GCPS 2010

__________________________________________________________________________













Enhancing Offshore Safety: A Description of the Offshore
Major Accident Risk (OMAR) Model


Mike Considine
BP Safety and Operations
Sunbury on Thames, UK

Dave Fargie
BP Exploration
Sunbury on Thames, UK
dave.fargie@uk.bp.com

Warrick Cooke
Tessella
Abingdon, UK
Warrick.Cooke@tessella.com


Prepared for Presentation at
American Institute of Chemical Engineers
2010 Spring Meeting
6
th
Global Congress on Process Safety
and the 44
th
Annual Loss Prevention Symposium
San Antonio, Texas
March 22-24, 2010

UNPUBLISHED



AIChE shall not be responsible for statements or opinions contained
in papers or printed in its publications


Enhancing Offshore Safety: A Description of the Offshore
Major Accident Risk (OMAR) Model


Mike Considine
BP Safety and Operations
Sunbury on Thames, UK

Dave Fargie
BP Exploration
Sunbury on Thames, UK
dave.fargie@uk.bp.com

Warrick Cooke
Tessella
Abingdon, UK
Warrick.Cooke@tessella.com

Keywords: offshore, risk, safety, design, QRA, BP, Tessella, risk reduction, concept
selection

Abstract

Past incidents within the oil and gas industry have demonstrated the importance of
assessing and managing major accident hazards. BP has undertaken to drive the
principles of inherently safer design and continuous risk reduction into its operations, and
these processes are underpinned by a comprehensive understanding of the factors that
affect major accident risk. BP has developed a process for assessing offshore risk and has
applied it to its offshore facilities to identify the key risk drivers and to provide guidance
on how those risks can be effectively mitigated. The paper describes this process,
illustrated by some practical examples. Compared to onshore analysis, the assessment of
offshore risk presents particular challenges such as near-field hazard effects, time-
dependence, escalation, distinctive non-process events and a genuinely 3D environment.
In 2008 BP engaged a technology consultancy to work with internal subject matter
experts in developing a 3D model to implement this offshore risk assessment process.
Based on consistent rule-sets, the model allows a variety of facility types to be spatially
represented, accounting for dimensions/properties of decks, walls, enclosures, refuges,
egress routes and evacuation facilities. The location of hydrocarbon systems and
associated inventories are specified as well as the distribution of people during a range of
operational states. Risk reduction options on operational plant or new designs can be
modeled and the benefits objectively assessed. The paper includes examples of the
models application.




1. Introduction

Over the last 30 years there have been a number of major incidents associated with oil
and gas offshore operations that have led to a large number of fatalities. Examples
include:

1980 - Alexander Kielland, collapse of accommodation platform, 123 fatalities
1982 Ocean Ranger, sinking of semi-submersible, 84 fatalities
1983 Glomar Java, capsize of drillship in typhoon, 81 fatalities
1984 Enchova Central, ignited blowout, 42 fatalities
1986 North Sea, helicopter crash, 45 fatalities
1988 Piper Alpha, platform explosion and riser fire, 167 fatalities
1989 Seacrest, capsize of drill ship in typhoon, 91 fatalities
2001 P36, sinking of semi-submersible, 11 fatalities
2005 Bombay High, ship collision with platform and riser fire, 22 fatalities
2007 Usumacinta, jack up collision with platform, 22 fatalities
2009 North Sea, helicopter crash, 16 fatalities

BP manages such risks through the Major Accident Risk (MAR) process. This process
is described in reference (1).

The MAR process generates FN and FEnvironment curves for sites/operations. In
addition, the MAR process generates a numerical value of the risk of each individual
scenario that can be described in terms of a Weighted Expectation Value (WEV). The
WEV incorporates a risk aversion index (i.e., events involving higher N values are
accorded disproportionately high severity scores). The WEV values can be used to
establish priorities for risk reduction measures relating to individual scenarios.

