OGP Risk Assessment Data Directory, Report No. 434, Compiled, 2010

Risk Assessment Data Directory
Report No. 434

March 2010
Summary
International Association of Oil & Gas Producers
P ublications
Global experience
The International Association of Oil & Gas Producers has access to a wealth of technical
knowledge and experience with its members operating around the world in many different
terrains. We collate and distil this valuable knowledge for the industry to use as guidelines
for good practice by individual members.
Consistent high quality database and guidelines

Our overall aim is to ensure a consistent approach to training, management and best prac-
tice throughout the world.
The oil and gas exploration and production industry recognises the need to develop consist-
ent databases and records in certain fields. The OGP’s members are encouraged to use the
guidelines as a starting point for their operations or to supplement their own policies and
regulations which may apply locally.
Internationally recognised source of industry information

Many of our guidelines have been recognised and used by international authorities and
safety and environmental bodies. Requests come from governments and non-government
organisations around the world as well as from non-member companies.
Disclaimer
Whilst every effort has been made to ensure the accuracy of the information contained in this publication,
neither the OGP nor any of its members past present or future warrants its accuracy or will, regardless
of its or their negligence, assume liability for any foreseeable or unforeseeable use made thereof, which
liability is hereby excluded. Consequently, such use is at the recipient’s own risk on the basis that any use
by the recipient constitutes agreement to the terms of this disclaimer. The recipient is obliged to inform
any subsequent recipient of such terms.
This document may provide guidance supplemental to the requirements of local legislation. Nothing
herein, however, is intended to replace, amend, supersede or otherwise depart from such requirements. In
the event of any conflict or contradiction between the provisions of this document and local legislation,
applicable laws shall prevail.
Copyright notice
The contents of these pages are © The International Association of Oil and Gas Producers. Permission
is given to reproduce this report in whole or in part provided (i) that the copyright of OGP and (ii)
the source are acknowledged. All other rights are reserved.” Any other use requires the prior written
permission of the OGP.
These Terms and Conditions shall be governed by and construed in accordance with the laws of Eng-
land and Wales. Disputes arising here from shall be exclusively subject to the jurisdiction of the courts of
England and Wales.
Risk Aassessment data directory – summary
Background
At the end of 1996, the E&P Forum (the previous name of OGP) completed and issued the Risk
Assessment Data Directory. Its aim was to provide a catalogue of information that could be used
to improve the quality and consistency of risk assessments with readily available benchmark data
and references for common types of incident analysed in upstream production operations. Incidents
typically analysed in E&P risk assessments were identified and divided into four major categories,
within which twenty-six individual datasheets were developed. Each datasheet contained informa-
tion describing the event: incident frequency, population and causal data and a discussion of the data
sources, range, availability and application.
These datasheets were made available to OGP members and other interested parties in a loose bound
file. They were also available as electronic Word documents and more recently as PDF files in the
members’ area of the OGP website (http://members.ogp.org.uk). In 2006, OGP’s Safety Commit-
tee formed a task force to consider the future of the data directory. As a first step, the task force
undertook a survey of staff in member companies to establish the level of interest in the existing
data directory and in an updated directory. The survey showed strong interest in an update. The task
force acted accordingly.
Another OGP document, Guidelines for the development and application of health, safety and envi-
ronmental management systems (1994), identifies “evaluation and risk management” as a key ele-
ment of an effective HSE management system. The use of formal risk assessment in achieving the
goal-setting objectives of this element has become widely accepted in the E&P industry. It is now an
essential framework in recent legislation. Experience shows that the application of risk assessment is
important both to improved plant and system integrity and to cost effectiveness. It provides valuable
information for risk-based decision-making.
Formal risk assessment is a structured, systematic process. It supplements traditional design and
risk management processes. It can be based on qualitative or quantitative methods or a combina-
tion thereof. The objective of formal risk assessment is to analyse and evaluate risk. Risk assess-
ment is made up of the following fundamental steps: hazard identification to identify what could go
wrong, consequence assessment to address the potential effects, frequency assessment to determine
the underlying causes and likelihood or probability of occurrence of a hazardous event, assessing the
risks and evaluating potential risk reduction measures.
In risk assessment, frequency is estimated based on knowledge and expert judgment, historical expe-
rience, and analytical methods. These combine to support judgments made by risk assessment teams.
Historical experience is expressed in terms of statistical data gathered from existing operations, gen-
erally in the form of incidents, base failure rates and failure probabilities. A key issue when using risk
assessment is the uncertainties associated with the results. This has a bearing on the confidence with
which the information can be used to influence decisions. Therein lies the need for reliable data to
support E&P risk assessment work.

The objective of the Risk assessment data directory is to provide data and information that can be
used to improve the quality and consistency of risk assessments with readily available benchmark
data. The directory includes references for common incidents analysed in upstream production
operations. The original 1996 data directory included 26 individual datasheets. The updated direc-
tory (2009) now includes 20 datasheets, although the scope of the material presented is similar to
the original with some reorganisation. The structure of four major categories from the 1996 direc-
tory is retained.
Each datasheet contains:
• information describing the event
• incident frequency
• population and causal data
• a discussion of the data sources, range, availability and application.
©OGP 1
The intention is that the Risk assessment data directory may facilitate the systematic assessment of
risks within individual OGP member companies and across the E&P industry. It is hoped that the
updated directory will continue to be a valuable reference document.
Examples of specific applications of the directory include:
• Estimating screening level and order of magnitude incident frequencies
• Reviewing external risk assessment (ie those performed by consultants, design contractors, etc)
• Evaluating risk in QRAs and qualitative assessments
• Comparing industry and corporate performance
• Identifying important risk contributors
The directory also provides reference lists of data sources that can be consulted for more detailed
information. The directory is not intended to be a comprehensive source of incident data. Appli-
cations requiring more comprehensive data should consult the original references as well as other
publicly available information and company data sources. Sources for the data include information
available to the public and industry such as may be obtained from industry projects and the litera-
ture. That is, the directory contains organised publicly available information and data contributed
by individual companies, which has been previously submitted by others.
While every reasonable effort has been made to ensure the quality and accuracy of the information
and data provided, it is the responsibility of each company or organisation using the data to review
the information and determine that the material is suitable for their specific application.
Directory update process

The original data directory was developed as a QRA Subcommittee activity without any central
funding of external consultants. For this, update the task force decided to rely on a centrally funded
consultant to update and revise the datasheet in a consistent manner. With this approach in mind,
a number of consultants operating in the risk assessment field were invited to submit bids for the
update of the entire data directory. They were also invited to make proposals for how the directory
might be modified or improved based on their experience and developments made in the quantita-
tive risk assessment field in recent years.
The work was awarded to DNV Energy, which proposed some deletions, recombination and addi-
tional datasheets. To spread the cost to OGP, update work was commenced in 2007 and continued
through 2008 and into the early part of 2009. A focal point for each datasheet was appointed. He
or she had the responsibility of collecting and compiling comments from the task force and their
organisations on the various datasheets. Periodic meetings with DNV Energy provided opportuni-
ties to discuss and agree the comments.
OGP agreed to make the datasheets available on the OGP website and carried out the necessary
work to do this. Datasheets are available as PDF files and also provide hyperlinks to other more
detailed or useful data sources. As a quality assurance check, an independent expert reviewed the
draft directory. After approval from the OGP Safety Committee, the Data Directory was issued in
the third quarter of 2009. As with all OGP documents the data directory is available to the public
at no charge.
2 ©OGP
Risk Aassessment data directory – summary
Directory scope and content

The directory covers both onshore and offshore E&P activities. The data have been collated under
four major categories:
Accident data: Collated statistical data of accidents (i.e., events that have led to detrimental effects in terms of loss of
life, environmental damage or property damage)
Event data: Collated statistical data of hazardous events (i.e., events that led to or had the potential to lead to an
accident)
Safety systems: Collated statistical data on the reliability of various safety systems employed to prevent and/or
mitigate hazardous events.
Vulnerabilities: Criteria for assessing the vulnerability of plant and humans to hazardous events.
Under each category, there is a series of individual datasheets. The original 1996 Data Directory had
a total of 26 datasheets as follows: Accident Data 7; Event Data 8; Safety Systems 6; Vulnerabilities
5. In the updated directory the number of datasheets in each category is revised to 6, 8, 1 and 4
respectively.
These changes arise from reordering, recombination, splitting and deletion of certain datasheets.
Accident and Event datasheet subject matter remains largely unchanged with the exception that
separate Ignition Probability and Consequence modelling datasheets have been created. This type
of data was then removed from other event datasheets. The four human factors datasheets from the
1996 directory have been organised in a single human factors datasheet. Extreme weather has been
included in the structural failure risks datasheet. These changes leave a total of twenty datasheets as
listed below:
Accident data: Major accidents
Occupational risk
Land transport accident statistics
Aviation transport accident statistics
Water transport accident statistics
Construction risk for offshore units
Event data: Process release frequencies
Risers & pipeline release frequencies
Storage incident frequencies
Blowout frequencies
Mechanical lifting failures
Ship/installation collisions
Ignition probabilities
Consequence modelling
Structural risk for offshore installations
Safety systems: Guide to finding and using reliability data for QRA
Vulnerabilities: Vulnerability of humans
Vulnerability of plant/structure
Escape, evacuation and rescue
Human factors in QRA
©OGP 3
The basic content of each datasheet is as follows:

1. Scope and application Brief outline of data presented in datasheet and details of
the situation for which the datasheet would be applicable.
This includes statements regarding where care should be
exercised in its use.
2. Summary of recommended data: Data presented in a tabular and/or graphical format.
3. Guidance on data use: Guidance on general validity and precautions to be applied
in using the data. Consideration of uncertainties.
4. Review of data sources: The data sources used to obtain the data presented in
section 2.
5. Recommended data sources for further information: Listing of sources of more detailed and specific data.
6. References: Detailed list of references.
Note that the format presented above is general. Individual datasheets vary to some extent,
depending on relevance and availability of information.
The objective has been to identify so far as practical data available in the public domain and to dis-
cuss their applicability. However in a few isolated cases, reference is made to data not publicly avail-
able yet held by an OGP. Where this is the case, the judgment of the RADD Task Force is that these
data are sufficiently robust to include even though the user is not able to source the data directly.
It is not the intention of the Directory to address or comment in any way on the best approach or
methods for risk assessment studies. In some of the datasheets, particularly for Safety Systems, the
key data presented are in terms of how ‘reliable’ these systems are. “Reliability Analysis” is a distinct
specialist area. Any detailed assessment would require expert assistance. Another area that is recog-
nised as directly influencing the frequency of accidents and events is Human factors. Again, this is a
distinct specialist area, which would require expert assistance if any detailed assessment work was to
be undertaken. It should also be noted that there are many other areas where expert assistance would
be needed to undertake an in-depth study, eg assessing structural vulnerabilities or marine hazards.
Updating plans
It is recognised and accepted that the data presented in OGP’s Risk assessment data directory will
become out-of-date. Nevertheless, many of the data bases identified are actively maintained and by
directly accessing these source databases, up-to-date information can be obtained.
This update is the first to take place since the directory was originally issued in 1996/97. This is con-
sidered too long a delay between revisions. New arrangements will allow users to provide feedback
on errors, omissions and potential revisions or any new or better information, or data from other
geographic areas on the OGP website. Users and other interested parties are encouraged to make
use of this facility. OGP will then arrange to review this information periodically and update the
datasheets as required. Some datasheets have been allocated to other OGP Task Forces or Subcom-
mittees to maintain the data more frequently.
4 ©OGP
Report No. 434 – 1

March 2010
Process
release
frequencies
RADD – Process release frequencies
contents
1.0 Scope and Definitions ........................................................... 1
1.1 Equipment ....................................................................................................... 1
1.2 Release types .................................................................................................. 2
2.0 Summary of Recommended Data ............................................ 2
3.0 Guidance on use of data ...................................................... 19
3.1 General validity ............................................................................................. 19
3.2 Uncertainties ................................................................................................. 20
3.3 Definition of release types ........................................................................... 20
3.3.1 Full releases.............................................................................................................. 20
3.3.2 Limited releases ....................................................................................................... 21
3.3.3 Zero pressure releases ............................................................................................ 21
3.4 Consequence modelling for the largest release size ................................ 21
3.5 Modification of frequencies for factors specific to plant conditions ....... 22
3.5.1 General considerations ........................................................................................... 22
3.5.2 API 581 Approach..................................................................................................... 22
3.5.3 Safety Management.................................................................................................. 24
3.5.4 Inter-unit piping ........................................................................................................ 25
3.5.5 Flanges...................................................................................................................... 26
4.0 Review of data sources ....................................................... 27
4.1 Basis of data presented ............................................................................... 27
4.1.1 Summary of release statistics................................................................................. 28
4.1.2 Methodology for obtaining release frequencies ................................................... 28
4.1.3 Uncertainties in release frequencies...................................................................... 29
4.1.4 Comparison with experience .................................................................................. 29
4.1.5 Conclusions.............................................................................................................. 30
4.2 Other data sources ....................................................................................... 30
5.0 Recommended data sources for further information ............ 31
6.0 References .......................................................................... 31
6.1 References for Sections 2.0 to 4.0 .............................................................. 31
6.2 References for other data sources examined ............................................ 32
©OGP
Abbreviations:
ANSI American National Standards Institute
API American Petroleum Institute
DNV Det Norske Veritas
ESD Emergency Shutdown
HC Hydrocarbon
HCRD Hydrocarbon Release Database
HSE (UK) Health and Safety Executive
LNG Liquefied Natural gas
OREDA Offshore Reliability Data
OSHA Occupational Safety and Health Administration
PSM Process Safety Management
QRA Quantitative Risk Assessment (sometimes Analysis)
UKCS United Kingdom Continental Shelf
©OGP
1.0 Scope and Definitions

1.1 Equipment
This datasheet presents (Section 2.0) frequencies of releases from the following
process equipment types. They are intended to be applied to process equipment on the
topsides of offshore installations and on onshore facilities handling hydrocarbons but
are not restricted to releases of hydrocarbons.
1. Steel process pipes 10. Compressors: Reciprocating
2. Flanges 11. Heat exchangers: Shell & Tube, shell
side HC
3. Manual valves
12. Heat exchangers: Shell & Tube, tube
4. Actuated valves
side HC
5. Instrument connections
13. Heat exchangers: Plate
6. Process (pressure) vessels
14. Heat exchangers: Air-cooled
7. Pumps: Centrifugal
15. Filters
8. Pumps: Reciprocating
16. Pig traps (launchers/receivers)
9. Compressors: Centrifugal
OREDA [1] gives frequencies of releases from subsea equipment. If these are used, it
should be noted that these are based on only a small number of incidents (a total of 13
from several different components) and so are subject to considerable statistical
uncertainty. It is suggested that use of onshore/topsides failure frequencies, i.e. the
frequencies for the corresponding equipment types from nos. 1 to 16 above, is
preferable.
The precise definition of each equipment type is given with the data in Section 2.0.
Besides the equipment defined in the above list, the equipment types listed in Table 1.1
are also covered by the data given in Section 2.0.
Table 1.1 Other Equipm ent Types Covered
Equipment Type See Equipment Type See

Datasheet or Datasheet or
Section No. Section No.
Absorbers 6 Grayloc flanges Section 3.5.5
Clamp connections 2 Knock-out drums 6
Columns 6 Pipe connections 2
Distillation columns 6 Process reactors 6
ESD valves 4 Reactors 6
Fin-fan coolers 14 Scrubbers 6
Fittings (small-bore) 5 Separators 6
Gaskets Section 3.5.5 Small-bore fittings 5
©OGP 1
1.2 Release types

According to analysis of historic process release frequency data [2], releases can be
split into three different types:
• Full releases: consistent with flow through the defined hole, beginning at the
normal operating pressure, and continuing until controlled by emergency shut-down
and blowdown (if present and operable) or inventory exhaustion. This scenario is
invariably modelled in any QRA.
• Lim ited releases: cases where the pressure is not zero but the quantity released
is much less than from a full release. This may be because the release is isolated
locally by human intervention (e.g. closing an inadvertently opened valve), or by a
restriction in the flow from the system inventory (e.g. releases of fluid accumulated
between pump shaft seals). This scenario may be modelled, depending on the detail
of the QRA, but the consequences should reflect the limited release quantities.
• Zero pressure releases: cases where pressure inside the leaking equipment is
virtually zero (0.01 barg or less). This may be because the equipment has a normal
operating pressure of zero (e.g. open drains), or because the equipment has been
depressurised for maintenance. This scenario is typically excluded from QRA, and
is included mainly for consistency with the original HSE data (see Sections 3.3, 4.0).
Therefore, the release frequencies are tabulated for each of these release types, as well
as the overall frequencies for all release types taken together being tabulated1.
2.0 Summary of Recommended Data

A datasheet is given below for each of the equipment types listed in Section 1.1. The
definitions given of the equipment types are consistent with those used by the UK HSE.
1
Note that these overall frequencies are not the sum of the frequencies for each release type;
they are calculated by a separate mathematical function, as described in Section 4.1.2, fitted to
the release data.
2 ©OGP
Equipment Type: (1) Steel process pipes

Definition:
Offshore: Includes pipes located on topsides (between well and riser) and subsea (between
well and pipeline).
Onshore: Includes pipes within process units, but not inter-unit pipes or cross-country
pipelines.
The scope includes welds but excludes all valves, flanges, and instruments.
(a) All piping release frequencies (per metre year) by pipe diameter
6" DIA 12" DIA 18" DIA 24" DIA 36" DIA
HOLE DIA 2" DIA (150 (300 (450 (600 (900
RANGE (mm) (50 mm) mm) mm) mm) mm) mm)
1 to 3 9.0E-05 4.1E-05 3.7E-05 3.6E-05 3.6E-05 3.6E-05
3 to 10 3.8E-05 1.7E-05 1.6E-05 1.5E-05 1.5E-05 1.5E-05
10 to 50 2.7E-05 7.4E-06 6.7E-06 6.5E-06 6.5E-06 6.5E-06
50 to 150 0.0E+00 7.6E-06 1.4E-06 1.4E-06 1.4E-06 1.4E-06
>150 0.0E+00 0.0E+00 5.9E-06 5.9E-06 5.9E-06 5.9E-06
TOTAL 1.5E-04 7.4E-05 6.7E-05 6.5E-05 6.5E-05 6.5E-05
(b) Full piping release frequencies (per metre year) by pipe diameter
HOLE DIA 2" DIA (150 (300 (450 (600 (900
1 to 3 5.5E-05 2.6E-05 2.3E-05 2.3E-05 2.3E-05 2.3E-05
3 to 10 1.8E-05 8.5E-06 7.6E-06 7.5E-06 7.4E-06 7.4E-06
10 to 50 7.0E-06 2.7E-06 2.4E-06 2.4E-06 2.4E-06 2.3E-06
50 to 150 0.0E+00 6.0E-07 3.7E-07 3.6E-07 3.6E-07 3.6E-07
>150 0.0E+00 0.0E+00 1.7E-07 1.7E-07 1.6E-07 1.6E-07
TOTAL 8.0E-05 3.8E-05 3.4E-05 3.3E-05 3.3E-05 3.3E-05
(c) Limited piping release frequencies (per metre year) by pipe diameter
HOLE DIA 2" DIA (150 (300 (450 (600 (900
1 to 3 3.1E-05 9.9E-06 8.1E-06 7.8E-06 7.7E-06 7.6E-06
3 to 10 1.5E-05 4.9E-06 4.0E-06 3.8E-06 3.8E-06 3.7E-06
10 to 50 1.3E-05 2.5E-06 2.0E-06 1.9E-06 1.9E-06 1.9E-06
50 to 150 0.0E+00 3.2E-06 5.2E-07 5.0E-07 4.9E-07 4.9E-07
>150 0.0E+00 0.0E+00 2.4E-06 2.4E-06 2.4E-06 2.4E-06
TOTAL 5.9E-05 2.0E-05 1.7E-05 1.6E-05 1.6E-05 1.6E-05
(d) Zero pressure piping release frequencies (per metre year) by pipe diameter
HOLE DIA 2" DIA (150 (300 (450 (600 (900
1 to 3 3.7E-06 3.2E-06 3.1E-06 3.1E-06 3.1E-06 3.1E-06
3 to 10 2.7E-06 2.3E-06 2.3E-06 2.3E-06 2.3E-06 2.3E-06
10 to 50 6.0E-06 1.9E-06 1.8E-06 1.8E-06 1.8E-06 1.8E-06
50 to 150 0.0E+00 3.4E-06 7.7E-07 7.6E-07 7.6E-07 7.6E-07
>150 0.0E+00 0.0E+00 2.6E-06 2.6E-06 2.6E-06 2.6E-06
TOTAL 1.24E-05 1.07E-05 1.06E-05 1.05E-05 1.05E-05 1.05E-05
©OGP 3
Equipment Type: (2) Flanges

Definition:
The following frequencies refer to a flanged joint, comprising two flange faces, a gasket
(where fitted), and two welds to the pipe. Flange types include ring type joint, spiral wound,
clamp (Grayloc) and hammer union (Chicksan).
(a) All flange release frequencies (per flanged joint year) by flange diameter
HOLE DIA 2" DIA (150 (300 (450 (600 (900
1 to 3 4.4E-05 6.5E-05 9.6E-05 1.2E-04 1.5E-04 2.1E-04
3 to 10 1.8E-05 2.6E-05 3.9E-05 5.1E-05 6.2E-05 8.5E-05
10 to 50 1.5E-05 1.1E-05 1.6E-05 2.1E-05 2.5E-05 3.4E-05
50 to 150 0.0E+00 8.5E-06 3.2E-06 4.1E-06 5.1E-06 6.9E-06
>150 0.0E+00 0.0E+00 7.0E-06 7.6E-06 8.2E-06 9.3E-06
TOTAL 7.6E-05 1.1E-04 1.6E-04 2.1E-04 2.5E-04 3.4E-04
(b) Full flange release frequencies (per flanged joint year) by flange diameter
HOLE DIA 2" DIA (150 (300 (450 (600 (900
1 to 3 2.6E-05 3.7E-05 5.9E-05 8.3E-05 1.1E-04 1.7E-04
3 to 10 7.6E-06 1.1E-05 1.7E-05 2.4E-05 3.2E-05 4.9E-05
10 to 50 4.0E-06 3.0E-06 4.7E-06 6.6E-06 8.8E-06 1.4E-05
50 to 150 0.0E+00 2.0E-06 6.1E-07 8.7E-07 1.1E-06 1.8E-06
>150 0.0E+00 0.0E+00 1.7E-06 1.8E-06 1.9E-06 2.2E-06
TOTAL 3.8E-05 5.3E-05 8.3E-05 1.2E-04 1.5E-04 2.4E-04
(c) Limited flange release frequencies (per flanged joint year) by flange diameter
HOLE DIA 2" DIA (150 (300 (450 (600 (900
1 to 3 1.5E-05 2.3E-05 3.1E-05 3.8E-05 4.4E-05 5.4E-05
3 to 10 7.9E-06 1.2E-05 1.6E-05 2.0E-05 2.3E-05 2.8E-05
10 to 50 8.6E-06 6.4E-06 8.7E-06 1.1E-05 1.2E-05 1.5E-05
50 to 150 0.0E+00 5.4E-06 2.4E-06 2.9E-06 3.4E-06 4.1E-06
>150 0.0E+00 0.0E+00 4.3E-06 4.8E-06 5.2E-06 5.9E-06
TOTAL 3.2E-05 4.7E-05 6.2E-05 7.5E-05 8.7E-05 1.1E-04
(d) Zero pressure flange release frequencies (per flanged joint year) by flange diameter
HOLE DIA 2" DIA (150 (300 (450 (600 (900
1 to 3 1.5E-06 1.7E-06 2.6E-06 4.2E-06 6.7E-06 1.4E-05
3 to 10 1.1E-06 1.2E-06 1.9E-06 3.1E-06 4.9E-06 1.1E-05
10 to 50 2.0E-06 1.0E-06 1.5E-06 2.5E-06 4.0E-06 8.6E-06
50 to 150 0.0E+00 1.3E-06 6.4E-07 1.1E-06 1.7E-06 3.6E-06
>150 0.0E+00 0.0E+00 1.4E-06 2.2E-06 3.5E-06 7.6E-06
TOTAL 4.6E-06 5.3E-06 7.9E-06 1.3E-05 2.1E-05 4.5E-05
4 ©OGP
Equipment Type: (3) Manual valves

Definition:
Includes all types of manual valves (block, bleed, check and choke); valve types gate, ball,
plug, globe, needle and butterfly. The scope includes the valve body, stem and packer, but
excludes flanges, controls and instrumentation.
(a) All manual valve release frequencies (per valve year) by valve diameter
HOLE DIA 2" DIA (150 (300 (450 (600 (900
1 to 3 4.4E-05 6.6E-05 8.4E-05 9.8E-05 1.1E-04 1.3E-04
3 to 10 2.3E-05 3.4E-05 4.3E-05 5.0E-05 5.6E-05 6.4E-05
10 to 50 2.1E-05 1.8E-05 2.3E-05 2.7E-05 3.0E-05 3.4E-05
50 to 150 0.0E+00 1.1E-05 6.3E-06 7.3E-06 8.0E-06 9.3E-06
>150 0.0E+00 0.0E+00 7.8E-06 8.7E-06 9.5E-06 1.1E-05
TOTAL 8.8E-05 1.3E-04 1.7E-04 1.9E-04 2.1E-04 2.4E-04
(b) Full manual valve release frequencies (per valve year) by valve diameter
HOLE DIA 2" DIA (150 (300 (450 (600 (900
1 to 3 2.0E-05 3.1E-05 4.3E-05 5.3E-05 6.2E-05 7.8E-05
3 to 10 7.7E-06 1.2E-05 1.7E-05 2.1E-05 2.4E-05 3.0E-05
10 to 50 4.9E-06 4.7E-06 6.5E-06 8.0E-06 9.4E-06 1.2E-05
50 to 150 0.0E+00 2.4E-06 1.2E-06 1.5E-06 1.8E-06 2.2E-06
>150 0.0E+00 0.0E+00 1.7E-06 1.9E-06 2.1E-06 2.3E-06
TOTAL 3.2E-05 5.0E-05 6.9E-05 8.5E-05 1.0E-04 1.2E-04
(c) Limited manual valve release frequencies (per valve year) by valve diameter
HOLE DIA 2" DIA (150 (300 (450 (600 (900
1 to 3 2.4E-05 2.7E-05 3.2E-05 3.7E-05 4.3E-05 5.4E-05
3 to 10 1.4E-05 1.5E-05 1.8E-05 2.1E-05 2.5E-05 3.1E-05
10 to 50 1.4E-05 9.5E-06 1.1E-05 1.3E-05 1.5E-05 1.9E-05
50 to 150 0.0E+00 6.4E-06 3.5E-06 4.1E-06 4.7E-06 6.0E-06
>150 0.0E+00 0.0E+00 4.1E-06 4.8E-06 5.5E-06 7.0E-06
TOTAL 5.1E-05 5.8E-05 6.9E-05 8.1E-05 9.3E-05 1.2E-04
(d) Zero pressure manual valve release frequencies (per valve year) by valve diameter
HOLE DIA 2" DIA (150 (300 (450 (600 (900
1 to 3 3.6E-07 7.1E-07 1.1E-06 1.4E-06 1.7E-06 2.2E-06
3 to 10 3.5E-07 6.9E-07 1.1E-06 1.4E-06 1.7E-06 2.1E-06
10 to 50 2.4E-06 7.8E-07 1.2E-06 1.6E-06 1.9E-06 2.4E-06
50 to 150 0.0E+00 4.0E-06 7.1E-07 9.2E-07 1.1E-06 1.4E-06
>150 0.0E+00 0.0E+00 5.4E-06 7.0E-06 8.5E-06 1.1E-05
TOTAL 3.1E-06 6.2E-06 9.5E-06 1.2E-05 1.5E-05 1.9E-05
©OGP 5
Equipment Type: (4) Actuated valves

Definition:
Includes all types of actuated valves (block, blowdown, choke, control, ESDV and relief), but not actuated pipeline valves
(pipeline ESDV and SSIV). Valve types include gate, ball, plug, globe and needle. The scope includes the valve body, stem
and packer, but excludes flanges, controls and instrumentation.
(a) All actuated valve release frequencies (per valve year) by valve diameter
HOLE DIA 2" DIA (150 (300 (450 (600 (900
1 to 3 4.2E-04 3.6E-04 3.3E-04 3.1E-04 3.0E-04 2.8E-04
3 to 10 1.8E-04 1.5E-04 1.4E-04 1.3E-04 1.3E-04 1.2E-04
10 to 50 1.1E-04 6.6E-05 6.0E-05 5.6E-05 5.4E-05 5.0E-05
50 to 150 0.0E+00 3.3E-05 1.3E-05 1.2E-05 1.1E-05 1.1E-05
>150 0.0E+00 0.0E+00 1.8E-05 1.8E-05 1.8E-05 1.7E-05
TOTAL 7.1E-04 6.2E-04 5.6E-04 5.3E-04 5.0E-04 4.7E-04
(b) Full actuated valve release frequencies (per valve year) by valve diameter
HOLE DIA 2" DIA (150 (300 (450 (600 (900
1 to 3 2.4E-04 2.2E-04 2.1E-04 2.0E-04 2.0E-04 1.9E-04
3 to 10 7.3E-05 6.6E-05 6.3E-05 6.0E-05 5.9E-05 5.6E-05
10 to 50 3.0E-05 1.9E-05 1.8E-05 1.7E-05 1.7E-05 1.6E-05
50 to 150 0.0E+00 8.6E-06 2.4E-06 2.3E-06 2.2E-06 2.2E-06
>150 0.0E+00 0.0E+00 6.0E-06 5.9E-06 5.9E-06 5.9E-06
TOTAL 3.5E-04 3.2E-04 3.0E-04 2.9E-04 2.8E-04 2.7E-04
(c) Limited actuated valve release frequencies (per valve year) by valve diameter
HOLE DIA 2" DIA (150 (300 (450 (600 (900
1 to 3 1.7E-04 1.3E-04 1.1E-04 9.7E-05 8.9E-05 7.7E-05
3 to 10 8.8E-05 6.9E-05 5.7E-05 5.1E-05 4.7E-05 4.1E-05
10 to 50 7.8E-05 3.8E-05 3.2E-05 2.8E-05 2.6E-05 2.3E-05
50 to 150 0.0E+00 2.3E-05 9.0E-06 8.0E-06 7.3E-06 6.4E-06
>150 0.0E+00 0.0E+00 1.1E-05 9.8E-06 9.2E-06 8.3E-06
TOTAL 3.3E-04 2.6E-04 2.2E-04 1.9E-04 1.8E-04 1.6E-04
(d) Zero pressure actuated valve release frequencies (per valve year) by valve diameter
HOLE DIA 2" DIA (150 (300 (450 (600 (900
1 to 3 1.1E-05 1.8E-05 2.5E-05 3.0E-05 3.4E-05 4.1E-05
3 to 10 7.8E-06 1.3E-05 1.7E-05 2.1E-05 2.3E-05 2.8E-05
10 to 50 1.3E-05 9.6E-06 1.3E-05 1.6E-05 1.8E-05 2.2E-05
50 to 150 0.0E+00 1.1E-05 5.2E-06 6.2E-06 7.1E-06 8.5E-06
>150 0.0E+00 0.0E+00 9.3E-06 1.1E-05 1.3E-05 1.5E-05
TOTAL 3.2E-05 5.1E-05 6.9E-05 8.3E-05 9.5E-05 1.1E-04
6 ©OGP
Equipment Type: (5) Instrument connections

Definition:
Includes small-bore connections for flow, pressure and temperature sensing. The scope
includes the instrument itself plus up to 2 instrument valves, 4 flanges, 1 fitting and
associated small-bore piping, usually 25 mm diameter or less.
Instrument connection release frequencies (per instrument year; sizes 10 to 50
mm diameter)
HOLE DIA ALL FULL LIMITED ZERO

RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 3.5E-04 1.8E-04 1.6E-04 8.8E-06
3 to 10 1.5E-04 6.8E-05 7.4E-05 5.5E-06
10 to 50 6.5E-05 2.5E-05 3.6E-05 3.8E-06
TOTAL 5.7E-04 2.8E-04 2.7E-04 1.8E-05
©OGP 7
Equipment Type: (6) Process (pressure) vessels

Definition:
Offshore: Includes all types of pressure vessel (horizontal/vertical absorber, knock-out drum,
reboiler, scrubber, separator and stabiliser), but not the HCRD category “other”, which are
mainly hydrocyclones.
Onshore: Includes process vessels and columns, but not storage vessels.
The scope includes the vessel itself and any nozzles or inspection openings, but excludes all
attached valves, piping, flanges, instruments and fittings beyond the first flange. The first
flange itself is also excluded.
Pressure vessel release frequencies (per vessel year; connections 50 to 150 mm
diameter)

RELEASES
1 to 3 9.6E-04 3.9E-04 3.5E-04 1.8E-04
3 to 10 5.6E-04 2.0E-04 2.0E-04 1.4E-04
10 to 50 3.5E-04 1.0E-04 1.2E-04 1.2E-04
>50 2.8E-04 5.1E-05 7.9E-05 1.8E-04
TOTAL 2.2E-03 7.4E-04 7.4E-04 6.3E-04
Pressure vessel release frequencies (per vessel year; connections >150 mm
diameter)

RELEASES
1 to 3 9.6E-04 3.9E-04 3.5E-04 1.8E-04
3 to 10 5.6E-04 2.0E-04 2.0E-04 1.4E-04
10 to 50 3.5E-04 1.0E-04 1.2E-04 1.2E-04
50 to 150 1.1E-04 2.7E-05 3.7E-05 5.5E-05
>150 1.7E-04 2.4E-05 4.2E-05 1.4E-04
TOTAL 2.2E-03 7.4E-04 7.4E-04 6.3E-04
8 ©OGP
Equipment Type: (7) Pumps: Centrifugal

Definition:
Centrifugal pumps including single-seal and double-seal types*. The scope includes the
pump itself, but excludes all attached valves, piping, flanges, instruments and fittings beyond
the first flange. The first flange itself is also excluded.
* Analysis has shown that there is no statistical difference between single- and double-seal
types for releases in the size range considered.
Centrifugal pump release frequencies (per pump year; inlets 50 to 150 mm
diameter)

RELEASES
1 to 3 5.1E-03 3.4E-03 1.3E-03 2.4E-04
3 to 10 1.8E-03 1.0E-03 5.6E-04 1.4E-04
10 to 50 5.9E-04 2.9E-04 2.4E-04 9.4E-05
>50 1.4E-04 5.4E-05 8.3E-05 7.2E-05
TOTAL 7.6E-03 4.8E-03 2.2E-03 5.5E-04
Centrifugal pump release frequencies (per pump year; inlets >150 mm diameter)

RELEASES
1 to 3 5.1E-03 3.4E-03 1.3E-03 2.4E-04
3 to 10 1.8E-03 1.0E-03 5.6E-04 1.4E-04
10 to 50 5.9E-04 2.9E-04 2.4E-04 9.4E-05
50 to 150 9.7E-05 3.9E-05 5.0E-05 3.1E-05
>150 4.8E-05 1.5E-05 3.3E-05 4.1E-05
TOTAL 7.6E-03 4.8E-03 2.2E-03 5.5E-04
©OGP 9
Equipment Type: (8) Pumps: Reciprocating

Definition:
Reciprocating pumps including single-seal and double-seal types*. The scope includes the
pump itself, but excludes all attached valves, piping, flanges, instruments and fittings beyond
the first flange. The first flange itself is also excluded.
* Analysis has shown that there is no statistical difference between single- and double-seal
types for releases in the size range considered.
Reciprocating pump release frequencies (per pump year; inlets 50 to 150 mm
diameter)

RELEASES
1 to 3 3.3E-03 2.1E-03 8.9E-04 0.0E+00
3 to 10 1.9E-03 1.2E-03 6.2E-04 0.0E+00
10 to 50 1.2E-03 7.4E-04 4.7E-04 0.0E+00
>50 8.0E-04 5.0E-04 5.3E-04 0.0E+00
TOTAL 7.2E-03 4.5E-03 2.5E-03 0.0E+00
Reciprocating pump release frequencies (per pump year; inlets >150 mm
diameter)

RELEASES
1 to 3 3.3E-03 2.1E-03 8.9E-04 0.0E+00
3 to 10 1.9E-03 1.2E-03 6.2E-04 0.0E+00
10 to 50 1.2E-03 7.4E-04 4.7E-04 0.0E+00
50 to 150 3.7E-04 2.3E-04 1.9E-04 0.0E+00
>150 4.3E-04 2.7E-04 3.4E-04 0.0E+00
TOTAL 7.2E-03 4.5E-03 2.5E-03 0.0E+00
10 ©OGP
Equipment Type: (9) Compressors: Centrifugal

Definition:
The scope includes the compressor itself, but excludes all attached valves, piping, flanges,
instruments and fittings beyond the first flange. The first flange itself is also excluded.
Centrifugal compressor release frequencies (per compressor year;

inlets 50 to 150 mm diameter)

RELEASES
1 to 3 6.7E-03 3.4E-03 2.9E-03 3.7E-04
3 to 10 2.6E-03 6.8E-04 1.4E-03 2.4E-04
10 to 50 1.0E-03 1.3E-04 7.4E-04 1.8E-04
>50 3.0E-04 1.3E-05 3.5E-04 1.8E-04
TOTAL 1.1E-02 4.2E-03 5.5E-03 9.6E-04
Centrifugal compressor release frequencies (per compressor year; inlets >150
mm diameter)

RELEASES
1 to 3 6.7E-03 3.4E-03 2.9E-03 3.7E-04
3 to 10 2.6E-03 6.8E-04 1.4E-03 2.4E-04
10 to 50 1.0E-03 1.3E-04 7.4E-04 1.8E-04
50 to 150 1.9E-04 1.0E-05 1.9E-04 6.7E-05
>150 1.1E-04 2.5E-06 1.6E-04 1.1E-04
TOTAL 1.1E-02 4.2E-03 5.5E-03 9.6E-04
©OGP 11
Equipment Type: (10) Compressors: Reciprocating

Definition:
The scope includes the compressor itself, but excludes all attached valves, piping, flanges,
instruments and fittings beyond the first flange. The first flange itself is also excluded.
Reciprocating compressor release frequencies (per compressor year;

inlets 50 to 150 mm diameter)

RELEASES
1 to 3 4.5E-02 2.4E-02 1.9E-02 0.0E+00
3 to 10 1.7E-02 8.0E-03 9.4E-03 0.0E+00
10 to 50 6.7E-03 2.6E-03 4.7E-03 0.0E+00
>50 2.0E-03 8.8E-04 2.2E-03 0.0E+00
TOTAL 7.1E-02 3.6E-02 3.6E-02 0.0E+00
Reciprocating compressor release frequencies (per compressor year;

inlets >150 mm diameter)

RELEASES
1 to 3 4.5E-02 2.4E-02 1.9E-02 0.0E+00
3 to 10 1.7E-02 8.0E-03 9.4E-03 0.0E+00
10 to 50 6.7E-03 2.6E-03 4.7E-03 0.0E+00
50 to 150 1.3E-03 4.0E-04 1.2E-03 0.0E+00
>150 7.3E-04 4.8E-04 1.0E-03 0.0E+00
TOTAL 7.1E-02 3.6E-02 3.6E-02 0.0E+00
12 ©OGP
Equipment Type: (11) Heat exchangers: Shell & Tube, shell side
HC
Definition:
Shell & tube type heat exchangers with hydrocarbon in the shell side. The scope includes the
heat exchanger itself, but excludes all attached valves, piping, flanges, instruments and
fittings beyond the first flange. The first flange itself is also excluded.
Heat exchanger release frequencies (per heat exchanger year; inlets 50 to 150
mm diameter)

RELEASES
1 to 3 2.2E-03 1.2E-03 1.2E-03 0.0E+00
3 to 10 1.1E-03 4.1E-04 7.3E-04 0.0E+00
10 to 50 5.6E-04 1.4E-04 4.9E-04 0.0E+00
>50 2.6E-04 3.6E-05 4.0E-04 0.0E+00
TOTAL 4.1E-03 1.8E-03 2.8E-03 0.0E+00
Heat exchanger release frequencies (per heat exchanger year; inlets >150 mm
diameter)

RELEASES
1 to 3 2.2E-03 1.2E-03 1.2E-03 0.0E+00
3 to 10 1.1E-03 4.1E-04 7.3E-04 0.0E+00
10 to 50 5.6E-04 1.4E-04 4.9E-04 0.0E+00
50 to 150 1.4E-04 2.4E-05 1.7E-04 0.0E+00
>150 1.2E-04 1.2E-05 2.3E-04 0.0E+00
TOTAL 4.1E-03 1.8E-03 2.8E-03 0.0E+00
©OGP 13
Equipment Type: (12) Heat exchangers: Shell & Tube, tube side HC
Definition:
Shell & tube type heat exchangers with hydrocarbon in the tube side. The scope includes the
heat exchanger itself, but excludes all attached valves, piping, flanges, instruments and
fittings beyond the first flange. The first flange itself is also excluded.
mm diameter)

RELEASES
1 to 3 2.0E-03 8.2E-04 7.9E-04 1.8E-04
3 to 10 8.8E-04 3.8E-04 4.3E-04 7.7E-05
10 to 50 4.0E-04 1.8E-04 2.5E-04 3.4E-05
>50 2.0E-04 7.6E-05 1.9E-04 1.3E-05
TOTAL 3.4E-03 1.5E-03 1.7E-03 3.0E-04
diameter)

RELEASES
1 to 3 2.0E-03 8.2E-04 7.9E-04 1.8E-04
3 to 10 8.8E-04 3.8E-04 4.3E-04 7.7E-05
10 to 50 4.0E-04 1.8E-04 2.5E-04 3.4E-05
50 to 150 9.1E-05 4.3E-05 7.4E-05 7.7E-06
>150 1.1E-04 3.3E-05 1.2E-04 5.4E-06
TOTAL 3.4E-03 1.5E-03 1.7E-03 3.0E-04
14 ©OGP
Equipment Type: (13) Heat exchangers: Plate

Definition:
The scope includes the heat exchanger itself, but excludes all attached valves, piping,
flanges, instruments and fittings beyond the first flange. The first flange itself is also
excluded.
mm diameter)

RELEASES
1 to 3 5.1E-03 3.9E-03 2.7E-03 0.0E+00
3 to 10 2.8E-03 2.0E-03 1.3E-03 0.0E+00
10 to 50 1.6E-03 1.1E-03 6.7E-04 0.0E+00
>50 9.9E-04 6.3E-04 3.2E-04 0.0E+00
TOTAL 1.0E-02 7.3E-03 5.0E-03 0.0E+00
diameter)

