODUs, the main areas of concern for flotels were considered to be collisions from passing ships and ballast system failures. Collisions between the floating and fixed platforms were considered to be of lesser importance.

It was noted that a flotel operating in conjunction with a fixed platform in Norwegian waters would fall under the jurisdiction of the Norwegian Petroleum Act of 1985, and would have to meet NPD requirements. RABL did not investigate the extent to which NPD safety functions might differ from those of NMD.

The safety functions of concern to NPD are those associated with ‘escape ways’, ‘shelter areas’ and ‘floatability’ (i.e. the main support structure has to maintain its load-carrying capacity for a specified

61

time.) The report noted that the five safety functions considered in RABL cover a broader range of issues. It was therefore assumed that the RABL safety functions would be applicable to flotels. It was further suggested that it would be logical for authorities to adopt the same approach as developed in RABL for all floating platforms.

The report questioned whether the cut-off limit, originally defined for MODUs, is appropriate to flotels, which are operated in a different way. It was noted, however, that the cut-off used in RABL came from NPD, and so there should be no conflict.

62

RABL REPORT NO. 10

RABL report no. 10 [10] described a further extension of the RABL programme to include production platforms. The analytical procedure developed for MODUs was also found to be applicable to production platforms, although some modifications to the hazard models were found to be necessary.

The most important new hazard, compared with MODUs, was found to be process-related fires and explosions. Utility system fires only were considered for MODUs, and so an entirely new frequency evaluation was needed. The report noted that these risks are specific to each installation, because they depend on the process plant and the types of equipment in use. The analysis was therefore performed on a reference system equipped for production of oil and gas, which are separated, compressed and exported via two pipelines for the oil and gas. The export systems included equipment for metering and pigging. Results showed that annual impairment frequencies for the support structure were below 10-4, and therefore below the tentative cut-off limit.

The risk of ignited riser leaks (also classified under fires and explosions) was also considered to be possibly significant. Resulting RAE frequencies for impairment of the floatability safe function, based on a flexible gas riser without shut-off/ isolation possibilities, were around 2×10-4, and therefore above the cut-off limit. The report noted, however, that there was considerable uncertainty in the background data.

Other hazards considered for MODUs were found to be applicable to production units, but with different risk levels.

The collision risk level, in particular, was considerably reduced. Production platforms remain at the same location for many years, and are therefore marked on sea charts. Passing ships can therefore plan to avoid the platform, and this has a significant effect on the calculated risk level. As a comparative example, the following annual total collision frequencies were given for a semi-submersible at Troll:

• Drilling/ exploration: 6.7×10-2

• Drilling/ appraisal: 7.2×10-2

• Production: 1.8×10-2

These frequencies relate to all types of collisions (minor as well as major). The report noted that there will be a greater reduction in critical collisions than in non-critical collisions.

The frequency of blowouts on a floating production platform is often lower than for a MODU. The report concluded, however, that blowout occurrence frequencies were still relatively high, calling for careful consideration. Measures to prevent blowouts are therefore vital.

There are no general differences between ballast systems on production units and MODUs, and differences in risk are therefore primarily related to the way in which the system is operated. The report noted that one of the most important factors here is the type of riser in use. There is only a small margin for variations in draught with tensioned risers. Careful attention will have to be paid to ballasting and de-ballasting if there is on-board oil storage, possibly requiring frequent ballasting operations. More limited ballasting operations will be needed if flexible risers are used.

Mooring-induced heel and accidental weight condition represented very low levels of risk (an annual frequency of 10-6 to 10-7 for impairment of the floatability safety function).

Dropped objects leading to fire could represent a hazard for process equipment on the upper deck without a cover. The level of risk depended on the layout of the platform and the type of equipment exposed.

Structural hazards (inherent structural failure and extreme environmental loads) were independent of whether the platform was used for drilling or production. These factors are concept and design dependent, however.

63

A floating production platform on the Norwegian continental shelf falls under the jurisdiction of NPD. RABL did not concern itself with possible differences between safety functions defined by NPD and NMD. The report nonetheless noted that the five safety functions considered by RABL covered a broader range than those defined by NPD (escape ways, shelter area, support structure). It therefore concluded that the RABL safety functions were applicable to production units. The report also noted that the RABL cut-off value matched that defined by NPD, so that there was no conflict.

The report concluded that the same three types of hazards (collision with passing ships, ballast system failures, blowout) were the most critical for both MODUs and production systems. The risks from collision and blowout would generally be lower for a production unit, however.

64

RABL REPORT NO. 11

RABL report no. 11 [11] presented the final summary and conclusions of the entire RABL programme, including the two follow-up studies on semi-submersibles used as accommodation and production platforms [9, 10].