The MAR process is not the sole hazard evaluation and risk management tool for major
hazards. In addition to complying with regulatory and industry codes, businesses also
employ a range of tools appropriate to their operations, such as inherently safer design
(ISD) methodologies, hazard identification (HAZID), layers of protection analysis
(LOPA), hazard and operability studies (HAZOP) and quantitative risk assessment
(QRA).

The assessment of process-related hazards on offshore facilities is more complex than on
onshore facilities. For example, the physical effects of fires, explosions and toxic
releases are influenced by platform structures such as floors and walls. The simpler
consequence models are therefore not appropriate. Also populations are located in close
proximity to the hazards and opportunity for rapid escape may be limited such that:

The vulnerability of escape routes, shelter facilities and evacuation facilities
must be assessed; and
Delayed effects such as escalation of fires leading to release of other inventories
or structural failures must be addressed.


As the historical record shows, non-process events are also a major component of
offshore risk. Such events include ship collisions, earthquakes, wind/wave loading, loss
of stability/capsizing, structural collapse, dropped objects, accommodation fires and
transportation accidents (e.g., helicopter crashes).

To support the MAR process, BP has developed the Offshore Major Accident Risk
(OMAR) suite of tools. This series of applications guides trained users through the
process of characterizing the offshore facility and then models a range of hypothetical
events, producing estimates of the associated consequences and presenting the users on
completion with a risk curve and associated details of the contributing events.

2. Methodology

Conceptually, OMAR models a facility as one or more platforms along with a collection
of subsea release sources. Each platform consists of a series of decks, with each deck
containing a variety of boundaries, release sources and personnel escape routes.

From the placement of the boundaries (as provided by the user), details of the various
volumes on each deck are established, as well as the floors/ceilings that bound them.
Users then provide additional information for these volumes such as ignition sources,
degree of protection from smoke, etc.

Variations in platform activity can be modeled by dividing an operating year into one or
more Operational States with each state consisting of a set of active process and non-
process hazards, together with associated staffing levels.

OMAR models hydrocarbon events in a series of stages. Figure 1 gives an overview of
the modeling logic for a hypothetical hydrocarbon release.

The various stages are as follows:

a. Model Initial Release
OMAR considers two classes of releases: those from process systems and those
from well operations. OMAR determines how the release rate will vary with time
(taking into account any isolation or depressurisation that may be possible,
including a probability that such mitigation may fail), where the release occurs
(allowing liquid releases a chance to move to lower decks), and whether ignition
occurs (either immediately or after a delay).

b. Model Explosion Effects
For releases with a significant volatile or gaseous component, OMAR assesses
potential explosion events, considering such factors as timing of ignition and level
of congestion and confinement. Based on a historical database of CFD explosion
simulation results, OMAR estimates the effects of explosions taking into account
the geometry of the platform and the rate of release, and applying an exceedance

curve approach. The effects of the explosion propagating beyond the initial
release cloud are modeled both by the expansion of overpressure into adjacent
locations and the use of models for free-field expansion of a gas cloud. The
structural effects of the explosion are assessed based on user-defined blast
resistance of platform features such as walls and floors. The potential for
explosions to cause secondary releases is also modeled.



































Figure 1 Overall OMAR Methodology Flowsheet





c. Model Fire Effects
The rate of release of hydrocarbon and the type of inventory present determine the
maximum volume of fire that will be produced. Where there is sufficient space
and ventilation available to combust within the platform volume, OMAR treats
the fire as a simple source. Where there is not, OMAR uses a simple model for
determining where the fire spreads (taking into account any failures of boundaries
that have already occurred) and the geometry it adopts when it spills outside the
platform. From this analysis, OMAR determines the consequences of the fire on
populations, process equipment, escape routes and boundaries. This determination
involves consideration of both direct impingement and radiant effects, with the
latter taking into account the shielding available from surviving boundaries.
OMAR also assesses smoke effects, which are the predominant limitation to the
use of escape routes and evacuation equipment.