RELEASES
1 to 3 5.1E-03 3.9E-03 2.7E-03 0.0E+00
3 to 10 2.8E-03 2.0E-03 1.3E-03 0.0E+00
10 to 50 1.6E-03 1.1E-03 6.7E-04 0.0E+00
50 to 150 4.8E-04 3.2E-04 1.7E-04 0.0E+00
>150 5.1E-04 3.1E-04 1.5E-04 0.0E+00
TOTAL 1.0E-02 7.3E-03 5.0E-03 0.0E+00
©OGP 15
Equipment Type: (14) Heat exchangers: Air-cooled

Definition:
Often referred to as fin-fan coolers but in principle includes all air-cooled type heat
exchangers. The scope includes the heat exchanger itself, but excludes all attached valves,
piping, flanges, instruments and fittings beyond the first flange. The first flange itself is also
excluded.
mm diameter)

RELEASES
1 to 3 1.0E-03 1.0E-03 0.0E+00 0.0E+00
3 to 10 4.9E-04 4.9E-04 0.0E+00 0.0E+00
10 to 50 2.4E-04 2.4E-04 0.0E+00 0.0E+00
>50 1.1E-04 1.1E-04 0.0E+00 0.0E+00
TOTAL 1.0E-03 1.0E-03 0.0E+00 0.0E+00
diameter)

RELEASES
1 to 3 1.0E-03 1.0E-03 0.0E+00 0.0E+00
3 to 10 4.9E-04 4.9E-04 0.0E+00 0.0E+00
10 to 50 2.4E-04 2.4E-04 0.0E+00 0.0E+00
50 to 150 6.0E-05 6.0E-05 0.0E+00 0.0E+00
>150 4.9E-05 4.9E-05 0.0E+00 0.0E+00
TOTAL 1.0E-03 1.0E-03 0.0E+00 0.0E+00
16 ©OGP
Equipment Type: (15) Filters

Definition:
The scope includes the filter body itself and any nozzles or inspection openings, but
excludes all attached valves, piping, flanges, instruments and fittings beyond the first flange.
The first flange itself is also excluded.
Filter release frequencies (per filter year; inlets 50 to 150 mm diameter)

RELEASES
1 to 3 2.0E-03 1.3E-03 5.1E-04 1.3E-04
3 to 10 1.0E-03 5.1E-04 3.3E-04 9.3E-05
10 to 50 5.2E-04 1.9E-04 2.3E-04 7.7E-05
>50 2.6E-04 5.5E-05 2.1E-04 1.0E-04
TOTAL 3.8E-03 2.1E-03 1.3E-03 4.0E-04
Filter release frequencies (per filter year; inlets >150 mm diameter)

RELEASES
1 to 3 2.0E-03 1.3E-03 5.1E-04 1.3E-04
3 to 10 1.0E-03 5.1E-04 3.3E-04 9.3E-05
10 to 50 5.2E-04 1.9E-04 2.3E-04 7.7E-05
50 to 150 1.4E-04 3.5E-05 8.4E-05 3.3E-05
>150 1.2E-04 2.0E-05 1.3E-04 7.2E-05
TOTAL 3.8E-03 2.1E-03 1.3E-03 4.0E-04
©OGP 17
Equipment Type: (16) Pig traps

Definition:
Includes pig launchers and pig receivers. The scope includes the pig trap itself, but excludes
all attached valves, piping, flanges, instruments and fittings beyond the first flange. The first
flange itself is also excluded.
Pig trap release frequencies (per pig trap year; inlets 50 to 150 mm diameter)

RELEASES
1 to 3 3.2E-03 2.3E-03 7.4E-04 2.7E-04
3 to 10 1.9E-03 7.2E-04 5.6E-04 2.3E-04
10 to 50 1.2E-03 2.2E-04 4.8E-04 2.3E-04
>50 8.3E-04 4.7E-05 7.1E-04 5.2E-04
TOTAL 7.0E-03 3.3E-03 2.5E-03 1.3E-03
Pig trap release frequencies (per pig trap year; inlets >150 mm diameter)

RELEASES
1 to 3 3.2E-03 2.3E-03 7.4E-04 2.7E-04
3 to 10 1.9E-03 7.2E-04 5.6E-04 2.3E-04
10 to 50 1.2E-03 2.2E-04 4.8E-04 2.3E-04
50 to 150 3.7E-04 3.3E-05 2.1E-04 1.1E-04
>150 4.6E-04 1.4E-05 5.0E-04 4.1E-04
TOTAL 7.0E-03 3.3E-03 2.5E-03 1.3E-03
18 ©OGP
3.0 Guidance on use of data

3.1 General validity
The data presented in Section 2.0 can be used for process equipment on the topsides of
offshore installations and for onshore facilities handling hydrocarbons2, and could also
be used as appropriate for subsea completions.
DNV [3] have compared failure rate data for LNG facilities with the data presented in
Section 2.0. The comparison indicates that LNG failure frequencies may be around 40%
to 65% of those given here. However, this has not been verified and the data for LNG
installations is relatively sparse. We therefore recommend use of the same frequencies
for LNG installations as given in Section 2.0. A 50% reduction could be considered as a
sensitivity but decisions based on this would need to be fully justified.
The release frequencies given in Section 2.0 are valid for holes of diameter (d) from
1 mm to the diameter of the equipment (D). Frequencies of smaller holes may be
estimated by extrapolation of the frequencies to smaller hole sizes, but this is beyond
the range of the HSE data (see Section 4.0). The data are not sufficient to determine the
frequencies of larger holes (e.g. long splits or guillotine breaks allowing flow from both
sides) and this can only be addressed using engineering judgment.
The release frequencies are valid for equipment diameters (D) within the normal range
of offshore equipment. This is not precisely defined in the available equipment
population data. Using judgment based on the trends of the estimated diameter
dependence and the average diameters of the available data groups, the following
ranges of validity are suggested:
• Pipes: 20 to 1000 mm • Actuated valves: 10 to 1000 mm
• Flanges: 10 to 1000 mm Instruments:
• 10 to 100 mm
• Manual valves: 10 to 1000 mm • Pig traps: 100 to 1000
mm
• All other equipment: 40 to 400 mm
With lesser confidence, the datasheets in Section 2.0 can be used to estimate
frequencies over larger ranges, but they should be subject to sensitivity testing. These
functions have been checked for mathematical consistency over a range of equipment
diameters from 10 to 1000 mm. The frequencies are not recommended for equipment
outside this range.
2
The justification for using offshore data for onshore facilities is two-fold. First, no public
domain dataset for onshore facilities is available that is comparable to HCRD, considering both
the equipment population and completeness of recording releases. Second, although offshore
facilities operate in a more challenging (e.g. more corrosive) environment, this is compensated
for in the design, inspection and maintenance. Hence there is no apparent reason why onshore
and offshore release frequencies should differ significantly. However, some environmental
factors are considered in Section 3.5. The standard of the safety management system is also
believed to have a major influence on release frequencies, regardless of operating environment,
as also discussed in Section 3.5.
©OGP 19
3.2 Uncertainties
The sources of uncertainties in the estimated release frequencies are discussed in
Section 4.1.3.
The uncertainty in the release frequencies presented in Section 2.0 tends to be greatest
for large hole sizes, for equipment sizes far from the centres of the ranges of validity
given in Section 3.1, and for equipment types where fewer releases have been recorded
(see Section 4.1.1).
No quantitative representations of the uncertainty in the release frequency results have
yet been derived. Based on the sensitivity test that have been conducted and on
previous analyses of the same dataset, the uncertainly in the results may be a factor or
3 (higher or lower) for frequencies of holes in the region of 1 mm diameter, rising to a
factor of 10 (higher or lower) for frequencies of holes in the region of 100 mm diameter.
A simple sensitivity test would therefore be to use the frequencies for All releases in
place of the Full release frequencies.
3.3 Definition of release types

The three release frequency types defined in Section 1.0, and for which frequencies are
given separately in Section 2.0, are described in further detail in the following sub-
sections.
3.3.1 Full releases

This scenario is intended to be consistent with QRA models that assume a release
through the defined hole, beginning at the normal operating pressure, until controlled
by ESD and blowdown, with a small probability of ESD/blowdown failure. Full releases
are defined as cases where the outflow is greater than or broadly comparable with that
predicted for a release at the operating pressure (since the normal pressure is unknown
in HCRD) controlled by the quickest credible ESD (within 1 minute) and blowdown
(nominally a 30 mm orifice3). This is subdivided as follows:
• ESD isolated releases, presumed to be controlled by ESD and blowdown of the
leaking system.
• Late isolated releases, presumed to be cases where there is no effective ESD of the
leaking system, resulting in a greater outflow.
Typical use in the QRA:
These events should always be included in quantified risk assessments. They have the
potential of developing into serious events endangering personnel and critical safety
functions.
These releases represent approximately 31% of all releases in the HSE HCRD for 1992-
2006.
3
The actual orifice diameter should be used in QRA modelling, or preferably the orifice diameter
that gives blowdown to a specified pressure in the actual time
20 ©OGP
3.3.2 Limited releases

This scenario includes all other pressurised releases. They are defined as cases where
the equipment is under pressure (over 0.01 barg) but the outflow is less than from a
release at the operating pressure controlled by the quickest credible ESD (within 1
minute) and blowdown (through an orifice nominally of 30 mm diameter). This may be
because the release is isolated locally by human intervention (e.g. closing an
inadvertently opened valve), or by a restriction in the flow from the system inventory
(e.g. releases of fluid accumulated between pump shaft seals).
Typical use in the QRA:
a) Coarse QRAs. Limited Releases should normally be included in the risk analysis, and
treated as Full Releases with regards to the consequence modelling. This is a
conservative approach, which normally is in line with the nature of Coarse QRA.
b) Detailed QRAs. Limited Releases could be considered for their expected (realistic)
consequences. These events may be of concern for personnel risk, but it is less
likely that they develop into any major concern for other safety functions, such as
structural integrity, evacuation means, escalation, etc. Any consequence
calculations should reflect that these events involve limited release volumes. If the
consequences are not specifically assessed, the approach of a) above apply also for
detailed QRAs.
There are two possible approaches to modelling these releases, depending on whether
the limitation is on the duration (through prompt local isolation) or the flow (through a
restriction). In the first case (limited duration), flow is likely to be at the same release
rate as for a full release but reduced to a short duration (e.g. 30 seconds). In the second
case, the release rate will be much lower than for the corresponding full release and the
quantity released also smaller. In this case an approach previously suggested [4] has
been to model the flow rate as 8% of the full release rate and the duration as 6% of the
full release duration.
These releases represent approximately 59% of all releases in the HSE HCRD for 1992-
2006.
3.3.3 Zero pressure releases

This scenario includes all releases where the pressure inside the releasing equipment is
virtually zero (0.01 barg or less). This may be because the equipment has a normal
operating pressure of zero (e.g. open drains), or because the equipment has been
depressurised for maintenance.
Typical use in the QRA (but not limited to this example):
These are events that typically are excluded from QRA assessments. Most likely there
are no serious consequences and if so, the contribution to the overall risk level is
considered insignificant. These events are mainly included for consistency with the
original HSE data.
The event is likely to result in release of a small quantity of hydrocarbon. This could
be taken as the inventory of the system hydrocarbon full at atmospheric pressure.
These releases represent approximately 10% of all releases in the HSE HCRD for
1992-2006.
3.4 Consequence modelling for the largest release size

Where the data tables in Section 2.0 show “>50 mm” or “>150 mm” for the largest hole
diameter range, the consequences of the release should be modelled using the size of
the actual pipe/valve/flange or the largest connection to other equipment types.
©OGP 21
3.5 Modification of frequencies for factors specific to plant conditions

3.5.1 General considerations
The frequencies tabulated in Section 2.0 are generic frequencies for installations
designed and operating to “typical” European / North American standards. A large
number of possible factors may suggest that these generic frequencies ought to be
modified to make them specific to the local conditions. These factors include the
physical characteristics of the equipment, the operating conditions, and characteristics
of the management system in place. Factors related to the physical characteristics and
operating conditions could include:
• Design code • Operating environment • Process continuity
• Material of construction • Cold or hot weather • Stress cycling
• Fluid inside equipment • Equipment age • Welds
• Operating pressure • Seismic activity • Radiography
• Operating temperature • Integrity status
Many of these are addressed in Section 8.3 of API 581 1st ed. [14], discussed in Section
3.5.2. Some more specific factors relating to inter-unit piping and flanges are presented
in Sections 3.5.3 (piping) and 3.5.5 (flanges). The influence of safety management, well
recognized as influencing release rates, is discussed in Section 3.5.3.
3.5.2 API 581 Approach

3.5.2.1 1st Edition
An equipment modification factor is developed for each equipment item, based on the
specific environment in which the item operates. This factor is composed of four
subfactors illustrated in Figure 3.1. These subfactors are summarised as follows:
• The Technical Module Subfactor is the systematic method used to assess the
effect of specific failure mechanisms on the likelihood of failure. The module
evaluates:
1. The deterioration rate of the equipment item’s material of construction (i.e.
corrosion), resulting from its operating environment.
2. The effectiveness of the facility’s inspection programme to identify and monitor
the operative damage mechanisms prior to failure.
• The Universal Subfactor covers conditions that equally affect all equipment items
in the facility: plant condition, cold weather operation, and seismic activity.
• The M echanical Subfactor addresses conditions related primarily to the design
and fabrication of the equipment item.
• Conditions that are most influenced by the process and how the facility is operated
are included in the Process Subfactor.
The API 581 document provides full details of how the four factors can be evaluated
individually and combined to obtain the overall equipment modification factor for each
equipment item. This can then be applied to the generic frequencies given in Section
2.04.
4
However, it should be noted that Section 8.2 of API 581 includes generic leak frequencies for
many of the equipment types covered in this Datasheet. The factors are presumably intended to
be used with those frequencies, although there is nothing to suggest that this is obligatory.
Hence the equipment modification factor approach set out in API 581 is considered suitable for
more detailed analysis based on the generic frequencies presented in this datasheet.
22 ©OGP
Figure 3.1 Overview of Equipm ent Modification Factor (from API 581 1st ed.)
©OGP
3.5.2.2 Possible Changes for 2nd Edition

The 2nd edition is currently out for consultation with interested parties so its final
content is not fixed. However, some of the proposed changes affect the approach
summarised in Section 3.5.2.1 as follows:
• Parts of the universal and mechanical subfactors will be removed.
• The entirety of the process subfactor will be removed.
• Additional factors will be introduced to address very specific issues:
− Thinning
− Component lining damage
− Stress corrosion cracking
− External corrosion
− Brittle fracture
− Embrittlement
− Piping mechanical fatigue
Users of the API 581 1st edition approach are recommended to apprise themselves of
changes in the 2nd edition, which will be finalised subsequent to the issue of this
datasheet.
3.5.3 Safety Management

The quality of operation, inspection, maintenance etc is a critical influence on release
frequencies, as illustrated by the Flixborough accident (Section 2.4). The selected pipe
release frequencies reflect safety management in UK offshore installations during 1992-
2006, which is believed to be a good modern standard. The release frequencies at plants
with lesser standards may be much higher.
In order to reflect the standard of safety management at an individual plant, it is
possible to quantify this using a safety management audit, and convert the audit score
into an overall management factor (MF), by which all the generic failure frequencies can
be multiplied. Due to lack of experience with this technique, the relationship between
the audit scores and management factors is highly speculative. Several such
techniques have been used, of which the most recent studies [11][12] suggest that MF
values should lie between 0.1 and 10.0 (i.e. from 10 times better than average to 10 times
worse than average)5.
API 581 [14] provides a management systems evaluation audit scheme, summarised in
Section 8.4 and set out in full in a workbook forming Appendix III. The subject areas,
from the OSHA PSM standard [14], are:
• Leadership and administration • Mechanical integrity
• Process safety information • Pre-startup safety review
• Process hazard analysis • Emergency response
• Management of change • Incident investigation
• Operating procedures • Contractors
• Safe work practices • Audits
• Training
5
Although it has been suggested [13] that the degradation in plant condition that occurred at
Bhopal as a result of safety management deficiencies led to the risk of a major accident
increasing by a factor of 1000.
24 ©OGP
The audit comprises 101 questions, and the answers are scored to obtain a percentage.
This is converted to a management factor that applies to the whole unit or facility
studied. The conversion is based on assuming, first, that an “average” US
petrochemical plant would score 50%, giving a management factor of 1 (i.e. generic
frequencies, which are multiplied by this factor, are unchanged). A “perfect” score of
100% would yield an order of magnitude reduction in total unit risk, i.e. a factor of 0.1. A
score of 0% would result in an order of magnitude increase in total unit risk, i.e. a factor
of 10. Figure 3.2 shows the resulting conversion graph.
Figure 3.2 Frequency Moification Factor vs. Managem ent System

Evaluation (API 581)
Note that the scoring is stated to be against an “average US petrochemical plant”.

Since the frequencies presented in Section 2.0 are based on offshore UKCS data, it
should not be assumed that safety management in that environment is comparable with
that on an average US petrochemical plant. However, no comparative study and
corresponding conversion system has been developed for offshore UK, hence use of
this system requires some care and guidance is beyond the scope of this datasheet.
3.5.4 Inter-unit piping

The frequencies given in datasheet 1 for steel piping are, for onshore installations,
intended to be applied within process units. For piping linking process units (inter-unit
pipe) and piping to/from storage or loading facilities (transfer pipe), the following
release frequency modification factors can be applied:
• Inter-unit pipe: 0.9
• Transfer pipe: 0.8
These have been derived from detailed analysis of the causes of piping failure [5] and
application to this analysis of judgemental modifications to account for the differences
in inter-unit and transfer pipes [6].
©OGP 25
3.5.5 Flanges
Studies [7], [8] of the effect of flange type on flange failure frequency developed
modification factors to the frequencies presented on datasheet 2. These functions
should be applied when performing detailed risk analyses where the flange types are
known, alternatively as decision input to design when flange types are to be decided.
The flange types considered are:
• ANSI Ring Joint
• ANSI Raised faced
• Compact flange
• Grayloc flange.
The release frequency for each flange type is based on the release frequency for flange
from HCRD data. HCRD data for flanges include ring joint, spiral wound, Grayloc and
hammer union, but the contribution from each type can not be identified from the flange
frequency. The ANSI Ring Joint, at this time the most common flange type, is assumed
to be represented by the HCRD data for flanges.
Because different flanges will have different failure modes, and thereby both different
release frequencies and different distribution of release frequencies, dependent on hole
size or release rate, the release frequency for the different flange types will be adjusted
relative to the release frequency for ANSI Ring Joint flanges. The resulting modification
factors are set out in Table 3.1.
26 ©OGP
Table 3.1 Release Frequency Modifications for Different Flange Types
Flange type Hole Modification

diameter
range (mm)
ANSI Ring Joint 1-3 None
3-10 None
10-50 None
50-150 None
>150 None
ANSI Raised 10% of total flange release
Face 1-3 frequency
10% of total flange release
3-10 frequency
10-50 frequency
50-150 frequency
>150 frequency
Compact 1-3 × 0.062
3-10 × 0.062
10-50 × 0.062
50-150 × 0.991
>150 × 0.991
Grayloc 1-3 × 0.064
3-10 × 0.064
10-50 × 0.064
50-150 × 1.020
>150 × 1.020
4.0 Review of data sources

4.1 Basis of data presented
The release frequencies for the main process equipment items presented in Section 2.0
are based on an analysis of the HSE hydrocarbon release database (HCRD) for 1992-
2006 [9], according to a methodology described in [4]. An overview of this methodology
is given in Section 4.1.2.
The HSE hydrocarbon release database (HCRD) has become the standard source of
release frequencies for offshore QRA and provides a large, high-quality collection of
release experience, now available on-line. All offshore releases of hydrocarbons are
required to be reported to the HSE Offshore Safety Division (OSD) as dangerous
occurrences under the Reporting of Injuries, Diseases and Dangerous Occurrences
Regulations 1995 (RIDDOR), which became effective offshore on 1 April 1996. The
Hydrocarbon Releases (HCR) system contains detailed voluntary information on
offshore hydrocarbon release incidents supplementary to that provided under RIDDOR
(and previous offshore legislation that applied prior to April 1996). The database
contains reports of 3824 releases dating from 1 October 1992 to 31 March 2006, of which
2551 relate to the equipment types addressed in this datasheet.
©OGP 27
The database is considered to be “high-quality” on a combination of two features:

• The equipment population is believed to be highly accurate
• The incident population is believed to be reasonably complete, and not to suffer so
much from the under-reporting of small incidents that often occurs
Hence it has been selected in preference to other data sources discussed in Section 4.2.
4.1.1 Summary of release statistics

Table 4.1 summarises the number of releases and exposure (population) for each
equipment type represented in the HSE HCRD.
Table 4.1 Sum m ary of Release Statistics for HSE HCRD 1992-2006
Equipment type All Releases Releases Exposure

excluding <
1 mm
1. Steel process pipes 700 646 5,958,814 pipe metre years
2. Flanges 327 298 3,368,520 flange joint years
3. Manual valves 175 154 1,498,038 valve years
4. Actuated valves 264 221 329,562 valve years
5. Instrument connections 528 442 749,786 instrument years
6. Process (pressure) vessels 42 37 17,494 vessel years
7. Pumps: Centrifugal 126 110 14,564 pump years
8. Pumps: Reciprocating 21 19 2,652 pump years
9. Compressors: Centrifugal 40 33 3,110 compressor
years
10. Compressors: 43 36 507 compressor
Reciprocating years
11. Heat exchangers: Shell & 18 14 3,398 exchanger years
Tube, shell side
12. Heat exchangers: Shell & 26 21 6,165 exchanger years
Tube, tube side
13. Heat exchangers: Plate 31 30 2,865 exchanger years
14. Heat exchangers: Air- 5 2 1,069 exchanger years
cooled
15. Filters 48 47 12,495 filter years
16. Pig traps 29 28 3,994 pig trap years
4.1.2 Methodology for obtaining release frequencies

The method of obtaining release frequencies from HCRD consists of three main steps:
• Grouping data for different types and sizes of equipment, where there is insufficient
experience to show significant differences between them.
• Fitting analytical frequency functions to the data, in order to obtain a smooth
variation of release frequency varying with equipment type and hole size. For some
equipment types the influence of equipment size can also be inferred.
• Splitting the release frequencies into the different release scenarios described above
(Sections 1.0, 3.3).
28 ©OGP
The release size distribution is represented by an analytical frequency function [2],

which ensures non-zero release frequencies for all holes sizes between 1 mm and the
diameter of the inlet pipe. In the case where the frequency depends on the equipment
size (Steel process pipes, Flanges, Manual valves), the function is of the general form:
where: F(d) = frequency per year of releases exceeding size d (mm)

D = equipment diameter
Frup = rupture frequency per year
C,a,m,n = constants specific to the equipment type and release scenario
In the case where the frequency does not depend on the equipment size the function is
of the simpler general form:
where the symbols have the same meanings as above.

The function can then be used to calculate the frequency of a release in any size range
(such as the ranges used in Section 2.0) d1 to d2 as F(d1) – F(d2).
The rupture frequency Frup and constants C,a,m,n referred to above are derived by a
combination of mathematical curve fitting and expert judgment.
4.1.3 Uncertainties in release frequencies

Uncertainties in the estimated release frequencies arise from three main sources:
• Incorrect information in HCRD about the releases that have occurred. This included
the possibility of under-reporting of small releases, errors in measuring the hole
diameter or estimating the quantity released etc. Although the data in HCRD
appears to be of unusually high quality, the possibility of bias or error is recognized.
• Inappropriate categorisation of the releases into the different scenarios.
• Inappropriate representation of the release frequency distributions by the fitted
release frequency distributions. This results in part from the small datasets, but also
from the simplifications inherent in the chosen functions, and their use to
extrapolate frequencies in areas where no releases have yet been recorded.
Sensitivity tests have been carried out [4] on the release frequency functions. The
sensitivity tests indicated that the results are sensitive to:
• The choice of isolation and blowdown times.
• The accuracy of the recorded release quantities.
• The treatment of cases where the inventory is not recorded.
4.1.4 Comparison with experience

A comparison has been made between historical release frequencies for a North Sea
platform and the corresponding frequencies predicted by the model described in the
preceding sub-sections. The results are set out in Table 4.2.
©OGP 29
Table 4.2 Com parison of Predicted Release Frequencies with Historical

Experience for One North Sea Platform
Data Release Release Gas Release Frequency (/year)

Source Categor Rate Full Limited Zero TOTAL
y (kg/s) Releases Releases Pressure
Releases
-1
Historical Small 0–1 N/A N/A N/A 1.3 × 10
data Medium 1 – 10 N/A N/A N/A 0
Large > 10 N/A N/A N/A 0
-1
TOTAL All N/A N/A N/A 1.3 × 10
-2 -2 -3 -1
HCRD Small 0–1 6.0 × 10 3.3 × 10 5.1 × 10 1.4 × 10
(see Note Medium 1 – 10 2.4 × 10
-2
5.6 × 10
-2
0 8.0 × 10
-2
below) -3 -2 -2
Large > 10 6.0 × 10 3.8 × 10 0 4.4 × 10
-2 -1 -2 -1
TOTAL All 9.1 × 10 1.4 × 10 3.4 × 10 2.7 × 10
Note: Frequencies as predicted by model described in the preceding sub-sections, based on
HCRD data up to 2003.
From the comparison in Table 4.2, the following observations and conclusions were
made:
• Compared to the original risk analysis frequencies, based on data from a 1995
analysis, the new total release frequencies estimated based on the HRCD data are
reduced significantly, by about 84%.
• Compared to the adjusted risk analysis frequencies, the new total release estimated
based on the HRCD data are reduced significantly, by about 71%.
• Compared to the historical release frequencies, the new total and full release
frequencies estimated based on the HRCD data are within a factor of about 2 (noting
that the platform concerned had only one recorded release during the period of
operation considered, introducing uncertainty into the estimate of the true historical
rate).
4.1.5 Conclusions
Others have also analysed the HCRD and obtained different functional forms for the
release frequencies. However, the release scenarios identified in Section 1.0 provide:
• A plausible representation of the different circumstances in which releases have
been found to occur;
• A model that ensures the frequencies of “full” releases (typically modelled in all
QRAs) are not over-estimated;
• A model that, overall, is consistent with experience.
On this basis, the data tabulated in Section 2.0 are presented as the best available
analysis of the best available data.
4.2 Other data sources

A large number of other data sources and analyses of process release frequencies were
analysed previously. These are listed in Section 6.2 (not all of these address all the
equipment types for which frequencies are given in Section 2.0).
30 ©OGP
5.0 Recommended data sources for further information

For further information, the data sources used to develop the release frequencies
presented in Section 2.0 and discussed in Sections 3.0 and 4.0 should be consulted.
These references are shown in bold in Section 6.1.
6.0 References
6.1 References for Sections 2.0 to 4.0
The principal references are shown in bold; the others were used to provide
supplementary information.
[1] SINTEF, 2002 (OREDA 2002). Offshore Reliability Data, 4th. ed.
[2] Spouge, J R, 2005. New Generic Leak Frequencies for Process Equipment, Process
Safety Progress, 24(4), 249-257.
[3] DNV, 2006. Confidential Report 2006-1269.
[4] DNV, 2004. Confidential Report 2004-0869.
[5] Technica, 1989. Confidential Report for UK HSE.
[6] DNV Technica, 1993. Confidential Report.
[7] DNV, 1997. Reliability Evaluation of SPO Compact Flange System, DNV Technical
Report 97-3547, rev. 2, for Steelproducts Offshore A/S.
[8] DNV, 2005. Decision model for choosing flange or weld connection, DNV Technical
Report (in Norweigan) 2005-0462, rev. 2.
[9] HSE HCRD. Hydrocarbon Releases (HCR) System , Health and Safety
Executive. https://www.hse.gov.uk/hcr3/ (Full data only available to
authorised users.)
[10] Pitblado, R M, Williams, J and Slater, D H, 1990. Quantitative Assessment of Process
Safety Programs, Plant Operations Progress, 9(3), AIChemE. (Presented at CCPS
Conference on Technical Management of Process Safety, Toronto).
[11] Hurst, N, Young, S, Donald, I, Gibson, H and Muyselaar, A, 1996. Measures of
Safety Management and Performance and Attitudes to Safety at Major Hazard
Sites, J. Loss Prevention in the Process Industries, 9(2).
[12] DNV, 1998. BRD on Risk Based Inspection, API Committee on Refinery Equipment,
unpublished draft.
[13] Wells, G L, Phang, C, and Reeves, A B, 1991. HAZCHECK and the Development of
Major Incidents, IChemE Symp. Ser. No. 124, 305-316, IChemE, Oxford: Pergamon
Press.
[14] API, 2000. Risk-Based Inspection Base Resource Document, API Publication 581,
1st ed.
[15] OSHA, 1992. 29 CFR 1910.119, Process Safety Management of Highly Hazardous
Chemicals; Final Rule; February 24, 1992. Federal Register, 57(36), 6356-6417.
©OGP 31
6.2 References for other data sources examined

ACDS, 1991. Major Hazard Aspects of the Transport of Dangerous Substances, Advisory
Committee on Dangerous Substances, Health & Safety Commission, HMSO.
AEA, 1998. Hydrocarbon Release Statistics Review, Report for UKOOA, AEA Technology.
AEA, 2000. A Preliminary Analysis of the HCR99 Data, Report for UKOOA, AEA
Technology.
AME (1998), PARLOC 96: The Update of Loss of Containment Data for Offshore Pipelines,
Offshore Technology Report OTH 551, Health & Safety Executive
Ames, S. & Crowhurst, D, 1988. Domestic Explosion Hazards from Small LPG
Containers, J. Haz. Mat., 19, 183-194.
Arulanatham, D.C. & Lees, F.P., 1981. Some Data on the Reliability of Pressure
Equipment in the Chemical Plant Environment, Int. J. Pres. Ves & Piping, 9, 327-338.
Aupied J.R., Le Coguiec, A. & Procaccia, H., 1983. Valves and Pumps Operating
Experience in French Nuclear Plants, Reliability Engineering, 6, 133-151.
Batstone, R.J. & Tomi, D.T., 1980. Hazard Analysis in Planning Industrial Developments,
Loss Prevention, 13, 7.
Baldock, P.J., 1980. Accidental Releases of Ammonia - An Analysis of Reported
Incidents, Loss Prevention, 13, 35-42.
Blything, K.W. & Reeves, A.B., 1988. An Initial Prediction of the BLEVE Frequency of a 100
te Butane Storage Vessel, UKAEA, SRD R448.
Bush, S.H., 1978. Reliability of Piping in Light Water Reactors, Symposium on Application
of Reliability Technology to Nuclear Power Plants, International Atomic Energy Agency, vol.
1, IAEA-SM-218/11.
Bush, S.H., 1988. Statistics of Pressure Vessel and Piping Failures, J. Pressure Vessel
Technology, 110/227.
Cox, A.W., Lees, F.P. & Ang, M.L., 1990. Classification of Hazardous Locations, Rugby, UK:
Institution of Chemical Engineers.
Crossthwaite, P.J., Fitzpatrick, R.D. & Hurst, N.W., 1988. Risk Assessment for the Siting of
Developments near Liquefied Petroleum Gas Installations, IChemE Symposium Series No
110.
Data Engineering, 1998. Hydrocarbon Release Database, Population Data Statistics, OTO
98 158, Health & Safety Executive, Offshore Safety Division.
Davenport, T.J., 1991. A Further Survey of Pressure Vessel Failures in the UK, Reliability
91, London.
E&P Forum, 1992. Hydrocarbon Leak and Ignition Database, Report 11.4/180.
GEAP, 1964. Survey of Piping Failures for the Reactor Primary Coolant Pipe Rupture Study,
Report 4574, General Electric Atomic Power.
Green A.E. & Bourne A.J., 1972. Reliability Technology, New York: Wiley
Gulf Oil, 1978. A review of Gulf and other data.
Hannaman, G.W., 1978. GCR Reliability Data Bank Status Report, General Atomic
Company, Project 3228.
Hawksley, J.L., 1984. Some Social, Technical and Economic Aspects of the Risks of Large
Plants, CHEMRAWN III.
32 ©OGP
HSE (1978), A Safety Evaluation of the Proposed St Fergus to Mossmorran Natural Gas
Liquids and St Fergus to Boddam Gas Pipelines, Health and Safety Executive
HSE, 1997. Offshore Hydrocarbon Releases Statistics 1997, Offshore Technology Report
OTO 97 950, Health & Safety Executive, London: HMSO.
HSE, 2000. Offshore Hydrocarbon Release Statistics 1999, Offshore Technology Report
OTO 1999 079, Health & Safety Executive, London: HMSO.
IAEA, 1988. Component Reliability Data for Use in Probabilistic Safety Assessment,
International Atomic Energy Authority Technical Document 4/8.
IEEE, 1984. IEEE Guide to the Collection and Presentation of Electrical, Electronic, Sensing
Component and Mechanical Equipment Reliability Data for Nuclear-Power Generating
Stations, Institute of Electrical & Electronics Engineers, Std 500-1984.
Johnson, D.W. & Welker, J.R., 1981. Development of an Improved LNG Plant Failure Rate
Data Base, Applied Technology Corporation, Report No. GRI-80/0093.
Kellerman, O. et al., 1973. Considerations about the Reliability of Nuclear Pressure
Vessels, International Conference on Pressure Vessel Technology, San Antonio, Texas,
USA.
Lees, F.P., 1996. Loss Prevention in the Process Industries, 2nd Ed., Oxford: Butterworth-
Heinemann.
Oberender, W. et al , 1978. Statistical Evaluations on the Failure of Mechanically Stressed
Components of Conventional Pressure Vessels, Technischen Uberwachungs-Vereine
Working Group on Nuclear Technology.
Pape, R.P. & Nussey, C., 1985. A Basic Approach for the Analysis of Risks From Major Toxic
Hazards, paper presented at Assessment and Control of Major Hazards, EFCE event no.
322, Manchester, UK, IChemE Symposium Series 93, 367-388.
Phillips, C.A.G. & Warwick, R.G., 1969. A Survey of Defects in Pressure Vessels Built to
High Standards of Construction and its Relevance to Nuclear Primary Circuits, UKAEA
AHSB(S) R162.
Reeves, A.B., Minah, F.C. & Chow, V.H.K., 1997. Quantitative Risk Assessment
Methodology for LPG Installations, EMSD Symposium on Risk and Safety Management in
the Gas Industry, Hong Kong.
Rijnmond Public Authority, 1982. A Risk Analysis of Six Potentially Hazardous Industrial
Objects in the Rijnmond Area - A Pilot Study, COVO, Dordrecht: D. Reidel Publishing Co.
Scandpower, 1981. Risk Analysis, Gas and Oil Leakages, Report for Statoil, Scandpower
Report 2.64.28.
Sherwin, D.J. & Lees, F.P., 1980. An Investigation of the Application of Failure Rate Data
Analysis to decision-Making in Maintenance of Process Plants, Proc. Instn. Mech. Engrs,
194, 301-308.
Smith, D.J., 1997. Reliability, Maintainability and Risk, 5th Ed., Oxfrod: Butterworth-
Heinemann.
Smith, T.A. & Warwick, R.G., 1974. The Second Survey of Defects in Pressure Vessels Built
to High Standards of Construction and its Relevance to Nuclear Primary Circuits, UKAEA
Safety and Reliability Directorate Report SRD R30.
Smith, T.A. & Warwick, R.G., 1981. A Survey of Defects in Pressure Vessels in the UK for
the Period 1962-78, and its Relevance to Nuclear Primary Circuits, UKAEA Safety and
Reliability Directorate Report SRD R203.
Sooby, W. & Tolchard, J.M., 1993. Estimation of Cold Failure Frequency of LPG Tanks in
Europe, Conference on Risk & Safety Management in the Gas Industry, Hong Kong.
©OGP 33
Svensson, L.G. & Sjögren, S., 1988. Reliability of Plate Heat Exchangers in the Power
Industry, American Society of Mechanical Engineers, Power Generation Conference,
Philadelphia, USA.
USNRC, 1975. Reactor Safety Study, Appendix III - Failure Data, US Nuclear Regulatory
Commission, NUREG-75/014, WASH-1400.
USNRC, 1980. ata Summaries of Licensee Event Reports of Valves at US Commercial
Nuclear Power Plants, by W.H. Hubble & C.F. Miller, EG&G Idaho Inc, for US Nuclear
Regulatory Commission, NUREG/CR-1363.
USNRC., 1981. Nuclear Plant Reliability Data System (NPRDS), US Nuclear Regulatory
Commission, NUREG/CR-2232, Annual Report.
Veritec, 1992. QRA handbook, DNV Technica Report 92-3147.
Wright, R.E., Steverson, J.A., & Zuroff, W.F., 1987. Pipe Break Frequency Estimation for
Nuclear Power Plants, US Nuclear Regulatory Commission, NUREG/CR-4407, Washington
DC.
Whittle, K., 1993. LPG Installation Design and General Risk Assessment Methodology
Employed by the Gas Standards Office, Conference on Risk & Safety Management in the Gas
Industry, Hong Kong.
34 ©OGP

March 2010
Blowout
frequencies
RADD – Blowout frequencies
contents
1.1 Application ...................................................................................................... 1
1.2 Definitions ....................................................................................................... 1
3.0 Guidance on use of data ........................................................ 6
3.1 General validity ............................................................................................... 6
3.2 Uncertainties ................................................................................................... 6
3.3 Example ........................................................................................................... 6
4.0 Review of data sources ......................................................... 7
4.1 Basis of data presented ................................................................................. 7
4.2 Onshore blowouts ........................................................................................ 11
6.0 References .......................................................................... 13
©OGP 1
Abbreviations:
BOP Blowout Preventer
EUB Alberta Energy and Utilities Board
GoM Gulf of Mexico
HPHT High Pressure High Temperature
NSS North Sea Standard
OCS (US) Outer Continental Shelf
2 ©OGP

1.1 Application
This datasheet presents (Section 2.0) frequencies of blowouts and well control
incidents. They are intended to be applied to well operations worldwide, both offshore
and onshore, as indicated in the table headings.
1.2 Definitions
The following definitions are taken from [1]:
• Blowout An incident where formation fluid flows out of the well or
between formation layers after all the predefined technical
well barriers or the activation of the same have failed.
• W ell release An incident where hydrocarbons flow from the well at some
point where flow was not intended and the flow was
stopped by use of the barrier system that was available on
the well at the time of the incident,
• Shallow gas An incident where shallow gas is released from the well
release after a gas zone has been penetrated before the BOP has
been installed (any zone penetrated after the BOP is
installed is not a shallow gas incidents)
• Oil well A well where the formation has an estimated gas/oil ratio
(GOR) less than 1,000
• Gas well A well where the formation has an estimated gas/oil ratio
(GOR) exceeding 1,000
• HPHT well A well with an expected shut-in pressure equal to or above
690 bar (10,000 psi) and/or bottom hole temperatures equal
to or above 150°C (300°F)
• North Sea Operation performed with BOP installed including shear
Standard (NSS) ram and two barrier principle followed
operation
• Production Production, injection and closed in production wells
• W ell intervention Completion, wireline, coiled tubing, snubbing and other
workover operations
• W ireline Wireline operations in production or injection wells (i.e. not
wireline operations carried out as part of drilling and
completion operations)
• W orkover Workover activities (not including wireline, snubbing or
coiled tubing operations). Often referred to as "heavy
workover"
©OGP 1