Collision risk was found to be the most significant contribution to risk, irrespective of the mode of operation. The most probable scenario leading to structural loss of a column was a high impact collision from a passing vessel.

Current rig designs are capable of surviving collisions from attendant vessels impacting at low speed. There was a significant risk of collision from attendant vessels at high speed and passing merchant vessels. Impact energies in the range 20 MJ to 80 MJ had the highest frequencies of occurrence. Reserve buoyancy in the upper deck provided a survival capacity equivalent to an impact energy in the range 60 MJ to 70 MJ, protecting against attendant vessels colliding at high speed. Reserve buoyancy was therefore considered to provide a significant and necessary improvement to the stability margin.

Ballast system failure and fire were ranked as the next most significant sources of risk.

‘Third generation’ (post Ocean Ranger, designed in 1985/6 and later) rigs were found to have a significantly lower level of risk from ballast system failure than earlier designs, and well below the cut­off limit above which the risk was considered significant. These designs have ballast rooms at both ends of each pontoon, and improved stability characteristics.

There was found to be significant advantage in carrying out a ballast system reliability assessment (in the form of a fault tree analysis) in addition to, or in lieu of, a failure modes and effects analysis.

Fire and explosion were not critical for survival of the structure, at least for mobile drilling and accommodation platforms. The ability to move away from a blowout was considered to be critical. Prevention of long-lasting gas fires caused by riser or pipeline leaks was recommended. Such fires can potentially last for such a long time that no feasible protection for the platform can be devised.

Overall Approach

The overall approach adopted in the analysis is described as follows:

1. System description,

2. Hazard identification,

3. Definition of relevant accidental events,

4. Evaluation of consequences relative to the main safety functions,

5. Division into Design Accidental Events (DAEs) and Residual Accidental Events (RAEs),

6. Evaluation of RAE frequencies,

7. Comparison with cut-off limit,

8. Design load specification.

The classification into DAEs and RAEs depends on an assessment of the event and its consequences for the platform. This process often involves an element of iteration, in order to arrive at RAEs that fall below the chosen cut-off limit.

Accidental events which do not impair any of the safety functions are considered to be DAEs, and are events on which the design is based. All other events are considered to be RAEs. They have such severe consequences that they may impair one or more of the safety functions. During the RABL study frequencies of occurrence of RAEs were compared with the cut-off criterion for each hazard and safety function separately. Further details of this procedure are described in the above summary of RABL report no. 8 [8].

65

Design Accidental Events

The Norwegian Petroleum Act of 1985 defines three aspects of ‘total safety’:

• Personnel safety,

• Environmental safety,

• Safety related to investment/ production.

The NPD requires that: ‘The platform design must be such that a design accidental event related to complete or partial (progressive) loss of buoyancy does not cause harm to personnel outside the area of the initial accident, or (for the partial loss) a danger to the platform integrity.’

The safety criteria and functions considered during the RABL programme were based on the ‘total safety’ concept, but with primary emphasis on personnel safety. Protection of the platform as an investment was considered to be a secondary priority. Environmental pollution risks were not considered in relation to loss of buoyancy.

The main objective of the safety criteria is to limit the consequences for personnel. The design therefore has to ensure that rapid sinking or capsizing does not occur. Critical design conditions are defined by the DAEs, in which the platform has to remain intact with no more than local damage.

A necessary survival period is needed to protect personnel as well as the installation itself, and a number of safety functions were defined for this purpose. The following safety functions were limited to the effects of buoyancy loss, in line with the concerns of the RABL project:

SF1: the platform shall remain in a floating condition for a period until external salvage assistance is possible (‘floatability’ function);

SF2: the platform shall remain in a condition with limited inclination so as to allow a safe evacuation, taking into consideration the accidental conditions that will exist on the platform (‘evacuation’ function);

SF3: at least one escape route should be usable from central positions to a usable muster station for at least one hour after the accident (‘escape ways’ function);

SF4: the shelter area should not be flooded until a safe evacuation has been completed (‘shelter area’ function);

SF5: safety control of marine and drilling operations should not be lost until a safe evacuation has been completed (‘marine controls’ function).

Impairment of these safety functions was considered in relation to the heel angle of the vessel over a period of time.

Residual Accidental Events

RAEs are accidental conditions that are beyond the capabilities of the platform. The cut-off limit for RAEs was based on the inherent safety level of second generation rigs, and was chosen to be in the range 5×10-5 to 5×10-4 per platform year, around a central value of 1×10-4 per platform year.