d. Update Population Locations
Having determined the initial effects of the event, OMAR then models the
movement of populations in response to fire, smoke and explosions. This
modeling may result in populations moving to a safer location (e.g., to a protected
refuge area or an adjacent bridge-linked platform) or attempting evacuation
(either orderly or disorderly). The intention is to reflect the anticipated response
in an emergency situation.

e. Determine time of next significant event.
OMAR does not model the facility in continuous time. Instead, it attempts to
determine the time points when significant events may occur and only models the
consequences at these milestones. Significant events typically relate to failures of
boundaries or process equipment (leading to escalation) or increased impact on
populations such as the protection time of a safe refuge being compromised.
Modeling continues until no more events are possible, or until all the populations
are safe. Once no further processing is required, details of the event are stored,
such as the frequency (taking into account both the initial event frequency and the
probability of the different factors taking place) and the various consequences.

In the OMAR model, release frequencies have been derived from data from UK North
Sea operations, where there is a rigorous incident recording regime. Process release
frequencies were based on reported events per process system (e.g., oil metering, oil
separation, gas dehydration, gas compression, etc.). Since the offshore data was derived
primarily from North Sea data, an adjustment factor can be applied for other regions to
reflect the local historical experience of releases.

In addition to modeling ignited hydrocarbon releases, OMAR also records details of
unignited releases (to track environmental effects), as well as modeling the risks from
non-process events.

The OMAR Results Viewer provides users with the ability to explore the contributors to
risk in an interactive manner. As OMAR models the events with very fine granularity,

the Results Viewer affords users the ability to aggregate events (for example by
operational state, overpressure, release location, etc.) and to apply filters. As a starting
point, the tool includes a number of typical aggregations and filters that are applicable to
many facilities.

Ensuring an appropriate level of quality assurance for OMAR was a vital part of the
project activity. In addition to Tessella's own software QA processes, BP engaged DNV
Aberdeen to deliver a level of independent technical verification. This exercise was a
considerable task and DNV's contribution to the success of the project is gratefully
acknowledged.

3. Application

The BP portfolio of assets encompasses a broad variety of concept types. It was therefore
necessary for the OMAR tool to have sufficient flexibility to model each type of facility
design. OMAR has been applied to complex and simple integrated jacket designs as well
as multi-jacket bridge linked facilities. See Figure 2. The tool has also been utilized to
study spar and FPSO (Floating Production Storage and Offloading) designs, and transient
drilling activity where jack-up rigs are alongside jacket platforms. The model has proved
to be robust to this range of applications, although typically some further modeling
methodology development was required as each new concept was considered for the first
time.





















Figure 2 Example of Bridge-Linked Jacket Facility


OMAR is applicable for use in studying operational facilities as well as new-build and
platform-upgrade capital projects. The user-friendliness of OMAR allows trained
engineers from a project or facility to have a large role in producing and running models.
This facility in turn allows a great level of ownership at a local level and reduces reliance
on central resources.

The visual nature of the modeling facilitates powerful communication and discussion of
the study. The model inputs can be clearly seen, giving assurance that key features of the
platform design have been appropriately reflected. Study conclusions and risk reduction
options can also be clearly explained.

3.1 Application within Operations

In one example the model was used to study an existing integrated, mixed production
platform. The overall field layout was represented at the facility level by importing a
scaled maritime chart showing the location of the platform and mapping out the approach
routing of its pipelines. See Figure 3. Local wind rose data was specified to allow
probabilistic assessment of the impact of smoke. In this case the prevailing wind
direction was very dominant, so the location of the platform living quarters in a normally
cross-wind location was an important inherently safer design feature to be accounted for.























Figure 3 Example Facility Level View


For each deck, the layout plan was electronically imported into the software (see Figure
4) and appropriately scaled and cross-referenced to establish the platforms geometry.
Vertical boundaries were drawn demarking the extent of the platform at that deck level
and the walls/barriers on it. Fire and blast resistance were specified where appropriate.
In addition, properties of each deck flooring section (e.g., grated or solid) were also input
to reflect their influence on the migration of gas and liquid releases as well as their
bearing on predicted explosion overpressures.