For well operations in the North Sea and in other offshore areas where the equipment is
of North Sea Standard (see Section 1.2), Scandpower’s analysis [2] of SINTEF’s blowout
database is recommended. For well operations in other areas of the world, SINTEF’s
own analysis [1] of the database is recommended. Both sets of data are tabulated
below. In the original reports [1,2] they are presented in different ways, however so far
as possible the tables below are consistent in layout for easy comparison.
For North Sea Standard operations, [2] does not give separate frequencies for topside
and subsea releases, except for shallow gas releases. DNV have estimated the fractions
of subsea releases where applicable; these are also included in the table below.
For onshore operations, comparable data were not found. It is recommended to use the
offshore data presented here. Some possibly indicative values are presented in Section
4.2.
2 ©OGP
Blowout and W ell Release Frequencies for Offshore Operations of North Sea
Standard
Operation Category Frequency Fractio
Averag Gas Oil Unit n
e Subsea
-4
Exploration Drilling, Topside Blowout 6.0 × 10 - per drilled
shallow gas well
-4
Diverted Well Release 8.3 × 10 - per drilled
well
-5
Well Release 9.3 × 10 - per drilled
well
-4
Subsea Blowout 9.8 × 10 - per drilled
well
-4
Development Drilling, Topside Blowout 4.7 × 10 - per drilled
shallow gas well
-4
Diverted Well Release 6.5 × 10 - per drilled
well
-5
Well Release 7.3 × 10 - per drilled
well
-4
Subsea Blowout 7.4 × 10 - per drilled
well
-4 -4 -4
Exploration Drilling, deep Blowout 3.1 × 10 3.6 × 10 2.5 × 10 per drilled 0.39
(normal wells) well
-3 -3 -3
Well Release 2.5 × 10 2.9 × 10 2.0 × 10 per drilled 0.39
well
-3 -3 -3
Exploration Drilling, deep Blowout 1.9 × 10 2.2 × 10 1.5 × 10 per drilled 0.39
(HPHT wells) well
-2 -2 -2
well
-5 -5 -5
Development Drilling, deep Blowout 6.0 × 10 7.0 × 10 4.8 × 10 per drilled 0.33
(normal wells) well
-4 -4 -4
well
-4 -4 -4
Development Drilling, deep Blowout 3.7 × 10 4.3 × 10 3.0 × 10 per drilled 0.33
(HPHT wells) well
-3 -3 -3
well
-5 -4 -5
Completion Blowout 9.7 × 10 1.4 × 10 5.4 × 10 per operation 0
-4 -4 -4
Well Release 3.9 × 10 5.8 × 10 2.2 × 10 per operation 0
-6 -6 -6
Wirelining Blowout 6.5 × 10 9.4 × 10 3.6 × 10 per operation 0
-5 -5 -6
-4 -4 -5
Coiled Tubing Blowout 1.4 × 10 2.0 × 10 7.8 × 10 per operation 0
-4 -4 -4
-4 -4 -4
Snubbing Blowout 3.4 × 10 4.9 × 10 1.9 × 10 per operation 0
-4 -4 -4
-4 -4 -4
Workover Blowout 1.8 × 10 2.6 × 10 1.0 × 10 per operation 0
-4 -4 -4
-6 -5 -6
Producing Wells Blowout 9.7 × 10 1.8 × 10 2.6 × 10 per well year 0.125
-5 -5 -6
(excluding external causes) Well Release 1.1 × 10 2.0 × 10 2.9 × 10 per well year 0.125
-5 -5 -5
Producing Wells, external Blowout 3.9 × 10 3.9 × 10 3.9 × 10 per well year 0.125
causes Well Release - - - per well year -
-5
Gas Injection Wells Blowout - 1.8 × 10 - per well year 0.125
-5
Well Release - 2.0 × 10 - per well year 0.125
-6
Water Injection Wells Blowout 2.4 × 10 - - per well year 0.125
Well Release - - - per well year -
©OGP 3
Blowout and W ell Release Frequencies for Offshore Operations Not of North Sea
Standard
Operation Category Well Frequency Fractio
Type n
Subsea
-3
Exploration Drilling, Blowout (surface flow) Appraisal 1.3 × 10 per drilled 0.59
shallow gas well
-3
Wildcat 1.9 × 10 per drilled 0.59
well
1 2
Blowout (underground flow) Appraisal 0 per drilled 0
well
1 2
Wildcat 0 per drilled 0
well
-4
Diverted well release Appraisal 3.2 × 10 per drilled 0
well
-4
Wildcat 9.3 × 10 per drilled 0
well
-4
Well release Appraisal 3.2 × 10 per drilled 1.0
well
-4
well
-4
Development Drilling, Blowout (surface flow) - 9.6 × 10 per drilled 0.18
shallow gas well
-5 2
Blowout (underground flow) - 4.4 × 10 per drilled 0
well
-4
Diverted well release - 7.0 × 10 per drilled 0
well
-5
Well release - 8.8 × 10 per drilled 0
well
-3
Exploration Drilling, deep Blowout (surface flow) Appraisal 1.4 × 10 per drilled 0.41
well
-3
well
1
Blowout (underground flow) Appraisal 0 per drilled -
well
-4 2
well
1
Diverted well release Appraisal 0 per drilled -
well
1
Wildcat 0 per drilled -
well
1 3
Well release Appraisal 0 per drilled 1.0
well
1 3
Wildcat 0 per drilled 1.0
well
-4
Development Drilling, deep Blowout (surface flow) - 3.5 × 10 per drilled 0.14
well
-4 2
Blowout (underground flow) - 1.3 × 10 per drilled 0
well
1
Diverted well release - 0 per drilled -
well
-4
Well release - 2.2 × 10 per drilled 0.25
well
-4
Completion Blowout (surface flow) - 4.6 × 10 per 0
completion
1
Blowout (underground flow) - 0 per 0
completion
-4
Diverted well release - 3.1 × 10 per 0
completion
1
Well release - 0 per 0
completion
4 ©OGP
Blowout and W ell Release Frequencies for Offshore Operations Not of North Sea
Standard
Operation Category Well Frequency Fractio
Type n
Subsea
-5
Production Blowout (surface flow) - 3.3 × 10 per well year 0.43
-6 2
Blowout (underground flow) - 4.7 × 10 per well year 0
1
Diverted well release - 0 per well year 0
-6
Well release - 9.5 × 10 per well year 0
-3
Workover Blowout (surface flow) - 1.0 × 10 per workover 0.05
1 2
Blowout (underground flow) - 0 per workover 0
1
Diverted well release - 0 per workover 0
-4
Well release - 8.5 × 10 per workover 0
-5
Wireline Blowout (surface flow) - 1.1 × 10 per wireline 0
job
1
Blowout (underground flow) - 0 per wireline 0
job
1
Diverted well release - 0 per wireline 0
job
-5
Well release - 1.1 × 10 per wireline 0
job
Notes
1. Based on no incidents to date. However, these scenarios are considered credible. Table 4.1
gives population data, from which estimates can be made of these frequencies if required.
2. For underground flow releases there are no topsides releases. For all other releases,
fractions of releases occurring at topsides = (1 - fraction subsea).
3. Only 2 occurrences, both located at subsea wellhead (see Section 4.1). Subsea fraction = 0 if
wellheads are located at topsides.
©OGP 5

The data presented in Section 2.0 should be considered valid for the North Sea and US
GoM OCS.
They can also be applied to other areas of the world, according to whether or not
standards are considered to be equivalent to those in the North Sea.
For onshore operations it is recommended to use the offshore data presented in Section
2.0.
3.2 Uncertainties
As in any analysis of historical frequencies, there are uncertainties in:
• The population (in this case, wells drilled, well operations or well years)
• The incident data
In particular, where incidents are infrequent, another incident just after the data period
may significantly increase the statistical frequency, especially when no incidents have
been recorded to date but are nevertheless credible (as is the case with some of the
SINTEF category – well type combinations).
The SINTEF database [1] has been extensively reviewed to ensure that it is as complete
as possible in regard both to population and incidents, minimising so far as possible
these uncertainties. According to [1]:
“It is SINTEF’s belief that from 1980-01-01 most blowouts occurring in the US
Gulf of Mexico (GoM) Outer Continental Shelf (OCS), the UK and Norway have
been included in the database.”
Therefore, they present frequencies based on this period and these geographical areas.
Neither SINTEF [1] nor Scandpower [2] have, in their reports, quantified these
uncertainties in the way that, for example, OREDA [5] does for equipment reliability;
instead they have focused on data quality.
Further potential uncertainties arise where the frequencies are used outside the context
of the data, for example, in other areas of the world. SINTEF present data for all
blowouts in their database, covering 49 countries/areas, and incident data for 4 other
countries/waters. However, the populations and numbers of blowouts in each case are
small, and hence SINTEF do not recommend using frequency estimates obtained from
these data in preference to the data used to obtain the frequencies presented in Section
2.0 (see Section 4.1). Hence there is greater uncertainty in using the data for other
countries/waters but no quantification of this uncertainty is available. Using the
frequencies for operations not of North Sea Standard will introduce an element of
conservatism to any analysis.
3.3 Example
A hypothetical North Sea platform has 8 oil producing wells and 2 gas injection wells.
There are one workover and two wireline jobs per year on the platform oil wells. The
following extract from Section 2.0 highlights the relevant frequencies:
6 ©OGP
Operation Category Frequency Fractio

Averag Gas Oil Unit n
e Subsea
-6 -6 -6
Wirelining Blowout 6.5 × 10 9.4 × 10 3.6 × 10 per 0
operation
-5 -5 -6
Well Release 1.1 × 10 1.6 × 10 6.1 × 10 per 0
operation
-4 -4 -4
Workover Blowout 1.8 × 10 2.6 × 10 1.0 × 10 per 0
operation
-4 -4 -4
Well Release 5.8 × 10 8.3 × 10 3.2 × 10 per 0
operation
-6 -5 -6
Producing Wells Blowout 9.7 × 10 1.8 × 10 2.6 × 10 per well 0.125
(excluding external causes) year
-5 -5 -6
Well Release 1.1 × 10 2.0 × 10 2.9 × 10 per well 0.125
year
-5
Gas Injection Wells Blowout - 1.8 × 10 - per well 0.125
year
-5
Well Release - 2.0 × 10 - per well 0.125
year
The annual frequencies of blowouts and well releases are then:

Blowouts: (8 × 2.6 × 10-6) + (2 × 1.8 × 10-5) + (1 × 1.0 × 10-4) + (2 × 3.6 × 10-6) ≈ 1.6 × 10-4
Well releases: (8 × 2.9 × 10-6) + (2 × 2.0 × 10-5) + (1 × 3.2 × 10-4) + (2 × 6.1 × 10-6) ≈
4.0 × 10-4
The annual frequencies of topsides and subsea blowouts are:
Topsides Blowouts:
(0.875 × 8 × 2.6 × 10-6) + (0.875 ×2 × 1.8 × 10-5) + (1 × 1.0 × 10-4) + (2 × 3.6 × 10-6) ≈
1.6 × 10-4
Subsea Blowouts: (0.125 × 8 × 2.6 × 10-6) + (0.125 ×2 × 1.8 × 10-5) ≈ 7.1 × 10-6
Topsides Well releases:
(0.875 × 8 × 2.9 × 10-6) + (0.875 × 2 × 2.0 × 10-5) + (1 × 3.2 × 10-4) + (2 × 6.1 × 10-6) ≈
3.9 × 10-4
Subsea Well releases: (0.125 × 8 × 2.9 × 10-6) + (0.125 × 2 × 2.0 × 10-5) ≈ 7.9 × 10-6

The key data source is the SINTEF Offshore Blowout Database, described in [1]. SINTEF
have performed their own analysis of this database, updated annually, in order to obtain
the frequencies set out in Section 2.0. These are based on blowout data from the US
Gulf of Mexico OCS, UKCS and Norwegian waters for the period 1st January 1980 to 1st
January 2005. Table 4.1 gives the numbers of wells and incidents in the database for
these areas and period.
Scandpower [2] annually review the SINTEF database and analyse it further to obtain
blowout frequencies applicable specifically to the North Sea (and other places where
equipment standards are comparable). They use the most recent 20 years’ data
©OGP 7
available. Their report explains how the analysis is done, however two key elements of
this are:
• Elimination of irrelevant incidents
• Adjustment due to trend over time
Table 4.2 sets out the numbers of wells and incidents used in their analysis.
[4] provides the basis for the HPHT well frequencies, concluding that the blowout
frequency for an HPHT well is 12.3 times higher than for a normal well (including
underground blowouts).
8 ©OGP
Table 4.1 Num bers of W ells and Incidents in SINTEF Offshore Blowout
Database [1]
Operation Category Well No. of

Type Wells/
Incidents
Exploration Drilling, Number of Exploration Appraisal 6,257 Wells
shallow gas Wells Drilled Wildcat 7,505 Wells
Blowout (surface flow) Appraisal 8
Wildcat 14
Blowout (underground Appraisal 0
flow) Wildcat 0
Diverted well release Appraisal 2
Wildcat 7
Well release Appraisal 2
Wildcat 2
Development Drilling, Number of Development - 22,833 Wells
shallow gas Wells Drilled
Blowout (surface flow) - 22
Blowout (underground - 1
flow)
Diverted well release - 16
Well release - 2
Exploration Drilling, deep Number of Exploration Appraisal 6,257 Wells
Wells Drilled Wildcat 7,505 Wells
Blowout (surface flow) Appraisal 9
Wildcat 13
Blowout (underground Appraisal 0
flow) Wildcat 7
1
Diverted well release Appraisal 0
1
Wildcat 0
Well release Appraisal 3
Wildcat 3
Development Drilling, Number of Development 22,833 Wells
deep Wells Drilled
flow)
Well release - 5
Completion Number of Completions 20,328 Wells
flow)
Well release - 0
Production Number of Well Years in 211,142 Well
Service Years
flow)
Well release - 2
Workover Number of Workovers 19,920
Workovers
flow)
Well release - 17
Wirelining Number of Wireline Jobs 358,941
©OGP 9
Operation Category Well No. of

Type Wells/
Incidents
Wireline Jobs
flow)
Well release - 4
Table 4.2 Num bers of W ells and Incidents in Scandpower Blowout Analysis
[2]
Operation Category No. of

Wells/
Incidents
Exploration Drilling Number of Wells Drilled 9,172 Wells
(shallow gas) Incidents 26
Development Drilling Number of Wells Drilled 13,022 Wells
(shallow gas) Incidents 29
Drilling (deep) Number of Wells Drilled 9,744 Wells
Blowout 2
Number of Wells Drilled 2,854 Wells
Well release 4
All Well Interventions Number of Oil Well Years in 95,270 Wells
Service Years
Number of Gas Well Years in 82,204 Wells
Service Years
Completion Number of Completions 16,381
Completions
Blowout 4
Well release 4
Wireline Number of Wireline Ops Per 1.7 Ops/Year
2
Year
Blowout 4
Well release 2
3
Coiled Tubing Number of Coiled Tubing Ops 358 Ops
2
Number of Well Years 4,214 Well
Years
Blowout 2
Well release 2
3
Snubbing Number of Snubbing Operations 196 Ops
2
Number of Well Years 4,214 well
years
Blowout 3
Well release 1
Workover Workover Interval – Oil Wells [3] 5 years
Workover Interval – Gas Wells 7 years
[3]
Blowout 8
Well release 11
Production Number of Well Years in Service 177,474 Well
Years
Blowout – external causes 7
Blowout – not external causes 5
Well release 2
Notes to Table 4.1 and Table 4.2

1. No number of incidents is given in the report for this scenario. It has been assumed that
there have been 0 such incidents to date.
2. Assumed based on feedback from oil companies.
10 ©OGP
3. Norwegian Sector only used as basis for frequency estimates.

The basis for the subsea fractions for North Sea Standard operations are as follows:
• Exploration drilling, deep blowouts: 12 out of 31 from outside casing or underground
− Assumed also to apply to exploration drilling, deep well releases
− Assumed to be the same for HPHT wells as for normal wells
• Development drilling, deep blowouts: 5 out of 15 from outside casing or
underground
− Assumed also to apply to development drilling, deep well releases
− Assumed to be the same for HPHT wells as for normal wells
• Production well releases (excluding external causes): assumed to be the same as for
production blowouts (excluding external causes)
− Assumed also to apply to production well releases, external causes
− Assumed also to apply to gas and water injection wells
From the SINTEF report [1], Tables 4.5 to 4.7, the basis for the subsea fractions for
operations not of North Sea Standard are as follows:
• Exploration drilling, shallow gas blowouts:
− Surface flow: 13 out of 22 with known location
− Diverted well release: 9, assumed to have been topsides
− Well release: 2 out of 2 at subsea wellhead
− All assumed to be same for appraisal and wildcat wells
• Development drilling, shallow gas blowouts:
− Surface flow: 4 out of 22
− Underground: 1 at wellhead, assumed topsides
− Diverted well release: 16 at wellhead, assumed topsides
− Well release: 1 at subsea wellhead
• Exploration drilling, deep blowouts:
− Underground: 1 out of 6 with known location (remainder no surface flow)
− Diverted well release, well release: all topsides
• Development drilling, deep blowouts:
− Underground: 3 out of 3 no surface flow
− Well release: 1 out of 4 with known location
• Completion blowouts: 0 out of 15 subsea
• Production blowouts:
− Underground: 1 out of 1 no surface flow
− Well release: 0 out of 2 with known location
• Workover blowouts:
− Well release: 0 out of 17
• Wireline blowouts: 0 out of 7 with known location
4.2 Onshore blowouts

For onshore blowouts, the Alberta Energy and Utilities Board (EUB) maintains a
database of onshore drilling incidents [6]. This database includes drilling occurrence
©OGP 11
data for Alberta from 1975 till 1990 with a total of 87,944 wells drilled. The database
contains incident reports for individual well control occurrences. The occurrence data
are presented below.
Category Number of Occurrences Frequency (per well

drilled)
Blow* 53 6.0 x 10-4

Blowout 43 4.9 x 10-4
Total 96 1.1 x 10 -3
* A category of well control incident defined as an uncontrolled release of wellbore fluids to
atmosphere that can be shut-in or diverted to flare in a short period of time. They are assumed
here to be equivalent to well releases as defined in the SINTEF and Scandpower work.
The total frequency is about 40% of the corresponding value for offshore drilling
blowouts.
During 2002 – 2006 there were 39 blowouts and 88,856 wells drilled (blows no longer
being recorded). Of the 39 blowouts, 7 involved release of gas, the remainder released
only fresh water. Taking the full number of blowouts gives a frequency of 4.4 × 10-4
blowouts per well drilled, about 10% smaller than the frequency above from 1975 – 1990
data and hence not significantly lower.
For comparison, this is about 40% of the corresponding value for offshore drilling
blowouts and well releases presented in Section 2.0. However it should be noted that
Alberta wells are believed to be sour, with precautions being taken accordingly to
minimise the likelihood of releases. Hence use of the above frequencies is not
recommended except in a similar context.
EUB also records the numbers of blowouts during well interventions and other
blowouts (from producing or suspended wells) but they do not record the
corresponding population data (numbers of well interventions, producing wells and
suspended wells).

Other databases previously used have been:
• BLOWOUT, an internal DNV compilation of blowouts and well control incidents from
the North Sea and US waters during 1970-89.
• WOAD (World Offshore Accident Databank), a public-domain database maintained
by DNV covering all offshore hazards.
The data from both of these are now included in the SINTEF database and hence are
superseded.

The SINTEF and Scandpower reports [1,2] should be consulted for further information.
In particular, the Scandpower report [2] explains how the frequencies presented in
Section 2.0 are derived from the statistics in Table 4.2.
12 ©OGP
6.0 References
1. SINTEF 2006. Blowout and Well Release Characteristics and Frequencies, 2006, Report
No. STF50 F06112.
2. Scandpower Risk Management AS 2006. Blowout and Well Release Frequencies –
Based on SINTEF Offshore Blowout Database, 2006, Report No. 90.005.001/R2.
3. Nilsen, E F 1999. Basis utblåsningsfrekvenser 1999, internal technical memo, Statoil
HMS T&T SIK.
4. SINTEF Safety and Reliability, Alliance Technology, Scandpower 1998. Estimation of
Blowout Probability of HPHT Wells, Report No. STF38 F98420.
5. OREDA 2002.
6. Alberta Energy and Utilities Board. Oil and Gas Well Blowout Reports.
©OGP 13

March 2010
Storage
incident
frequencies
RADD – Storage incident frequencies
Contents:
1.1 Application ...................................................................................................... 1
1.2 Definitions ....................................................................................................... 1
1.2.1 Atmospheric Storage Tanks...................................................................................... 1
1.2.2 Refrigerated Storage Tank Designs ......................................................................... 2
1.2.3 Pressurised Storage Vessels .................................................................................... 3
1.2.4 Non-process Hydrocarbon Storage Offshore.......................................................... 3
1.2.5 Underground Storage Tanks..................................................................................... 4
2.1 Atmospheric Storage Tanks .......................................................................... 4
2.2 Refrigerated Storage Tanks ........................................................................... 5
2.3 Pressurised Storage Vessels......................................................................... 6
2.4 Oil Storage on FPSOs..................................................................................... 6
2.5 Non-process Hydrocarbon Storage Offshore .............................................. 6
2.6 Underground Storage Tanks ......................................................................... 7
3.0 Guidance on Use of Data ....................................................... 7
3.2 Uncertainties ................................................................................................... 7
4.0 Review of Data Sources ......................................................... 8
4.1 Atmospheric Storage Tanks .......................................................................... 8
4.1.1 Selection of Generic Value for Atmospheric Storage Tanks ................................. 8
4.1.2 Overfilling.................................................................................................................... 9
4.2 Refrigerated Storage Tanks ......................................................................... 10
4.2.1 Selection of Generic Value for Refrigerated Storage Tanks ................................ 10
4.3 Pressurised Storage Vessels....................................................................... 11
4.3.1 Accident Source Data .............................................................................................. 11
4.3.2 Selection of Generic Value for Pressurised Storage Vessels.............................. 12
4.4 Oil Storage on FPSOs................................................................................... 13
4.5 Non-process Hydrocarbon Storage Offshore ............................................ 13
4.5.1 Methanol.................................................................................................................... 14
4.5.2 Diesel......................................................................................................................... 14
5.0 Recommended Data Sources for Further Information ........... 15
6.0 References .......................................................................... 15
©OGP 1
Abbreviations:
ASME American Society of Mechanical Engineers
ATK Aviation Turbine Kerosene
BG British Gas
BLEVE Boiling liquid expanding vapour explosion
FPSO Floating Production, Storage and Offloading Unit
GRI Gas Research Institute
HSE Health & Safety Executive
IPO Interprovinciaal Overleg
LNG Liquefied Natural Gas
LPG Liquefied Petroleum Gas
MIC Methyl Isocyanate
OREDA Offshore Reliability Database
QRA Quantified Risk Assessment
SRD Safety and Reliability Directorate
WOAD World-wide Offshore Accident Databank
2 ©OGP

1.1 Application
This datasheet presents (Section 2.0) frequencies of releases from the following types
of storage:
1. Atmospheric storage
2. Refrigerated storage
3. Pressurised storage
4. Oil storage on FPSOs
5. Non-process Hydrocarbon Storage Offshore
6. Underground storage
For refrigerated storage tanks previous studies and available historical data have been
reviewed to produce a consistent set of estimates of frequencies of catastrophic rupture
for different designs of refrigerated storage tanks.
FPSOs typically store large quantities of crude oil in cargo oil tanks; this is periodically
transferred to shuttle tankers. Only fires/explosions from the cargo oil tanks are
considered,
Non-process hydrocarbon storage offshore includes methanol, diesel and ATK systems
together with the associated pipework.
Underground storage tanks can be divided into buried or mounded storage tanks (mainly
for fuels such as petrol and LPG), and excavated or leached storage caverns. Section
2.0 presents guidance how failure frequencies for buried or mounded storage tanks
might be estimated.
1.2 Definitions
1.2.1 Atmospheric Storage Tanks
Atmospheric storage tanks contain liquids ambient pressure and at or near ambient
temperature. They are usually fabricated from mild steel on a concrete base,
surrounded by a low bund wall. They are designed to withstand an internal
pressure/vacuum of 0.07 bar. The main types are [1]:
• Fixed roof tanks. These have a vapour space between the liquid surface and the
tank roof. They require a vent for vapour at the top of the tank. They are sub-
divided by roof design:
− Domed roof – up to about 20 m diameter.
− Cone roof – up to about 76 m diameter.
• Floating roof tanks. These have a roof that floats on the liquid surface to reduce
vapour loss. The roof requires a seal around the edge against the tank walls. Types
of roof design include:
− Pan roof.
− Annular pontoon roof.
− Double-deck roof.
• Fixed plus internal floating roof tanks. These are a combination of both types.
©OGP 1
In Section 2.0 failures from the tank walls are considered. Strictly, failures of associated
equipment such as inlet/outlet valves, pipes within the bund and pressure relief valves
should be excluded. In practice, many studies include failures at these points because
available failure data often does not distinguish them clearly from failures of the tank
itself. However, when considering tank ruptures and roof fires, the distinction is not
important.
1.2.2 Refrigerated Storage Tank Designs

There are several different designs of refrigerated storage tank, and different failure
frequencies may be applicable. The main types are [2]:
• Single containm ent tanks. These are a single primary container and generally
an outer shell designed and constructed so that the primary container is required to
meet the low temperature ductility requirements for storage of the product.
• Double containm ent tanks. These are designed and constructed so that both
the inner self supporting primary container and the secondary container are capable
of independently containing the refrigerated liquid stored. To minimise the pool of
escaping liquid, the secondary container should be located at a distance not
exceeding 6m from the primary container. The primary container contains the
refrigerated liquid under normal operating conditions. The secondary container is
intended to contain any leakage of the refrigerated liquid, but is not intended to
contain any vapour resulting from this leakage.
• Full containm ent tanks. These are designed and constructed so that both self
supporting primary container and the secondary container are capable of
independently containing the refrigerated liquid stored and for one of them its
vapour. The secondary container can be 1m to 2m distance from the primary
container. The primary container contains the refrigerated liquid under normal
operating conditions. The outer roof is supported by the secondary container. The
secondary containment shall be capable both of containing the refrigerated liquid
and of controlled venting of the vapour resulting from product leakage after a
credible event.
• Spherical Storage Tanks. Spherical, single containment tanks consisting of an
unstiffened, sphere supported at the equator by a vertical cylinder. For onshore
tanks, the lower part of the support cylinder is made of concrete and the tank is
protected by a domed concrete cover. The outside of the tank and the aluminium
part of the support cylinder are insulated by means of a panel system to the required
thickness for the specified boil-off rate.
• Mem brane tank. These are designed and constructed so that the primary
container, constituted by a membrane, is capable of containing both the liquefied
gas and its vapour under normal operating conditions and the concrete secondary
container, which supports the primary container, should be capable of containing all
the liquefied gas stored in the primary container and of controlled venting of the
vapour resulting from product leakage of the inner tank. The vapour of the primary
container is contained by a steel liner which forms with the membrane an integral
gastight containment. The action of the liquefied gas acting on the primary
container (the metal membrane) is transferred directly to the pre-stressed concrete
secondary container through the load bearing insulation.
Underground tanks have been constructed in the past. These are typically earth pits
where the ground around the pit is frozen by the cold liquid, thus providing a seal. Due
to practical difficulties, this type is now rare.
2 ©OGP
The characteristics of each type are set out in BS EN 1473.
1.2.3 Pressurised Storage Vessels

Pressurised storage tanks are considered to be storage tanks operating under pressure
of at least 0.5 bar. They include a wide variety of vessels, and are categorised for the
purposes of QRA (quantified risk assessment) as follows:
• Storage vessels – in which fluids are held under stable conditions. These are
subdivided for this analysis into:
− Large storage vessels – spheres and bullets (long cylindrical tanks) in excess of
approximately 50 m3 capacity, typically used in dedicated storage installations.
− Medium storage vessels – fixed cylindrical tanks less than approximately 50 m3
capacity, typically used in industrial or domestic installations.
• Small containers – portable cylinders and drums less than approximately 2 m3
capacity.
The main UK design code is BS 5500:1991 Specification for Unfired Fusion Welded
Pressure Vessels (see [1] p12/20). It divides vessels into 3 categories. The highest
standard, Category 1, requires full non-destructive testing of main seam welds. The
corresponding US code is the ASME Boiler and Pressure Vessel Code, 1992.
Section 2.0 covers pressure vessels and any equipment directly associated with them,
i.e. nozzles and instrumentation (with associated flanges), and the inspection cover
(manway). Connection points are included up to the first flange, although the flange
itself is not included. Lines into and out of the vessel, and the associated flanges and
valves are not included in the scope.
Although the lines into and out of the vessel are not included in the scope, the actual
number of lines would have an influence on the failure rate, as failures are more likely at
the connection points where these lines join the vessel. Other equipment may influence
the failure rate, such as relief systems being blocked. Such issues are not addressed in
this datasheet but should be considered separately if appropriate,
1.2.4 Non-process Hydrocarbon Storage Offshore

The term “non-process fires” covers any fires and explosions that are not covered by
the modelling of process hydrocarbon events. Most types of non-process fire involve
materials other than hydrocarbons (e.g. electrical fires, chemical gas explosions).
However, non process hydrocarbons such as diesel and ATK, and other hazardous
materials such as methanol, are frequently stored on offshore installations in
unpressurised tanks of a few m3 capacity. In the event of a leak or rupture, these
materials may be ignited and so have the potential to cause a fire that could result in
injury or possibly fatality. Some data are available for such systems.
Although most non-process fires are very small incidents (e.g. a chip-pan fire in the
galley lasting a few seconds), some have been larger causing damage and fatalities.
The frequency of non-process fires may be larger than process fires, suggesting that
they should not be overlooked if the risk analysis is to be comprehensive.
©OGP 3
1.2.5 Underground Storage Tanks

There are several types of underground storage tanks:
• Petrol filling station tanks – small buried atmospheric tanks, typically used for petrol
at filling stations.
• Underground pressure vessels – small buried or mounded pressure vessels,
typically used for LPG.
• Caverns – large excavated in-ground tanks, typically used for liquefied gas or crude
oil storage at refineries or storage terminals.
• Salt dome caverns – large capacity storage located deep underground in natural
rock formations, typically used for storage of gas under pressure.
In Section 2.0 failures of the first two types are discussed. Only failures of the tank
itself are considered; surface facilities are excluded. On a petrol tank, the surface
facilities may include underground pipes, and metering as well as above-ground
dispensing pumps. On a gas storage tank, surface facilities may include surge vessels,
injection pumps, gas driers and metering systems. Failures of the supply system, such
as loading from road tankers and leaks from loading hoses are also excluded.

2.1 Atmospheric Storage Tanks
The best available estimates of leak frequencies for atmospheric tanks are summarised
in Table 2.1.
Table 2.1 Atm ospheric Storage Tank Leak Frequencies
Type of Tank Type of Release Leak Frequency

(per tank year)
-3
Floating roof Liquid spill on roof 1.6 × 10
-3
Sunken roof 1.1 × 10
-3
Fixed/ floating roof Liquid spill outside tank 2.8 × 10
-6
Tank rupture 3.0 × 10
The frequencies of different types of fire/explosion are summarised in Table 2.2.
4 ©OGP
Table 2.2 Atm ospheric Storage Tank Fire Frequencies
Type of Fire Floating Roof Fixed Roof Fixed plus

Tank Tank (per tank Internal
(per tank year) year) Floating Roof
Tank
(per tank year)
-3 -3
Rim seal fire 1.6 × 10 1.6 × 10
-4
Full surface fire on roof 1.2 × 10
-5 -5
Internal explosion & full surface 9.0 × 10 9.0 × 10
fire
-5 -5
Internal explosion without fire 2.5 × 10 2.5 × 10
-5
Vent fire 9.0 × 10
-5 -5 -5
Small bund fire 9.0 × 10 9.0 × 10 9.0 × 10
-5 -5 -5
Large bund fire (full bund area) 6.0 × 10 6.0 × 10 6.0 × 10
2.2 Refrigerated Storage Tanks

Estimates of frequencies of catastrophic rupture for different designs of refrigerated
storage tanks are shown in Table 2.3.
Table 2.3 Sum m ary of Refrigerated Storage Tank Leak Frequencies
Tank Design Catastrophic Rupture Frequency Leak Frequency

(per tank per year) (per connection
year)
Primary Secondary Primary
Containment Containment 2 Containment Only
Only 1
-5 -6 -5
Existing Single 2.3 × 10 7.3 × 10 1.0 × 10
Containment Tanks
-6 -7 -5
New Single Containment 2.3 × 10 7.3 × 10 1.0 × 10
Tanks
-7 -8 -5
Double Containment 1.0 × 10 2.5 × 10 1.0 × 10
Tanks
-7 -8
Full containment tanks3 1.0 × 10 1.0 × 10 0
-7 -8
Membrane tank 3
1.0 × 10 1.0 × 10 0
1
The pool area is that of the secondary containment
2
For single containment tanks this scenario corresponds to bund overtopping
3
No collapse is considered for these tank types if they have a concrete roof
A leak or rupture of the tank, releasing some or all of its contents, can be caused by
brittle failure of tank walls, welds or connected pipework due to use of inadequate
materials, combined with loading such as wind, earthquake or impact. Where there is
the potential for such loading – in particular, in seismically active zones – specialist
analysis of the failure likelihood should be sought.
©OGP 5
2.3 Pressurised Storage Vessels

Table 2.4 gives leak frequencies for typical hole size categories.
Table 2.4 Sum m ary of Pressure Vessel Leak Frequencies
Hole Diameter Leak Frequency (per

vessel year)
Range Nominal Storage Small
Vessels Containers
-5 -7
1-3 mm 2 mm 2.3 × 10 4.4 × 10
-5 -7
3-10 mm 5 mm 1.2 × 10 4.6 × 10
-6
10–50 mm 25 mm 7.1 × 10
-6
50-150 mm 100 mm* 4.3 × 10
-7 -7
>150 mm Catastrophic 4.7 × 10 1.0 × 10
-5 -6
TOTAL 4.7 × 10 1.0 × 10
*Or diameter of largest pipe connection if this is smaller
The frequency of a tank BLEVE (Boiling Liquid Expanding Vapour Explosion) should be
calculated using fault tree analysis, taking account of adjacent fire sources capable of
causing this event. Previous such analysis indicates that a frequency in the range 10-7
to 10-5 per vessel year would be expected for a large storage vessel.
2.4 Oil Storage on FPSOs

A frequency of fires in cargo oil tanks of 8.8 x 10-4 per tanker year was derived from data
on oil tankers [33]. This data is over 15 years old and based on oil tankers, and there
was very limited experience with FPSOs at that time compared with now. However,
more recent data (see Section 4.4) does not permit a better estimate. A suitable
frequency for QRA is therefore best obtained by a theoretical approach, e.g. using fault
tree analysis, taking account of the specific design features of the installation and the
potential for human error.
2.5 Non-process Hydrocarbon Storage Offshore

Table 2.5 and Table 2.6 present release frequencies for methanol and diesel/ATK
systems offshore, where the system includes the tank and the associated pipework.
Where there is more than one tank, the tank frequencies given can be multiplied up and
the totals recalculated.
Table 2.5 Offshore Methanol Storage Leak Frequencies (per year)
Small Medium Large Rupture Total

-3 -4 -4 -5 -3
Tank 1.6 × 10 4.6 × 10 2.3 × 10 3.0 × 10 2.3 × 10
-3 -3 -3 -2
Pipework 7.9 × 10 1.6 × 10 1.1 × 10 - 1.1 × 10
-3 -3 -3 -5 -2
Total 9.5 × 10 2.0 × 10 1.3 × 10 3.0 × 10 1.3 × 10
Fraction 74% 15% 10% 0.2% 100%
6 ©OGP
Table 2.6 Offshore Diesel/ATK Storage Leak Frequencies (per year)
Small Medium Large Rupture Total

-3 -4 -4 -5 -3
Tank 1.6 × 10 4.6 × 10 2.3 × 10 3.0 × 10 2.3 × 10
-2 -3 -3 -2
Pipework 2.1 × 10 4.1 × 10 2.8 × 10 - 2.7 × 10
-2 -3 -3 -5 -2
Total 2.2 × 10 4.6x 10 2.9 × 10 3.0 × 10 3.0 × 10
Fraction 74% 15% 10% 0.1% 100%
2.6 Underground Storage Tanks

There is inadequate data to estimate the frequencies of failures of underground tanks
directly, and they are usually obtained using data for above ground tanks and
eliminating contributions from hazards that are not relevant. In general, this involves
eliminating external impact and fire escalation cases. These approaches are not yet
sufficiently developed to recommend standard frequencies and so for buried/ mounded
tanks a specific assessment by a risk specialist is recommended. Note also that a leak
from a buried or mounded tank is likely first to be into the surrounding soil and may not
reach the open air; even if it does, it may not eject the intervening soil and so may be
limited in rate and velocity by this.
Likewise, there is inadequate data to estimate the frequencies of leaks from storage
caverns and a specialist assessment of this is recommended.
3.0 Guidance on Use of Data

The data presented in Section 2.0 can be used for storage tanks and containers for
onshore facilities containing refrigerated and ambient liquids; those presented in
Section 2.4 should be used for unpressurised storage of methanol and non-process
hydrocarbons offshore. The derivation and application of the data is discussed further
in Section 4.0.
3.2 Uncertainties
The sources of uncertainty in the estimated leak and fire frequencies are discussed in
Section 4.0 for the different tank types.
The uncertainty in the frequencies presented in Section 2.0 tends to be greatest for
catastrophic failures due to lack of failure experience. Furthermore, the applicability of
the failure modes in the historical events to modern tank designs may also be
inappropriate because of improvements in tank design.
The uncertainty in values for atmospheric storage tanks could be represented by a
range of at least a factor of 10 higher or lower. Estimates of leak frequencies for large
pressure vessels, for both the overall leak frequencies and the rupture frequencies,
range over 4 orders of magnitude.
©OGP 7
4.0 Review of Data Sources

4.1 Atmospheric Storage Tanks
Failure experience was reviewed from a number of sources:
• [3] includes 122 cases of atmospheric storage tank fires world-wide during 1965-89.
• [4] lists 69 such events during 1981-96.
• [5] lists 107 events during 1951-95 (see [1] App I).
4.1.1 Selection of Generic Value for Atmospheric Storage Tanks

A wide variation is apparent in the source data. The LASTFIRE data [4] is considered
the most reliable source for releases from floating roof tanks. The frequency based on
US petroleum industry tanks >10,000 bbl is believed to be the best estimate for rupture
frequency.
For large floating roof tanks, the LASTFIRE study [4] provides the best available fire
frequencies. In the absence of any other data, they are assumed applicable to all sizes
of floating roof tanks. The bund fire frequencies are assumed applicable to all types of
tanks.
For fixed roof tanks, the best available estimate is from a Technica study for tank
operators in Singapore [3]. For explosions in fixed roof tanks, the ratio of fires and
explosions in world-wide event data has been used. For tanks with both fixed and
internal floating roof, the frequencies of appropriate fire/explosion types have been
selected from the other tank types. For catastrophic ruptures, an estimate based on US
petroleum industry experience has been used, which is consistent with the absence of
ruptures in the LASTFIRE data.
Comparison of sources for atmospheric tank leak frequency data suggests that the
uncertainty in these values could be represented by a range of at least a factor of 10
higher or lower.
For fixed roof tanks, the Singapore study [3] and API [5] give values in the range
1.8 × 10-4 to 3.0 × 10-4 per tank year. The Singapore data is considered to be
comprehensive and is more recent, so the value of 1.8 × 10-4 per tank year is adopted
here. The full surface fire frequency is 50% of this, i.e. 9 × 10-5 per tank year.
For tanks with fixed plus internal floating roof, the fire frequency might be expected to
be lower than for the other designs. However, these tend to be used for more highly
flammable products, so this may offset any reduction in the average fire frequency. In
the absence of better information, it is assumed that the frequency of rim seal fires is as
for open-top floating roof tanks, while the frequency of full-surface fires is as for fixed
roof tanks.
Explosions may occur inside fixed roof tanks if flammable vapour is ignited. If the tank
contains liquid, this is likely to result in a full-surface fire. If the tank is empty but not
gas free, there may be no further fire, although the event may be fatal for people inside
the tank at the time (e.g. 2 events described in [6]). Explosions inside fixed roof tanks
may produce debris that damages adjacent tanks (e.g. Romeoville, 24 September 1977).
Floating roof tanks are designed to eliminate flammable vapour within the tank, but in
principle explosions may also occur:
• Inside the tank when empty, while the roof is supported on legs above the tank base.
However, no such incidents are known.
8 ©OGP
• Above the roof but inside the shell, if vapour leaks past the floating roof. In an open-
top tank, this is expected to produce a flash fire rather than an explosion, if ignited.
However, such explosions may occur in tanks with fixed plus internal floating roof.
• Outside the tank area, if vapour drifts into a confined space before ignition occurs.
However, this should be modelled in the risk analysis as a tank leak.
No previous estimate of explosion frequency is available for storage tanks. Most
reports of explosions are derived from press accounts (e.g. MHIDAS), which do not
identify the type of tank involved. They also refer to world-wide experience, for which
the tank population is not known.
LASTFIRE [4] gives no cases of explosions in 33,906 tank years for open-top floating-
roof tanks. Making the common assumption that this is equivalent to “0.7 explosions to
date”, the frequency is assumed to be 2 × 10-5 per tank year. This may be conservative,
as it is similar to the frequency for tanks with fixed plus internal floating roof estimated
below.
Technica [3] analysed 122 tank fires from MHIDAS, in which 2% were initiated by
explosions. A total of about 22% of these incidents were recorded as involving
explosions. It is not known how many of these were in fixed or floating roof tanks.
These would be included in the fire frequencies above.
DNV [7] analysed MHIDAS reports of fires on crude oil tanks, in which 19 out of 92 were
reported as explosions followed by fires. This suggests that as many as 20% of fires
may begin with explosion-like events. It is not known how many of these were in fixed
or floating roof tanks.
Failure experience for fires/explosions where there is definite information about the roof
type and ignition consequences indicate that in tanks without an internal floating roof,
all full surface fires began with explosions. In addition, there were 3 explosions that did
not result in fires in the tank. Based on the frequency of 9 × 10-5 per year adopted above
for full surface fires, this suggests an additional frequency of 2.5 × 10-5 per year for
explosions without fires.
In tanks with an internal floating roof, there has been one incident of a full-surface fire
with no report of any preceding explosion. However, this event has little practical
significance for risk analysis. There is insufficient information to give a ratio of fires
and explosions significantly different to that estimated above for open top floating roof
tanks.
4.1.2 Overfilling
The main causes of liquid spill onto the roof were roof fracture and overfill. The
LASTFIRE report suggests that 19% of all leaks outside of a storage tanks were caused
by overfilling. There are a large number of variables involved in the mechanism for
overfill. It is therefore recommended that to model overfill effectively would require
detailed analysis using fault tree techniques.
©OGP 9
4.2 Refrigerated Storage Tanks

There have been several estimates of the failure frequency for refrigerated storage
tanks, addressing different tank designs. Historical data is mainly influenced by single
wall tanks. The Second Canvey Study [8] addressed double-wall LNG tanks; the COVO
study [9] addressed double integrity tanks; and IPO [10] further addressed double and
full containment tanks. No single study is superior in all respects. All these sources
and available historical data have been reviewed to produce a consistent set of
estimates of frequencies of catastrophic rupture for different designs of refrigerated
storage tanks.
4.2.1 Selection of Generic Value for Refrigerated Storage Tanks

During the last 30 years, there have been only 2 spontaneous catastrophic ruptures of
large refrigerated tanks although this might rise to 3 if the small tank at Varennes was
included and to 4 if the escalation event at Guayaquil was included.
The world-wide population of refrigerated storage tanks is not known with any
precision, although it has been estimated as approximately 2000 tanks. This would give
a historical catastrophic rupture frequency of 2/(2000 × 30) = 3 × 10-5 per tank year. This
would be 6 × 10-5 per tank year if the small tank and escalation events were included.
This approach is very uncertain, and the applicability of the failure modes in the
historical events to modern tank designs is unclear. Nevertheless, it does indicate that
rupture frequencies as low as 10-6 per tank year would be very difficult to justify when
compared to actual accident experience.
16 leaks from refrigerated storage tanks have been reported during the period 1965-95.
The total number of liquid leaks may be lower, since some of these may have been
vapour leaks, but this may be offset if some events have been omitted from MHIDAS.
Using this value, an overall leak frequency is 16 / (2000 × 30) = 2.7 × 10-4 per tank year.
Excluding ruptures and escalation events, this becomes 2.1 × 10-4 per tank year. These
leaks were mainly small.
A number of sources were reviewed in estimating the generic values for refrigerated
storage. These include:
• First Canvey Report [11]
• BG Estimate [12, 13, 14]
• Second Canvey Report [8]
• SRD LPG Study
• LA LNG Study
• COVO Study [9]
• GRI Data
• IPO Values [10]
None of the above analyses are superior in all respects. The BG estimate is based on
the most extensive engineering investigation of failure modes, but it appears to neglect
some failure modes (e.g. aircraft impacts) and is strongly influenced by judgement. The
estimate based on historical failure experience automatically includes all failure modes,
but some may not be applicable to modern tanks, and both the failure experience and
the tank exposure estimates may be inaccurate.
The values from the Second Canvey Report are between the BG and historical estimates
above. They also have the merit of having been used in a well-known public-domain
QRA. They are therefore adopted as cautious best estimates. The BG and historical
10 ©OGP
estimates could be used as optimistic and pessimistic sensitivity tests respectively.