RABL suggested that a reduction in the frequency of occurrence of a particular hazard should be imperative if that frequency is greater than 5×10-4 per year, and must be considered if greater than 5×10-5 per year. The same cut-off frequency is also defined by NPD for production installations, and means that the same value may be used regardless of whether the semi-submersible is used for drilling operations, floating production or accommodation.

Risk Overview

The report presented results from a case study on a ‘second generation’ (post Alexander L. Kielland, NMD regulations after about 1982) rig. The highest frequencies of events were found to be in the range 0.5 to 1×10-3 per platform year. Results were shown separately for the ‘floatability’ and ‘escape ways’

66

safety functions. Impairment of ‘escape ways’ means that the platform has inclined to more than 15 degrees in less than one hour, which is a hazardous situation for personnel but not for the rig itself. The report commented that it was not surprising that these frequencies were high.

Impairment of ‘floatability’ included all events causing capsize within a couple of days. The platform will have been evacuated long before capsize occurs, and residual risks to personnel are much lower.

It was found that the residual risk levels for ‘floatability’ corresponded approximately with the actual frequency of total loss.

A burning blowout and collision were shown to be major hazards to both ‘escape ways’ and ‘floatability’. Ballast failure was a significant hazard for ‘escape ways’, and mooring-induced heel a lesser hazard for ‘floatability’. All other risks were considered to be low.

The main thrust of RABL was directed towards semi-submersibles used as mobile drilling units, and full case studies were performed on mobile drilling units only. The programme was extended, however, to cover accommodation and floating production units.

Risk levels for a floating production or accommodation platform were similar to those assessed for a mobile drilling unit. Collision risks were much reduced, however, where platforms were marked on sea charts. This was seen as a significant factor in collision avoidance. Long-lasting fires or explosions may be a significant risk for a floating production unit.

Collision risks for a flotel drifting into its fixed platform were found to be low provided the flotel has significant thruster capacity (as do most modern platforms). The collision risk was higher for a platform with little thruster capacity.

Hazards considered during the RABL project are summarised in Table 2.

Table 2: Applicability of hazards to different types of units

Hazard Mobile Drilling Accommodation Production Unit Unit Unit

Falling objects Yes Yes Yes

Collision with a passing vessel Yes Yes Yes

Collision between a flotel & a fixed No Yes No platform

Inherent structural failure Yes Yes Yes

Burning blowout Yes No Yes

Utility systems fire and explosion Yes Yes Yes

Subsea gas blowout Yes No Yes

Tripping due to anchor failure Yes Yes Yes

Abnormal weight condition Yes No Yes

Ballast system failure Yes Yes Yes

Structural failure Yes Yes Yes

Accidental effects from fixed platform No Yes No

Subsea gas leak from a riser/ pipeline No No Yes

Fire and explosion due to process/ riser No No Yes system leaks

67

Collision Hazards

The ‘second generation’ platforms considered in the case studies had reserve buoyancy in the deck, in accordance with NMD regulations at that time. The principle is that the platform should survive loss of buoyancy of a column without capsizing. It is likely, however, that failure of connections between the deck and column will cause the same event to flood the deck and also destroy the column. Reserve buoyancy should therefore be seen as a last defence. A severe collision with a passing vessel (e.g. a 5000 DWT vessel travelling at full speed) represents an event of this type, and (according to estimates made during the RABL programme) such events are not particularly rare.

For the particular platform considered, upper deck reserve buoyancy was ineffective if the column failed structurally. With such ineffective reserve buoyancy, the difference in risk levels between first and second generation platforms turned out to be marginal. Minor design changes, at little or no cost, could make reserve buoyancy much more effective, however, possibly reducing the risk level by a factor of five.

Collision hazards varied significantly between different fields, and between different locations within a field, depending on the density of merchant vessel traffic. The risks of collision with fixed production platforms were significantly lower than risks to mobile platforms, because the former are marked on navigational charts. Risks to accommodation platforms were also considered to be lower, because charts show the fixed installations to which they are connected.

An accommodation unit may also drift onto the nearby fixed platform, but this only presents a moderate hazard for most modern units, because most have sufficient thruster capacity to counteract the effects of mooring line failure. This might be a more significant hazard in cases where the unit does not have adequate thruster capacity, but the risk of collision from a passing vessel was considered to be dominating.

It was noted that design requirements were normally based on a 14 MJ collision with a 5000 tonne vessel travelling at 2 m/s. Case studies during the RABL programme indicated that the ultimate structural capacity of a column would be of the order of 50 MJ before complete failure occurs. Some energy may be absorbed by deflecting the vessel, and transforming the energy into rotation. A semi­submersible platform may therefore survive a 70 MJ to 80 MJ impact, provided the reserve buoyancy of the deck is unimpaired by structural failure of a column.