The escape routes on and between decks were also mapped onto the 2D deck plan views
and can be seen as a connected network on the 3D representation. This mapping allowed
modeling of the movement of personnel on board in the event of hypothetical incidents,
thus assessing their potential for finding safe refuge and/or escaping from the platform.
The modeling allowed the specification of the location and vulnerability of the main
lifeboats as well as secondary escape means such as life rafts and ladders. In this case
the environmental conditions and deck heights allowed escape without equipment, so
realistic (but not over-optimistic) credit was taken for disorderly evacuation as a last
choice option.


Vertical boundaries, in
this case a firewall
Escape route
network
Process
Systems
Flooring
Region
Vertical boundaries, in
this case a firewall
Escape route
network
Process
Systems
Flooring
Region




















Figure 4 Example 2D Deck Level and 3D Views


Process systems were added at representative locations to specify the point of
hydrocarbon release. Systems that were highly distributed (e.g., the flare collection
network) were split using multiple locations with a weighted distribution of release
frequencies. The vulnerability of each process system to escalation from fire and blast
was individually represented by a fire exposure time limit and an overpressure resistance
limit respectively.

Details of hazardous inventories were recorded and associated with the various process
system(s) from which they could potentially release. Inventories were typically defined
based on the physical and process location of major Emergency Shutdown Valves but
with quantitative account given to the potential for isolation failure and subsequent
extended release duration.

Operational states for the platform were identified, in this case representing:

Normal daytime operation with outside process area maintenance and
operations activity;
Normal nighttime without planned maintenance activity; and
Well workover periods accounting for additional staffing and blowout potential
associated with wireline and coil tubing interventions.

For each operational state the number of people in each platform location was specified
as well as process systems and well operation hazards prevalent. In some other studies a
more extensive range of operational states has been used. Examples include: increased
staffing levels on a live platform in preparation for a turnaround, periods of jack up rig
presence for drilling or extensive workover, etc.
Non-process events including transportation hazards (helicopters and crew boats),
environmental hazards (storms and seismic events) and ship collisions (passing and
visiting vessels) were specified. Where appropriate, localized numerical data (e.g.,
number of visiting vessels) was used together with regional shaping factors (e.g., ones
based on local helicopter accident statistics).

The results of the analysis were produced in the form of F-N curves, F-Environment
curves and contributors to risk quantified by WEV. These results allowed identification
of the key drivers of risk and prompted action in the following areas:

Reducing People On Board Recognizing the number of people exposed to the
hazards as an important factor, the staffing levels were challenged to reduce this
exposure whilst maintaining operational integrity.

Relocation of people to safer platform areas The analysis highlighted the
exposure of some personnel in buildings to fire and blast events initiating in the
adjacent main process area. Relocation of people away from the main process
area and up to the plated deck above reduced their direct vulnerability to fire and

blast events and improved their access to the lifeboats. A blast wall was also
provided to further protect buildings on the upper level.

Reduced leak frequency Establishing that higher-than-industry-benchmarked
hydrocarbon release frequency was a significant component of the predicted risk
provided additional incentive to develop a focused and successful reduction
programme. A high level of reporting rigor allowed specific release causes to be
targeted and mitigated, specifically, small bore piping, stainless steel tubing, and
flange and valve integrity. Fabric maintenance was also stepped up to address
external corrosion issues. The programme allowed a reduction of ~33% in leak
frequency to be demonstrated.

Removal of solid wind walls in favor of a louvered design The measure
increased the natural ventilation on the platform, reducing both the potential for
build-up of flammable gas and potential explosion overpressures.

Focus on long duration events Another outcome of the study was to highlight
events where escalation of fire and blast events initiated longer duration riser and
well releases. This outcome in turn triggered a more detailed review of the steps
that could be taken to reduce both the likelihood and consequences of such events.

Non-Process Hazards Opportunity was identified to increase the level of
assurance associated with the response of the jacket to earthquake events.
Helicopter use was also optimized to reduce risk, as transportation was recognized
as a key risk contributor.