The IPO values could be used as a more optimistic sensitivity test.
There have been no formal considerations of the effects of tank design on failure
frequencies. With the exception of the IPO study, each of the studies referenced above
addresses a different type of tank, so frequencies cannot be compared.
The historical data is probably dominated by single-wall ammonia tanks, and hence the
catastrophic failure frequency of 3 × 10-5 is appropriate for them. The Canvey studies
related to double-wall LNG tanks, and hence the value of 7.3 × 10-6 is appropriate for
them. The difference is a factor of 4, which seems subjectively realistic. This can be
compared to the difference of a factor of 10 assumed in the LA LNG study.
The effect of double integrity tanks would be to reduce the frequency further. The
COVO value [9] of 1 × 10-6 may be appropriate for this, i.e. a further reduction by a factor
of 7.
Double containment tanks have the same frequencies, but these apply to releases into
the middle space. The further probability of release beyond the secondary containment
depends on the likelihood of common cause failures. The IPO judgements suggest a
probability of 0.25.
Full containment tanks do reduce the frequencies of release further. The IPO
judgements suggest a frequency of 1 × 10-8 may be appropriate for them, i.e. a further
reduction by a factor of 100 compared to double integrity tanks.
4.3 Pressurised Storage Vessels

4.3.1 Accident Source Data
Lees [1] lists several major accidents involving large storage vessels including:
• Ruptures, BLEVEs and leaks of LPG tanks, including the well known Feyzin and
Mexico City disasters.
• The rupture of an ammonia tank at Potchefstroom, South Africa, 13 July 1973, that
caused 18 fatalities.
• A leak from a chlorine tank, Baton Rouge, Louisiana, USA, 10 December 1976. There
were no fatalities but 10,000 people were evacuated.
Major accidents involving medium storage vessels listed by Lees [1] include:
• Leak from of LPG tank, Wealdstone, Middlesex, UK, 20 November 1980.
• Leak of MIC from tank, Bhopal, India, 3 December 1984. A 46 m3 refrigerated
stainless steel pressure vessel containing methyl isocyanate (MIC) suffered a
release through the relief valve. The release may have been due to entry of water
causing an exothermic reaction that increased the temperature and pressure until
the relief valve lifted. The cloud of toxic gas caused approximately 2000 fatalities
among nearby residents.
• Rupture of a CO2 tank, Worms, Germany, 21 November 1988.
• Rupture of an ammonia tank, Dakar, Senegal, March 1992, causing 41 fatalities.
Gould [15] lists 16 failures of chlorine tanks in the range 4 to 30 tonnes.
©OGP 11
4.3.1.1 Additional Source Data for BLEVEs

In the UK, only one BLEVE of a fixed LPG vessel is known (a domestic vessel of less
than 1 tonne capacity, at Kings Ripton in 1988) in a population of approximately 925,000
vessel years up to 1989 [16]. This indicates a BLEVE frequency of 1 × 10-6 per vessel
year. An earlier published estimate was 3 × 10-6 per vessel year [17]. Using the
population of 132,000 vessels in 1991 [18] allows the exposure up to the end of 1998 to
be estimated as 2,113,000 vessel years, giving a frequency of 5 × 10-7 per vessel year.
Since 98% of the exposure relates to vessels under 5 tonnes capacity, this is
appropriate for medium storage vessels.
4.3.2 Selection of Generic Value for Pressurised Storage Vessels

The best available source of leak frequencies for hydrocarbon process pressure vessels
is provided by the HSE hydrocarbon release database [19].
In the absence of any collection of data on leak frequencies from storage vessels
(spheres and bullet tanks), available analyses indicate that these are not significantly
different to the leak frequencies from steam boilers [20]. This source does not give a
leak size distribution, but it gives frequencies a factor of 100 lower than estimated above
for process vessels, and therefore this factor has been applied to the process vessel
size distribution.
Available estimates of leak frequencies from small containers (drums and cylinders) for
liquefied gases indicate leak frequencies a further factor of 50 lower than for steam
boilers.
Comparison of the above estimates of leak frequencies for large pressure vessels
suggests both the overall leak frequencies and the rupture frequencies range over 4
orders of magnitude.
Pressure vessel design and inspection involves extensive effort to avoid catastrophic
cold rupture. Some studies have argued that such events are not possible. Fracture
mechanics analysis [21] has indicated that under normal circumstances defects in a
stress-relieved vessel will cause a leak rather than a catastrophic failure. For vessels
that are not stress-relieved, critical crack lengths could be so short that a leak-before-
break condition can be excluded.
A realistic leak size distribution might therefore use a continuous function up to the size
of the largest connecting pipe, together with a rupture probability. However, for
modelling purposes, the catastrophic rupture of the vessel will need to be represented
in a different way to a rupture the size of the connecting pipe.
For large/medium storage vessels, there is no high-quality data on leak frequency. Most
studies have used data on steam boilers, which is of questionable relevance, although
Davenport [20] shows no significant difference in the frequencies. Nevertheless, its use
is only justifiable in the absence of better data. Gould [15] considered that the air
receiver data from [20] was more appropriate for storage vessels, due to the absence of
temperature cycling. Arulanantham & Lees [22] show a leak frequency for storage
vessels that is not significantly different to that for process vessels, but this is not
supported by other sources.
Several judgmental reviews of data applied to LPG storage vessels [9,23,24,25] give leak
frequencies in the range 5 × 10-6 to 6 × 10-5 per vessel year. These appear to be based
on Davenport [20]. None are particularly authoritative. These judgements could be
represented by a size distribution 100 times lower than the HSE offshore data. This
would be a leak frequency of 5 × 10-5 per vessel year and a rupture frequency of 5 × 10-7
per year.
12 ©OGP
The published estimate of rupture frequency of 2.7 × 10-8 by Sooby & Tolchard [18] is as
yet unsupported by any collection of failure data. It is a factor of 20 below that
proposed above, and is considered suitable for a sensitivity test.
Similar leak frequencies have been observed for process vessels in the onshore
process industry [22] and the offshore industry (OREDA and HSE). It is therefore
assumed that otherwise similar pressure vessels in different industries have
approximately the same leak frequencies.
4.3.2.1 BLEVE Data

There were at least 25 large storage spheres world-wide subjected to fire impingement
during 1955-87, of which 12 were destroyed by BLEVE, leading to a BLEVE frequency of
approximately 10-5 per vessel year [27]. This value does not take account of design
improvements that resulted from these events. Few BLEVEs of storage vessels have
been reported since 1984. Therefore the current frequency should be lower.
The likelihood of a BLEVE on a given tank depends on its fire protection measures and
the site layout. This is best addressed using a fault tree approach, combined with
modelling of possible fire scenarios and their impact on the tank.
4.4 Oil Storage on FPSOs

A 1990 study [33] obtained a frequency of fires/explosions on oil tankers over 6000 GRT
of 2.2 × 10-3 per year from IMO data [34] for the period 1982-86. This frequency was
adjusted assuming the COT fire frequency is related to the number of tanks, and hence
the tanker frequency was reduced by 50% (6 tanks on FPSO compared with typically 12
on tankers.) A further 20% reduction was applied to reflect the historical trend in risk
between 1972 and 1986 to obtain a frequency of 8.8 × 10-4 per year for cargo tank
fires/explosions on FPSOs.
Based on data in [32], there have been no fire/explosion incidents on FPSOs operating
in UKCS up to 2005. There have been 2 incidents involving cargo tanks. One involved
overfilling and the other involved dropping liquid nitrogen onto the deck (above a tank),
which consequently cracked; both of these can be considered to be due to human error.
In neither case was there ignition. There have been no incidents of FPSO cargo oil tank
failure up to 2005 [32] other than due to human error.
4.5 Non-process Hydrocarbon Storage Offshore

The main source of data on non-process fires is the WOAD database [28]. It includes
802 fire/explosion events up to 1996, of which 516 did not involve a hydrocarbon leak
and hence were probably non-process fires. Most of these were recently reported
events in the Norwegian Sector, where reporting standards are highest. Since WOAD
relies on public domain reports, classification into process and non-process fires may
be imprecise.
The HSE hydrocarbon release database includes 117 leaks involving non-process
hydrocarbons in the UK Sector during 1992-97, 43 of which ignited. The published
report [29] includes system populations and leak frequencies for different utilities
systems.
The installation names and incident dates are not available, and hence this data is
impossible to combine with the WOAD data. The HSE offshore accident and incident
©OGP 13
statistics reports (e.g. [30]) include numbers of fires/explosions, but do not provide any
information to distinguish process and non-process fires.
4.5.1 Methanol
In [29] methanol leaks may be included under several systems. Although leak size
distributions are included, there is insufficient leak experience to give smooth
distributions.
Calculating methanol leak frequencies is awkward because the systems in the HSE
database include both methanol and other fluids. For flow lines and manifolds, the
systems are dedicated to a single product, but the population data includes condensate
lines.
Therefore the frequency should use the total number of leaks. This assumes that the
frequencies are the same for methanol and condensate. For process systems, both
methanol and other lines are included in all systems. Therefore the frequency should
use only the methanol leaks, and leaks from the oil and gas lines should be included
under process leaks.
An alternative approach is to use generic equipment leak frequencies. For example, the
tank leak frequency could be based on the pressure vessel value of 1.5 × 10-4 per year.
In the HSE database, none of the 12 methanol leaks during 1992-97 were from methanol
tanks. Methanol leaks might occur due to over-filling of the tank, and a fault tree
analysis could be made of this, taking account of the filling frequency and the tank’s
high-level and high-pressure trips. A further contribution to the failure frequency might
arise from escalation of other events near to the tank. The deluge system should be
adequate to cover the whole tank evenly as well as the tank supports, to prevent
collapse of the tank in a fire.
The data presented in Table 2.5 is a “system” leak frequency combining a tank leak
frequency distribution and a pipe work leak. The total number of leaks from a methanol
system is taken from [31] and set at 1.3 × 10-2 per system year.
Using data from [29] the overall contribution from tank leaks is 2.6 × 10-3 per tank year.
The rupture frequency is 3.0 × 10-5 per yr and the remaining small, medium and large
tank leak frequencies are calculated based on a continuous leak frequency function.
The contribution from pipework, pumps and flanges is calculated by dividing the
remaining leak frequency (system - tank) between Small (75%), Medium (15%) and Large
(10%) releases.
4.5.2 Diesel
In [29] diesel leaks may be included under several systems. Although leak size
distributions are included, there is insufficient leak experience to give smooth
distributions.
Calculating diesel leak frequencies from these is awkward because the systems in the
HSE database include both diesel and other fluids. The HSE use the 31 leaks
categorised as “utilities, oil, diesel” and an exposure 1511 diesel utilities systems, to
give a frequency of 2.1 × 10-2 per system year. However, this omits diesel leaks from
other systems. An alternative approach would be to divide the total of 52 leaks by the
1511 diesel utilities systems, to give a frequency of 3.4 × 10-2 per system year.
An alternative approach is to use generic equipment leak frequencies. For example, the
tank leak frequency could be based on the pressure vessel value of 1.5 × 10-4 per year.
14 ©OGP
In the HSE database, 5 of the 52 diesel leaks during 1992-97 were from tanks and one
was from a pressure vessel. Assuming that each of the diesel systems had one tank,
these 6 leaks in 1511 system-years would give a frequency of 4 × 10-3 per tank year.
The data presented in Table 2.6 have been calculated using a similar approach to that
used for methanol leaks. The total number of leaks from a diesel system is taken from
[31] and set at 3.4 × 10-2 per year. However, this frequency includes oil export and well
systems. Eliminating leaks involving these systems gives a system leak frequency of
3.0 × 10-2 per year.
Using data from [29] the overall contribution from tank leaks is 2.6 × 10-3 per tank year.
The rupture frequency is 3.0 × 10-5 per year and the remaining small, medium and large
tank leak frequencies are calculated based on a continuous leak frequency function.
The contribution from pipework, pumps and flanges is calculated by dividing the
remaining leak frequency (system - tank) between Small (75%), Medium (15%) and Large
(10%) releases.
5.0 Recommended Data Sources for Further Information

6.0 References
The principal source references are shown in bold.
1. Lees, F.P. 1996. Loss Prevention in the Process Industries, 2nd. ed., Oxford:
Butterworth-Heinemann.
2. BS EN 1473: 1997. Installation and equipment of liquefied natural gas – Design of
onshore installations.
3. Technica 1990. Atmospheric Storage Tank Study, Confidential Report for
Oil & Petrochem ical Industries Technical and Safety Com m ittee,
Singapore, Project No. C1998.
4. LASTFIRE 1997. Large Atmospheric Storage Tank Fires - A Joint Oil
Industry Project to Review the Fire Related Risks of Large Open-Top
Floating Roof Storage Tanks.
5. API 1998. Interim Study - Prevention and Suppression of Fires in Large
Aboveground Atmospheric Storage Tanks, Am erican Petroleum Institute
Publication 2021A.
6. DNV 1997. Fires and Explosions in Atmospheric Fixed Roof Storage Tanks, Confidential
Report for Oil Refineries Ltd, Project No. C8263.
7. DNV 1998. HAZOP Study and Risk Assessment of Venezia Refinery, Confidential
Report for AgipPetroli SpA, Project No. C383005.
8. HSE 1981. Canvey - A Second Report - An Investigation of Potential Hazards
from Operations in the Canvey Island/Thurrock Area 3 years After
Publication of the Canvey Report, Health & Safety Executive, London:
HMSO.
9. Rijnm ond Public Authority 1982. A Risk Analysis of Six Potentially
Hazardous Industrial Objects in the Rijnmond Area - A Pilot Study, (the
“COVO Study”), Dordrecht: D. Reidel Publishing Co.
©OGP 15
10. IPO 1994. Handleiding voor het opstellen en beoordelen van een extern
veiligheidsrapport, Interprovinciaal Overleg.
11. HSE 1978. Canvey – An Investigation of Potential Hazards from Operations in the Canvey
Island/Thurrock Area, Health & Safety Executive, London: HMSO.
12. British Gas 1979. Further Studies on the Integrity and Modes of Failure of Canvey Above
Ground Storage Tanks, British Gas Engineering Research Station Report ERS R1983.
13. British Gas 1981a. The Hazard of Rollover – Canvey Terminal Above Ground Storage
Tanks, British Gas Fundamental Studies Group Report FST 812.
14. British Gas 1981b. An Assessment of the Probability of Unintentionally Filling to the Roof
an Above Ground LNG Storage Tank at the Canvey Island Methane Terminal.
15. Gould, J. 1993. Fault Tree Analysis of the Catastrophic Failure of Bulk Chlorine Vessels,
AEA Technology, Report SRD/HSE/R603, London: HMSO.
16. ACDS 1991.
17. Blything, K.W. & Reeves, A.B. 1988. An Initial Prediction of the BLEVE Frequency of a
100 Tonne Butane Storage Vessel, SRD Report R488.
18. Sooby, W. & Tolchard, J.M. 1993. Estimation of Cold Failure Frequency of LPG
Tanks in Europe”, Conference on Risk & Safety Management in the Gas Industry, Hong
Kong.
19. HSE 2000. Offshore Hydrocarbon Releases Statistics 1999, Offshore
Technology Report OTO 1999 079, Health & Safety Executive, London:
HMSO.
20. Davenport, T.J. 1991. A Further Survey of Pressure Vessel Failures in the UK,
Reliability 91, London.
21. Smith, T.A. 1986. An Analysis of a 100 te Propane Storage Vesse”, UKAEA Safety and
Reliability Directorate Report SRD R314.
22. Arulanatham, D.C. & Lees, F.P. 1981. Some Data on the Reliability of Pressure
Equipment in the Chemical Plant Environment, Int. J. Pres. Ves & Piping 9 327-338.
23. Crossthwaite, P.J., Fitzpatrick, R.D. & Hurst, N.W. 1988. Risk Assessment for the
Siting of Developments near Liquefied Petroleum Gas Installations, IChemE Symp.
Ser. 110.
24. Pape, R.P. and Nussey, C. 1985. A Basic Approach for the Analysis of Risks From
Major Toxic Hazards, Assessment and Control of Major Hazards, EFCE event no. 322,
Manchester, UK, IChemE Symp. Ser. 93, 367-388.
25. Whittle, K. 1993. LPG Installation Design and General Risk Assessment
Methodology Employed by the Gas Standards Office, Conference on Risk & Safety
Management in the Gas Industry, Hong Kong, October.
26. Reeves, A.B., Minah, F.C. & Chow, V.H.K. 1997. Quantitative Risk Assessment
Methodology for LPG Installations, EMSD Symposium on Risk and Safety Management
in the Gas Industry, Hong Kong, March.
27. Selway, M. 1988, The Predicted BLEVE Frequency of a Selected 200 m3 Butane Sphere
on a Refinery Site, SRD Report R492.
28. W OAD. W orld Offshore Accident Database, DNV.
29. HSE (1997a): Offshore Hydrocarbon Release Statistics, 1997, Offshore
Technology Report OTO 97 950, Health & Safety Executive.
16 ©OGP
30. HSE (1997b): Offshore Accident and Incident Statistics Report, 1997,
Offshore Technology Report OTO 97 951, Health & Safety Executive.
31. Spouge, J R 1999. A Guide to Quantitative Risk Assessment for Offshore
Installations, Publication No. 99/100, ISBN 1 870553 365, London: CMPT.
32. Det Norkse Veritas 2007. Accident statistics for floating offshore units on the UK
Continental Shelf 1980-2005, Research Report RR567, Health & Safety Executive.
33. Technica, 1990. Port Risks in Great Britain from Marine Transport of Dangerous
Substances in Bulk: A Risk Assessment, Report for The Health & Safety Executive,
Project No. C1216.
34. IMO, 1987. Casualty Statistics, Report of the Steering Group, Annexes 1 – 3 (Analyses of
Casualties to Tankers, 1972-1986), MSC 54/INf 6, 26.
©OGP 17

March 2010
Riser &
pipeline
release
frequencies
RADD – Riser & pipeline release frequencies
contents
1.1 Application ...................................................................................................... 1
1.2 Definitions ....................................................................................................... 1
3.2 Uncertainties ................................................................................................... 3
3.3 Application of frequencies to specific pipelines ......................................... 3
3.3.1 Offshore pipelines...................................................................................................... 4
3.3.2 Onshore pipelines ...................................................................................................... 6
3.4 Application to pipelines conveying fluids other than hydrocarbons ........ 6
4.1.1 Risers and offshore pipelines ................................................................................... 6
4.1.2 Onshore gas pipelines............................................................................................... 8
4.1.3 Onshore oil pipelines................................................................................................. 9
6.0 References .......................................................................... 11
6.2 References for other data sources.............................................................. 11
©OGP 1
Abbreviations:
AGA American Gas Association
ANSI American National Standards Institute
ASME American Society of Mechanical Engineers
CONCAWE Conservation of Clean Air and Water in Europe
DOT (US) Department of Transportation
EGIG European Gas Pipeline Incident Data Group
ESDV Emergency Shutdown Valve
PARLOC Pipeline And Riser Loss Of Containment
UK HSE United Kingdom Health and Safety Executive
UKOPA United Kingdom Pipeline Operators’ Association
VIV Vortex Induced Vibration
2 ©OGP

1.1 Application
This datasheet presents (Section 2.0) frequencies of riser and pipeline releases.
Frequencies for offshore and onshore pipelines are included.
The frequencies given are based on analysis for pipelines conveying hydrocarbons.
They may be applied to pipelines conveying other fluids as discussed in Section 3.4.
1.2 Definitions
The pipeline frequencies are given for four different sections as shown in Figure 1.1.
Risers are considered to comprise three sections:
• Above water (often taken to be the topsides section below the riser ESDV)
• Splash zone (exposed to aggressive corrosion conditions and ship collisions)
• Below water (to the flange connection with the pipeline or a spool piece)
Figure 1.1 Definition of Pipeline Sections
For offshore sections, frequencies are given for steel and flexible risers and pipelines.
“Flexible” should be understood in the context of the source data (see Section 4.1.1),
which is from the North Sea. It therefore includes risers from FPSOs, TLPs and
semisubmersibles but would not include deepwater technologies such as steel catenary
risers. These are a specialist and relatively new area, and the failure frequency analysis
should accordingly be undertaken utilising suitable expertise.
©OGP 1

The recommended frequencies and associated data are presented as follows:
• Table 2.1 Recommended Riser and Pipelines failure Frequencies
• Table 2.2 Recommended Hole Size Distributions for Risers and Pipelines
• Table 2.3 Release Location Distribution for Risers
Note that separate failure frequencies are not given for Segment III, Landfall zone. This
segment, representing the tidal zone, is defined as the area where the pipeline may be
wet and dry at different times. This allows the anode system to function. Onshore
pipelines are often more affected by corrosion than pipelines in the tidal zone. Hence
frequencies for onshore pipelines should be used in tidal zones. A pipeline in the
landfall zone may also be subject to increased risk of external impact, e.g. due to
grounding ships. Such risks may have to be assessed separately.
Table 2.1 Recom m ended Riser and Pipelines failure Frequencies
Pipeline Category Failure Unit

frequency
-4
Subsea pipeline: Well stream pipeline and other 5.0 × 10 per km-year
in open sea small pipelines containing
unprocessed fluid
-5
Processed oil or gas, pipeline 5.1 × 10 per km-year
diameter ≤ 24 inch
-5
Processed oil or gas, pipeline 1.4 × 10 per km-year
diameter > 24 inch
-4
Subsea pipeline: Diameter ≤ 16 inch 7.9 × 10 per year
external loads causing -4
damage in safety zone Diameter > 16 inch 1.9 × 10 per year
-3
Flexible pipelines: All 2.3 × 10 per km-year
subsea
-4
Risers Steel - diameter ≤ 16 inch 9.1 × 10 per year
-4
Steel – diameter > 16 inch 1.2 × 10 per year
-3
Flexible 6.0 × 10 per year
-3
Oil pipelines onshore Diameter < 8 inch 1.0 × 10 per km-year
-4
8 inch ≤ diameter ≤ 14 inch 8.0 × 10 per km-year
-4
-4
-4
Diameter > 28 inch 2.5 × 10 per km-year
-4
Gas pipelines onshore Wall thickness ≤ 5 mm 4.0 × 10 per km-year
-4
5 mm < wall thickness ≤ 10 mm 1.7 × 10 per km-year
-5
10 mm < wall thickness ≤ 15 8.1 × 10 per km-year
mm
-5
Wall thickness > 15 mm 4.1 × 10 per km-year
2 ©OGP
Table 2.2 Recom m ended Hole Size Distributions for Risers and Pipelines
Hole size Subsea Onshore pipeline Riser

pipeline Gas Oil
Small (< 20 mm) 74% 50% 23% 60%
Medium (20 to 80 mm) 16% 18% 33% 15%
Large (> 80 mm) 2% 18% 15%
25%
Full rupture 8% 14% 29%
Table 2.3 Release Location Distribution for Risers
Release location Distribution

Above water 20%
Splash zone 50%
Subsea 30%

The frequencies given are based on analysis for pipelines conveying hydrocarbons.
They may be applied to pipelines conveying other fluids as discussed in Section 3.4.
There is an implicit assumption that the pipelines are built to a recognized international
standard such as ANSI/ASME B31.4/8 [1,2] or (for subsea pipelines) DNV-OS-F101 [3].
3.2 Uncertainties
In addition to the known causes of fluid release from transport pipelines, as discussed
in Section 4.0, new or unforeseen factors may cause shutdown of pipelines. It is
impossible to estimate the contribution from such incidents to the release frequencies,
neither is it possible to state that it is more likely that some pipelines will sustain failure
before others. Accordingly, unknown factors cannot be used either to identify pipelines
which are especially exposed to the possibility of leakage or to prioritize risk mitigation
measures.
3.3 Application of frequencies to specific pipelines

In Table 2.1, most frequencies are given per km-year as they are dependent on the
length of the pipeline. For a typical pipeline of length ℓ (km) with release frequency fkm,
the release frequency F along the full length of the pipeline is simply given by:
F = ℓ × fkm per year:
There are several causes that can result in the release frequency for a specific pipeline,
or for a section of a pipeline, being different from that obtained simply using the Section
2.0 frequencies.
©OGP 3
In general there are two main groups of causes causing pipeline failures. The first
group is related to loads exceeding pipeline critical loads, usually resulting in an
isolated incident. The second group is related to effects gradually weakening the
pipeline over a period of time. Those considered here are:
Isolated incidents – offshore Mechanisms acting over time – offshore
• Loads from trawl boards • Corrosion
• Ship anchor / sinking ship • Open spans causing fatigue
• Subsea landslide • Buckling
Isolated incidents – onshore Mechanisms acting over time – onshore
• External interference e.g. digging • Construction defect
• Hot-tap made by error • Material failure
• Ground movement e.g. landslide • Ground movement e.g. mining
• Corrosion
These are discussed further in Sections 3.3.1 (offshore pipelines) and 3.3.2 (onshore
pipelines), with some guidance given on modifying the Section 2.0 frequencies.
However, in situations where several of these causes pertain or critical decisions are
dependent on the analysis results, a detailed analysis should be carried out utilising
appropriate expertise and data specific to the situation. Such analysis is beyond the
scope of this datasheet.
3.3.1 Offshore pipelines
Where none of the additional causes listed in Section 3.3 that could exacerbate the
likelihood of a release are present, the release frequency can be reduced by 50%.
On pipeline sections where loads from trawl boards pose a threat, it is suggested that
frequencies could be up to a factor of 5 higher (see Section 3.3.1.1).
On pipeline sections where the other causes pose a threat, it is suggested that
frequencies could be up to a factor of 2 higher (see Sections 3.3.1.2 to 3.3.1.5).
3.3.1.1 Loads from trawl boards

Pipelines located in areas where trawling activity takes place may be damaged.
Pipelines are normally dimensioned to withstand loads from a trawl, such as impacts,
overdraw1 or hook up2. The pipe wall is normally covered by a concrete coating giving
protection against local impact loads to the pipeline, and it gives the pipeline the
necessary weight to gain stability.
Overdraw and hook ups can initiate buckling of the pipeline. Free spans will exacerbate
the effect of trawl impacts.
A trawl can also catch other equipments such as exposed flanges and bolts, and a trawl
hook up may cause pipeline fracture on smaller pipelines.
1
Overdraw is a situation where the trawl board comes in under the pipeline and is drawn over
applying force sideways.
2
Hook up is a situation where the trawl board gets stuck beneath the pipeline. The pipeline may
be damaged if the vessel tries to bring in the trawl.
4 ©OGP
Trawling with lump weights is a relatively new practice and consequently most pipelines
are not designed to tackle such loads. Even though no serious damage due to lump
weights has yet been registered, it is still uncertain what consequences boom trawl and
lump weights may cause.
3.3.1.2 Ship anchor / impact from sinking ships

Pipelines located in areas with shipping traffic may be damaged by anchors getting hold
of the pipeline, or a sinking ship hitting the line. The relevant factors include shipping
traffic density, distance from shore or port, water depth, vessel traffic surveillance.
3.3.1.3 Material left behind from war years

If a pipeline is laid through coastal areas that were mined during war years, there may
still be material present that poses a threat to the pipeline even if these areas were
cleared before installation of the pipeline.
3.3.1.4 Fatigue (mainly due to free spans)

Free spans can result in fatigue if the span is excited by current, and the pipeline can
fracture relatively quickly. Some spans develop as the soil beneath the pipeline is
washed away, and an already existing span may evolve quickly since the free spans
influence local currents near the pipeline.
Only one example, from China, is known to be caused by free spans. The incident was
caused by extreme climatic conditions (2 following cyclones) and the free span was
longer than what the pipeline was designed for. Vortex Induced Vibration (VIV) has
caused leakages in the past, but today’s pipelines are designed to resist the associated
stress.
3.3.1.5 Buckling
Buckling (bends) may occur if the pipeline is prevented from extension forced by
pressure tension in the axial direction. This can cause buckling sideways or upwards.
Some pipelines are designed to allow for a controlled buckling to relieve axial tension. It
is important that the buckling takes place over a long distance. In extremely
disadvantaged situations, when the buckling is very local, great strain may be placed on
the pipeline. The consequence may be pipeline leakage and subsequent replacement.
Buckling will normally occur during the first years of operation when temperatures are
at their highest, but may occur if operational conditions are changed, new connections
of pipeline or new compressor stations.
3.3.1.6 Material damage/failures

If there are indications of pipelines being especially exposed to a specific type of failure,
then corrections should be made utilising suitable engineering expertise. Typical
correction factors would be in the range 2 to 3, applied to the contribution from the
specific failure mechanism affected; expert engineering judgment should be used to
determine a suitable factor.
©OGP 5
3.3.1.7 Fluid medium

Both wet and dry gas should be properly processed to avoid corrosion or keep
corrosion under control. For example, control and monitoring techniques of the
pipelines operated by Norwegian companies is considered to be so good that wet gas
pipelines do not have a higher probability of corrosion than the dry gas pipelines. The
same applies to processed gas. Hence in general no correction need be applied for
fluid medium. However, if it is known that the control techniques in place or planned do
not meet current best practice, then a correction should be made in the same way as
described for material damage/failures (Section 3.3.1.6).
3.3.2 Onshore pipelines

The EGIG and CONCAWE reports [7,8] give breakdowns of release frequencies by cause
and release size. These are partially reproduced in Sections 4.1.2 (gas pipelines) and
4.1.3 (oil pipelines), and further data are available in the EGIG and CONCAWE reports.
These sources of information could be used to obtain more location specific estimates
of the release frequencies. However, in situations where several of these causes pertain
or critical decisions are dependent on the analysis results, a detailed analysis should be
carried out utilising appropriate expertise and data specific to the situation. Such
analysis is beyond the scope of this datasheet.
3.4 Application to pipelines conveying fluids other than hydrocarbons

Certain non hydrocarbon fluids can increase the likelihood of failure through specific
mechanisms. For example, under certain circumstances ammonia may cause stress
corrosion cracking, increasing the contributions from internal and external corrosion.
In the first European Benchmark Study, DNV [5] estimated a factor-of-3 increase in these
contributions to the overall failure frequency. As already discussed in Section 3.3.1, the
factor should be estimated using expert engineering judgment.

4.1.1 Risers and offshore pipelines
The frequencies and distributions presented in Section 2.0 for risers and offshore
pipelines are derived from DNV’s re-analysis [6] of the data presented in PARLOC 2001
[4]. The re-analysis was performed because of recognised errors in the frequencies
given in PARLOC 2001 itself.
Table 4.1 presents the data used as the basis of the analysis.
Allocation of failures to failure mechanisms vary according to source. Table 4.2
indicates how much different mechanisms contribute to the overall failure frequency.
This can be used to determine how specific features of the pipeline design may affect
the frequency. Section 3.3 provides some general guidance that is not dependent on
failure mechanism. Expert judgment should be used where the likelihood of failure by a
specific mechanism is affected by specific features of the pipeline design (see Section
3.3.1).
6 ©OGP
Table 4.1 Incident and Population Data for Offshore Pipelines from [4]
Pipeline description No. of Exposure time

releases
Well stream pipelines and other
small pipelines containing 60033 km-years
30
unprocessed fluid, diameter ≤ 16 10576 pipe-years
inch
Well stream pipelines and other
36925 km-years
small pipelines containing
3 (pipe-years not
unprocessed fluid, diameter > 16
available)
inch
Processed oil or gas pipeline, 59003 km-years
3
diameter ≤ 24 inch 4320 pipe-years
Processed oil or gas pipeline, 147608 km-years
2
diameter > 24 inch 2949 pipe-years
External load causing pipeline
1 7 8836 years
damage , diameter ≤ 24 inch
External load causing pipeline 2
1 0.7 3734 years
damage , diameter > 24 inch
Steel riser, diameter< 16 inch 10 10979 riser-years
Flexible pipeline 3447 km-years
11
3898 pipe-years
2
Steel riser, diameter > 16 inch 0.7 5937 riser-years
Flexible riser 5 5 riser-years
Notes
1. Applies to near platform zone
2. No releases to date; estimate using standard statistical techniques.
Table 4.2: Allocation of Failure Mechanism s from [4]: Offshore Pipelines,

All Diam eters
Failure mechanism Distribution

Corrosion 36%
Material 13%
External loads causing damage 38%
Construction damage 2%
Other 11%
Note: This is a summary. The distribution varies between
hole sizes. For further information refer to the source
report [4].
Table 4.3: Hole Size Distribution for Offshore Pipelines from [4]
Hole size Number of releases

Pipelines Risers
Small (< 20 mm) 37 9
Medium (20 to 80 mm) 8 2
Large (> 80 mm) 1 4
©OGP 7
Full rupture 4
Total 50 15
4.1.2 Onshore gas pipelines

The frequencies presented in Section 2.0 for onshore gas pipelines are based on data
from EGIG’s most recently available report [7]. The EGIG database spans the period
1970-2004; it includes 1123 incidents on pipelines with a total exposure of
approximately 2.77 million km-years. It shows an average incident frequency over this
period of 4.1 × 10-4 per km-year and an average over the period 2000-2004 of 1.7 × 10-4
per km-year.
Table 4.4 reproduces the breakdown of failures by cause given in the EGIG report [7].
Table 4.4: Allocation of Failure Mechanism s from [7]: Onshore Gas

Pipelines, All Diam eters / W all Thicknesses
Failure mechanism Distribution

External interference 49.7%
Construction defect / Material 16.7%
failure
Corrosion 15.1%
Ground movement 7.1%
Hot-tap made in error 4.6%
Other/unknown 6.7%
The report also presents a graph showing the frequencies by cause separately for three
sizes of failure:
• Pinhole/crack: diameter of hole ≤ 20 mm.
• Hole: 20 mm ≤ diameter of hole ≤ pipeline diameter
• Rupture: hole diameter > pipeline diameter
The report presents more detailed frequencies for each of the causes listed above.
Those showing the dependence of the frequencies of failure due to external interference
and corrosion on pipeline wall thickness have been used to derive the frequencies
presented in Section 2.0 for pipelines with a wall thickness up to 15 mm. For thicker
walled pipes, it has been assumed that the frequency is 50% of that for pipelines with a
wall thickness of 10 – 15 mm based on the trend with diameter.
Wall thickness rather than pipeline diameter has been found to be the most significant
factor in determining pipeline failure rates. To some extent it is dependent on diameter,
so accordingly some dependence on diameter is implicit in the data presented.
Based on the rolling 5-year average total frequencies presented in the report, it has
been assumed that current frequencies are approximately 50% of the 1970-2004
average. The frequencies in Section 2.0 include this trend factor.
The report contains more detailed analysis of pipeline failure rate dependencies than is
presented here, addressing:
• External interference: pipeline diameter, depth of cover and wall thickness
8 ©OGP
• Construction defect / Material failure: year of construction

• Corrosion: year of construction, type of coating and wall thickness
• Ground movement: pipeline diameter
• Hot-tap made by error: pipeline diameter
• Other / unknown: main causes
For more detailed analysis of these factors, reference should be made to the report
directly.
4.1.3 Onshore oil pipelines

The frequencies presented in Section 2.0 for onshore oil pipelines are based on data in
CONCAWE [8]. The data include 379 failures on pipelines with a total exposure for
pipelines containing crude oil and products of approximately 667,000 km-years. More
detailed analysis has enabled the diameter specific frequencies presented in Section 2.0
to be derived.
The CONCAWE report [8] includes a detailed breakdown of failure size and mechanism,
partially reproduced in Table 4.5.
Based on the definitions of the failure sizes in the CONCAWE report [8], the hole size
distribution given in Table 2.2 has been derived as follows:
• Pinhole + Fissure: Small (diameter of hole ≤ 20 mm.)
• Hole: Medium (20 mm ≤ diameter of hole ≤ 80 mm)
• Split: Large (diameter of hole > 80 mm)
• Rupture: Rupture (pipeline diameter)
Table 4.5: Allocation of Failure Mechanism s from [8]: Onshore Oil

Pipelines, All Diam eters / W all Thicknesses
Failure Distribution
mechanism Pinhole Fissure Hole Split Rupture Overall
1
Total no. of failures 20 21 58 27 50 176
Percentage of total 12% 12% 34% 16% 29% 100%
Mechanical failure 5% 19% 12% 22% 24% 17%
Operational 0% 5% 2% 11% 4% 4%
Corrosion 90% 33% 29% 30% 18% 34%
Natural hazard 0% 5% 2% 11% 2% 3%
Third party 5% 38% 55% 26% 52% 43%
Note 1: Hole size data was only available for 176 out of the 379 failures.
©OGP 9

For risers and offshore pipelines, the PARLOC 2001 data [4] is regarded as the best
source despite the shortcomings in the report noted in Section 4.1.1. It should be
noted, however, that the previous cycle of 2-yearly revisions has lapsed.
Other data sources from which onshore pipeline failure frequency data can be obtained
included:-
1. US Department of Transportation. The US Department of Transportation Office
of Pipeline Safety maintains a database of leaks from hazardous liquid and gas
pipelines, together with exposure data. The database covers 800,000 km of pipelines,
and is the largest of its kind.
An analysis of the gas transmission and gathering line data was prepared for several
years for the American Gas Association (AGA) by Batelle (e.g. Jones & Eiber 1989).
An analysis of liquid pipeline data was prepared for DOT and API by Keifner &
Associates (Keifner et al 1999).
The database itself can be obtained from the DOT website at
ops.dot.gov/libindex.htm. It includes files of pipeline incidents for natural gas
transmission/gathering and distribution lines and liquid lines. Each is split into 1984
to date and pre-1984, due to a change in inclusion criteria. Pipeline population data
is available in separate files for each year for 1995-98 for gas transmission/gathering
and distribution lines. Summary statistics, together with population data for liquid
lines since 1986 are at ops.dot.gov/stats.htm.
2. United Kingdom Onshore Pipeline Operators’ Association (UKOPA).
UKOPA has issued a report (2005) that analyses pipeline product loss incidents in
the UK over the period 1962-2004, covering about 21,700 pipeline km at the end of
2004 and 650,000 km-years pipeline exposure. Products covered are: natural gas
(dry), natural gas liquid, ethane, ethylene, propane, propylene, LPG, butane,
condensate and crude oil (spiked).
Overall incident frequencies are calculated for 5-year periods. For the whole 43-year
period the report presents frequencies by hole size (not related to pipeline diameter),
and by cause and size of leak. There is further breakdown by hole size of the
frequencies for external interference and corrosion as follows:
External interference External corrosion
• Pipeline diameter • Wall thickness class
• Measured wall thickness • Year of construction
• Area classification • External coating type
• Type of backfill
3. UK HSE (1999). This study of the risk from UK gasoline pipelines collected data
on events worldwide involving gasoline leaks from cross country pipelines. The
data were used to determine the likelihood of events such as leaks and fires, and
also to generate consequence models based on the available data. The report
references CONCAWE and US DOT data.
4. UK HSE (2001). This study specifically addresses third party damage to onshore
pipelines, comparing EGIG data and BG Transco’s incident database. The latter
represents nearly 460,000 km-years exposure, with 32 third party incidents, 32 loss
events, and 564 incidents altogether. The third part activity failure model takes into
account such factors as: pipeline diameter, wall thickness and location; depth of
cover; damage prevention measures in place.
10 ©OGP

presented in Section 2.0 and discussed in Sections 0 and 4.0 should be consulted.
These references are shown in bold in Section 6.0.
6.0 References
1. ANSI/ASME B31.4:2006. Pipeline Transportation Systems for Liquid Hydrocarbons and
other Liquids.
2. ANSI/ASME B31.8:2003. Gas Transmission and Distribution Piping Systems.
3. DNV-OS-F101 2000 amended Oct. 2005. Submarine pipeline systems, Offshore
Standard.
4. PARLOC 2001 – The Update of Loss of Containm ent Data for Offshore
Pipelines, prepared by Mott McDonald for the UK HSE, UKOOA and IP, 2003.
5. DNV 1989. Phase 1 Report, CEC Benchmark Study – Project HH, Independent Risk
Analysis.
6. DNV 2006. Riser/Pipeline Leak Frequencies, Technical Note T7, rev. 02, unpublished
internal document.
7. EGIG 2005. 6 th EGIG-report 1970-2004 Gas Pipeline Incidents, 6 th report of
the European Gas Pipeline Incident Data Group, Doc. No. EGIG
05.R.0002.
8. CONCAW E 2002. Performance of crosscountry oil pipelines in W estern
Europe, Report No. 1/02.
6.2 References for other data sources

(US) Department of Transportation. Refer ops.dot.gov/stats/stats.htm.
((UK) Health and Safety Executive 1999. Assessing the risk from gasoline pipelines in the
United Kigdom based on a review of historical experience, Contract Research Report
210/1999, prepared by WS Atkins Safety & Reliability.
http://www.hse.gov.uk/research/crr_pdf/1999/crr99210.pdf.
(UK) Health and Safety Executive 2001. An assessment of measures in use for gas
pipelines to mitigate against damage caused by third party activity, Contract Research Report
372/2001, prepared by WS Atkins Consultants Ltd.
http://www.hse.gov.uk/research/crr_pdf/2001/crr01372.pdf.
UKOPA 2005. Pipeline Product Loss Incidents (1962 - 2004), prepared by Advantica,
Report Ref. R 8099, for UKOPA FDMG. http://www.ukopa.co.uk/.
©OGP 11

March 2010
Human
factors
in QRA
P ublications
Global experience


Disclaimer
Copyright notice
England and Wales.
RADD – Human factors in QRA
contents
1.1 Application ...................................................................................................... 1
1.2 Definitions and Terminology of HF ............................................................... 1
1.2.1 Definitions................................................................................................................... 1
1.2.2 Terminology................................................................................................................ 2
2.0 Human Factors Process Descriptions .................................... 3
2.1 Human Factors in Offshore Safety Cases .................................................... 3
2.1.1 Rationale ..................................................................................................................... 3
2.1.2 Stages ......................................................................................................................... 3
2.2 Human Factors in UK Onshore Safety Cases .............................................. 5
2.2.1 Rationale ..................................................................................................................... 5
2.2.2 Stages ......................................................................................................................... 6
2.3 Workload Assessment ................................................................................... 7
2.3.1 Rationale ..................................................................................................................... 7
2.3.2 Stages ......................................................................................................................... 8
2.4 Human Error Identification........................................................................... 11
2.4.1 Rationale ................................................................................................................... 11
2.4.2 Stages ....................................................................................................................... 12
2.4.3 Techniques ............................................................................................................... 14
2.5 Human Reliability Assessment.................................................................... 15
2.5.1 Rationale ................................................................................................................... 15
2.5.2 Stages ....................................................................................................................... 15
2.5.3 Techniques ............................................................................................................... 19
2.6 Human Factors in Loss of Containment Frequencies............................... 19
2.6.1 Rationale ................................................................................................................... 19
2.6.2 Stages ....................................................................................................................... 19
2.6.3 Techniques ............................................................................................................... 28
2.7 Human Factors in the determination of event outcomes.......................... 28
2.7.1 Rationale ................................................................................................................... 28
2.7.2 Stages ....................................................................................................................... 28
2.7.3 Techniques ............................................................................................................... 31
2.8 Human Factors in the assessment of fatalities during escape and
sheltering....................................................................................................... 32
2.8.1 Rationale ................................................................................................................... 32
2.8.2 Stages ....................................................................................................................... 33
2.9 Human Factors in the assessment of fatalities during evacuation, rescue
and recovery.................................................................................................. 38
2.9.1 Rationale ................................................................................................................... 38
2.9.2 Stages ....................................................................................................................... 39
2.9.3 Techniques ............................................................................................................... 46
3.0 Additional Resources .......................................................... 48
3.1 Legislation, guidelines and standards........................................................ 48
3.1.1 UK Legislation, Guidelines and Standards............................................................ 48
3.1.2 Key Guidance and References ............................................................................... 48
3.2 Key Societies and Centres........................................................................... 50
3.2.1 United Kingdom ....................................................................................................... 50
3.2.2 Europe ....................................................................................................................... 50
©OGP
3.2.3 Scandinavia .............................................................................................................. 51