Ballast Failure Hazard

The second main contributor to risk was ballast system failure. A comparison was made between risks to ‘first’ (late 1970s), ‘second’ (1982/1983) and ‘third generation’ (1985/1986) platforms, only the last of which have a ballast pump room at each corner, together with considerable flexibility and redundancy in the system. The total RAE risk was estimated to be above 1×10-3 per platform year for the ‘first generation’ unit, with a slightly lower risk for the ‘second generation’ platform. This risk was almost eliminated, however, for the ‘third generation’ platform.

The report noted that ballast failure frequencies were almost constant, irrespective of the platform’s mode of operation. The results were therefore regarded as valid for mobile drilling units, accommodation and production units.

Blowout Hazard

Blowouts (with attendant hazards of explosion, fire and loss of buoyancy) were the third main contributor to risk. Blowouts have a relatively high frequency of occurrence, and are characterised by consequences that cannot be designed against. The only effective way to reduce the risk to the platform is therefore to reduce the frequency of blowouts, or else the probability that the platform will be exposed to consequences of blowout.

The prevention of blowouts was considered to be the more crucial aspect. Statistics showed that there is a relatively high risk of blowout during exploration drilling in both American and North European

68

waters. Blowout risks are somewhat lower during production, but still present a significant hazard to a floating production unit. Blowout risks are not relevant to accommodation units.

The other important aspect is the ability of the platform to re-locate following a blowout. This is an important advantage of a mobile platform over a fixed platform. Rapid re-location should be possible in almost any accidental condition. Reliable re-location may be a problem, however, blowout statistics showing that the probability of success was only about 0.4.

Buoyancy effects from the gas plume were not considered to be a threat.

The main risk associated with a blowout is that of gas or oil ignition, creating a long-lasting fire, possibly combined with an explosion. These hazards depend strongly on reservoir and field characteristics.

Other Hazards

Other hazards only contributed about 2% to the total risk, and were of minor importance. These hazards included falling loads, mooring-induced heel (tripping), inherent structural failures and extreme environmental loads. The report noted, however, that some of these hazards might become more significant when risks associated with ballast and collision events are reduced.

An additional hazard for a production unit is fire or explosion following a leak from the process system, a riser or a pipeline. Leaks generally have limited significance, because they generally occur on the upper deck, with limited potential to cause major structural damage. Riser leaks were considered to be a more significant hazard, especially where flexible risers are used without subsea isolation systems. A gas leak without subsea isolation could cause a long-lasting fire, threatening platform integrity.

Recommendations

The analysis methodology and procedure were considered to be robust and sensitive to differences between concepts, provided all important aspects are considered.

It was therefore recommended that the new analysis methodology should be used to assess safety levels for new platform designs, or for existing platforms subject to changes in operational premises.

The report nonetheless recognised the vulnerability of any risk assessment procedure to lack of statistical data and to lack of insight into what are relevant and important failure modes.

Technical recommendations included the following:

• Collision risk requires the greatest attention, particularly focussing on collision prevention measures. These might include warning systems and extended exclusion zones in specific cases. The report also recommended further studies to define true collision risk levels.

• The reserve buoyancy function should be made as effective as possible, to withstand moderate collisions with, for example, a small vessel travelling at full speed. The design should also prevent, as far as possible, loss of reserve deck buoyancy following structural failure of a column. The report suggested that such failures might be avoided quite simply and cheaply.

• Having ballast rooms at all four corners significantly reduced risk levels. Such systems also provide important benefits in terms of redundancy and flexibility. It was also considered important to arrange the system so that human failure cannot easily lead to a critical condition.

• Risk assessment was recommended, in addition to FMEA studies on ballast systems, because FMEA studies are not capable of assessing failure combinations adequately.

69

• The most effective risk reducing measure associated with blowouts was to reduce the occurrence of blowouts themselves. Risks associated with fire and explosion can be reduced by maximising the probability of relocating the platform quickly following a blowout.

• Risks associated with semi-submersibles used as accommodation units were found to be similar to those associated with mobile drilling units, and the same recommendations applied.

The main additional recommendation for a floating production unit was to prevent long-lasting gas fires caused by pipeline or riser leaks, especially where flexible gas export risers are used. Subsea isolation of the leak was considered to be particularly useful.

Appendices to the report summarise the background to the RABL programme, the hazards considered, and the analysis methodology adopted, together with summary and contents pages from each of the earlier RABL reports.

70

Printed and published by the Health and Safety ExecutiveC30 1/98

Printed and published by the Health and Safety Executive C0.06 11/03

ISBN 0-7176-2729-2

RR 143

9 78071 7 627295£15.00