The impact of each potential risk reduction intervention was assessed to allow
prioritization and to demonstrate an ongoing process of continuous risk reduction. These
results were presented in the form of their impact on the F-N curve (position of the line
before and after the reduction measure) as well as the reduction in the percentage of
WEV.

3.2 Application in Project Concept Evaluation

The OMAR approach to offshore modeling has been utilized in both greenfield and
brownfield project contexts. In a recent greenfield project, a number of different offshore
concepts were being considered during the concept selection stage.

The conclusion of the study was that the option with a separate LQ platform was the
lowest risk option, being somewhat lower than the FPSO case.

At a more detailed level within each concept, a number of specific risk reduction options
were identified:


Relocation of a gas riser to increase separation from the populated area (jacket
options);
Review of crane location to eliminate potential for dropped objects on pipelines;
Elimination of populated buildings on the wellhead platform; and
Provision of alternative evacuation points on FPSO options (ensuring escape options
at each end of the vessel).

These results were used to support the projects drive towards an inherently safer design
solution as well as indentifying specific risk reduction opportunities for the project to
develop during the next stages of engineering design. It also helped to raise the profile of
inherent safety and risk reduction as a critical step in the project.

In a brownfield setting the offshore OMAR approach has been used to assist the scope
development of projects aiming to rehabilitate and upgrade older platforms. In one
example a series of complexes was modeled to establish a baseline risk profile and
identify prioritized risk contributors. Scoping options were modeled to assess their
impact and to demonstrate tangible risk reduction benefits. Examples of measures that
were assessed and implemented were:

Reduction in platform POB to limit numbers exposed to offshore hazards;
Removal of significant ignition sources (e.g., fired heaters);
Integrity upgrades to drive down leak frequency; and
Provision of improved protection for personnel in offshore buildings

Assessing the upgrade programme as a whole was particularly beneficial as it allowed
some optimization of the implementation plan to ensure that more significant measures
were put in place earlier.

4. Future Developments

The need to prevent the model becoming something of a black box that takes input and
cryptically produces an F-N curve was recognized early in the project. Without an
understanding of the sources of risk the tool would have limited value in driving specific
and tangible risk reduction measures. To this end the OMAR Event Level Viewer tool
was developed. The Viewer provides a tool through which users can explore an
individual event, see how the event progresses, including the effects of fires and
explosions overlaid on a 3D model of the facility, and report the effects on populations.
The intention is that this tool will allow users to understand why a specific event has
particular consequences and, when coupled with the OMAR Results Viewer, allow
specific recommendations to be made on how to reduce risk. Additionally, the views
provided by the Event Level tool (see Figure 5) are a significant aid in communicating
offshore hazards and risk at different levels within the organization.

As a recent addition to the OMAR suite of tools, best practice in the use of the Event
Level Viewer is rapidly developing. As experience is gained in using the tool, new
insights will help to develop deeper understanding of the risk profile of a facility. In

parallel, it is planned that the underlying OMAR model will continue to be improved,
taking into account additional factors (e.g., toxicity) as well as further enhancing the
usability of the model.



Figure 5 Example View from Event Level Viewer

5. Conclusion

The BP MAR process provides a framework for consistent assessment of major accident
risk across the companys broad portfolio of assets. It supplies a key input into BPs
management of continuous risk reduction and embeds the principles of inherently safer
design.

The OMAR tool is a 3D risk model, applicable to a broad range of offshore concepts. The
interface is user friendly, fostering study ownership at a local level in preference to
reliance on centralized expert resources. The rule sets embedded within the model drive
a high level of consistency with the aim of minimizing subjectivity. The Results Viewer
allows considerable flexibility in interrogating the output of the model, facilitating a deep
understanding of the contributors to facility risk.

Experience within BP has shown that offshore OMAR analysis has led to tangible risk
reductions in both operational and project environments.



6. References:

1) The major accident risk (MAR) process - developing the profile of major accident
risk for a large multi national oil company", M. Considine and S.M. Hall, Process Safety
and Environmental Protection Volume 87, Issue 1, January 2009.