3.2.4 United States and Canada ....................................................................................... 51
3.2.5 South America .......................................................................................................... 51
3.2.6 Australia and New Zealand ..................................................................................... 51
3.2.7 Rest of the World ..................................................................................................... 51
4.0 References & Bibliography .................................................. 52
4.1 References..................................................................................................... 52
4.2 Bibliography .................................................................................................. 55
©OGP
Abbreviations:
ALARP As Low As Reasonably Practicable
APJ Absolute Probability Judgement
COMAH Control of Major Accident Hazard regulations
CREE The Centre for Registration of European Ergonomists
CREAM Comprehensive Risk Evaluation And Management
EEM External Error Modes
ETA Event Tree Analysis
FMEA Failure Modes and Effect Analysis
FTA Fault Tree Analysis
HAZOP Hazard and Operability study
HAZID Hazard Identification
HCI Human Computer Interaction
HEA Human Error Assessment
HEART Human Error Analysis and Reduction Technique
HEI Human Error Identification
HEP Human Error Rate Probability
HF Human Factors
HMI Human Machine Interface
HRA Human Reliability Assessment
HSC Health and Safety Commission
HSE Health and Safety Executive
HTA Hierarchical Task Analysis
LOC Loss of Containment
NORSOK The competitive standing of the Norwegian offshore sector
(Norsk sokkels konkurranseposisjon)
MAH Major Accident Hazards
OIM Offshore Installation Manager
OSHA Operational Safety Hazard Analysis
PA Public Address
PEM Psychological Error Mechanisms
PFEER Prevention of Fire, Explosion and Emergency Response
POS Point of Safety
PRA Probability Risk Assessment
PPE Personal Protective Equipment
PSA Probability Safety Assessment
PSF Performance Shaping Factors
PTW Permit to Work
QRA Quantitative Risk Assessment
RIDDOR Reporting of Injuries, Diseases and Dangerous Occurrences Regulations
SHARP Systematic Human Action Reliability Procedure
SHERPA Systematic Human Error Reduction and Prediction Approach
SMS Safety Management System
SRK Skill, Rule, Knowledge
SWIFT Structured What If Technique
THERP Technique for Human Error Rate Prediction
TR Temporary Refuge
UK United Kingdom
©OGP

1.1 Application
This report contains guidance material for Human Factors (HF) studies within the
various forms of risk and error assessment and analysis. It defines the terminology
used in such studies, and includes information on applicable legislation, guidelines and
standards; process descriptions and techniques.
In Safety, Health and Environment, Human Factors (also called ergonomics) is
concerned with "environmental, organisational and job factors, and human and
individual characteristics, which influence behaviour at work in a way which can affect
health and safety” [1]. As a multidisciplinary field involving psychology, physiology, and
engineering, among other disciplines, Human Factors is a broad subject. It is involved
in the design, development, operation and maintenance of systems in all industrial
sectors. This datasheet aims to provide the user with a greater awareness of Human
Factors theory and practice
It should be borne in mind that much of the material used in human factors is drawn
from a number of industry sources. Hence, for example human error rates are often
context specific (i.e. using data based upon error rates for control room operators it will
be necessary to determine if it requires some modification when considering error rates
in a different environment).
It is important to understand the processes that can be followed for Human Factors
since they often utilise a number of similar techniques. This datasheet outlines the
processes and makes reference to the techniques.
In Section 2.0, nine HF processes are described as follows:
1. Human Factors in Offshore Safety Cases
2. Human Factors in UK Onshore Safety Cases
3. Workload Assessment
4. Human Error Identification
5. Human Reliability Assessment
6. Human Factors in Loss of Containment Frequencies
7. Human Factors in the determination of event outcomes
8. Human Factors in the assessment of fatalities during escape & sheltering
9. Human Factors in the assessment of fatalities during evacuation, rescue and
recovery
1.2 Definitions and Terminology of HF

1.2.1 Definitions
‘Human Factors’ or ‘Ergonomics’ can be defined [2] as:
“that branch of science and technology that includes what is known and theorised about
human behavioural and biological characteristics that can be validly applied to the
specification, design, evaluation, operation, and maintenance of products and systems to
enhance safe, effective, and satisfying use by individuals, groups, and organisations”.
1 ©OGP
Put simply, this means “designing for human use”. The user or operator is seen as a
central part of the system. Accident statistics from a wide variety of industries reveal
that Human Factors, whether in operation, supervision, training, maintenance, or
design, are the main cause of the vast majority of incidents and accidents.
Human Factors attempts to avoid such problems by fitting technology, jobs and
processes to people, and not vice versa. This involves the study of how people carry out
work-related tasks, particularly in relation to equipment and machines. When
considering the use of HF technology in safety-related systems, it is worth noting a
further Human Factors definition [1]:
“environmental, organisational and job factors, and human and individual characteristics, which
influence behaviour at work in a way which can affect health and safety”
Human Factors or ergonomics is generally considered to be an applied discipline that is
informed by fundamental research in a number of fields, notably psychology,
engineering, medicine (physiology and anatomy) and sociology.
1.2.2 Terminology
The term “Human Factors” has many synonyms and related terms. Most of these are
shown below, with explanation of key differences where generally agreed:
Ergonomics - the term ergonomics literally means “laws of work”. It is the traditional
term used in Europe, but is considered synonymous with “Human Factors”, a North
American-derived term. Some associate the term ergonomics more with physical
workplace assessment, but this is an arbitrary distinction. Other terms include Human
Engineering and Human Factors Engineering
Cognitive Ergonomics or Engineering Psychology - this is a branch of Human Factors or
ergonomics that emphasises the study of cognitive or mental aspects of work,
particularly those aspects involving high levels of human-machine interaction,
automation, decision-making, situation awareness, mental workload, and skill
acquisition and retention.
Human-Machine Interaction (HMI) or Human-Computer Interaction (HCI) – the applied study
of how people interact with machines or computers.
Working Environment - this emphasises the environmental and task factors that affect
task performance.
©OGP 2
2.0 Human Factors Process Descriptions

2.1 Human Factors in Offshore Safety Cases
2.1.1 Rationale
The UK's Offshore Safety Case Regulations came into force in 1992. A ‘Safety Case’ is a
written document within which the company must demonstrate that an effective
management system is in place to control risks to workers and, in particular, to reduce
to a As Low As Reasonably Practicable (ALARP) the risks from a major accident. The
duty holder (owner or operator) of every offshore installation operating in British waters
is required to prepare a ‘Safety Case’ and submit it to the UK HSE Offshore Safety
Division for formal acceptance.
The main thrust of a Safety Case is a demonstration by the installation operator that the
risks to the installation from Major Accident Hazards (MAH) have been reduced to
ALARP. Traditionally the offshore industry has found it difficult to integrate Human
Factors into the Safety Cases. Although there is a requirement to address human factor
issues, the guidance has been unclear on how this should be achieved. A variety of
tools and techniques have been initiated by a legislative focus and these are used to
varying degrees by different operators.
There are two sections within Safety Cases that are of high importance, the Safety
Management System and Risk Assessment sections. Within these are a number of
factors that should be addressed in order to meet the legislative requirements of the
Safety Case.
2.1.2 Stages
The main part of the safety case which Human Factors issues are relevant to is the
Safety Management System (SMS). Within the SMS there are a number of areas that
should demonstrate the consideration of Human Factors issues. Areas include:
Human Reliability And Major Accident Hazards

The management system should demonstrate suitable methods for ensuring human
reliability and the control of major accident hazards. Offshore installation risk
assessments consist of both quantitative and qualitative components, considering the
following:
• Hazard Identification
• Assessment of Consequences
• Prevention, detection, control, mitigation, and emergency response.
Key approaches, both qualitative and qualitative, include HAZOPs and other Hazard
Identification (HAZID) techniques. HAZOP is an identification method designed
predominantly for the identification of hardware and people related hazards.
Engineering system HAZOPs are generally poor in their coverage of human factor
issues though this is mainly due to the knowledge and expertise of the participants and
the facilitator. Specific Human Factors and Procedural HAZOPs are available for use.
Structured What IF Technique (SWIFT) is an increasingly used technique for hazard
identification that is particularly good for examining organisational and Human Factors
issues.
3 ©OGP
Workforce Involvement
A key component in the effectiveness of the management of installation MAHs is the
involvement of the workforce in the identification of MAHs and the development of
specific prevention, detection, control, mitigation and emergency response measures.
Involving the workforce helps to ‘buy-in’ support and ensure personnel are well
informed of changes. This is a key aspect required by the UK HSE when it decides on
the acceptance of the Safety Case and has been reinforced by changes in 2005 “By
involving the workforce, they become more familiar with how they manage their safety
in their day to day operations, enabling the safety case to be part of their daily
operations, achieving the objective of having a ‘live’ safety case.”
Incident and Accident Investigation

The RIDDOR regulations state that reporting of accidents and incidents is mandatory.
Efforts are being made to increase the reporting levels of near miss incidents [3].
Incident and accident investigation is a formal requirement within an effective safety
management system. It is one of the key tools for continuous improvement, a
requirement for demonstrating continuous safe operation and that risks are being
continuously driven to ALARP.
Safety Culture and Behavioural Safety (Observational Based Programs)

Many offshore installations now operate a behavioural safety programme within the
management system. Behavioural safety programmes may be a proprietary package or
developed in-house specifically for the operator’s organisation. A variety of behavioural
safety programmes are available and are designed to improve the safety culture of the
organisation [4].
There are also methods and proprietary packages for the assessment and monitoring of
an organisation's safety culture and climate.
Emergency Response
The safety management system should make consideration of the following areas of
emergency response:
• Emergency egress and mustering i.e. consideration of the route layout, alarm
sounding etc in relation to various foreseeable accident scenarios.
• Evacuation and rescue modelling. This is vital for identifying the weakness /
effectiveness of procedures
• Demonstration of a good prospect of rescue and recovery in accordance with the
Prevention of Fire, Explosion and Emergency Response (PFEER) regulations.
• Emergency training and crisis management, i.e. regular drills are held offshore on a
weekly basis.
• Survival Training. This is given to all offshore personnel and is refreshed on a
regular basis, the intervals being defined by age scales.
Work Design
The inclusion and consideration of personnel’s working arrangement is an important
part of the Safety Case. It can impact heavily upon the working performance and safety
behaviours of personnel. Current research is looking into the implications of shift work
on safety behaviours [5].
©OGP 4
Of further importance is the handover process by personnel between shifts.
Workload and Manning Levels

Efforts have been made to reduce manning levels on installations to a safe operational
minimum. Various methods are available to enable risk assessment of these manning
levels (see Section 2.3).
Permit to Work Systems

The UK HSE and the Norwegian Oil Industry Association (OLF) have published guidance
for onshore and offshore activities [6], [7].
Working Environment
Key working environment issues offshore include lighting, access for maintenance and
operation, noise, vibration and exposure to weather. All of these affect the operator’s
ability to work effectively. The UK HSE is currently reviewing legislative requirements to
bring them in line with the Norwegian NORSOK standards.
Training and Competency Assurance

Training and competency assurance is increasingly being recognised as a vital human
factors issue. Demonstration of personnel training and competency is a requirement
within the safety management system. Training needs of personnel should be identified
and competency demonstrated and verified by an appropriate authority [8].
In addition to the demonstration that an effective safety management system is in place,
the Safety Case should demonstrate that the major accident hazards on the installation
have been identified and controlled. This can be demonstrated through the use of Safety
Critical Task Analysis in addition to complementary methods of analysis such as
Quantified Risk Assessment, HAZOPs and HAZID techniques.
2.2 Human Factors in UK Onshore Safety Cases

2.2.1 Rationale
It is generally understood that virtually all major accidents include Human Factors
among the root causes and that prevention of major accidents depends upon human
reliability at all onshore sites, no matter how automated.
Assessment is a team process; it is important that the team members do not examine
their topic in isolation, but in the context of an overall ALARP demonstration.
2.2.2 Stages
2.2.2.1 Identify potential for human failures
The COMAH safety report needs to show that measures taken and SMS are built upon a
real understanding of the potential part that human reliability or failure can play in
initiating, preventing, controlling, mitigating and responding to major accidents.
Occasionally quantitative human reliability data is quoted: this should be treated with
caution. Local factors make considerable impacts so generic data, if used, must be
accompanied by an explanation as to why it is applicable for the site.
5 ©OGP
2.2.2.2 Choosing and justifying the measures

Few COMAH safety reports justify or explain how the choice is made between functions
that are automatic and those that are manual. Yet this can be key to showing that all
necessary measures are in place or that risks are ALARP, following principles of
inherent safety.
There should not be over reliance on training and procedures in place of reasonably
practical physical measures.
2.2.2.3 Implementing control measures

Once the potential human contribution has been identified, this should be reflected in
the choice and design of measures in place. All sites rely to a degree on compliance
with procedures. Yet many sites have areas of ineffective compliance rates and few, if
any, will ever reach 100%. Therefore regular reviews should be conducted of safety
critical procedures.
2.2.2.4 Management assurance

The main functions of a safety management system are to bring consistency and
discipline to the necessary measures by means of a quality assurance system by
maintaining good industry practice (which under pins the ALARP argument). This is
done by completing documentation, audit and control; and to ensure continuous
improvements towards ALARP by means of capturing lessons learned and setting and
meeting appropriate targets in relation to the major accident hazard.
The UK HSE has funded research into creating a model that allowed the easy integration
of HF issues into the identification of major chemical hazards, safety management
systems for managing those hazards and related organisational issues. Although, the
research for this model is based on onshore industries, the principles within it could
also be applied to the offshore industry. This model was trialled in a workshop with UK
HSE specialists from a broad range of industries. The feedback was both positive and
negative with a summary being that the model was usable but required packaging
differently so that it could be more easily understood and applied by a wider audience
[9].
2.3 Workload Assessment

2.3.1 Rationale
The construct of workload has no universally acceptable definition. Stein [10] uses the
following definition:
“The experience of workload is based on the amount of effort, both physical and psychological,
expended in response to system demands (task load) and also in accordance with the
operator’s internal standard of performance.” (p. 157).
Put simply, workload problems occur where a person has more things to do than can be
reasonably coped with. Workload can be experienced as either mental, or physical, or
both, and will be associated with various factors, such as:
• Time spent on tasks.
• Number, type (e.g. manual, visual), and combination of tasks.
©OGP 6
• Task pacing and scheduling.

• Operator experience, state, and perceptions.
• Environmental factors (e.g. noise, temperature).
• Time, in relation to work-sleep cycle.
Problems with workload can occur when workload is too high (overload) or too low
(underload). Some examples of causes of workload are shown in Table 2.1.
Table 2.1 Som e Exam ples of Causes of Excessive and Insufficient

W orkload
EXCESSIVE W ORKLOAD INSUFFICIENT W ORKLOA D

Rapid task scheduling (e.g. excessive task Slow or intermittent task scheduling (e.g.
cycle times). downtime).
Signals occurring too rapidly, particularly in Signals occurring infrequently (e.g.
the same sensory modality (e.g. several visual monitoring a radar display in an area of very
alarms presented at the same time). low activity).
Unfamiliarity or lack of skill (e.g. a trainee Excessive skill relative to job (e.g. a highly
operator keeping up with a fast production skilled operator packing boxes).
line).
Complexity of information (e.g. an air traffic Monotonous or highly predictable
controller dealing with traffic at various information
speeds, directions, at flight levels).
Personal factors (e.g. emotional stress).
At the upper limits of human performance, excessive workload may result in poor task
performance and operator stress. Underload, may be experienced as boredom, with
associated distraction. Both may result in ‘human error’ - failing to perform part of a
task, or performing it incorrectly.
Workload assessment may be used as part of the investigation of several problems,
such as:
• Manning requirements and de-manning.
• Shift organisation.
• Information and HMI design.
• Job design.
• Team design.
2.3.2 Stages
2.3.2.1 Problem definition
First determine whether the problem is one of excessive or insufficient task load, and
whether the workload is primarily physical or mental. Then investigate, by discussing
with operators and supervisors, the source of the workload problem, e.g.:
• Manning arrangements - too many or too few operators will cause workload
problems.
7 ©OGP
• Shift organisation - poor shift organisation can result in manning problems, but may
have other effects such as fatigue, which will have further effects on workload.
• Information and HMI design - problems with information display (e.g. too much,
poorly organised, badly designed, etc.) can overload the operator.
• Job design - poor task scheduling or organisation can lead to under- or overload.
• Team design and supervision - poor team design and supervision may result in
some operators being overloaded or underloaded.
• Competing Initiatives – Competition between teams can be good for productivity but
can also lead to an increase in operator workload as more tries to be carried out in
the same period of time.
• Unreliable hardware – If machinery is constantly failing then maintainers and
operators will have to work harder to achieve a reasonable level of performance.
2.3.2.2 Collection of background information

Important background information may include:
• Number of operators (and number affected by workload problem).
• Operator availability (particularly for safety-critical tasks).
• Cover arrangements for sickness, holiday/vacation, training, etc.
• Team design.
• Approximate percentages of time operators spend on different tasks.
• Extraneous operator duties (e.g. fire crew, first aid, forklift truck driver, etc.).
• Shift pattern/working hours.
• Overtime arrangements.
• Management and supervision (level of supervisor).
• Previous incidents associated with workload.
• Environmental and physiological information (heat, etc).
2.3.2.3 Selection and application of assessment method

The assessment method required will depend upon the source of the workload problem:
• Manning arrangements
• Shift organisation
• Information and Human-Machine Interface (HMI) design
• Job design (see Human Error Identification)
• Team design and supervision
In addition, a number of other more direct measures of workload are available. These
can be divided into the following categories:
• Primary task performance - indicates the extent to which the operator is able to
perform the principal work mission (e.g. production to schedule). These types of
measures can be difficult to implement and have little sensitivity when highlighting
problem areas.
©OGP 8
• Secondary task performance - these measures involve the operator performing two
tasks, a primary and a secondary task. Both tasks are measured, but depending on
the purpose and scope of the task, either the primary or secondary task is given
priority. Errors or performance decrements may be measured. These techniques are
generally only suited to simulated or experimental settings.
• Physiological and psycho-physiological techniques - these techniques measure a
physiological function, and in the case of mental workload, one that is known to
have some relationship with psychological functions. Examples include respiratory
activity (physical workload), cardiac activity (mental and physical workload), brain
activity (mental workload), and eye activity (mental workload). Again, these
measures generally require a base-line (or control) for that participant to be recorded
so that the ‘delta’ as a result of that variable can be established.
• Subjective assessment techniques - these techniques provide an estimate of workload
based on judgement, usually by the person undertaking the task.
• Task analytic techniques - these techniques aim to predict mental workload at an
earlier stage of the system life-cycle, using task analysis and time-line analysis. The
rationale is that the more time is spent on tasks, especially overlapping or
concurrent ones, the greater the workload. The approaches assume that mental
resources must be limited and use various models of mental workload. These
techniques can also be used to highlight simple workload conflicts such as an
operator not being in the location of an alarm when necessary.
In practical settings, the main techniques for workload assessment are subjective and
analysis specific tasks or sub-tasks. Some examples of these techniques are shown in
Table 2.2. These are mainly intended for the assessment of mental workload, but must
involve some physical component.
However, they are not suitable for purely physical tasks (e.g. assessing physical
fatigue). Also, most were developed for the aviation industry, but may be adapted fairly
easily for other industries.
Table 2.2 Som e Subjective and Task Analytic W orkload Assessm ent
Techniques
TYPE / METHOD DESCRIPTION

Subjective Techniques
Uni-dimensional rating Assess workload along a single dimension with a verbal
scales descriptor (e.g. Workload), with a scale (e.g. ‘Low’ to ‘High’).
10cm line Workload is simply rated on a scale from 1 to 10.
Modified Cooper- Scale developed for use with pilots, with scale descriptors of
Harper Scale mental effort.
Bedford Rating Scale Developed from the Modified Cooper-Harper Scale.
Descriptors make reference to spare mental capacity.
Multi-dimensional Assess the different factors that are thought to contribute to
Rating Scales workload. More diagnostic than uni-dimensional scales.
NASA-TLX Assesses six dimensions: mental demand, physical demand,
temporal demand, performance, effort, and frustration.
Ratings are made on a scale from 1 to 20, then the
dimensions are weighted using a paired comparisons
technique. The weighted ratings can be summed to provide
an overall score.
9 ©OGP
TYPE / METHOD DESCRIPTION

General General questionnaires can be developed and applied, or
Questionnaires and interviews can be conducted, to ask about specific aspects
Interviews of workload, e.g. how much, when, who, why, etc.
Instantaneous Measures that can ‘track’ workload over a time period,
Assessment allowing investigation of workload peaks and troughs.
Instantaneous Self Workload is rated at specific intervals on a scale of 1 (under-
Assessment (ISA) utilised) to 5 (excessive). The operator presses one of five
buttons every two minutes, when signalled by a flashing
light. The results for all operators are fed to a computer
terminal for observation.
C-SAW The operator watches a video replay of the task and applies a
rating on a scale of 1 to 10 using the Bedford Scale.
Task Analytic Techniques
Timeline analysis Timeline analysis is a general; task analysis technique that
maps operator tasks along the time dimension, taking
account of frequency and duration, and interactions with
other task and personnel. This method is most suited to
tasks that are consistently structured (in terms of task steps,
durations, frequency, etc), with little variation in how they are
performed. Workload can be rated in retrospect (by an
expert) on a 5- or 6- point scale from 0% to 100%.
Timeline Analysis and A timeline analysis is conducted for observable tasks and
Prediction (TLAP) their durations. The tasks are assumed to have different
channels: vision (looking); audition (listening); hands
(manipulating by hand); feet (using feet); and cognition
(thinking). By observing and listening to the operator, an
estimate can be made of the amount of time required for each
task.
Visual, Auditory, This uses experience subject matter experts to rate a variety
Cognitive, of tasks between 0 (no demand) to 7 (highest demand) to the
Psychomotor following workload channels: visual; auditory; cognitive and
psychomotor (movement). The demand on the channels is
summed to give a score, and a scope is available for
‘excessive workload’.
Workload Index W/INDEX is based on Wickens’ Multiple Resource Theory,
(W/INDEX) which describes humans as fixed capacity information
processors with access to different pools of resources. Six
channels are used: visual, auditory, spatial cognition, verbal
cognition, manual response, and voice response. W/INDEX
also tries to weight the interference between channels (e.g.
speaking and listening to speech at the same time).
Micro-SAINT Micro-SAINT is a computer simulation that simulates the
operator activities in responding to events.
Sometimes, techniques may be used with the entire population of operators affected. At
other times, it may be necessary to apply the technique on a sample of operators. This
will depend on the scope of the project, and the number of operators affected by the
workload problem. It may be sensible to employ more than one technique.
©OGP 10
2.3.2.4 Workload smoothing

If workload is excessive or insufficient, it may be necessary to redesign the task, job, or
equipment, or re-organise the shift pattern, manning arrangements, etc. A sample of
operators should be involved in this process.
2.4 Human Error Identification

2.4.1 Rationale
Human Error Identification (HEI) is a generic term for a set of analytical techniques that
aim to predict and classify the types of human errors that can occur within a system so
that more effective and safer systems can be developed. HEI can be either a standalone
process or part of a wider Human Reliability Assessment (HRA) (see Section 2.5).
The concept of human error is at the heart of HRA and HEI. Reason [11] defines human
error as:
“a generic term to encompass all those occasions in which a planned sequence of mental or
physical activities fails to achieve its intended outcome, and when these failures cannot be
attributed to the intervention of some chance agency” (p.9).
HEI provides a comprehensive account of potential errors, which may be frequent or
rare, from simple errors in selecting switches to ‘cognitive errors’ of problem-solving
and decision-making.
Some errors will be foreseen or ‘predicted’ informally during system development, but
many will not. It is often then left to the operators to detect and recover from these
errors, or automated systems to mitigate them. HEI can be a difficult task because
humans have a vast repertoire of responses. However, a limited number of error forms
occur in accident sequences, and many are predictable. HEI is an important part of HRA
because errors that have not been identified cannot be quantified, and might not be
addressed at all. Kirwan [12] considers that HEI is at least as critical to assessing risk
accurately as the quantification of error likelihoods. HEI can also identify the
Performance Shaping Factors (PSFs), which may be used in the quantification stage,
and will be necessary for error reduction.
HEI can be used for various types of error such as [13]:
• Maintenance testing errors affecting system availability.
• Operating errors initiating the event/incident.
• Errors during recovery actions by which operators can terminate the event/incident.
• Errors which can prolong or aggravate the situation.
• Errors during actions by which operators can restore initially unavailable equipment
and systems.
Two models of human error underlie most techniques. The first is Rasmussen’s [14]
‘skill’, ‘rule’ and ‘knowledge’ (SRK) based performance distinction. The majority of
physical, communication or procedural errors are ‘skill' or ‘rule' based whilst the
majority of ‘cognitive’ errors of planning and decision-making are ‘knowledge-based’.
The second model is Reason’s [11] distinction of slips, lapses and mistakes. Slips and
lapses are:
'errors resulting from some failure in the execution and/or storage stage of an action sequence,
regardless of whether or not the plan which guided them was adequate to achieve its
objective'.
11 ©OGP
Slips are associated with faulty action execution, where actions do not proceed as
planned. Lapses are associated with failures of memory. These errors tend to occur
during the performance of fairly ‘automatic’ or routine tasks in familiar surroundings,
and attention is captured by something other than the task in hand. Examples include
misreading a display, forgetting to press a switch, or accidentally batching the wrong
amount to a batch counter.
Reason [11] also defines mistakes as:
'deficiencies in the judgmental and/or inferential processes involved in the selection of an
objective or in the specification of the means to achieve it, irrespective of whether or not the
actions directed by this decision-scheme run according to plan'.
So intended actions may proceed as planned, but fail to achieve their intended outcome.
Mistakes are difficult to detect and likely to be more subtle, more complex, and more
dangerous than slips. Detection may rely on intervention by someone else, or the
emergence of unwanted consequences. Examples include misdiagnosing the
interaction between various process variables and then carrying out incorrect actions.
Violations are situations where operators deliberately carry out actions that are contrary
to organisational rules and safe operating procedures.
2.4.2 Stages
The first task is to determine the scope of the HEI, including:
• Is it a standalone HEI or HRA study?
• What are the types of tasks and errors to be studied?
• What is the stage of system development?
• Are there any existing HEIs or task analyses?
• What is the level of detail required?
2.4.2.1 Task analysis

HEI requires a thorough analysis of the task. This is because each stage of the task, and
the sequence and conditions in which sub-tasks are performed, must be described
before potential errors at each stage can be identified. ‘Task analysis’ covers a range of
techniques for the study of what an operator is required to do to achieve a system goal.
The most widely used method is called ‘Hierarchical Task Analysis’ or HTA. This
produces a numbered hierarchy of tasks and sub-tasks, usually represented in a tree
diagram format, but may also be represented in a tabular format. It will be necessary to
decide the level of resolution or detail required. In some cases, button presses,
keystrokes etc may need to be described, in other cases, description may be at the task
level. An operator may need to be involved in the study. Once a task analysis has been
developed, HEI can take place.
2.4.2.2 Human Error Identification Worksheet

A typical HEI worksheet may include the following information:
• Task Step - this may be at button-press/key-stoke level or task level depending on
the detail required.
• External Error Modes (EEM) - the external failure keywords.
©OGP 12
• Psychological Error Mechanisms (PEM) - underlying psychological process producing

the error.
• Causes and Consequences.
• Safeguards and Recovery - automated safeguards and potential human recovery
actions.
• Recommendations - in terms of procedures, equipment, training, etc.
2.4.2.3 Screening
It is then necessary to comb through the HEI worksheets to find errors that are not
adequately protected against by safe guards. In particular, where there are no
technological safeguards and human recovery is required (especially the same
operator), then such errors should be taken further forward for analysis (qualitative or
quantitative).
2.4.2.4 Human Error Reduction

Human error reduction strategies or recommendations may be required where the
safeguards in place are not adequate in light of the risk of human error.
Recommendations may be made during the HEI or during the HRA itself, so this stage
may involve reviewing such recommendations in light of the screening exercise. Human
Factors should be considered during the implementation of solutions, and any
recommendations should be considered in an integrated fashion, taking into account
the context of the working environment and organisation. Kirwan [15] notes four types
of error reduction:
• Prevention by hardware or software changes - e.g. interlocks, automation.
• Increase system tolerance - e.g. flexibility or self-correction to allow variability in
operator inputs.
• Enhance error recovery - e.g. improved feedback, checking, supervision, automatic
monitoring.
• Error reduction at source - e.g. training, procedures, interface and equipment
design.
Typically, error reduction might focus on the following:
• Workplace design and Human Machine Interface
• Equipment design
• Ambient environment
• Job design
• Procedures
• Training
• Communication
• Team work
• Supervision and monitoring
Often, error reduction strategies are not as effective as envisaged, due to inadequate
implementation, a misinterpretation of measures, side-effects of measures (e.g.
13 ©OGP
operators removing interlocks), or acclimatisation to measures (especially if

motivational). Hence, the efficacy of measures should be monitored.
2.4.2.5 Documentation and Quality Assurance

Results and methods are documented such that they are auditable. The rationale and all
assumptions should be made clear. This is important for error reduction strategies to
ensure that they remain effective and that the error reduction potential is realised and
maintained.
Ensure that the worksheets are reviewed by any operators involved. It is also useful to
involve an independent auditor. HEI can become too reliant on the individual analyst,
which can result in biases where the analyst loses sight of interactions, becomes too
focused on detail, and the analysis becomes repetitive and routine. An external auditor
(i.e. a second, independent assessor) can prevent this.
2.4.3 Techniques
A number of HEI techniques have been developed. Most existing techniques are either
generic error classification systems or are specific to the nuclear and process
industries, or aviation. These techniques range from simple lists of error types, to
classification systems based around a model of how the operator performs the task.
Some of the most popular techniques for Human Error Identification are:
• Systematic Human Error Reduction and Prediction Process-SHERPA
• Comprehensive Risk Evaluation And Management - CREAM
• Human Factors Structured What IF Technique - SWIFT
• Human Hazard and Operability Study - HAZOP
• Human Failure Modes and Effects Analysis - FMEA
2.5 Human Reliability Assessment
2.5.1 Rationale
Human error has been seen as a key factor associated with almost every major
accident, with catastrophic consequences to people, property and the environment.
Accidents with major human contributions are not limited to any particular parts of the
world, or any particular industry, and include the Aberfan mining disaster (1966), the
Bhopal chemical release (1984), the Chernobyl melt-down and radioactivity release
(1986), the Piper Alpha platform explosion (1988) and the Kegworth air disaster (1989).
The study of human error was given a major spur by the Three Mile Island accident
(1979).
Human Reliability Assessment (HRA) can be defined as a method to assess the impact
of potential human errors on the proper functioning of a system composed of
equipment and people. HRA emerged in the 1950s as an input to Probabilistic Safety (or
Risk) Assessments (PSA or PRA). HRA provided a rigorous and systematic
identification and probabilistic quantification of undesired system consequences
resulting from human unreliability that could result from the operation of a system. HRA
developed into a hybrid discipline, involving reliability engineers, ergonomists and
psychologists.
The concept of human error is at the heart of HRA. Reason [11] defines human error as:
©OGP 14
“a generic term to encompass all those occasions in which a planned sequence of mental or
physical activities fails to achieve its intended outcome, and when these failures cannot be
attributed to the intervention of some chance agency” (p. 9).
It is necessary to understand several aspects of the socio-technical system in order to
perform a HRA. First, an understanding of the engineering of the system is required so
that system interaction can be explored in terms of error potential and error impact.
Second, HRA requires an appreciation of the nature of human error, in terms of
underlying Psychological Error Mechanisms (PEMs) as well as Human Factors issues
(called Performance Shaping Factors, PSFs) that affect performance. Third, if the HRA is
part of a PSA, reliability and risk estimation methods must be appreciated so that HRA
can be integrated into the system’s risk assessment as a whole.
A focus on quantification emerged due to the need for HRA to fit into the probabilistic
framework of risk assessments, which define the consequences and probabilities of
accidents associated with systems, and compare the output to regulatory criteria for
that industry. If the risks are deemed unacceptable, they must be reduced or the system
will be cancelled or shut down. Indeed, most HRAs are nowadays PSA-driven Human
error quantification techniques which use combinations of expert judgement and
database material to make a quantified assessment of human unreliability in situations
where the actual probability of error may be small but where the consequences could be
catastrophic and expensive.
2.5.2 Stages
The HRA approach has qualitative and quantitative components, and the following can
be seen as the three primary functions of HRA:
• Human Error Identification
• Human Error Quantification
• Human Error Reduction.
The qualitative parts of HRA are the identification or prediction of errors (along with the
preceding task analyses), the identification of any related PSFs such as poor
procedures, system feedback, or training, and the subsequent selection of measures to
control or reduce their prevalence. The quantitative part of HRA includes the estimation
of time-dependent and time-independent human error probabilities (HEPs) and the
estimation of the consequences of each error on system integrity and performance.
These estimations are based on human performance data, human performance models,
analytical methods, and expert judgement, described in more detail below.
There are 10 stages to HRA [15]:
1. Problem Definition.
2. Task Analysis.
3. Human Error Identification.
4. Human Error Representation.
5. Screening.
6. Human Error Quantification.
7. Impact Assessment.
8. Human Error Reduction.
15 ©OGP
9. Quality Assurance.
10. Documentation.
2.5.2.1 Problem Definition

Determine the scope of the HRA, including:
• Is it a standalone or PSA driven assessment?
• What are the types of scenarios, tasks (operation, maintenance, etc.) and errors to
be studied?
• What is the stage of system development?
• What are the system goals for which operator actions are required, and how do
safety goals fit in?
• Is quantification is required - absolute or relative?
• What is the level of detail required?
• What are the risk assessment criteria (e.g. deaths, damage)?
• Are there any existing HRAs (including HEIs and task analysis)?
This will require discussions with system design and plant engineers, and operational
and managerial personnel. The problem definition may shift with respect to above
questions as the assessment proceeds (e.g. the identification of new scenarios).
2.5.2.2 Task analysis

Task analysis is required to provide a complete and comprehensive description of the
tasks that have to be assessed. Several methods may be used, such as Hierarchical
Task Analysis or Tabular Task Analysis. The main methods of obtaining information for
the task analysis are observation, interviews, walk-throughs, and examination of
procedures, system documentation, training material. For a proceduralised task, HTA is
probably most appropriate. Operational personnel should verify the task analysis
throughout if possible.
2.5.2.3 Human Error Identification

Human Error Identification (HEI) is a generic term for a set of analytical techniques that
aim to predict and classify the types of human errors that can occur within a system so
that more effective and safer systems can be developed (see Section 2.4).
2.5.2.4 Human Error Representation

Representation allows the assessor to evaluate the importance of each error, and to
combine risk probabilities of failures (hardware, software, human, and environmental).
The main representation techniques used in HRA are Fault Tree Analysis (FTA) and
Event Tree Analysis (ETA). These:
• enable the use of mathematical formula to calculate all significant combinations of
failures
• calculate the probabilities
• indicate the degree of importance of each event to system risk and
©OGP 16
• allow cost-benefit analysis.

FTA is a logical structure that defines what events must occur for an undesirable event
to occur. The undesirable event is usually placed at the top of the FTA. Typically two
types of gates are used to show how events at one level can proceed to the next level
up but others do exist. The typical types of gates are:
• OR gate - the event above this occurs if any one of the events joined below this gate
occurs.
• AND gate - the event above this occurs if all of the events joined below this gate
occur.
FTA can be used for simple or complex failure paths, comprising human errors alone or
a mixture of hardware, software, human, and/or environmental events. The structured
events can be quantified, thus deriving a top event frequency. FTA is a good way of
incorporating Human Errors that act as contributors to initiating events in the reliability
assessment. One issue of consideration is the level of component data that is available
(e.g. failure to perform a single action or as a result of the failure to carry out a task).
ETA proceeds from an initiating event typically at the left-hand side of the tree, to
consider a set of sequential events, each of which may or may not occur. This results
normally in binary branches at each node, which continue until an end state of success
or failure in safety terms is reached for each branch. ETA is a good way of representing
the reliability of human actions as a response to an event, particularly where human
performance is dependent upon previous actions or events in the scenario sequence.
This is primarily because ETA represents a time sequence and most operator responses
are based on a sequence of actions that usually have to be carried out in a pre-defined
sequence.
Within both FTA and ETA it is important to recognise the potential of the human to be a
cause of dependent failure. This can either be through the fact that failure to carry out an
initial part of the task influences the probability of succeeding in the remainder of the
task, or that the same error is made when performing the task more than once. A good
example of the potential for dependent failure to occur would be the faulty maintenance
of redundant trains of equipment or miscalibration of multiple sets of instruments being
carried out by the same team. Such errors must not be treated independently, since
underestimation will result. Dependency is generally associated with mistakes rather
than slips. Additionally poor procedures or working practices can also be a frequent
cause of dependent failures.
2.5.2.5 Screening
Screening analysis identifies where the major effort in the quantification effort should be
applied, i.e. those that make the greatest contribution to system risk. In general terms, it
is usually easier to quantify error which refers to the failure to perform a single action.
However it is also unusual to have sufficient resource to, for example, identify all the
potential modes of maintenance error. Therefore a balance must be struck between the
level of modelling and the criticality of the failure. The Systematic Human Action Reliability
Procedure (SHARP) defines three methods of screening logically structured human
errors:
I. Screening out human errors that could only affect system goals if they occur in
conjunction with an extremely unlikely hardware failure or environmental event.
II. Screening out human errors that would have negligible consequences on system
goals.
17 ©OGP
III. Assigning broad probabilities to the human errors based on a simple

categorisation, e.g. as given in Table 2.3.
Table 2.3 Generic Hum an Error Probabilities [15]
CATEGORY FAILURE
PROBABILITY
-3
Simple, frequently performed task, minimal stress 10
-2
More complex task, less time variable, some care necessary 10
-1
Complex unfamiliar task, with little feedback, and some 10
distractions
-1
Highly complex task, considerable stress, little performance 3 × 10
time
0
Extreme Stress, rarely performed task 10 (= 1)
Note: Table 2.7 also contains some generic human error probabilities from a different source
2.5.2.6 Human Error Quantification

Human Error Quantification techniques quantify the Human Error Probability, defined as:
Human error quantification is perhaps the most developed phase of HRA, yet there is
relatively little objective data on human error. Some human error databases are now
becoming available [15], [16]. The use of expert judgement is therefore required with
some of the available techniques that use existing data, where it exists.
Most of the best tools available are in the public domain.
2.5.2.7 Impact Assessment

In order to consider impacts, the results of HRA can be:
• used as absolute probabilities and utilised within PSAs. It would be necessary to
demonstrate whether human error was a major contributor to inadequate system
performance, via analysis of the fault tree to determine the most important events.
Here, HEPs would be used in conjunction with system models to demonstrate that
the system meets acceptable criteria.
• used comparatively to compare alternative work systems to determine which
constitute the higher relative risk and therefore the higher priority for action.
2.5.2.8 Quality and Documentation Assurance

The HRA process must be documented clearly such that they are auditable. Rationale
and all assumptions should be clear, so that the study can be audited, reviewed (e.g. in
the case of a future accident), updated or replicated if necessary.
2.5.3 Techniques
Widely used and available techniques for HRA are:
©OGP 18
• HEART (Human Error Assessment and Reduction Technique)

• THERP (Technique for Human Error Rate Prediction)
• APJ (Absolute Probability Judgement)
2.6 Human Factors in Loss of Containment Frequencies

2.6.1 Rationale
This section describes how Human Factors methods can be used to estimate the human
error component of loss of containment (LOC) frequencies.
According to some sources, the identification of management mechanisms which could
have prevented or recovered unsafe conditions leading to Loss of Containment
accidents, indicates that some 90% of LOC accidents are preventable. However, before
an accident can be prevented the hazard associated with it needs to be identified and
mitigated. These, accidents can be modelled and quantified by estimating the Human
Error rate and probability associated with the event. This in turn can be used to
determine whether the mitigation is truly ALARP.
2.6.2 Stages
To be able to estimate the human error component of LOC, three activities that need to
take place:
1. The human errors need to be established that lead to the LOC
2. The probability of that error occurring needs to be calculated.
3. If there is more than one error, this needs to be combined correctly to provide an
accurate result.
2.6.2.1 Establishing the Human Errors

Before the errors can be assessed their cause and direct consequence need to be
established. This can be established systematically using Hierarchical Task Analysis, or
from expert opinion via a HAZID, HAZOP or OSHA.
These error and events can then be logged and verified as being valid before being
combined with the probability data.
Most people only consider operator errors when looking for the sources of error.
However, examination of major accidents shows management failures to often underlie
these errors in the following organisational areas [17]:
• Poor control of communication and coordination:
− between shifts;
− upward from front line personnel to higher management in the organisational
hierarchy and downward in terms of implementing safety policy and standards
throughout the line of management (particularly in a multi-tiered organisation);
− between different functional groups (e.g. between operations and maintenance,
between mechanical and electrical);
− between geographically separated groups;
19 ©OGP
− in inter-organisational grouping (particularly where roles and responsibilities

overlap) such as in the use of sub-contractors, or in an operation which requires
the co-ordination of multiple groups within the same operational "space";
− in heeding warnings (which is one of the important manifestations of the above
where the indicators of latent failures within an organisation become lost or
buried).
• Inadequate control of pressures:
− in minimising group or social pressures
− in controlling the influence of workload and time pressures
− of production schedules
− of conflicting objectives (e.g. causing diversion of effort away from safety
considerations)
• Inadequacies in control of human and equipment resources:
− where there is sharing of resources (where different groups operate on the same
equipment), coupled with communication problems, e.g. lack of a permit-to-work
(PTW) system.
− where personnel competencies are inadequate for the job or there is a shortage
of staff
− particularly where means of communication are inadequate
− where equipment and information (e.g. at the man-machine or in support
documentation) are inadequate to do the job
• Rigidity in system norms such that systems do not exist to:
− adequately assess the effects and requirements of change (e.g. a novel situation
arises, new equipment is introduced)
− upgrade and implement procedures in the event of change
− ensure that the correct procedures are being implemented and followed
− intervene when assumptions made by front line personnel are at odds with the
status of the system
− control the informal learning processes which maintain organisational rigidity
These are types of failure which can be addressed in a Safety Management System
(SMS) audit to derive an evaluation of the management system.
Further work had been carried out to look at the effectiveness of these error
establishing processes. In a study of accidents [18], [19] in the chemical processing
industry sponsored by the UK Health and Safety Executive, around 1000 loss of
containment accidents from pipework and vessels from onshore chemical and
petrochemical plants were analysed, and the direct and underlying causes of failure
were assessed.
The underlying causes were defined in terms of a matrix which expressed (a) the activity
in which the key failure occurred, and (b) the preventive mechanism failure (i.e. what
management did not do to prevent or rectify the error). The preventive mechanisms are
described below.
Hazard study (of design or as-built)
©OGP 20
Hazard studies of design, such as HAZard and OPerability studies (HAZOP), should
identify and determine design errors and potential operational or maintenance errors to
the extent they fall within the scope of the review. Some underlying causes of failure
will be recoverable at the as-built stage such as certain layout aspects or wrong
locations of equipment. Hazard study covers:
• inadequacies or failures in conducting an appropriate hazard study of design;
• failure to follow-up recommendations of the HAZOP or other hazard study.
Human Factors review

This category specifically refers to cases of failure to recover those underlying causes
of unsafe conditions which resulted in human errors within the operator or maintainer -
hardware system, including interfaces and procedures. These errors are of the type that
can be addressed with a Human Factors oriented review. The unrecovered errors will
be information processing or action errors in the following categories:
• failure to follow procedures due to poor procedural design, poor communication,
lack of detail in PTW, inadequate resources, inadequate training, etc.;
• recognition failures due to inadequate plant or equipment identification, or lack of
training, etc.;
• inability or difficulty in carrying out actions due to poor location or design of
controls.
Task Checking
Checks, inspections and tests after tasks that have been completed should identify
errors such as installing equipment at the wrong location or failure to check that a
system has been properly isolated as part of maintenance.
Routine Checking
The above are all routine activities in the sense that they are part of a vigilance system
on regular look-out for recoverable unsafe conditions in plant / process. These
activities may be similar to the task checking category activities but they are not task
driven. This category also includes failure to follow-up, given identification of an unsafe
condition as part of routine testing or inspection. Evidence for events that would be
included in this category would be:
• equipment in a state of disrepair;
• inadequate routine inspection and testing
The distribution of failures is shown in Table 2.4 and Table 2.5, and graphically in Figure
2.1. Human Factors aspects of maintenance and normal operations account for around
30% of LOC incidents (a similar proportion could have been prevented by a hazard
study of the design (by HAZOP, QRA etc.).
A study of 402 North Sea offshore industry release incidents, from a single operator,
indicates results consistent with those obtained for the onshore plant pipework study
[20].
21 ©OGP
Figure 2.1 Contributions to Pipework Failures According to Underlying

Causes and Preventive Mechanism s [19]
Table 2.4 Distribution of direct causes of pipework and vessel failures

[18],[19][18]
Cause Of Failure % Of Known Causes

Pipework Vessels
Overpressure 20.5 45.2
Operator Error (direct) 30.9 24.5
Corrosion 15.6 6.3
Temperature 6.4 11.2
Impact 8.1 5.6
External Loading 5.0 2.6
Wrong Equipment/Location 6.7 1.9
Vibration 2.5 0
Erosion 1.3 0.2
Other 2.5 2.6
Table 2.5 Percentage Contribution of underlying causes to pipework (P)

(n=492) and vessel (V) failures (n=193)
(all unknown origins and unknown recovery failures rem oved) [19][18]
RECOVERY NOT HAZARDS HUMAN TASK ROUTINE TOTAL

MECHANISM RECOVER STUDY FACTORS CHECKIN CHECKIN
ABLE G G
©OGP 22
Origin P V P V P V P V P V P V
Natural 1.8 0.5 0 0 0 0 0.2 0 0 0 2 0.5
causes
Design 0 0 25 29 2 0 0 0 0.2 0.5 27.2 29.5
Manufacture 0 0 0 0 0 0 2.5 0 0 0 2.5 0
Construction 0.1 0 0.2 0.3 2 0 7.6 1.8 0.2 0 10.1 2.1
Operations 0 0 0.1 5.4 11.3 24.5 1.6 2.1 0.2 0 13.2 32
Maintenance 0 0 0.4 2.1 14.8 5.7 13 3.6 10.5 10.8 38.7 22.2
Sabotage 1.2 1 0 0 0 0 0 0 0 0 1.2 1.0
Domino 4.6 11.9 0.2 0.3 0 0 0 0 0.3 0.5 5.1 12.7
Total 7.7 13.4 25.9 37.1 30.1 30.2 24.9 7.5 11.4 11.8 100 100
The key areas already mentioned for the control of loss of containment incidents, can
be listed as follows (in order of importance for preventing pipework failures):
• Hazard review of design
• Human Factors review of maintenance activities
• Supervision and checking of maintenance tasks
• Routine inspection and testing for maintenance
• Human Factors review of operations
• Supervision and checking of construction/installation work
• Hazard review (audit) of operations
• Supervision and checking of operations
Swain and Guttman [21] have identified a global set of action errors which are
developed in numerous sources on error identification. The following list from [22] can
be used:
• Error of omission: omission of required behaviour
• Error of commission: operation performed incorrectly (e.g. too much, too little),
wrong action, action out of sequence.
• Action not in time: failure to complete an action in time or performing it too late/too
early.
• Extraneous act: performing an action when there is no task demand.
• Error recovery failure: many errors can be recovered before they have a significant
consequence; failure to do this can itself be an error.
2.6.2.2 The Probability of the Error Occurring

Table 2.6 shows the results of research carried out to determine the split on causes of
LOC between the human and equipment failure.
Table 2.6 Split of causes for LOC s in differing industries
SOURCE DOMAIN % CAUSED BY % CAUSED BY REFERENCE

HUMAN EQUIP
23 ©OGP
Generic LOC 40 60 [23]

Crane Accidents 55 45 [24],[25],[26],[27][28]
Chemical Process 60-90 40-10 [28]
Petrochemical 50 50 [28]
Furthermore, in a study of 402 offshore LOC incidents, 47% originated in maintenance,

30% originated in design, 15% in operations, and 8% in construction. Of the
maintenance failures, 65% were due to errors in performing maintenance and 35%
failure to carry out the required activity.
The data which identify the relative contribution of human and hardware failures are
useful for benchmarking in fault tree analysis. This serves as a comparison about
whether the analysis is giving results consistent with the historical data, which is
particularly important when human failure probabilities in fault trees are derived
primarily from expert judgement.
2.6.2.2.1 Example Human Error Rates

A simple guide to generic human error rates is contained in Table 2.7.
Table 2.7 Exam ple Generic Hum an Error Rates [29]
Error Type of behaviour Nominal human error

type probability (per
demand)
-5
1 Extraordinary errors of the type difficult to conceive how 10
they could occur: stress free, powerful cues initiating for
success.
-4
2 Error in regularly performed commonplace simple tasks 10
with minimum stress.
-3
3 Errors of commission such as operating the wrong but- 10
ton or reading the wrong display. More complex task,
less time available, some cues necessary.
-2
4 Errors of omission where dependence is placed on situ- 10
ation cues and memory. Complex, unfamiliar task with
little feedback and some distractions.
-1
5 Highly complex task, considerable stress, little time to 10
perform it.
-1
6 Process involving creative thinking, unfamiliar complex 10 to 1
operation where time is short, stress is high.
Note: Table 2.3 also contains some generic human error probabilities from a different source
2.6.2.2.2 Performance Shaping Factors

Although a great deal is known about the effects of different conditions on human
performance, their quantification in terms of the extent to which error likelihood is
affected is poorly researched. Human Reliability Assessment techniques often provide
a database of the effects of PSFs, and these are generally based on judgement. The
PSFs with the biggest influence, such as high stress or lack of training, are broadly
estimated to result in an order of magnitude increase in error likelihood. Other effects
©OGP 24
relate to performance over time such as a decrease in the ability to remain vigilant over
long periods and hence detect changes in the environment.
Some data on the factors influencing the performance of an individual when carrying
out a task are shown in Table 2.8.
Table 2.8 M ultipliers for Perform ance Shaping Factors [30],[31] (Maxim um
predicted value by which unreliability m ight change going from "good"
conditions to "bad")
Error-Producing condition Multiplier

Unfamiliarity with a situation which is potentially important but which only 17
occurs infrequently or which is novel.
A shortage of time available for error detection and correction. 11
A low signal-noise ratio. 10
A means of suppressing or over-riding information or features which is too 9
easily accessible.
No means of conveying spatial and functional information to operators in a 8
form which they can readily assimilate.
A mismatch between an operator's model of the world and that imagined by a 8
designer.
No obvious means of reversing an unintended action. 8
A channel capacity overload particularly one caused by simultaneous 6
presentation of non-redundant information.
A need to unlearn a technique and apply one which requires the application of 6
an opposing philosophy.
The need to transfer specific knowledge from task to task without loss. 5.5
Ambiguity in the required performance standards. 5
A mismatch between perceived and real risk. 4
Poor, ambiguous or ill-matched system feedback. 4
No clear direct and timely confirmation of an intended action from the portion 4
of the systems over which control is to be exerted.
Operator inexperience (e.g. newly-qualified tradesman vs. "expert"). 3
An impoverished quality of information conveyed by procedures and 3
person/person interaction.
Little or no independent checking or testing of output 3
A conflict between immediate and long-term objectives. 2.5
No diversity of information input for veracity checks. 2.5
A mismatch between the educational achievement level of an individual and 2
the requirements of the task.
An incentive to use more dangerous procedures. 2
Little opportunity to exercise mind and body outside the immediate confines 1.8
of a job.
Unreliable instrumentation (enough that it is noticed). 1.6
A need for absolute judgements which are beyond the capabilities or 1.6
experience of an operator.
Unclear allocation of function and responsibility. 1.6
No obvious way to keep track of progress during an activity. 1.4
A danger that finite physical capabilities will be exceeded. 1.4
25 ©OGP
Error-Producing condition Multiplier

Little or no intrinsic meaning in a task. 1.4
High-level emotional stress 1.3
Evidence of ill-health amongst operatives, especially fever. 1.2
Low workforce morale. 1.2
Inconsistency in meaning of displays and procedures. 1.2
A poor or hostile environment (below 75% of health or life-threatening 1.15
severity).
st
Prolonged inactivity or high repetitious cycling of low mental workload tasks 1.1 for 1
half-hour,
1.05 for
each hour
thereafter
Disruption of normal work-sleep cycles. 1.1
Task Pacing caused by the intervention of others. 1.06
Additional team members over and above those necessary to perform task 1.03
normally and satisfactorily. Multiply per man
Age of personnel performing perceptual task. 1.02
This is a mature and commonly used approach. It is relatively simple to follow and
there are a large number of generic data sources for HEPs. However, it is very
dependent upon the skill of the analyst in identifying opportunities for error. It usually
requires at least a two person specialist team, one for the equipment and one for the
human reliability identification, with some mutual understanding of the operation of the
human-technical system.
2.6.2.3 Overall result

Operator error is incorporated through identification of opportunities for error which
could lead to the initiation of an accident. The opportunities for error could include:
• directly causing an initiating event (e.g. leaving a valve open and starting a pump)
• failing to recover (identify and correct) a mechanical failure or operator error which
directly or indirectly could cause an initiating event (e.g. failure to identify a stuck
valve, fail to check procedure completed)
• indirectly causing an initiating event (e.g. a calculation error, installing the wrong
piece of equipment)
Figure 2.2 shows the overall structure of incorporating human error into FTA
OR
AND
©OGP 26
Figure 2.2 Overall Structure of Incorporating Hum an Error into FTA
AND
To quantify this event so that the probability of the event occurring can be established,
the human error scores or the probability values, along with the performance shaping
factors need to be added to the stages within the FTA. These scores, when combined
together will give a overall likelihood of the event occurring.
Note that the term "operator error" is frequently used to cover all cases of front line
human error such as in maintenance, operations, task supervision, and start-stop
decisions. When identifying opportunities for error, it is usual to express each error as
an external (observable) mode of failure, such as an action error (E.g. doing something
incorrectly). This is preferable to using internal modes of failure (E.g. short term
memory failure).
There is a tendency to overestimate human error probabilities relative to the hardware
failure estimates. One reason is that human error recovery mechanisms are often
forgotten. For example, a maintenance error could be recovered by checking by the
supervisor. This means that in FTA, many human errors should have an AND gate with
error recovery failure. The latter would be 1 if there is no opportunity for error recovery.
For a well designed error management system, the practice is to use an error recovery
failure probability of 10-2.
The data provide a statistical model which has been used as a basis for factoring
Generic LOC data using a Modification of Risk Factor derived from an assessment of
the quality of Safety Management. The modification factor for generic failure rates
ranges between 0.1 and 100 for good and poor management respectively [32], but more
typically between 0.5 and 10 in practice.
2.6.3 Techniques
To complete this task of predicting LOC the following techniques could be used as a set
or individually:
• Hierarchical Task Analysis
• Human Error Assessment and Reduction Technique
• Fault Tree Analysis
27 ©OGP
And supported by:

• HAZIDs
• HAZOPs
• OSHAs
2.7 Human Factors in the determination of event outcomes

2.7.1 Rationale
Event outcome modelling is normally concerned with mitigation and escalation of an
initiating event. The outcome of events can be dependent on operator intervention,
either because the operator is required to perform a primary role, or because the
operator must rectify failures of automatic systems, e.g. if an automatic system fails or
an operator is aware of the event prior to automatic detection.
There are two approaches to event modelling. The first focuses purely on the activities,
errors or lapses that need to occur for the top event to occur. The second adds the
element of time into the equation so that scenarios where the outcome is affected by
response or reaction time can still be accurately modelled.
2.7.2 Stages
Before the event tree can be established, the initiating event and the tasks below that
need to be established. In addition, three human factor issues need to be considered as
part of the event tree. These are:-
• Human detection and recognition of the incident
• Operator activation of an emergency system
• Operator application of a specific procedure
Furthermore, factors that could affect these are:
• reliability of an operator recognising an emergency situation (clarity of the alerting
signal and subsequent information)
• familiarity with the task
• increased stress due to perceived threat
Each of these factors are applicable to both the time related ETA and the non-time ETA.
2.7.2.1 Establishing the top level event

The initiating event can be established from a number of sources. These include:-
• Practical experience – if the analysis is being carried out on a currently operating
system
• HAZID, HAZOP or OSHA – where expert judgement is used to define the critical
events
• Task Analysis – where the primary tasks and outcomes can be established.
©OGP 28
2.7.2.2 Event Tree Analysis

Once the initiating event has been established the event tree can be built around it. The
event tree is constructed by working thorough each of the possible actions that occur
after the initiating event to determine the likelihood of each outcome. Quantification can
be applied to the likelihood of an event occurring. The figures for this can come from a
number of sources including Fault Tree Analysis, Human Error Analysis, expert opinion
and user judgement. These figures are then multiplied together to give a likelihood
score for that end event occurring. The example in Figure 2.3 shows the consequences
of a rupture or leak in an unloading hose at a chemical plant. The contribution of the
human to the event tree could be added as an extra branch along the top of the tree.
Figure 2.3 An exam ple of an event tree
2.7.2.3 Simulating Human Contribution to Event Mitigation

This process differs from the first approach to event tree modelling by quantifying the
time taken to carry out that task. Therefore, a Task Analysis needs to be carried out to
define the steps taken during the event. To each of these tasks a time needs to be
allocated. These times can established either by observation of the task during trial
operational or during training runs. The captured times need to include reaction and
response times to actions as well as the time taken to actually perform the task. This
additional information can then be applied to the model to provide a time based
response to the top event. An example of the time allocation can be seen in Table 2.9.
Table 2.9 Exam ple tim es per task
Task Time taken

Recognise the incident 70 seconds
Request sufficient power to be available to operate the winches 10 seconds
Determine the direction to move the installation 20 seconds
29 ©OGP
Operate the winches so as to slacken and reel in opposing winches 30 seconds

Recognise the failure to request sufficient power 30 seconds
Recognise that the wrong direction has been selected 120 seconds
Recognise that the winches have been operated in the wrong 80 seconds
combination
2.7.2.4 Modifiers
As with all Human Factors and human performance issues, the ability to carry out tasks
can be altered by the environment in which they occur. These are called modifiers and
can affect time to complete the task, the procedure selected and the likelihood of an
error occurring. Example modifiers are:
• The clarity of the signal. If the signal is clear, highly attention gaining, and very
difficult to confuse with any other type of signal (including a false alarm) and the
required action by an operator is do nothing more than acknowledge it, the
-4 -5
likelihood of an operator error is small (in the region of 10 to 10 per demand).
Increasing the complexity of warning signals, therefore requiring the operator to
interpret a pattern of signals, raises the likelihood of error. The effect of a "low
signal to noise ratio" (i.e. signal masked by competing signals, or of low strength in
terms of perceptibility) can increase the likelihood of misdiagnosis by up to a factor
of 10.
• False alarm frequency. Data on human behaviour in fires in buildings shows that
80% to 90% of people assume a fire alarm to be false in the first instance (see
Section 2.8.2.2.2).
• Operator fam iliarity with the task. Due to the low probability of emergency
events operators can have little familiarity with the tasks that they have to perform.
This results in an increased likelihood of error. Table 2.10 below shows the human
error probabilities (HEP) for rule based actions by control room personnel after
diagnosis of an abnormal event [21].
Table 2.10 The hum an error probabilities (HEP) for rule based actions by
control room personnel after diagnosis of an abnorm al event
Potential Errors Hum an Error

error factor
probability
Failure to perform rule-based actions correctly when written procedures are
available and used:
Errors per critical step with recovery factors 0.05 10
Errors per critical step without recovery factors 0.25 10
Failure to perform rule-based actions correctly when written procedures are not
available or used:
Errors per critical step with or without recovery factors 1.0 -
Stress can also effect how a person reacts and has been shown to increase the
likelihood of error. Example modifiers are provided in Table 2.11.
©OGP 30
Table 2.11 Exam ple of Modifiers when Calculating Event Tree Probabilities
Stress Level Modifiers (Multipliers) of Nom inal

HEPs
Skilled Novice
Very low (Very low task load) 2 2
Optimum (Optimum task load):
Step-by-step task 1 1
Dynamic task 1 2
Moderately high (Heavy task load):
Dynamic task 5 10
Extremely High (Threat stress):
Diagnosis task Error probability = 0.25 Error probability = 0.5
(EF = 5) (EF = 5)
Furthermore, where an operator is to perform a number of tasks as part of a predefined

procedure the analyst must decide whether to apply the modifier to some or all of the
errors which may be made in following the procedure. It can be argued that the modifier
should be applied once (i.e. to the procedure as a whole) rather than to each error, since
the tasks are inherently linked by the procedure rather than being independent actions
2.7.3 Techniques
For this process there is not one recommended technique. However the use of
Hierarchical Task Analysis, HEART, THERP and APJ together will help input to the event
tree itself.
2.8 Human Factors in the assessment of fatalities during escape and

sheltering
2.8.1 Rationale
This section deals with the Human Factors issues which have a significant bearing on
the safety of personnel during escape and sheltering. Methods and data are presented
for assessing the likelihood of fatalities as events progress.
The term "escape" is considered to cover the movement of personnel from their initial
location (at the time of the event) to a place of safety. The term "sheltering" is
considered to cover the time spent by personnel within the place of safety. In the UK
offshore regulations, this place of safety is termed the Temporary Refuge (TR) or Place
of Safety (POS). For onshore installations these can include muster points.
Fatalities during escape and sheltering can be divided into three sub-categories, e.g.:
• immediate fatalities - personnel who are in close proximity in the initial stages of the
event
• escape fatalities - personnel who are not initially in close proximity but become
exposed to the event as they attempt to reach a temporary refuge or place of safety.
31 ©OGP
• sheltering fatalities - personnel who are exposed to a hazard while sheltering in the
temporary refuge or place of safety.
In estimating fatalities, assessment of the likelihood of personnel being exposed to the
hazard and the effect of exposure are required.
For hydrocarbon releases the hazards of concern are thermal radiation, explosion
overpressure or toxic gas/smoke inhalation and narcotic effects of hydrocarbon
inhalation, for which the methods of assessing the effect of exposure can include the
use of tolerability thresholds or Probit equations (see Human Vulnerability datasheet).
The estimation of the likelihood of personnel being exposed to a hazard during the
escape and sheltering phases involves both event consequence modelling (e.g. fire
propagation, temporary refuge impairment etc.) and human behaviour modelling. In an
offshore situation the behaviours of interest include:
• time taken to initiate escape
• speed of movement to the temporary refuge
• choice of route so as to minimise exposure
• choice of route based on perception of the hazard
• use of protective equipment.
Statistics for a QRA must be derived by interpreting data taken from a number of
sources. Particular factors to be taken into account in deriving the statistics are:
• the reliability of response to alarms and the effect of false alarm frequency on
response behaviour;
• characteristic behaviour patterns in life threatening situations
• changes in behaviour when exposed to a hazard (e.g. 2 operators died on the Brent
Bravo platform 2003 after they were exposed to light hydrocarbon which dulled their
senses and prevented rational decision making)
2.8.2 Stages
There are 3 key stages that need to be gone through in order to predict the number of
fatalities associated with escape and sheltering. These are:-
• Define the variables (including the Human Factors variables)
• Quantify those variables
• Model the variables
2.8.2.1 Defining the variables

The following list states some of the variables that could be manipulated to determine
the number of fatalities associated with these events:
• Number of people escaping
• The route they take
• Person reaction (time to respond and type of response)
• Where the incident occurred in relation to the temporary refuge / place of safety
• The temporary refuge (size, location, purpose)
©OGP 32
• Availability of Personal Protective Equipment / Personal Survival Equipment

• Training of the escapees in use of PPE and emergency procedures
• Degradation of human performance under the event conditions (stress, exposure to
toxic substances, smoke etc)
• Effect of other persons behaviour (team leader, following the person in front etc )
• Time of day
• Environmental conditions
• A person’s previous experiences
This list is not exhaustive and there may be some site specific variables that could be
added.
2.8.2.2 Quantification of the variables

The data within this section can be used to quantify some of the variables above during
the modelling process.
2.8.2.2.1 Varying the location of the event and the escapee

In analysing, the analyst cannot expect to find universally applicable historical data with
which to assess escape performance as this is location specific. For example, in regard
to the question of how likely it is that personnel will be in the vicinity of an event, the
analyst should consider the types of activities which take place on the installation. A
review should consider whether the alarm could be masked by other noises, and the
procedures followed to investigate an alarm, which may involve an operator being sent
to inspect the area.
Using the layout of the installation and details of the incident (such as availability of
escape ways, level of hazard) software tools can be used to assist in certain aspects of
escape evaluation. Most commonly they are used in the calculation of the time taken for
personnel to reach predefined points of safety. The approaches used by the models
differ and the scope for using them to estimate escape fatalities varies. Models which
may be suitable for applying to offshore installations include: EGRESS, MUSTER,
EVACNET+, SPECS, EXIT89.
A simple method for estimating the likelihood of personnel becoming exposed to a
hazard is to model the structure as a 3-D grid of cells and then consider, for an event in
a specific area, the likelihood of personnel entering the incident area as they make their
way to a TR/POS (see Figure 2.4).
33 ©OGP
Figure 2.4 Plan view of a sim ple bridge-linked platform , dem onstrat
m ethod of estim ating exposure probabilities
In estimating the probability associated with each starting point, not only the routing of
the walkways can be taken into account but some Human Factors issues can be
accommodated in the analysis:
• the detectability of the event (i.e. personnel are more likely to see an ignited release
than an unignited one and re-route accordingly). Events could be grouped together
into categories and a different version of the grid produced for each category.
Detectability can be enhanced indirectly by informative announcements over the PA
system, therefore relevant procedures can be considered in the analysis.
• Preferences for certain walkways/routes. Bias could be introduced into the
probability figures based on the routes used by personnel, including short-cuts that
may have become the norm.
The number of behavioural aspects which have a bearing on escape performance is
large, and for many, data are limited or from a different field of activity. Therefore an
analyst who wishes to reflect a particular working method within the assessment, such
as Buddy-Buddy working, will not have a specific database of statistical evidence with
which to work. This does not imply that the analysis cannot reflect such issues, but it
does imply that doing so requires some insight into the behavioural implications.
Validating a theoretical analysis of escape performance, whether it be performed with
the assistance of a software tool or not, is clearly problematic. Observing the time it
takes personnel to move around the installation and perform relevant tasks is a starting
point. In order to compare these data to the predictions of a model, due account must
be taken of the effects of emergency circumstances on the personnel and the platform
is needed. An approach to validating predictions of escape performance is proposed in
[33].
2.8.2.2.2 Reliability and time to respond to alarms (e.g. time to initiate escape to a TR/POS)
The reliability of response to alarms is a key issue in the assessment of mustering

performance. A large amount of data has been collected with regard to the factors
which affect behaviour following an alarm signal. The findings indicate that the two
dominant factors are:
• previous experience of alarms (false alarms)
©OGP 34
• confirmatory signals (such as smoke, fire, noise)

Data from building evacuations, where a high proportion of fire alarm signals are false,
indicate that a significant proportion of people are likely to seek confirmation before
commencing escape.
Further data to enable the factors affecting false alarm rate and response behaviour to
be identified are not available. It is expected that in the offshore environment the
proportion of personnel seeking confirmation before commencing escape would be less
than suggested by the data in Table 2.12 because of training and an awareness of the
potential danger.
Table 2.12 Data on response to alarm s
Issue Context Finding

Interpretation Fire drill in a building 17% assumed it to be a genuine alarm (sample of 176)
of alarm (without warning) false alarm - 83%
Interpretation Fire drill in a building 14% assumed it to be a genuine alarm
of alarm (without warning)
Interpretation Fire drill in a building 14% assumed it to be a genuine alarm (sample of 96)
of alarm (without warning)
Confirmation Actual fires in 9% (2 of 22) believed there was a fire before seeing flames
of hazard buildings 77% (17 of 22) required visual and other cues
Time to Research into normal 10% chose to evacuate after 35 seconds
respond to an alarms
alarm
Investigation Domestic fires 41 people performed 76 investigative acts
of the alarm
Tackling the Domestic fires 50% (268 out or 541) attempted to fight the fire
hazard
Tackling the Multiple occupancy 9% (9 out of 96) attempted to fight the fire
hazard fires
Use of fire Domestic fires Of 268 who knew of the nearby- location of an
extinguisher extinguisher, 50% tackled the fire but only 23% used the
extinguisher
Assisting Multiple occupancy 25 acts of giving assistance (total of 96 people)
others fires
2.8.2.2.3 Speed of movement of personnel

Data on speed of movement is relatively plentiful, and studies to assess degradation
due to exposure to hazards have been performed. Table 2.13 summarises some
relevant data.
Table 2.13 Data on the speed of m ovem ent

Density of people Unhindered Average speed of 1.4m/s
walking
2
Density of people Movement in 0.05 m/s in density of 0.5m per person
congested
area
Effect of smoke on Evacuation 40% reduction (from normal walking speed)
speed of evacuation from buildings
35 ©OGP
Effect of lighting Evacuation 10% reduction in speed (from normal walking speed)
level on speed of from buildings with emergency lighting of 0.2 lux
evacuation
level on speed of from buildings if fluorescent strips, arrows and signs are used in
evacuation pitch black surrounding
level on speed of from buildings in complete darkness
evacuation
Age of person Unhindered From the age of 19 onwards, decrease in speed of 1-
walking 2% per decade (average 16% reduction by age of 63)
The above table is for uninjured personnel. Although data is not available for personnel
with damaged limbs, a reduction in speed is expected. The relationship between
incapacitation and burns is complicated as burn injuries have a progressive effect. Stoll
and Greene [34] show that for second or third degree burns over 100% of body area, the
percentage incapacitation is less than 10% within the first 5 minutes, rising to 50% after
a few hours and reaching 100% in a day or so.
2.8.2.2.4 Choice of route

The choice of escape route contributes to the likelihood of a person being exposed to
the hazard while making their way to the TR/POS.
Two specific aspects of human behaviour which have been identified through review of
evacuations and are relevant to assessing the likelihood of route choice are:
• familiarity of personnel with the routes (i.e. seldom used emergency routes versus
normal routes);
• obstacles or hazards on the route (in particular the presence of smoke along the
route).
The data in Table 2.14 suggest a strong tendency for personnel to use routes with which
they have the greatest familiarity.
It is worth noting that it is common for personnel to become accustomed to using
routes which were not intended to be normal access routes (i.e. creating shortcuts).
Such an occurrence can invalidate the assumptions in a safety study.
Table 2.14 Hum an Behaviour Data on Choice of Evacuation Routes
Issue Context Finding Ref.

Familiarity with exits Hotel fire 51% departed through normal [35]
entrance
49% departed through fire exit
Familiarity with exits General evacuations 18% went to known exit without [36]
looking for another (sample size 50)
Familiarity with exits Evacuation drill in a 70% left through normal entrance [35]
lecture theatre 30% left through the fire exit
Moving through General evacuations Choice of exit is more influenced by [37]
smoke familiarity with the route than amount
of smoke
Moving through General evacuations 60% attempted to move through [38]
smoke smoke (50% of these moving 10 yards
or more)
©OGP 36
2.8.2.2.5 Performance in the use of Personal Protective Equipment (PPE) or

Personal Survival Equipment (PSE) - reliability of success in using
PPE/PSE and time to use PPE/PSE
In an emergency situation the PPE required to give additional protection can be
relatively complex equipment such as smoke hoods or self contained breathing
apparatus.
In terms of risk assessment, failures or delays in the use of the necessary PPE/PSE can
increase the likelihood of fatalities. Therefore, an estimate of the percentage of the
population who can use PPE/PSE correctly and the likely time taken are relevant.
The findings of a study of the reliability of use of re-generative breathing apparatus are
presented in Table 2.15. The study involved visiting mines and asking miners, without
warning, to put on their apparatus. The authors used a five point rating scale instead of
simple pass or fail categories as they recognised that users may be able to rectify their
mistakes, either by themselves or with the assistance of their colleagues. However, the
category "failing" implies that a user would have very little chance of ever protecting
themselves with the equipment.
Table 2.15 Perform ance in using re-generative breathing apparatus,

m easured at four m ines
Donning Proficiency Profiles at each Mine (% of personnel)

Skill Level M ine A Mine B Mine C Mine D
Failing 6.3 18.2 40.0 6.9
Poor 50 27.3 40.0 6.9
Marginal 15.6 15.2 6.7 6.9
Adequate 15.6 33.3 10.0 44.8
Perfect 12.5 6.0 3.3 34.5
The results of the study show that performance in the use of PPE can be poor. The
authors suggested that training was a dominant contributor to the differences between
the four mines. However, they did not provide details of the training regimes and
therefore insights into the relative importance of induction training or frequency of drills
cannot be gained.
Data on the time to use breathing apparatus is not available. The findings above
suggest that there can be significant differences between personnel who are very
familiar and experienced with the equipment, from those who are not.
2.8.2.2.6 Allowing for degradation in human performance due to toxic or thermal

exposure
The data given in Table 2.15 takes no account of exposure to a hazard. It can be
expected that exposure to a hazard could significantly degrade human performance.
Choice of route, ability to put on a smoke hood, and capability to use an escape system
are examples of behaviour which could be impaired by exposure to a hazard.
In reviewing the data and considering the degree to which performance could be
degraded it is necessary to consider indirect factors such as cognitive performance
degradation, sensory performance degradation, and physical performance degradation
37 ©OGP
(e.g. dexterity and co-ordination) when attempting to assess the effect on performance.
The greater the detriment to these performance parameters, the more likely will errors
be made and the time to perform tasks will increase.
There is limited data on the direct effect of exposure to hazards on human performance
and this is predominantly at concentrations below those possible in incidents. Table
2.16 has data on the effect of smoke inhalation.
Table 2.16 Data on the effect of exposure to sm oke on cognitive abilities

Cognitive Effect of exposure to smoke 100% accuracy at 0.1 ltr/min
abilities on simple arithmetic tasks 58% accuracy at 1.2 ltr/min
Referring to the data on the effects of Hydrogen Sulphide (see Human Vulnerability
datasheet) it is clear that a person’s ability to see will be impaired, and it is possible that
cognitive abilities will be hampered as exposure increases. It is these types of
inferences which are necessary in assessing the effect of exposure on escape
performance and with due regard to PPE requirements.
A viable approach is to assume that a fraction of the lethal concentration is sufficient to
disrupt cognitive abilities. A common choice is to use 15% of the LC50 value as a
threshold where the rate of decision errors is significantly increased.
2.9 Human Factors in the assessment of fatalities during evacuation, rescue

and recovery
2.9.1 Rationale
To evaluate the number of fatalities during evacuation, rescue and recovery, the person
and the environment in which the evacuation and rescue are being made should be
considered along with the equipment to be used and its location. This section will focus
on the Human Factors issues that should be considered as part of the QRA, however
during the QRA both the effect of the equipment and the HF issues mentioned should be
considered in unison.
2.9.2 Stages
2.9.2.1 Scenario definition
Before this analysis can be run the scenario and variables that are to be modelled or
considered need to be determined. For example, the following should be considered:
• Number of people evacuating
• Physical characteristics (size and strength / Anthropometry) of those people
• Layout of the facility to be evacuated
• Route to be taken
• Equipment to be used during the evacuation and rescue
• Environmental conditions
©OGP 38
• Type of event that has caused the escape and rescue. Specifically, the warning time
about the event, whether this event will cause confusion about the best form of
evacuation and rescue.
• Familiarity of the personnel to the evacuation and rescue procedures
• The history of the facility (number of false alarms, personal reaction to alarms)
This list is not exhaustive and there may be some additional site specific considerations
that need to be reviewed.
2.9.2.2 Task Analysis

Once the scenario for modelling has been defined, the detailed tasks to be carried out
need to be established so that the time duration and error analysis can be undertaken.
The most widely used method is called ‘Hierarchical Task Analysis’ or HTA. This
produces a numbered hierarchy of tasks and sub-tasks, usually represented in a tree
diagram format, but may also be represented in a tabular format. It will be necessary to
decide the level of resolution or detail required. In some cases, button presses,
keystrokes etc may need to be described, in other cases, description may be at the task
level. An operator may need to be involved in the study. Once the HTA is complete, each
stage can be reviewed to establish what the human limitations are so that they can be
considered within the analysis.
2.9.2.3 Issue Identification

Below is a summary of the potentially limiting factors that should be considered.
Anthropometry
• A person’s size and shape will have an effect on their ability to fit through escape
hatches and other confined spaces.
• The size of the individuals will effect the number of people who can fit into and move
around an escape craft.
Physiological
• The variations in the human ability to withstand the accelerations associated with
escape (e.g. deploying a life raft) need to be considered.
• The variation in the human body’s ability to survive at sea (cold adaptation, level of
training and survival skills etc)
• The range of strength when comparing individuals. This could affect a person’s
ability to open doors or hatches etc.
Psychological
The requirement for an evacuation implies that there is a significant risk to life.
Consequently the behaviour of personnel will be greatly affected by the stress of the
situation such that:
• the choice of actions is unlikely to be systematically thought through or weighed-up
against all others
39 ©OGP
• over-hasty decisions may be made based on incomplete and insufficient information

• personnel will begin “running on automatic”. There will be a reduction in the
intellectual level, with personnel resorting to familiar actions
• personnel will focus on the immediate task at hand to the exclusion of others and
their ability to take on board new information will be reduced
• personnel may exhibit rigidity in problem solving, e.g. concentrating on one solution
even though it does not work
• performance on seemingly simple tasks will be greatly affected. Tasks requiring
manual dexterity will be very much more difficult and require more time to complete
than in normal circumstances
Other
• The clothing and the kit that the person is wearing / carrying will affect the likelihood
of a person surviving an evacuation and rescue.
• Location of the survival equipment, and the accessibility of it will affect how its
used.
These points are pertinent to the performance of the person in overall charge, referred
to here as the Offshore Installation Manager (OIM). As the person with the role of
evaluating the incident and choosing if, how and when to evacuate, the decisions of the
OIM can influence the outcome.
The OIM could evaluate the conditions on the installation correctly and order an
evacuation at the most opportune moment. The OIM will have been trained in these sort
of events on training simulators. However, the OIM could also:
• delay the evacuation, or fail to give the command to evacuate incurring greater
fatalities than necessary
• give the order to evacuate when there is no need to do so and therefore expose the
personnel to unnecessary risks
• choose the wrong mode of evacuation.
The OIM needs to have decision criteria with which to judge the situation in order to
choose a strategy. Ambiguity in the criteria and uncertainty or inaccuracies in the
information available introduce the chance of a non-optimum strategy being selected.
In addition, the stress of the situation may affect the behaviour of the OIM, and exposure
to smoke or other toxic substances can affect his cognitive performance (see Human
Vulnerability datasheet), adding weight to the argument that the OIM will not always
choose the optimum strategy. Furthermore, the OIM’s training and personal experiences
will affect this decision criteria and this aspect is virtually unquantifiable but yet needs
to be considered.
2.9.2.4 Quantification
Quantification within this process comes in a number of forms, these could be:
• The time taken to complete an activity can be established by either running user
trials or by witnessing training events. The timings taken from these events should
be considered against the environment in which they were taken and then compared
©OGP 40
to the environment in which they will finally be carried out. It is likely that the final
environment is a stressful one which may alter the recorded task time. For example,
under a more stressful environment a person may rush to complete a task (making it
quicker) but this could increase the likelihood of making a mistake (which could
result in the action needing repeating or indeed different action having to be taken).
• Using anthropometric data it is possible to workout the proportion of the population
who cannot use, fit or access a piece of equipment. This will allow a percentage to
given about how many people could use it to escape.
• Human physiological limitations can be defined. This can be used to establish the
number of people who would be able to withstand the physical environment within
which the evacuation is taking place.
• A human error assessment can be carried out on the four stages of evacuation when
using a davit launched or freefall lifeboat system. This can be seen in [39]. This is
only one area of error that could occur. The likelihood of an error occurring should
be established on a case by case basis.
• Research can be carried out to establish how long humans can survive in an escape
made to the sea. The survivability of a person once they are in the water depends on,
water temperature, sea state, physiology of the person, equipment they are using
and their psychological state.
This list is not exhaustive and the variables applicable to the specific scenarios need to
be established.
2.9.2.5 Useful Data

This section is split into data applicable to three scenarios. These are:
• Estimating the proportion of personnel who are unable to use particular evacuation
systems
• Human Factors in lifeboat evacuation modelling
• Estimating fatalities during evacuation by other means
2.9.2.5.1 Estimating the proportion of personnel who are unable to use particular
evacuation systems
Human Physiological Limitations

Accelerations are experienced in accidental collisions (lifeboat striking the installation
structure) or as part of the evacuation process (jumping into the sea from a height,
freefall lifeboat launch, motions of the boat). Table 2.17 gives the average levels of
linear acceleration (g), in different directions, which can be tolerated on a voluntary
basis for specified periods). The figures are provided for acceleration in the x axes
(forwards/backwards) and the z axes (upwards/ downwards) [40].
Table 2.17 Average tolerable levels of linear acceleration (units of g = 9.81

m /s 2 )
Direction of Exposure Time

Acceleration 0.3 6 secs 30 1 min 5 mins 10 20
secs secs mins mins
41 ©OGP
+gz 15 11 8 7 5 4 3.5
-gz 7 6 3.5 3 2 1.5 1.2
+gx 30 20 13 11 7 6 5
-gx 22 15 10.5 8 6 5 4
An approach for evaluating acceleration effects in both conventional and free-fall

lifeboats has been developed from the Dynamic Response Model [41], initially
developed to study the response of pilots during emergency ejection from aircraft [42].
The Dynamic Response Model uses human tolerance criteria and lifeboat accelerations
to infer the response of occupants to accelerations acting at the seat support. The
method establishes an index for relating accelerations to potential injury.
Three levels of risk for acceleration are defined in terms of the probability of injury,
where a high level of risk carries a 50 percent probability of injury, a moderate level has
a 5 percent probability and a low level has a 0.5 percent probability. The derived index
values are presented in Table 2.18.
Table 2.18 Dynam ic Response Index lim its for high, m oderate and low risk
levels
Coordinate Dynam ic Response Index lim its (g)

axis High Risk Moderate Low Risk
Risk
-x 46.0 35.0 28.0
+y 22.0 17.0 14.0
-y 22.0 17.0 14.0
+z 22.8 18.0 15.2
-z 15.0 12.0 9.0
With regard to the launch of freefall lifeboats, the accelerations are designed to be
within tolerable limits and precautions, such as headrest straps, are included in some
designs to further safeguard the occupants. To date, experience has not revealed the
launch process to be intolerable.
The motion of the boat can cause seasickness. However, there is little evidence that
seasickness contributes to death in a TEMPSC [43].
Psychological Restrictions
The use of relatively new evacuation technology, in particular freefall lifeboats, has
raised the issue of the willingness of personnel to use evacuation systems.
Discussions with training centres give large differences ranging from no recorded
refusals to as many as 1 in a 100. Reasons for refusals include concern over prior back
pain/injury.
It is suggested that the refusal rate among personnel would vary with the type of
emergency event on the installation and with the prevailing weather conditions.
©OGP 42
Refusals are likely to increase in poor weather conditions, but decrease with increasing
perceived danger from the incident.
2.9.2.5.2 Human Factors in lifeboat evacuation modelling

Time taken to complete tasks
Table 2.19 shows example times taken to complete the various tasks carried out during
life boat launch.
Table 2.19 Estim ated Tim es for tasks in evacuation by traditional davit-
launched lifeboat (TEMPSC)
Task Nom inal

Tim e
Identify boat is useable (i.e. functioning of systems are checked) 2 min
Embark 6 min
Assess information and decide to descend 30 secs
Delay in descending (if there are difficulties with operating the 2 min
descent system)
Assess information and decide to disconnect 15 secs
Delay with disconnection (if there are difficulties with operating 2 min
the disconnection system)
Disconnect 10 secs
Release hooks manually (if there are difficulties with operating 3 min
the primary release system)
Manoeuvre from immediate vicinity of the installation 2 mins
Task Specific Human Error Rates

Table 2.20 and Table 2.21 present human error rates taken from a study that compared
freefall and davit launched lifeboats [39].
43 ©OGP
Table 2.20 Estim ated hum an errors probabilities (HEP) and possible outcom e in evacuation by freefall lifeboat
Stage Error Contingent Conditions (necessary for the Estimated Outcome

outcome to be realised) HEP (and
1
EF )
-2
Prepare to Hook release not checked Hook attached 10 (5) Death or injury
-1
embark Hook release check fails Catastrophic fault in hook system 10 (10) Death or injury
-2
Fail to correct hook release fault Catastrophic fault in hook system 10 (3) Death or injury
-2
Cradle orientation not checked Cradle not angled correctly after maintenance/drill 10 (10) Death or injury
-2
Cradle orientation check fails Cradle not positioned correctly after maintenance/drill 10 (10) Death or injury
-3
Fail to correct cradle orientation Cradle not positioned correctly after maintenance/drill 10 (3) Death or injury
-2
Protection systems not checked One or more protection systems has a catastrophic 10 (5) Death or injury
-2
Recovery winch connection not fault 10 (5) Occupants stranded in boat
-3
checked 10 (10) Occupants stranded in boat
Fails to detach connected recovery
winch
-3
Embarkation Fail to embark (scenario dependent) 10 (100) Death or injury of an individual
-2
Stretcher carried into boat in wrong 10 (3) Departure delayed
orientation
-3
Departure Straps not used correctly by a 10 (5) Death or injury to the
-3
passenger 10 (5) occupant
-3
Primary release system used 10 (5) Departure delayed
incorrectly Departure delayed
Secondary system used incorrectly
-2
Move Away Gearbox/prop check not done System has a fault 10 (10) Unmanoeuvrable boat
-3
Gearbox/prop check fails System has a fault 10 (10) Unmanoeuvrable boat
-2
Steering check not done System has a fault 10 (10) Unmanoeuvrable boat
-3
Steering system check fails System has a fault 10 (10) Unmanoeuvrable boat
-3
Starting controls not identified System has a fault 10 (5) Unmanoeuvrable boat
-3
Unable to start propulsion system System has a fault 10 (5) Unmanoeuvrable boat
1
EF = Error Factor
1
EF= Error Factor
©OGP 44
Table 2.21 Estim ated hum an errors probabilities (HEP) and possible outcom e in evacuation by conventional davit-
launched lifeboat
Stage Error Contingent Conditions (necessary Estimated Possible outcome

for the outcome to be realised) HEP (EF)
-3
Prepare to Davit structure not checked Catastrophic fault in structure 10 (5) Death or injury
-3
embark Davit structure check fails Catastrophic fault in structure 10 (3) Death or injury
-2
Winch system not checked Catastrophic fault in winch system 10 (10) Death or injury
-2
Winch system check fails Catastrophic fault in winch system 10 (10) Death or injury
-2
Maintenance Pendants not checked Maintenance pendants attached 10 (5) Departure Prevented
-2
Maintenance Pendants check fails Maintenance pendants attached 10 (10) Departure Prevented
-2
Winch system not checked Winch system not functioning 10 (10) Departure Prevented
-2
Winch system check fails Winch system not functioning 10 (10) Departure Prevented
-2
Hook release not checked Release system not functioning 10 (5) Occupants Stranded
-1
Hook release check fails Release system not functioning 10 (10) Occupants Stranded
-2
Fails to correct hook release fault Release system not functioning 10 (3) Occupants Stranded
-2
Winch system not checked Winch system fails during descent 10 (10) Occupants Stranded
-2
Winch system check fails Winch system fails during descent 10 (10) Occupants Stranded
-3
Embarkation All passengers do not embark 10 (100) Death or injury of
-3
Stretcher-bound injured do not embark 10 (5) person
-3
Departure Primary release system used incorrectly 10 (5) Departure Delayed
-3
Secondary system (if available) used incorrectly 10 (5) Departure Delayed
-3
Brake release not continuous 10 (5) Departure Delayed
-3
Wrong controls selected 10 (5) Departure Delayed
-3
Primary hook release system controls not operated 10 (5) Departure Delayed
-3
Occupants do not know how to use hook release 10 (5) Departure Delayed
-3
Occupants don’t know how to manually release hooks 10 (5) Departure Delayed
-2
Occupants do not know how to override hydrostatic hook 10 (10) Departure Delayed
release system interlock
-2
Move Away Incorrect direction navigated 10 (5) Death or injury
-3
Secondary manual release mechanism not operated 10 (5) Departure Prevented
-3
Primary release mechanism not operated 10 (5) Departure Delayed
-2
Incorrect direction navigated 10 (5) Departure Delayed
-2
Gearbox/prop check not done 10 (10) Unmanoeuvr. Boat
-3
Gearbox/prop check fails 10 (10) Unmanoeuvr. Boat
-2
Steering check not done 10 (10) Unmanoeuvr. Boat
-3
Failure of steering check 10 (10) Unmanoeuvr. Boat
-3
Starting controls not identified 10 (5) Unmanoeuvr. Boat
-3
Unable to start propulsion system 10 (5) Unmanoeuvr. Boat
1
EF = Error Factor
45 ©OGP
2.9.3 Techniques
To complete this assessment a number of different techniques could be employed.
There is no one correct answer and the structure, order and detail of the individual
assessments will depend on the level of risk associated with the event and the level of
detail required in the output.
Software models are available for assessing lifeboat evacuation, examples being
ESCAPE and FARLIFE. The ESCAPE programme is based on the Department of Energy
study. The FARLIFE programme is a time based simulator which can use the same data
and can include operational errors within the model
2.9.3.1 Estimating fatalities during evacuation by other means

2.9.3.1.1 Escape to Sea
Table 2.22 gives statistics for fatality rates as guidelines.
Table 2.22 Guidelines for fatality estim ates
M ode Factors Fatality ranges Data

Source
Personnel killed by Jumping height 1-5% for low heights Judgement
escaping direct to
sea 5-20% for large heights Judgement
2.9.3.1.1.1 Survival in the water

Table 2.23 gives survival time data or personnel not wearing survival suits [44].
Table 2.23 50% Survival Tim es for Conventionally Clothed Persons in still
water [44]
W ater tem perature Survival tim e for

(°C) 50% of persons
(hrs)
2.5 0.75
5 1
7.5 1.5
10 2
12.5 3
15 6
For personnel wearing a survival suit the time is significantly increased. New designs
have been shown to protect for over 4 hours at water temperature of 4°C [45]. Further
information is presented in the Human Vulnerability datasheet.
For the QRA analyst a key concern will be the number who have successfully donned
survival suits and life jackets before entering the water. Given that personnel who
escape to sea are unlikely to have had much time to prepare for their escape, the
likelihood of them putting on the safety clothing will be dependent on its accessibility.
©OGP 46
The analyst should consider whether the equipment is provided at the probable points
of alighting the installation or whether they are stowed in remote lockers.
The initial risk when entering the sea is from ‘cold shock’ which can cause you to inhale
even when underwater due to an involuntary gasping reflex [46].
2.9.3.1.1.2 Recovery from the sea

A review of the performance of attendant vessels in emergencies offshore [47] suggests
that the success for recovering personnel from the sea ranges between approximately
10% and 95% depending on the type of vessel and weather conditions.
Once individuals have been in the water for 3hrs or more they will become scattered
making locating and rescuing them more difficult.
Once recovery has been achieved there is still the risk of post-immersion collapse. This
could occur as the individual looses the hydrostatic assistance to circulation, leading to
collapse of blood pressure and consequent reduced cardiac output [46].
2.9.3.1.1.3 Modelling of Survivability

Robertson [46] found the Wissler model to be the most usable computer model when
predicting fatalities once they are in the water. This model uses the following
assumptions that are useful to note:
• Survival time will be reduced by 50% if the sea state is at Beaufort scale 3 rather
than 0. This is due to the increase in activity required to stay afloat and prevent
drowning.
• Survival time will be reduced by 10% if there is a 1 litre leakage of water into the
survival suit.
• An insulated immersion suit could increase the survival time by a factor of ten when
compared with a membrane suit.
• This model uses data about survival rate and water temperature to assessment
survivability.
• Each percentage of body fat equates approximately to a 0.1°C rise in deep body
temperature.
Many parameters can be varied within this model. However, there are many variable
which can effect a persons ability to survive and some of these are impossible to
determine. For example, the psychological factor of ‘giving up’ or ‘determination’ could
play a large part in a person’s ability to survive especially over drawn out period of time.
47 ©OGP
3.0 Additional Resources

3.1 Legislation, guidelines and standards
3.1.1 UK Legislation, Guidelines and Standards
The European Commission now defines many of the legal requirements for the UK.
Each Member State is then responsible for incorporating these requirements into their
domestic law.
The Health & Safety Com m ission (HSC) are the UK body that controls all health
and safety issues within the UK. The Health and Safety Executive (HSE) are the
government agency responsible for regulations and their enforcement through
inspection and investigation. See http://www.hse.gov.uk/.
3.1.2 Key Guidance and References

3.1.2.1 HSE Publications
http://www.hsebooks.co.uk/
http://www.hse.gov.uk/signpost/index.htm
http://www.hmso.gov.uk/
• HSE (1990) Noise at work: Noise assessment, information and control: Guidance
notes. HSE Books.
• HSE (1995) Improving compliance with safety procedures: Reducing industrial
violations. HSE Books.
• HSE (1997) Successful health and safety management, HSG 65. HSE Books.
• HSE (1998) Manual Handling: Guidance on Manual Handling Operations Regulations
1992, L23. HSE Books.
• HSE (1998) A guide to the Offshore Installations (Safety Representatives and Safety
• Committees) Regulations 1989: Guidance on Regulations, L110. HSE Books.
• HSE (1998) A guide to the Offshore Installations (Safety Case) Regulations 1992:
Guidance on Regulations, L30. HSE Books.
• HSE (1998) Safe use of lifting equipment: Approved code of practice and guidance
for the Lifting Operations and Lifting Equipment Regulations 1998, L113. HSE Books.
• HSE (1999) A guide to the Control of Major Accident Hazards Regulations 1999:
Guidance on Regulations, L111. HSE Books.
• HSE (1999) Reducing error and influencing behaviour, HSG 48. HSE Books.
• HFRG (2000) Improving maintenance: A guide to reducing human error. HSE Books.
3.1.2.2 British Standards

http://bsonline.techindex.co.uk/
• BS EN ISO 9241-1 (1997) Ergonomics requirements for office work with visual
display terminals (VDTs) - Part 1: General introduction.
• BS EN 9241-2 (1993) Ergonomics requirements for office work with visual display
terminals (VDTs) - Part 2: Guidance on task requirements.
©OGP 48
• BS EN 9241-3 (1993) Ergonomics requirements for office work with visual display
terminals (VDTs) - Part 3: Visual display requirements.
display terminals (VDTs) - Part 4: Keyboard requirements.
display terminals (VDTs) - Part 5: Workstation layout and postural requirement.
display terminals (VDTs) - Part 6: Guidance on the work environment.
display terminals (VDTs) - Part 7: Requirements for display with reflections.
display terminals (VDTs) - Part 8: Requirements for displayed colours.
display terminals (VDTs) - Part 9: Requirements for non-keyboard input devices.
display terminals (VDTs) - Part 10: Dialogue principles.
display terminals (VDTs) - Part 11: Guidance on usability.
display terminals (VDTs) - Part 12: Presentation of information.
display terminals (VDTs) - Part 13: User guidance.
• BS ISO 9241-14 (1997) Ergonomics requirements for office work with visual display
terminals (VDTs) - Part 14: Menu dialogues.
display terminals (VDTs) - Part 15: Command dialogues.
display terminals (VDTs) - Part 16: Direct manipulation dialogues.
display terminals (VDTs) - Part 17: Form-filling dialogues.
• BS EN ISO 7250 (1998) Basic human body measurements for technological design.
• DD 202 (1991) Ergonomics principles in the design of work systems Draft for
development.
• BS EN 60073 (1997) Basic and safety principles for man-machine interface, marking
and identification - Coding principles for indication devices and actuators.
3.1.2.3 ISO Standards

http://www.iso.ch/iso/en/ISOOnline.frontpage
• ISO 11064-1 (2000) Ergonomic design of control centres - Part 1: Principles for the
design of control centres, Working draft.
• ISO 11064-2 (2000) Ergonomic design of control centres - Part 2: Principles for
control suite arrangement.
49 ©OGP
• ISO 11064-3 (2000) Ergonomic design of control centres - Part 3: Control room
layout.
• ISO 11064-4 (2000) Ergonomic design of control centres - Part 4: Workstation layout
and dimensions
• ISO 11064-5 (2000) Ergonomic design of control centres - Part 5: Displays and
controls.
• ISO 11064-6 (2000) Ergonomic design of control centres - Part 6: Environmental
requirements, Working draft.
• ISO 11064-7 (2000) Ergonomic design of control centres - Part 7: Principles for the
evaluation of control centres.
• ISO 11064-8 (2000) Ergonomic design of control centres - Part 8: Ergonomics
requirements for specific applications.
3.2 Key Societies and Centres

There are several main bodies worldwide that cover Human Factors professionals.
3.2.1 United Kingdom

The Ergonomics Society is the professional body within the UK for ergonomics and
Human Factors practitioners. Individual registered members are required to have
completed an accredited university degree and have at least three years professional
experience. The Society outlines a Code of Conduct with which all members are
required to comply. For further information see http://www.ergonomics.org.uk/
3.2.2 Europe
The Centre for Registration of European Ergonom ists (CREE) holds a similar
register. Individuals must have a broad-based ergonomics degree qualification, together
with further experience in the use and application of ergonomics in practical situations
over a period of at least two years. The European Ergonomist category is approximately
equivalent to the Ergonomic Society’s Registered Member grade. For further
information see http://www.eurerg.org/
The Hum an Factors and Ergonom ics Society, Europe Chapter, is organised to
serve the needs of the Human Factors profession in Europe. This is a sub-society of the
US-based Human Factors and Ergonomics Society. For further information about their
aims and roles see http://www.hfes-europe.org/
Other ergonomics and Human Factors societies exist throughout Europe. Further
information can be found at the following websites:
• Federation of European Ergonom ics Societies: http://www.fees-network.org/
• Irish Ergonom ics Society: http://www.ul.ie/~ies/
• Society for French Speaking Ergonom ists: http://www.ergonomie-self.org/
• Germ an Ergonom ics Society: http://www.gfa-online.de/englisch/english.php
• Dutch ergonom ics Society: http://www.ergonoom.nl/NVvE/en
• Italian Ergonom ics Society: http://www.societadiergonomia.it/
©OGP 50
• Hellenic Ergonom ics Society: http://www.ergonomics.gr/index_en.htm

• Belgian Ergonom ics Society: http://www.besweb.be/
• Swiss Ergonom ics Society: http://www.swissergo.ch/en/index.php
3.2.3 Scandinavia
Ergonomics has a high profile in Scandinavian countries. There are several national
societies:
• Norwegian Ergonom ics Society: http://www.ergonom.no/ (Nowegian only)
• Swedish Ergonom ics Society: http://www.ergonomisallskapet.se/ (Swedish
Only)
• Finnish Ergonom ics Society: http://www.ergonomiayhdistys.fi/
Addresses and further details of how to contact these societies can be found at the
Nordic Ergonomics Society’s website
http://www.ergonom.no/Html_english/s02a01c01.html
3.2.4 United States and Canada

The Hum an Factors & Ergonom ics Society encourages education and training for
those entering the Human Factors and ergonomics profession and for those who
conceive, design, develop, manufacture, test, manage, and participate in systems. For
more information see http://hfes.org/
Association of Canadian Ergonom ists (Formerly the Human Factors Association
of Canada) http://www.ace-ergocanada.ca/
3.2.5 South America

• Argentinean Ergonom ics Society: www.geocities.com/CapeCanaveral/6616/
(Spanish only)
• Chilean Ergonom ics Society: http://sochergo.ergonomia.cl/ (Chilean Only)
3.2.6 Australia and New Zealand

The Ergonom ics Society of Australia (ESA) is the professional organisation of
Ergonomists in Australia. Its purpose is to promote the principles and practice of
ergonomics throughout the community. It has over 500 members. ESA is one of 36
federated societies worldwide that comprise the International Ergonomics Association
(IEA). See http://www.ergonomics.org.au/
New Zealand Ergonom ics Society (NZES) can be found at
http://www.ergonomics.org.nz/
3.2.7 Rest of the World

The International Ergonom ics Association is the federation of ergonomics and
Human Factors societies from around the world. The mission of IEA is to elaborate and
advance ergonomics science and practice, and to improve the quality of life by
51 ©OGP
expanding its scope of application and contribution to society. The IEA is governed by
the Council with representatives from the federated societies. Day-to-day administration
is performed by the Executive Committee that consists of the elected Officers and
Chairs of the Standing Committees. See http://www.iea.cc/
Further websites available for the rest of the world include:
• The Hong Kong Ergonom ics Society: http://www.ergonomics.org.hk/
• Iranian Ergonom ics Society: http://www.modares.ac.ir/ies/
• Ergonom ics Society of Korean: http://esk.or.kr/(Korean Only)
• Ergonom ics Society of Taiwan: http://esk.or.kr/
• Ergonom ics Society of Thailand: http://www.est.or.th/index.html (Thai Only)
• Indian Society of Ergonom ics: http://www.ise.org.in/
• Ergonom ics Society of South Africa has its own website at
http://www.ergonomics-sa.org.za/
4.0 References & Bibliography

4.1 References
[1] HSE, 1999. Reducing error and influencing behaviour (HSG48). HSE Books.
[2] Christensen, JM. Human Factors definitions, Human Factors Society Bull., 31(3),
8-9.
[3] HSE, 2003. Development of Human Factors methods and associated standards for
major hazard industries, RR081/2003.
http://www.hse.gov.uk/research/rrhtm/rr081.htm
[4] HSE, 2002. Strategies to promote safe behaviour as part of a health and safety
management system, CRR430/2002.
http://www.hse.gov.uk/research/crr_htm/2002/crr02430.htm
[5] HSE, 2006. Managing shiftwork: health and safety guidance, HSG256, Sudbury,
Suffolk: HSE Books.
[6] HSE, 1997. Guidance on permit-to-work systems in the petroleum industry,
ISBN 0 7176 1281 3, Sudbury, Suffolk: HSE Books.
[7] OLF Guideline no. 088 Common model for work permits.
http://www.olf.no/guidelines/common-model-for-work-permits-article2954-
301.html
[8] HSE, 2003. Competence assessment for the hazardous industries. RR086/2003.
[9] HSE, 2007. Development of a working model of how Human Factors, safety
management systems and wider organisational issues fit together, RR543/2007.
[10] Stein, E.S. and Rosenberg, B, 1983. The Measurement of Pilot Workload, Federal
Aviation Authority, Report DOT/FAA/CT82-23, NTIS No. ADA124582, Atlantic City.
[11] Reason, J., 1990. Human Error, Cambridge: Cambridge University Press.
[12] Kirwan, B., 1992a. Human error identification in human reliability assessment.
Part 1: Overview of approaches. Applied Ergonomics, 23(5), 299-318.
©OGP 52
[13] Spurgin, A.J., Lydell, B.D., Hannaman, G.W. and Lukic, Y., 1987. Human Reliability
Assessment: A Systematic Approach. In Reliability ‘87, NEC, Birmingham, England.
[14] Rasmussen, J., 1981. Human Errors. A Taxonomy for Describing Human Malfunction
in Industrial Installations, Risø National Laboratory, DK-4000, Roskilde, Denmark.
[15] Kirwan, B., 1994. Human reliability assessment. In J.R. Wilson and E.N. Corlett
(eds.), Evaluation of Human Work. London: Taylor and Francis, pp. 921-968.
[16] Gibson, W.H. and Megaw, T.D., 1999. The Implementation of CORE-DATA, a
Computerised Human Error Probability Database. HSE Contract Research Report
245/1999. http://www.hse.gov.uk/research/crr_pdf/1999/crr99245.pdf
[17] Bellamy, L.J., Wright, M.S. and Hurst, N.W., 1993. History and development of a
safety management system audit for incorporation into quantitative risk
assessment, International Process Safety Management Workshop, San Francisco,
22-24 September, AIChemE/CCPS.
[18] Bellamy, L.J. and Geyer, T.A.W., 1991. Organisational, Management and Human
Factors in Quantified Risk Assessment, HSE Contract Research Report 33/1991.
http://www.hse.gov.uk/research/crr_pdf/1999/crr99245.pdf
[19] Bellamy, L.J., Geyer, T.A.W., and Astley, J.A.A., 1989. Evaluation of the human
contribution to pipework and in-line equipment failure frequencies, HSE Contract
Research Report No. 89/15.
http://www.hse.gov.uk/research/crr_pdf/1989/crr89015.pdf
[20] Four Elements, 1993. Report No. 2258.
[21] Swain, A.D. and Guttman, H.E., 1983. A Handbook of Human Reliability Analysis
withEmphasis on Nuclear Power Applications. NUREG/CR-1278, USNRC,
Washington DC-20555.
[22] Bellamy, L.J., 1986. The Safety Management Factor: An Analysis of the Human
Error Aspects of the Bhopal Disaster, Safety and Reliability Society Symposium, 25
September , Southport, UK.
[23] Hurst, N.W., Bellamy, L.J. and Geyer, T.A.W., 1991. A classification scheme for
pipework failures to include human and sociotechnical errors and their
contribution to pipework failure frequencies, J. Haz. Mat., 26, 159-186.
[24] Danos W., and Bennett L.E., 1984. Risk Analysis of Crane Accidents, U.S.
Department of the Interior/Minerals Management Service, OCS Report MMS 84-
0056.
[25] Sutton R., and Towill D.R., 1982. A model of the crane operator as a man-
machine element, Proc. Second European Annual Conference on Human Decision
Making and Manual Control, pp25-42, June 2-4, University of Bonn, Poppelsdorfer
Schloss. Forschungsinstitut fur Anthropotechnik, FGAN/FAT, Federal Republic of
Germany: Wachtberg-Werhoven.
[26] Butler A.J., 1978. An investigation into crane accidents, their causes and repair costs,
Building Research Establishment Report CP75/78, Department of the
Environment.
[27] Wiken H., 1978. Offshore Crane Operations, Progress Report no 1, Study of offshore
crane casualties in the North Sea, Det Norske Veritas Technical Report 78-633.
53 ©OGP
[28] Kariuki, G. & Löwe, K., 2004. Incorporation Of Human Factors In The Design Process
, guide prepared for PRSIM Focus Group 4, Institute for Plant and Process
Technology, Process Safety and Plant Technology, Technische Universität
Berlin, Germany.
[29] Hunns, DM and Daniels, BK, 1980. The Method of Paired Comparisons,
Proceedings 6th Symp. on Advances in Reliability Technology, Report NCSR R23 and
R24, UK Atomic Energy Authority.
[30] Williams, J.C., 1988. A data-based method for assessing and reducing human
error to improve operational experience, Proc. IEEE 4th Conference on Human
Factors in Power Plants, Monterey, CA, 6-9 June.
[31] SRD/Humphreys, P. (ed.), 1988. Human Reliability Assessors Guide, Safety and
Reliability Directorate Publication RTS 88/95Q, Warrington: UK Atomic Energy
Authority
[32] Muyselaar, A.J. and Bellamy, L.J., 1993. An audit technique for the evaluation
and management of risks, CEC DGXI workshop on Safety Management in the
Process Industry, October 7-8, Ravello, Italy.
[33] Jack M., King D., 1993. Practical validation of installation evacuation, escape and
rescue, (EER) systems, Response to incidents offshore, 8-9 June, Aberdeen, IBC
Technical Services.
[34] Stoll A.M. and Greene L.C., 1959. Relationship between pain and tissue damage
due to thermal radiation, J. Appl. Physiol., 14, 373.
[35] Sime, 1985a. Movement towards the unfamiliar: Person and place affiliation in a
fire entrapment setting, Environment and Behaviour, 17:6, 697-724.
[36] Sixsmith, A.J., Sixsmith, J.A. & Canter, D.V., 1988. When is a door not a door? A
study of evacuation route identification in a large shopping mall, in Safety in the
Built Environment, ed. Sime, J.D., 62-74, E&FN SPON, London.
[37] Horiuchi, S., Murozaki, Y. & Hokuso, A., 1986. A case study of fire and
evacuation in a multi-purpose office building, Osaka, Japan, in Fire Safety
Science: Proceedings of the first International Symposium, eds. C.E.Grant &
P.J.Pagni, Washington DC, Hemisphere Publishing Corp., Washington DC.
[38] Wood, 1972. The behaviour of people in fires, Fire Research Note 953.
Borehamwood: Fire Research Station. UK.
[39] Four Elements, 1993. Freefall versus davit launched lifeboats: Human Factors study,
Project Ref. 2334.
[40] Sanders, M.S. and McCormick, E.J, 1987. Human Factors in Engineering and
Design, 6th. ed., ch17, 486-517, McGraw-Hill International Editions.
[41] Brinkley, J.W, 1984. Personnel Protection concepts for advanced escape system
design, AGARD conference proceedings, Human Factors Consideration in High
Performance Aircraft, pp6-1 to 6-12.
[42] Nelson, J.K., Hirsch, T.J. and Phillips, N.S, 1989. Evaluation of Occupant
accelerations in lifeboats, J. Offshore Mechanics and Arctic Engineering, III, 344-
349.
©OGP 54
[43] Landolt, J.P., Monaco, C., 1989. Seasickness in Occupants of Totally-Enclosed

Motor-Propelled Survival Craft (TEMPSC),
[44] Golden FstC. 1976. Hypothermia a Problem for North Sea Industries, J. Soc.
Occup. Med., 26, 85-88.
[45] Health and Safety at Work, 13:12, Croydon: Tolley Publishing Co Ltd..
[46] Robertson, D.H. and Simpson, M.E.. Review of Probable Survival Times for
Immersion in the North Sea, Offshore Technology Report OTO 95 038.
http://www.hse.gov.uk/research/otopdf/1995/oto95038.pdf
[47] Technica, 1987. The Performance of Attendant Vessels in Emergencies Offshore, A
study carried out for the UK Department of Energy, OTH 97 274.
4.2 Bibliography
American Conference of Governmental Industrial Hygienists, (1980) Hydrogen Sulphide
in Documentation of the Threshold Limit Values, 4th Edition, ACGIH, Cincinnati, p
225.Ahlborg, G., (1951) Hydrogen Sulphide Poisoning in Shale Oil Industry in Arfch.
Industrial Hygiene and Occupational Medecine, 3, p 247.
Bellamy, L.J., et al. (1990) Experimental programme to investigate informative fire warning
characteristics for motivating fast evacuation, Building Research Establishment, Garston,
Watford, U.K.
Bellamy, L.J., Geyer, T.A.W., and Astley, J.A.A. (1989) Evaluation of the human
contribution to pipework and in-line equipment failure frequencies. HSE Contract
Research Report No. 89/15.
Brabazon P.G., Gibson W.H., Tinline G., Leathley B.A., Practical Applications of Human
Factors Methods in Offshore Installation Design. Offshore South East Asia, 6-9
December, 1994
Brown W et al., The qualification of human variability and its effect on nuclear power
plant risk, Brookhaven National Laboratory, Upton, NY, 1990
Canter, D. (1980) (ed) Fires and Human Behaviour, Chichester: Wiley.
Canter, D. (1984) Studies of human behaviour in fire: empirical results and their implications
for education and design. Building Research Establishment, Garston, Watford, U.K.
Crossthwaite, P.J., Fitzpatrick, R.D., Hurst, N.W. Risk assessment for the siting of
developments near liquefied petroleum gas installations, IChemE Symposium Series 110
Dalkey, N. C. (1972. The Delphi method: An experimental study of group opinion. In N. C.
Dalkey, D. L. Rourke, R. Lewis, & D. Snyder (Eds.. Studies in the quality of life: Delphi and
decision-making (pp. 13-54. Lexington, MA: Lexington Books.
DeGroot, M. (1974), " Reaching a consensus", Journal of the American Statistical
Association, Vol. 69 No.345, pp.118-21.
Edelman, H. & Bichman, E. (1980) A model of behaviour in fires applied to a nursing home
fire in Fires and Human Behaviour (Ed. Canter, D.) 181-204, Chichester: Wiley.
Eisenberg et al., (1975) Vulnerability Model. A Simulation Systems for Assessing Damage
Resulting from Marine Spills. Nat. Tech. Service Report, AD-A015-245, Springfield, VA
Elkins, H.B., (1952) Hydrogen Sulphide in The Chemistry of Industrial Toxicology, New York:
John Wiley & Sons, p 95 & 232.
55 ©OGP
Embrey, D.E. (1986. SHERPA - a systematic human error reduction and prediction
approach. Paper presented at the International Topical Meeting on Advances in Human
Factors in NuclearPower Systems, Knoxville, Tennessee.
Ergonomics, 33 (10/11), 1365-1375.
ESCAPE, DNV Technica
Evacuation Model, Railway Gazette International, Vol 149, no 10, October 1993, p. 713
Evans, C.L., 1967. The toxicity of Hydrogen Sulphide and other Sulphides in Journal of
Experimental Physiology, 52 (3), p 231.
Fahy R.F., EXIT89: an evacuation model for high-rise buildings. In: Fire Safety Science -
proceedings of the third international symposium, London. Elsevier, 1991, p 815-823,
ISBN 1851667199
FARLIFE, Four Elements, 1993
Fruin, J.J. (1970) Designing for pedestrians - A level of service concept. Ph.D. Dissertation,
The Polytechnic Institute of Brooklyn, June, 1970.
Gafafer, W.M. Ed. (1964) Hydrogen Sulphide, in Occupational Diseases: A Guide to their
Recognition, Public Health Service Publication. No. 1097, US Department of Health,
Education and Welfare, Washington, DC, p 163.
Gibson, H., Basra, G., and Kirwan, B. Development of the CORE-DATA database. Safety
& Reliability Journal, Safety and Reliability Society, Manchester, 19, 1, 6-20, 1999.
Grandjean, E & Kroemer, K.H.E. (1999. (5th Ed.) Fitting To The Task; A Textbook Of
Occupational Ergonomics. Taylor & Francis: London.
Haggard, H.W., 1928. The Toxicology of Hydrogen Sulphide, Journal of Industrial Hygiene,
7, p 113
Health and Safety Executive (1996. Collection of Offshore Human Error Probability Data -
Volume 1: Main Report; Volume 2: Appendices. Health & Safety Executive, London,
Offshore Technology Report - OTO 95 037.
Herd C.J., Jones R.H., Lewis K., Evacuation, escape and rescue analysis by integrated risk
assessment. In: Risk analysis in the offshore industry II, Aberdeen, 25-27 March 1991.
IBC Technical Services.
HFRG (1995. Improving compliance with safety procedures: reducing industrial
violations. HSE Books.
Himann, Cunningham, Rechnitzer & Paterson, 1988
Hollnagel, E. (1993. Human Reliability Analysis: Context and Control. London: Academic
Press.
HSE (1997. Successful Health and Safety Management (HSG65. HSE Books.
HSE (1998), Assessment principles for Offshore Safety Cases, HSG181, HSE Books,
Norwich.
HSE (2001), Human Factors for COMAH Safety Report Assessors, HID Central Division
Human Factors Team.
Human factors: Inspectors human factors toolkit.
http://www.hse.gov.uk/humanfactors/comah/toolkit.htm
©OGP 56
Humphreys, P. (1988. Human reliability assessors guide: an overview. In B.A. Sayers

(Ed.), Human Factors and Decision Making: Their Influence on Safety and Reliability. London:
Elsevier Applied Science, pp. 71-86.
Humphreys, P. (Ed.) (1995. Human Reliability Assessors Guide: A Report By The Human
Factors In Reliability Group. SRD Association, Warrington.
Johnstone, R.T. and Saunders, W.B. (Eds.) (1960). Noxious Gases: Hydrogen Sulphide
(H2S) in Occupational Diseases and Industrial Medicine, W.B. Saunders, Philadelphia, p
115.
Jones, J.P., (1975) Hazards of Hydrogen Sulphide Gas, Selected Papers from the 23rd
Annual Gas Measurement Institute, 16.
Ketchell N., et al, When and how will people muster. In: Response to incidents offshore, 8-
9 June 1993, Aberdeen, IBC Technical Services
Kirwan, B & Ainsworth, L.K. (1992. A Guide To Task Analysis. Taylor & Francis: London.
Kirwan, B. (1988. A comparative evaluation of five human reliability assessment
techniques. In B.A. Sayers (Ed.), Human Factors and Decision Making: Their Influence on
Safety and Reliability. London: Elsevier Applied Science, pp. 87-109.
Kirwan, B. (1992. Human error identification in human reliability assessment. Part 1:
Detailed comparison of techniques. Applied Ergonomics, 23 (6), 371-381.
Kirwan, B. (1996. The validation of three Human Reliability Quantification techniques -
THERP, HEART and JHEDI: Part I - Technique descriptions and validation issues.
Applied Ergonomics, 27 (6), 359-373.
Kirwan, B. (1997. The validation of three Human Reliability Quantification techniques -
THERP, HEART and JHEDI: Part III - Practical aspects of the usage of the techniques.
Applied Ergonomics, 28 (1), 27-39.
Kirwan, B. (1997. Validation of Human Reliability Assessment techniques: Part 1 –
Validation issues. Safety Science, 27 (1), 25-41.
Kirwan, B. (1997. Validation of Human Reliability Assessment techniques: Part 2 –
Validation results. Safety Science, 27 (1), 43-75.
Kirwan, B. (1998. Human error identification techniques for risk assessment of high risk
systems - Part 1: review and evaluation of techniques. Applied Ergonomics, 29 (3), 157-
177.
Kirwan, B. (1998. Human error identification techniques for risk assessment of high-risk
systems - Part 2: towards a framework approach. Applied Ergonomics, 29 (5), 299-318.
Kirwan, B. Basra, G. Taylor-Adams, S.E, CORE-DATA: a computerised human error
database for humanreliability support., Human Factors and Power Plants, 1997. 'Global
Perspectives of Human Factors in Power Generation'., Proceedings of the 1997 IEEE
Sixth Conference, 1997, On page(s): 9/7-912
Kirwan, B., Gibson, H., Kennedy, R., Edmunds, J., Cooksley, G. And Umbers, I. (2004)
Nuclear Action Reliability Assessment (NARA): A data-based HRA tool. In Probabilistic
Safety Assessment and Management 2004, Spitzer, C., Schmocker, U., and Dang, VN
(Eds), London, Springer, pp 1206-1211.
Kirwan, B., Kennedy, R., Taylor-Adams, S., Lambert, B. (1997. The validation of three
Human Reliability Quantification techniques - THERP, HEART and JHEDI: Part II -
Results of validation exercise. Applied Ergonomics, 28 (1), 17-25.
57 ©OGP
Kirwan, B., Scannali, S. and Robinson, L. (1996. Applied HRA: A case study. Applied
Ergonomics, 27 (5), 289 - 302.
Kisko T.M., Francis R.L., Noble C.R., EVACNET+ User’s Guide, Gainesville, Florida:
University of Florida Department of Industrial and Systems Engineering, April 1984
Kovac, J.G., Vaught, C., Branich Jr., M.J., Probability of making a successful mine escape
while wearing a self-contained self rescuer, Journal of the International Society for
Respiratory Protection, Vol 10, Issue 4.
Krockeide, G. (1988) An introduction to luminous escape systems in Safety in the Built
Environment (Ed. Sime, J.D.) p 134-146.
Meshkati, N., Hancock, P.A., Rahimi, M. and Dawes, S.M. (1995. Techniques in mental
workload assessment. In J.R. Wilson an E.N. Corlett, Evaluation of Human Work. London:
Taylor and Francis. Concise description of techniques for mental workload assessment.
MUSTER, DNV Technica.
Patty, F.A., Ed. (1963) Hydrogen Sulphide, in Industrial Hygiene and Toxicology, Volume 2
New York: Interscience.
Pauls, J. (1980) Building Evacuation: research findings and recommendations in Fires and
Human Behaviour (Ed. D. Canter), John Wiley & Sons, Chichester, p251-275.
Pheasant, S, Bodyspace: Anthropometry, Ergonomics and the Design of the Work, Second
Edition 1996
Poda, G.A., (1966) Hydrogen Sulphide can be Handled Safely in Arch. Environmental
Health, 12, p 795.
Reason, J. (1990. A systems approach to organisational error. Ergonomics, 38 (8), 1708-
1721.
Reason, J. (1999. Managing The Risks Of Organisational Accidents. Ashgate: USA.
Reidel, D. (1982) Risk analysis of Six Potentially Hazardous Industrial Objects in the
Rijnmond Area: A Pilot Study, A report to the Rijnmond Public Authority, Dordrecht ("The
COVO Study".
Senders, J.W. and Moray, N.P. (1991. Human Errors: Cause, Prediction, and Reduction.
Hillsdale, New Jersey: Lawrence Erlbaum.
Shepherd, A. (2001. Hierarchical Task Analysis. London: Taylor and Francis. A well-written
and illustrated guide to HTA including methodology and application to design,teams and jobs,
information and skill, training, support documentation and human resource management.
Shorrock, S.T. and Hughes, G.J. (2001. Let's get real: How to assess human error in
practice. IBC seminar on human error techniques, October 2001, London.
Shorrock, S.T., Kirwan, B., MacKendrick, H. and Kennedy, R. (2001. Assessing human
error in Air Traffic Management systems design: Methodological issues. Le Travail
Humain, 64 (3), 269-289.
Siegel, S. (1956. Nonparametric Statistics for the Behavioral Sciences. McGraw-Hill Book
Company, Inc., New York.
Taylor-Adams, S.T., and Kirwan, B. Human Reliability Data Requirements. International
Journal of Quality & Reliability Management, 12, 1 24-46, 1995.
Tong, D. & Canter, D. (1985) The decision to evacuate: A study of the motivations which
contribute to evacuation in the event of fire Fire Safety Journal, 9, 257-265.
©OGP 58
US National Institute for Occupational Safety and Health (1977) Criteria for a
recommended standard occupational exposure to Hydrogen Sulphide, DHEW (NIOSH)
Publication Number 77-158.
Waagenaar, W.A. and Reason, J.T. (1990. Types and Tokens in Accident Causation.
Waters, T. (1988. Human Factors reliability benchmark exercise, report of the SRD
participation. In B.A. Sayers (Ed.), Human Factors and Decision Making: Their Influence on
Safety and Reliability. London: Elsevier Applied Science, pp. 87-109.
Whittingham, B. (1993) Human Factors in QRA - Data and Methodology. pp. 93-118 in
proceedings of the E&P Forum Workshop on Data in Oil and Gas Quantitative Risk
Assessments, December 1993, Report no. 11.7/205 Jan 1994.
Wickens, C. D. et al (1998. An Introduction to Human Factors Engineering. Longman: New
York.
Wickens, C.D. (1992. Engineering Psychology and Human Performance (Second Edition.
New York: Harper Collins. Contains chapter on attention, time-sharing and workload.
Williams, J.C. (1986. HEART - a proposed method for assessing and reducing human
error. In Ninth Advances in Reliability Technology Symposium, University of Bradford.
Williams, J.C. (1992. Toward an improved evaluation tool for users of HEART.
Proceedings of the International Conference on Hazard Identification, Risk Analysis,
Human Factors and Human Reliability in Process Safety, Orlando, February, Chemical
Centre for Process Studies (CCPS.
Wilson, J.R & Corlett, N.E. (1999. (2nd Ed.) Evaluation Of Human Work. Taylor & Francis:
London.
Wilson, J.R. and Corlett, E.N. (1995) (Eds. Evaluation of Human Work. London: Taylor and
Francis. A classic guide to Human Factors methodology. Highly comprehensive, covering all
aspects of Human Factors assessment methods. Includes a chapter on Task Analysis by
Stammers and Shepherd.
Wong, S. et al., Risk sensitivity to human error in the LaSalle PRA, NUREG CR/-5527,
U.S. Nuclear Regulatory Commission, Washington, DC., 1990
Yant, W.P., 1930. Hydrogen Sulphide in Industry: Occurrence, Effects and Treatment in,
American Journal of Public Health, 20, p 598.
59 ©OGP
Report No. 434 – 6.1

March 2010
Ignition
probabilities
RADD – Ignition probabilities
contents
1.0 Introduction ........................................................................ 1
2.0 Summary of Recommended Data ......................................... 1
2.1 Ignition Probability Curves ......................................................................... 1
2.2 Blowout Ignition Probabilities .................................................................. 16
3.0 Guidance on use of data .................................................... 17
3.1 General Validity.......................................................................................... 17
3.2 Alternative Approaches ............................................................................ 17
3.2.1 Releases addressed by datasheets in Section 2.0 ............................................ 17
3.2.2 Other releases ....................................................................................................... 20
3.3 Uncertainties .............................................................................................. 20
4.0 Review of data sources ...................................................... 20
5.0 Recommended data sources for further information ........... 22
6.0 References ......................................................................... 22
©OGP 1
Abbreviations
FPSO Floating Production Storage and Offloading (Installation)
NAP Normal Atmospheric Pressure
NUI Normally Unmanned Installation
UKOOA United Kingdom Offshore Operators Association
2 ©OGP
1.0 Introduction
The data presented in section 2 provide estimates of the probabilities of hydrocarbon
releases igniting to result in an explosion and/or a sustained fire. These data may be
applied to any on the leak types described in the Process Release Frequencies
datasheet1.
The values presented relate to “total” ignition probability, which can be considered as
the sum of the probabilities of immediate ignition and delayed ignition. Immediate
ignition can be considered as the situation where the fluid ignites immediately on
release through auto-ignition or because the accident which causes the release also
provided an ignition source. Delayed ignition is the result of the build-up of a
flammable vapour cloud which is ignited by a source remote from the release point. It
is assumed to result in flash fires or explosions, and also to burn back to the source
of the leak resulting in a jet fire and/or a pool fire.
These probabilities are considered appropriate for use in QRA studies where a
relatively coarse assessment is acceptable. Section 3.2 refers to a more detailed
approach for QRAs where this is considered to be required.

2.1 Ignition Probability Curves
Data presented in this section come in the form of 28 mathematical functions drawn
from the UKOOA look-up correlations (see section 4.0) which relate ignition
probabilities in air2 to release rates for typical scenarios both onshore and offshore.
The various scenarios are summarised in Table 2.1,
1
With the exception of “zero pressure” releases, where the limited inventory and hence cloud
size would result in a lower ignition probability than would be predicted using this approach.
2
Ignition probabilities in other atmospheres, e.g. oxygen enriched or chlorine, are outside the
scope of this datasheet.
©OGP 1
Table 2.2 and Table 2.3. The functions themselves are given in both tabular and
graphical form in the data sheets which follow.
The curves of ignition probability vs. release rate comprise between two and four
sections, each a straight line when plotted on log-log axes.
These curves represent “total” ignition probability. The method assumes that the
immediate ignition probability is 0.001 and is independent of the release rate. As a
result, all the curves start at a value of 0.001 relating to a release rate of 0.1 kg/s.
Users of the data may wish to adopt this value and to obtain delayed ignition
probabilities by subtracting 0.001 from the total ignition probability, e.g. an ignition
probability value of 0.004 obtained from the look-up correlations can be considered as
an immediate ignition probability of 0.001 and a delayed ignition probability of 0.003.
2 ©OGP
Table 2.1 Onshore Ignition Scenarios
Scenario
Look-up Release Type Application
No.
1 Pipe Liquid Industrial Releases of flammable liquids that do not have any significant flash fraction (10% or less) if
(Liquid Releases from onshore released from onshore cross-country pipelines running through industrial or urban areas.
pipeline in industrial area)
2 Pipe Liquid Rural Releases of flammable liquids that do not have any significant flash fraction (10% or less) if
(Liquid Releases from onshore released from onshore cross-country pipelines running through rural areas.
pipeline in industrial area)
3 Pipe Gas LPG Industrial Releases of flammable gases, vapour or liquids significantly above their normal (Normal
(Gas or LPG release from Atmospheric Pressure (NAP)) boiling point from onshore cross-country pipelines running
onshore pipeline in an through industrial or urban areas.
industrial area)
4 Pipe Gas LPG Rural Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
(Gas or LPG release from point from onshore cross-country pipelines running through rural areas.
onshore pipeline in a rural area)
5 Small Plant Gas LPG Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
(Gas or LPG release from small point from small onshore plants (plant area up to 1200 m2, site area up to 35,000 m2).
onshore plant)
6 Small Plant Liquid Releases of flammable liquids that do not have any significant flash fraction (10% or less) if
(Liquid release from small released from small onshore plants (plant area up to 1200 m2, site area up to 35,000 m2) and
onshore plant) which are not bunded or otherwise contained.
7 Small Plant Liquid Bund Rural Releases of flammable liquids that do not have any significant flash fraction (10% or less) if
(Liquid release from small released from small onshore plants (plant area up to 1200 m2, site area up to 35,000 m2) and
onshore plant where the spill is where the liquid releases from the plant area are suitably bunded or otherwise contained.
bunded)
8 Large Plant Gas LPG Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
(Gas or LPG release from large point from large onshore outdoor plants (plant area above 1200 m2, site area above 35,000
onshore plant) m2).
9 Large Plant Liquid Releases of flammable liquids that do not have any significant flash fraction (10% or less) if
(Liquid release from large released from large onshore outdoor plants (plant area above 1200 m2, site area above 35,000
onshore plant) m2) and which are not bunded or otherwise contained.
10 Large Plant Liquid Bund Rural Releases of flammable liquids that do not have any significant flash fraction (10% or less) if
(Liquid Released from large released from large onshore outdoor plants (plant area above 1200 m2, site area above 35,000
onshore plant where spill is m2) and where the liquid releases from the plant area are suitably bunded or otherwise
bunded) contained.
©OGP 3
Scenario
No.
11 Large Plant Congested Gas Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
LPG point from large onshore plants (plant area above 1200 m2, site area above 35,000 m2), where
(Gas or LPG released from a the plant is partially walled/roofed or within a shelter or very congested.
large confined or congested
onshore plant)
12 Tank Liquid 300m x 300m Bund Releases flammable liquids that do not have any significant flash fraction (10% or less) if
(Liquid release from a large released from very large onshore outdoor storage area 'tank farm' (e.g. spill in a large multi-
confined or congested onshore tank bund over 25,000 m2 area).
plant) See curve No. 30 “Tank Liquid – diesel, fuel oil’ if liquids are stored at ambient conditions
below their flash point.
13 Tank Liquid 100m x 100m Bund Releases of flammable liquids that do not have any significant flash fraction (10% or less) if
(Liquid release from onshore released from onshore outdoor storage area 'tank farm' (e.g. spill in a large tank bund
tank farm where spill is limited containing four or fewer tanks, or any other bund less than 25,000 m2 area).
by small or medium sized bund) See curve No. 30 “Tank Liquid – diesel, fuel oil’ if liquids are stored at ambient conditions
below their flash point.
14 Tank Gas LPG Plant Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
(gas or LPG release from point from onshore outdoor storage tanks located in a 'tank farm' entirely surrounded by
onshore tank farm within the plants. For tank farms adjacent to plants use curve No. 15 “Tank Gas LPG Storage Industrial”
plant) or Curve No. 16 “Tank Gas LPG Storage Only Rural” look-up correlations. Releases from
process vessels or tanks inside plant areas should be treated as plant releases.
15 Tank Gas LPG Storage Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
Industrial point from onshore outdoor storage tanks located in a 'tank farm' adjacent to plants or
(Gas or LPG released from situated away from plants in an industrial or urban area.
onshore tank farm sited
adjacent to a plant or away from
the plant in an industrial area)
16 Tank Gas LPG Storage Only Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
Rural point from onshore outdoor storage tanks located in a 'tank farm' adjacent to plants or
(Gas or LPG released from situated away from plants in a rural area.
onshore tank farm sited
adjacent to a plant or away from
the plant in an industrial area)
Source: Energy Institute [1]
4 ©OGP
Table 2.2 Offshore Ignition Scenarios
Scenario
No.
17 Offshore Process Liquid Releases of flammable liquids that do not have any significant flash fraction (10% or less) if
(Liquid release from offshore released from within offshore process modules.
process module)
18 Offshore Process Liquid NUI Releases of flammable liquids that do not have any significant flash fraction (10% or less) if
(Liquid release from offshore released from within offshore process modules or decks on NUIs.
process area on NUI)
19 Offshore Process Gas Open Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
Deck NUI point from an offshore process weather deck/ open deck on NUIs. Can also be used for
(Gas release from offshore open/uncongested weather decks with limited process equipment on larger attended
process open deck area on NUI) integrated platforms.
20 Offshore Process Gas Typical Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
(Gas release from typical point from within offshore process modules or decks on integrated deck / conventional
offshore process module) installations). Process modules include separation, compression, pumps, condensate
handling, power generation, etc. If the module is mechanically ventilated or very congested –
see curve No. 22 “Offshore Process Gas Congested or Mechanical Vented Module”.
21 Offshore Process Gas Large Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
Module point from within large offshore process modules or decks on integrated deck / conventional
(gas release from typical installations (module greater than 1000 m2 floor area). Process modules include separation,
offshore process module) compression, pumps, condensate handling, power generation, etc. If the module is
mechanically ventilated or very congested – see curve No. 22 'Offshore Process Gas
Congested or Mechanical Vented Module'.
22 Offshore Process Gas Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
Congested or Mechanical point from within offshore process modules or decks on integrated deck / conventional
Vented Module installations: applies where the module is enclosed and has a mechanical ventilation system
(Gas released from a or is very congested (volume blockage ratio => 0.14 and less than 25% of area of the end
mechanically ventilated or very walls open for natural ventilation)
congested offshore process
module)
23 Offshore Riser Releases from offshore installation risers in the air gap area where there is little chance of the
(Gas release from typical release entering process areas on the installation (e.g. solid decks, wind walls). Applies to
offshore riser in air gap) partial flashing oil or gas releases.
May also be used for blowouts with well positioned diverters directing any release away from
the installation (see also curve No. 27 “Offshore Engulf – blowout riser”).
©OGP 5
Scenario
No.
24 Offshore FPSO Gas Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
(Gas release from offshore point from within offshore process modules or decks on FPSOs. See curve No. 25 “offshore
FPSO process module) FPSO Gas Wall” if the release is from an area downwind of a transverse wall across the FPSO
deck.
25 Offshore FPSO Gas Wall Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
(Gas release from offshore point from within offshore process modules or decks on FPSOs. This correlation applies if
FPSO process module behind a the release is from an area downwind of a transverse wall across the FPSO deck.
transverse solid wall)
26 Offshore FPSO Liquid Releases of flammable liquids that do not have any significant flash fraction (10% or less) if
(Liquid release from typical released from within offshore process modules or decks on FPSOs
offshore FPSO process
module)
27 Offshore Engulf – blowout – Releases from drilling or well working blowouts or riser failures under open grated deck
riser areas where the release could engulf the entire installation and reach into platform areas:
(Major release which can engulf applies to partial flashing oil or gas releases. (see also curve No. 23 “Offshore Riser” for riser
an entire offshore installation) releases and blowouts with divertors)
Note. Curve Nos. 28 and 29 related to Cox, Lees and Ang formulation which were included in the document for comparison
Table 2.3 Special (Derived) Ignition Scenarios
Scenario Look-up Release Type Application

No.
30 Tank Liquid – diesel fuel oil Releases of combustible liquids stored at ambient pressure and at temperatures below their
(Liquid Release from onshore flash point (e.g. most gas, oil, diesel and fuel oil storage tanks) from onshore outdoor storage
tank farm of liquids below their area “tank farm”. This look-up correlation can be applied to releases from tanks and low
flash point, e.g. diesel or fuel pressure transfer lines or pumps in the tank farm/ storage area. However, it should not be
oil) used for high-pressure systems (over a few barg): in these situations use curve No. 12 “Tank
Liquid 300m x 300m Bund” or curve No. 13 “Tank Liquid 100 x 100m Bund”
6 ©OGP
Data Sheet 1: Scenarios 1 – 4
©OGP 7
8 ©OGP
©OGP 9
Data Sheet 4: Scenarios 12, 13 & 30
10 ©OGP
©OGP 11
Data Sheet 6: Scenarios 17 & 18
12 ©OGP
©OGP 13
14 ©OGP
Data Sheet 9: Scenarios 23 & 27
©OGP 15
Notes:
1. A flammable substance above its auto-ignition temperature is likely to ignite on
release and should be modelled as having an ignition probability of one.
2. Very reactive substances are unlikely to found in oil and gas processing
operations but if present it is suggested that the values given in the look-up
correlations are doubled, subject to a maximum of 1. Such substances include
hydrogen, acetylene, ethylene oxide and carbon disulphide.
3. High flash point (>55°C) liquids stored at or near ambient conditions are
significantly less likely to ignite than suggested in the look-up correlations. It is
suggested that an ignition probability from the look-up correlations is multiplied by
a factor of 0.1 subject to a minimum of 0.001 and taking account of the 0.001
immediate ignition probability.
4. For liquids with flash fractions above 10% it is suggested that the ignition
probability is estimated by combining the relevant liquid ignition probability with a
suitable gas/LPG ignition probability. The appropriate release rates should be
obtained from the flash fraction, e.g. a 10 kg/s release with a 20% flash fraction
should give rise to an equivalent 2 kg/s gas release and 8 kg/s liquid release.
The two probabilities can be combined using the following equation;
Alternatively the higher of the two ignition probabilities can be used on the basis
that the areas covered by the liquid and gas are likely to have considerable
overlap.
5. Since the correlations are based on typical combinations of ignition sources, it
follows that they should not be used in situations where particularly strong
sources such as fired heaters are present. In this case the full UKOOA ignition
model is more appropriate.
2.2 Blowout Ignition Probabilities

An alternative to the blowout ignition probabilities given by the UKOOA look-up
correlations can be obtained from Scandpower’s interpretation of the blowout data
provided by SINTEF 2. This is given in Table 2.4. The most significant category is that
for deep blowouts which indicates an early ignition probability of 0.09. For the
purposes of QRA studies this can be taken as occurring immediately on release. The
report also gives a delayed ignition probability of 0.16 although all of these are taken
to occur more than one hour after the start of the release. Conservatively, this could
be taken as occurring shortly after the initial release and result in an explosion.
Table 2.4 Ignition Probabilities for Blowouts and W ell Releases on

Platform s
Release Type Early ignition Delayed Very Delayed

(< 5 min) ignition ignition (> 60 min)
(5 – 60 min)
Shallow Gas Blowout 0.07 0.11 0.07
Deep Blowout 0.09 - 0.16
Deep Well Release 0.03 - -
16 ©OGP

3.1 General Validity
The correlations are considered to provide an acceptable approach for use in typical
QRA studies. For more detailed analysis it is recommended that the full spreadsheet
UKOOA ignition model is used so that the specific circumstances with regard to
layout and ignition sources can be more accurately represented.
The correlations were developed for UKOOA member companies with the intention of
providing representative probabilities for installations operating in UK waters. They
may be applied to the analysis of hydrocarbon releases in other regions which comply
with recognised industry good practice, as it is applied in the UKCS.
The forward to the Energy Institute report states that the model and look-up
correlations “are not suited to the ignition probability assessment of refrigerated
liquefied gases, vapourising liquid pools, sub-sonic gas releases, or non-momentum
driven releases, such as those following catastrophic storage vessel failure.”
Despite this note, flashing liquid releases are covered by a number of the correlations
and analysts may further modify them by combining them with a gas or LPG ignition
probability in suitable proportions as suggested in note 4 of section 2.1. Atmospheric
storage tanks are dealt with in the Storage Incident Frequencies data sheet. Low
momentum and sub-sonic gas releases are uncommon in process systems. An
approach to the scenarios for which the correlations are not valid is suggested in
Section 3.2.2.
3.2 Alternative Approaches
3.2.1 Releases addressed by datasheets in Section 2.0
The initial task for the analyst is to determine which of the scenarios given in Table 2.1
to
©OGP 17
Table 2.2 and Table 2.3 best matches the scenario under consideration. There may be
situations where the scenario under consideration lies between two of the described
scenarios, in which case the analysts may attempt to interpolate between two curves.
The data presented in the tables in Section 2.0 can be used in three ways:
1. Estimate from the graphs
2. Obtain probability based on the tabulated values
3. Use values in Table 3.1 to calculate the probability. Note that, in interpolating
between the data points, it is necessary to take logarithms of the release rate and
probabilities, interpolate between these to find the logarithm of the required
probability and then obtain the value itself, i.e.:
where Pign is the required ignition probability corresponding to release rate Q

is the ignition probability at a release rate of Qlower (the lower bound of
the relevant curve section), and
is the ignition probability at a release rate of Qupper (the upper bound of
the relevant curve section)
The third of these options is the recommended approach and the analyst may find it
convenient to construct a spreadsheet or some other computer programme to carry
this out.
The data used to generate the lines on the graphs in the datasheets (Section 2.1) are
shown in Table 3.1. This has been derived from Table 2.9 in the Institute of Energy
report 1, which provides further explanation on the derivation of the lines. This
specifies the release rates and ignition probabilities relating to each of the points
bounding the segments as indicated in Figure 3.1. Some information on the timing of
ignitions is also available in 1.
Figure 3.1 Typical Ignition Probability Curve
18 ©OGP
A more accurate assessment may be obtained by the use of the full UKOOA ignition
model which is described in 1. This has been implemented in a spreadsheet tool
which is made available on a CD which accompanies the report. This allows the user
to input specific data relating to release conditions, platform layout and ignition
sources. However, this requires more effort on the part of the analyst and the
availability of more installation specific data compared with the relative ease with
which the look-up functions can be used.
©OGP 19
Table 3.1 Data for Look-up Correlations
Point 1 Point 2 Point 3 Point 4

Scenario Type Release Probability Release Probability Release Probability Release Probability
No. rate rate rate rate
1 Pipe Liquid Industrial 0.1 0.001 70.00 0.07
2 Pipe Liquid Rural 0.1 0.001 0.30 0.00 70.00 0.01
3 Pipe Gas LPG Industrial 0.1 0.001 1000.01 1.00
4 Pipe Gas LPG Rural 0.1 0.001 10.00 0.00 23408.55 1.00
5 Small Plant Gas LPG 0.1 0.001 1.00 0.00 3.00 0.01 498.99 0.60
6 Small Plant Liquid 0.1 0.001 1.00 0.00 100.00 0.10
7 Small Plant Liquid Bund Rural 0.1 0.001 1.00 0.00 8.05 0.01
8 Large Plant Gas LPG 0.1 0.001 1.00 0.00 260.00 0.65
9 Large Plant Liquid 0.1 0.001 1.00 0.00 109.99 0.13
10 Large Plant Liquid Bund Rural 0.1 0.001 1.00 0.00 42.49 0.05
Large Plant Congested Gas
11 0.1 0.001 1.00 0.00 70.00 0.43 325.03 0.70
LPG
12 Tank Liquid 300x300 Bund 0.1 0.001 1.00 0.00 7.00 0.00 519.62 0.12
13 Tank Liquid 100x100 Bund 0.1 0.001 1.00 0.00 7.00 0.00 49.03 0.02
14 Tank Gas LPG Plant 0.1 0.001 1.00 0.00 102.84 1.00
Tank Gas LPG Storage Only
15 0.1 0.001 1.00 0.00 100.00 0.23 988.11 1.00
Industrial
Tank Gas LPG Storage Only
16 0.1 0.001 1.00 0.00 10.00 0.02 52551.35 0.50
Rural
17 Offshore Process Liquid 0.1 0.001 100.00 0.02
18 Offshore Process Liquid NUI 0.1 0.001 24.73 0.01
Offshore Process Gas Open
19 0.1 0.001 1.00 0.00 31.42 0.03
Deck NUI
20 Offshore Process Gas Typical 0.1 0.001 3.00 0.01 37.01 0.04
Offshore Process Gas Large
21 0.1 0.001 5.00 0.03 30.00 0.05
Module
Offshore Process Gas
22 Congested or Mechanically 0.1 0.001 1.00 0.01 92.63 0.04
Vented Module
23 Offshore Riser 0.1 0.001 38.27 0.03
24 Offshore FPSO Gas 0.1 0.001 1.00 0.00 50.00 0.15
25 Offshore FPSO Gas Wall 0.1 0.001 0.30 0.00 10.00 0.15
26 Offshore FPSO Liquid 0.1 0.001 100.00 0.03
Offshore Engulf – Blowout -
27 0.1 0.001 100.00 0.10
Riser
Tank Liquid - Diesel and
30 Fuel Oil 0.1 0.001 1.00 0.00 7.00 0.00 25.55 0.00
20 ©OGP
3.2.2 Other releases

As noted in Section 3.1, the UKOOA ignition model cannot be considered valid for all
types of release. In particular, it does not refrigerated releases that form evaporating
liquid pools.
Analysis of these and the other scenarios referred to there may require a more
fundamental treatment by calculating likely cloud sizes for the given release, material
and weather conditions and estimating the number and strength of ignition sources
which the flammable part of the cloud may reach. There is no generally recognized
method for determining ignition source strength for use in QRAs. Some values are
given in the “Purple Book” [3] but these are estimates based on engineering judgment
and do not have any more scientific basis.
3.3 Uncertainties
The assessment of ignition probability is subject to a large degree of uncertainty. The
spreadsheet model produced under phase I of the joint industry project is itself
subject to uncertainties in the analytical approach taken and in the data used. The
adoption of the lookup correlations based on this model introduces more
uncertainties because a compromise has to be made in selecting the most appropriate
curve and these curves themselves are approximations to the curves produced by the
model itself.
Ignition probabilities are influenced by design layout, the number and separation of
ignition sources, the quality of maintenance of equipment, and thereby the control of
ignition sources.
Despite these uncertainties, the approach is considered to be an advance on other
formulations which relate ignition probability to release rate only with no regard for
the presence of ignition sources, the nature of the fluids or the layout of the plant.

The data presented in Section 2 are largely a reproduction of data from the Energy
Institute Research Report [1], published on behalf of the joint industry project
sponsors UKOOA (Now Oil and Gas UK), the HSE and the Energy Institute. The report
reviews existing models and develops a new model which could be applied to both
onshore and offshore scenarios. The work was undertaken in two phases. The first
phase involved developing a model for assigning ignition probabilities in QRA studies
and to further the understanding of scenario specific ignition probabilities. The work
was undertaken by AEA Technology (now ESR Technology) and co-ordinated by a
joint industry steering group drawn from UKOOA member representatives, the HSE
and consultants working in the field of onshore and offshore QRA.
The report summarised the current status of knowledge and research in the field of
ignition probability estimation in support of QRA. It evaluated this, together with the
usefulness of the UK HSE’s hydrocarbon release database as a basis to develop an
improved ignition model for use in QRA. The end result is a spreadsheet model for
estimating the ignition probability of process leaks offshore and also attempts to
include the capability to assess the ignition probability of most typical onshore
hydrocarbon leak scenarios. The spreadsheet attempts to model the ignition
©OGP 21
probability by considering the size of the gas cloud which would be formed by the
release and taking into account the number and type of ignition sources which the
cloud, at sufficient concentration, might reach. As a result of the complexity of the
model, users are required to obtain and enter a significant amount of data relating to
the platform configuration and the distribution of ignition sources.
Having completed the work to establish a model, a second phase was commissioned
to consider representative scenarios which would generate look-up correlations which
could be used in QRA studies without the need for the user to gather the data required
for the full model. The following summarises the release types considered.
• Gas releases
• LPG (flashing liquefied gas) releases
• Pressurised liquid oil releases – leading to a spray release with flashing/
evaporation/ aerosol formation
• Low pressure liquid oil releases – leading to a spreading pool only (no aerosol
formation or flashing)
• Release rates from 0.1 to 1000 kg/s – (graphs shown in the data sheets are
extended to 10000 kg/s where the probability function does not reach a maximum
below 1000 kg/s)
The configurations considered are given in Table 2.1 to Table 2.3.

A large number of analyses were carried out to produce graphs of ignition probability
against release rate. Figure 4.1 shows a typical set of curves.
In the final stage of the process, groups of similar curves were considered and
grouped into the scenarios listed in Table 2.1 to Table 2.3. These scenarios were then
examined and a representative curve assigned to them. These curves consist of
between two and four segments each of which appears as a straight line when plotted
on logarithmic axes. It is these curves which are depicted in the data sheets.
Figure 4.1 Exam ple of Ignition Probability Curve Calculated by UKOOA

ignition m odel
22 ©OGP
Prior to the introduction of the UKOOA ignition model approach outlined above, the
formulation attributed to Cox, Lees and Ang 4 was widely used. This gained
acceptance largely because of the proportion of analysts using it rather than because
of the rigour of the theory underlying it. Ignition probabilities predicted by this
method were in excess of what was found to occur in practice and this was partly
responsible for instigating the work which resulted in the UKOOA ignition model.
References in this report to “UKOOA (spreadsheet) model” and “UKOOA look-up
correlations” relate respectively to the output from the two phases of the project [1].

For further information, on the ignition probability curves presented in this document,
the Energy Institute report 1 should be consulted.
6.0 References
1. Ignition Probability Review, Model Development and Look-Up Correlations, Research
Report published by the Energy Institute, January 2006. ISBN 978 0 85293 454 8
2. Scandpower Risk Management AS 2006. Blowout and Well Release Frequencies –
Based on SINTEF Offshore Blowout Database, 2006, Report No. 90.005.001/R2.
3. Guidelines for quantitative risk assessment (Purple book), Part 1, Establishment,
CPR18 E, Committee for the Prevention of Disasters (CPR), National Institute of
Public Health and Environment (RIVM), Ministry of Transport, Public Works &
Water Assessment Management, AVIV Adviserend Ingenieurs Save Ingenieurs
(Adviesbureau), 1999.
4. Cox, Lees and Ang, 1991. Classification of Hazardous Locations, Rugby: Institution
of Chemical Engineers, ISBN 0 85295 258 9.
©OGP 23

March 2010
Consequence
modelling
RADD – Consequence modelling
contents
2.0 Summary of Recommended Approaches ................................ 1
2.1 Release modelling .......................................................................................... 3
2.1.1 Simple approaches to release modelling................................................................. 4
2.1.2 Software for release modelling ................................................................................. 6
2.1.3 Modelling Releases from Buried Pipelines.............................................................. 7
2.2 Dispersion and ventilation modelling ........................................................... 7
2.2.1 Simple approaches to dispersion modelling........................................................... 9
2.2.2 Software for dispersion modelling ......................................................................... 11
2.2.3 CFD for ventilation and dispersion modelling....................................................... 12
2.3 Fire and thermal radiation modelling.......................................................... 13
2.3.1 Simple approaches to fire and thermal radiation modelling................................ 14
2.3.2 Software for fire and thermal radiation modelling ................................................ 20
2.3.3 CFD for fire and thermal radiation modelling ........................................................ 20
2.4 Explosion modelling..................................................................................... 22
2.4.1 Simple approaches to explosion modelling .......................................................... 23
2.4.2 Software for explosion modelling........................................................................... 23
2.4.3 CFD for explosion modelling .................................................................................. 24
2.5 Smoke and gas ingress modelling.............................................................. 24
2.5.1 Simple approaches to smoke and gas ingress modelling ................................... 25
2.5.2 Software for smoke and gas ingress modelling.................................................... 26
2.5.3 CFD for smoke and gas ingress modelling ........................................................... 27
2.6 Toxicity modelling ........................................................................................ 27
2.6.1 Simple approaches to toxicity modelling .............................................................. 29
2.6.2 Software for toxicity modelling............................................................................... 29
2.6.3 CFD for toxicity modelling....................................................................................... 29
3.0 Guidance on use of approaches ........................................... 29
3.2 Uncertainties ................................................................................................. 30
3.3 Choosing the right approach for consequence modelling ....................... 30
3.4 Geometry modelling for CFD ....................................................................... 31
6.0 References .......................................................................... 32
6.1 References for Sections ‎2.0 to ‎4.0 .............................................................. 32
©OGP
Abbreviations:
BLEVE Boiling Liquid Expanding Vapour Explosion
CFD Computational Fluid Dynamics
CHRIS Chemical Hazards Reference Information System
CSTR Continuous Stirred Tank Reactor
CV Control Volume
DAL Design Accidental Load
EU European Union
FV Finite Volume
HVAC Heating, Ventilation and Air Conditioning
IDLH Immediate Danger to Life and Health
JIP Joint Industry Project
LDx Lethal Dose resulting in fatalities to x% of population
LFL Lower Flammable Limit (also known as Lower Explosive Limit, LEL)
MSDS Material Safety Data Sheet
PDR Porosity, Distributed Resistance
SLOD Significant Likelihood of Death
SLOT Specified Level Of Toxicity
SVP Saturated Vapour Pressure
TNO Nederlandse Organisatie voor Toegepast Natuurwetenschappelijk
Onderzoek
(Netherlands Organization for Applied Scientific Research)
TR Temporary Refuge
UVCE Unconfined Vapour Cloud Explosion
VCE Vapour Cloud Explosion
©OGP

Consequence modelling refers to the calculation or estimation of numerical values (or
graphical representations of these) that describe the credible physical outcomes of loss
of containment scenarios involving flammable, explosive and toxic materials with
respect to their potential impact on people, assets, or safety functions.
This datasheet presents (Section 2.0) recommended approaches to consequence
modelling for accidental releases of hazardous materials, with the potential to cause
harm to people, damage to assets and impairment of safety functions, from offshore
and onshore installations.
Consideration of environmental impacts is excluded, although the recommended
approaches to release modelling (in particular for liquids) may be applied to estimate
potential quantities of hydrocarbon spilt.
This datasheet is not intended to be a textbook of consequence modelling theory but
rather to indicate the consequence phenomena that need to be considered and to
provide guidance on modelling that is fit for purpose.
2.0 Summary of Recommended Approaches

This section addresses the following consequences of a loss of containment incident:
1. Release (discharge)
2. Dispersion in air and water
3. Fire and thermal radiation
4. Explosion
5. Smoke and gas ingress
6. Toxicity
Figure 2.1 illustrates and develops the relationship between many of these.
For each topic, guidance is given on some or all of the following possible approaches:
• Simple correlations or formulae
• General purpose consequence modelling software (see below)
• CFD (Computational Fluid Dynamics – see below)
Whichever approach is adopted, it should be used with an understanding of its range of

validity, its limitations, the input data required, the valid results that can be obtained, the
results’ sensitivity to the different input data, and how the results can be verified.
©OGP 1
Figure 2.1 Consequence Phenom ena and their Interrelationship
General Purpose Consequence Modelling Software

The main commercial general purpose consequence modelling packages are:
• CANARY, from Quest (http://www.questconsult.com/canary.html)
• EFFECTS, from TNO
(www.tno.nl/content.cfm?context=markten&content=product&laag1=186&laag2=267
&item_id=739)
• PHAST, from DNV
(http://www.dnv.com/services/software/products/safeti/SafetiHazardAnalysis/index.a
sp)
• TRACE, from Safer Systems (www.safersystem.com)
These model most of the consequences set out above apart from smoke. However, they
are designed for onshore studies and not all of the models included will be appropriate
for offshore use, in particular in enclosed modules. The sections below give guidance
on the appropriate use of these models.
In addition, there are freeware packages that can be downloaded for the internet but
these do not come with any training or support, or with any guarantee of code quality;
2 ©OGP
the commercial packages listed above do include these and come from reputable
organizations with quality management systems.
In addition, freeware “calculators” may be found for specific consequences (e.g.
BLEVE) but these suffer the same disadvantages listed above for general consequence
modelling.
Com putational Fluid Dynam ics

Computational Fluid Dynamics (CFD) can be used to obtain numerical solutions for
ventilation, dispersion and explosion problems for both offshore platforms and onshore
plants. CFD simulations are becoming increasingly common as the computing power of
standard desktop computers grows. The NORSOK standard Z-013 [21] specifies use of
CFD in its probabilistic approach to explosion risk assessment. The objective of the
probabilistic assessment is to generate realistic (representative) overpressures for an
area based on probabilistic arguments. Ventilation, gas leaks, dispersion as well as gas
explosions are considered by establishing probable explosion scenarios, performing
explosion simulations and establishing probability of exceedance curves.
The application of CFD for gas explosion studies is common for offshore platforms and
is increasingly used onshore in cases where the explosion risk is significant and a
better description of the physics is required in order to give a more robust estimate of
the risk.
CFD simulations essentially solve the conservation equations for mass, momentum and
enthalpy in addition to the equations for concentration and flammable gas effects. The
equations are generally closed using the κ−ε turbulence model. Most of the
commercially available CFD packages (see below) are based on the Finite Volume (FV)
method which uses an integral form of the conservation equations. Essentially, the
solution domain is subdivided into a number of control volumes (CV) at the centroid of
which lies a computational node where the variable values are calculated. The
conservation equations are applied to each CV and interpolation is used to express
variable values at the CV surface in terms of the centre values.
The most widely used commercially available CFD packages are:
• AutoReaGas, from Century Dynamics
(http://www.ansys.com/Products/autoreagas.asp)
• CFX, from ANSYS, Inc. (http://www.ansys.com/products/cfx.asp)
• FLUENT, now also from ANSYS, Inc. (http://www.fluent.com/)
• EXSIM, from EXSIM Consultants AS (http://www.exsim-consultants.com/)
• FLACS, from GexCon (http://www.gexcon.com/index.php?src=flacs/overview.html)
• Kameleon FireEx, from ComputIT (http://www.computit.no/)
2.1 Release modelling

Release modelling – also called discharge or source term modelling – is mainly used to
determine the rate at which a fluid is released to the environment in a loss of
containment incident, together with the associated physical properties (e.g.
temperature, momentum).
A simple approach is to calculate the initial rate and to assume that this is constant over
time. This is often used for studies of onshore facilities, especially where the offsite
risk is the motivation for the study.
©OGP 3
A more sophisticated approach is to model the time dependence of the release rate.
This is often used for studies of offshore facilities, where the time dependence has a
significant impact on the likelihood, in particular, of the initial event escalating. The
modelling required is more complex but avoids certain issues that arise when initial rate
modelling is used:
• Initial rate modelling can lead to over-prediction of the flammable/explosive mass in
a vapour cloud
• Initial rate modelling can lead to over-prediction of the size of a jet fire over time but
under-predict its duration or the time for which it exceeds a critical length (e.g. to
other equipment)
• Initial rate modelling can lead to over-prediction of the impact of toxic gas or smoke
effects
In general, time dependence should be explicitly modelled in offshore studies, where

the impacts over relatively short distances (tens of metres) and over time periods up to
the required endurance times of the TR (Temporary Refuge) and other safety functions,
which may be of the order of 1 hour, are of concern. Time dependence is less often
modelled in onshore studies, where the impacts over relatively long distances
(hundreds of metres to a few kilometres) and over time periods up to that required for
effective emergency action to commence. An exception to this is the modelling of
cross-country pipeline ruptures, for which time dependence may be important.
2.1.1 Simple approaches to release modelling

Where gas or non-flashing liquid would be released from an orifice, simple formulae
exist to calculate the initial rate, in particular Bernoulli’s equation for liquids (strictly,
incompressible fluids).
Some example release rates are shown in Figure 2.2, Figure 2.3 and Figure 2.4 for
selected representative materials. These were obtained using DNV’s PHAST software.
Equations for modelling time-varying releases of gas, including blowdown, are given in
the CMPT Guide to quantitative risk assessment for offshore installations [1]. This also
includes a simple method for calculating the flash fraction of a liquid such as
unstabilized crude.
Modelling releases from ruptured pipelines is rather more complex as the pipeline
pressure decreases away from the release point over time and so the flow rate
decreases with time, especially for gases. It is therefore normal to use software tools
for discharge modelling.
4 ©OGP
Figure 2.2 Release Rates for Natural Gas at 20°C
Figure 2.3 Release Rates for Propane at 20°C
Note: at 1 barg and 5 barg the releases are vapour; at higher pressures they are two-phase.
©OGP 5
Figure 2.4 Release Rates for Kerosene-type Liquid at 20°C (density = 714
kg/m 3 )
2.1.2 Software for release modelling

There is a range of software tools available that include release modelling. As with all
software, its range of validity and limitations need to be understood. For example, the
thermodynamics of mixtures may be modelled by an “average” equivalent pure
component. However, as computer power increases, this limitation is increasingly
being eliminated in favour of full multicomponent thermodynamics.
Software can model some or all of the following:
• Time-dependent releases, including inflow, isolation and blowdown
• Flashing liquid releases
− Releases that flash in the atmosphere as they are released
− Releases from vessels containing liquid that flashes as the pressure decreases
• Releases from vessels of different shapes and orientations
• Releases from long pipelines
These models are generally appropriate for use onshore and offshore.
When the fluid after release is two-phase, the modelling needs to predict the liquid
droplet size so that the amount of liquid that rains out (falls to the ground or water
surface) can be calculated as part of the dispersion modelling (Section 2.2).
SPT Group’s OLGA software (http://www.sptgroup.com/products/olga) can be used to
model time dependent releases from pipeline networks and includes multiphase flow
capability.
It should be noted that a release from a high pressure reservoir will normally be quite
complex with sonic flow, expansion and compression shocks. In safety studies, this
6 ©OGP
complex outflow is often not calculated and the boundary conditions for the jet are
given at surrounding pressure. Both the specified momentum and the temperature
(density) of this jet may be important for the dispersion simulation and thereby the
resulting gas cloud size. Often this boundary condition is specified as pure gas at sonic
velocity at surrounding pressure or lower. This is not conserving momentum and
should not be used when momentum is important for dispersion.
2.1.3 Modelling Releases from Buried Pipelines

Following a full bore rupture there will be flow from both sides of the break. The
consequences of a full bore rupture of a buried pipeline can be modelled as follows:
1. Initial high flow rate: consider immediate ignition as a fireball, using mass released
up to the time when this mass equals the fireball mass giving the same fireball
duration.
2. Ensuing lower flow rate(s): model dispersion and delayed ignition with low
momentum (velocity) as the flows from both sides of the break are likely to interact.
The following figure illustrates a possible simplification into quadrants of release

directions for a leak from a buried pipeline. The text beside suggests an approach to
modelling these for medium and large leaks, based on these having sufficient force to
throw out the overburden (and even concrete slabs, if placed on top).
1. Vertical release. Model as vertical release
(upwards) without modification of normal discharge
modelling output, i.e. full discharge velocity.
2, 3. Horizontal release. Model at angle of 45°
upwards with velocity of 70 m/s.
4. Downward release. Model as vertical release
(upwards) with low (e.g. 5 m/s) velocity to reflect loss of
momentum on impact with ground beneath.
For small horizontal or downward leaks, the force exerted by the flow is unlikely to
throw out the overburden, hence the flow will only slowly percolate to the surface. The
following approach is suggested for all release directions:
• Calculate discharge rate as normal.
• Remodel release with a very low pipeline pressure (1 barg for operating pressure
>10 barg, 0.1 barg for operating pressure < 10 barg), to simulate diffusion through
the soil, with the hole size modified to obtain the same discharge rate as above.
2.2 Dispersion and ventilation modelling

Dispersion modelling is used to determine how the fluid released spreads in the
environment: usually air but also water1.
• Onshore, dispersion is usually modelled for releases into the open air
• Offshore, modelling dispersion within an enclosed module is usually required;
modelling underwater releases (e.g. pipeline and flowline failures) is often also
needed.
1
Dispersion in soil is considered in environmental rather than safety risk studies and is outside
the scope of this datasheet.
©OGP 7
When a release is in the open air, several mechanisms may cause it to disperse. These
are illustrated in Figure 2.5. Not all releases go through all phases. A gas release on an
offshore platform may go directly from turbulent jet to passvie dispersion. A release
from a stack may be passive from the stack tip. The vapour in a release of refrigerated
LPG will be dense from the start.
Figure 2.5 Mechanism s of Atm ospheric Dispersion of Vapour
A vapour release inside an enclosed volume (a module of an offshore installation or a

building onshore) will mix with the air flowing through the volume. On offshore facilities
with enclosed modules, what is required for fire and explosion calculations is first of all
the size of the flammable/explosive cloud within the module. Onshore, the vapour cloud
may emerge from a vent or stack, already partially diluted, and then disperse in the
environment.
When the release is wholly or partially liquid, typically this will fall onto a solid surface
or through a grated deck to the sea below; on a solid surface it will spread out to form a
pool. At the same time, some of this liquid may vaporize, adding to any vapour in the
initial release, and will disperse in the atmosphere, as illustrated in Figure 2.6.
Dispersion modelling thus frequently has to be able to model all of these phenomena, in
addition to addressing the different mechanisms of atmospheric dispersion. The
8 ©OGP
relationship between many of these phenomena and mechanisms is illustrated in Figure

2.1.
Figure 2.6 Pool Vaporisation
2.2.1 Simple approaches to dispersion modelling

Very little dispersion modelling can validly be done using simple formulae. That which
can is as follows:
1. Passive (“Gaussian”) dispersion
2. Gas build-up in enclosed volumes
− Using a Continuous Stirred Tank Reactor (CSTR) model, when it is acceptable to
assume a uniform concentration throughout the volume (e.g. as source term for a
release from a vent or stack, or calculating toxic impact for people indoors)
− To calculate the quantity of flammable gas, for explosion modelling (see Section
2.4)
3. Oil pool spreading
4. Gas releases subsea.
The equations for passive dispersion, 1, can be found in standard texts on atmospheric
dispersion. The equations for 2 (CSTR model) and 3 are given in [1].
Two simplified methods have been developed to calculate the quantity of flammable gas
in an enclosed volume such as an offshore module (2). Section 4.2.3.1 of [2] presents a
simple equation valid when the ventilation flow field is close to uniform. A workbook
approach to estimating the flammable volume produced by a gas release [3, 4] has been
developed as part of the JIP on Gas Build Up from High Pressure Natural Gas Releases in
Naturally Ventilated Offshore Modules, sponsored by 10 operators and the UK HSE.
For gas releases subsea (4), a common assumption is that the diameter of the plume at
the sea surface is 20% of the water depth at the release point, regardless of the gas flow
©OGP 9
rate. This diameter together with the gas flow rate can then be used as input to a
Gaussian plume model.
Some example dispersion modelling results (distances to LFL) are given in Figure 2.7
and Figure 2.8. These were obtained using DNV’s PHAST software.
Figure 2.7 Dispersion Distances to LFL for Vapour Releases at 20°C
Note: “F1.5” refers to F stability, 1.5 m/s wind speed; “D5” refers to D stability, 5 m/s
wind speed.
10 ©OGP
Figure 2.8 Dispersion Distances to LFL for Two-Phase Propane Releases at

20°C
Note: “F1.5” refers to F stability, 1.5 m/s wind speed; “D5” refers to D stability, 5 m/s
wind speed.
2.2.2 Software for dispersion modelling

Atmospheric dispersion modelling software mainly divides into:
• “Box” models, which calculate vapour cloud dimensions and concentrations from
bulk properties.
• CFD models, which divide the “computational domain” representing the space
through which the fluid disperses, into small volume elements where physical
properties are calculated explicitly.
In general, plume models do not allow for the influence of terrain, assuming a flat,
unobstructed surface. Plume models cannot model well the near field characteristics of
dispersion within a congested or confined area such as an offshore module or the
middle of a process unit. However, for “far field” (i.e. in open areas) dispersion and
when numerous release cases need to be run, plume models are ideal.
The software used needs to be selected with an understanding of the phenomena
(identified in Section 2.2) likely to occur for the cases being modelled, to ensure that the
software can adequately model them. For example:
• A Gaussian plume model would not be appropriate for a gas release under pressure,
which will initially disperse as a turbulent jet (see Figure 2.5)
• For releases of pressurised LPG, rain-out and re-evaporation may need to be
modelled.
The results from dispersion modelling need to be examined to ensure they are sensible,
i.e. that they match expectations about their behaviour.
©OGP 11
FLOWSTAR, a model developed by CERC (www.cerc.co.uk/software/flowstar.htm) for

calculating profiles of the mean airflow and turbulence in the atmospheric boundary
layer, can calculate plume trajectory and spread in complex terrain and over variable
surface roughness. It is limited to passive dispersion (i.e. it cannot be used when fluid
momentum or density is significant) but its ability to model air flow over hilly terrain
may be useful. It is part of the widely accepted ADMS (Atmospheric Dispersion
Modelling System) suite of programs for air pollution modelling.
Other software packages such as CALPUFF and INPUFF are available, which are
especially suitable for mid- and far-field applications and for long (> 1 hour duration)
releases, however potential users should be aware of their limitations. HGSYSTEM
(www.hgsystem.com) is also well known as a freely available set of DOS-based
dispersion models.
2.2.3 CFD for ventilation and dispersion modelling

CFD’s main application in dispersion modelling for QRA is in explosion analysis, of
which ventilation and dispersion simulations are an important part.
In explosion analysis for offshore installations, the objective of the ventilation
simulations is to generate a ventilation distribution in terms of rate, direction and
probability. Based on this information, representative wind conditions are selected for
the dispersion simulations. The NORSOK Z-013 standard [21] recommends that at least
8 wind directions are considered for the ventilation simulations. Only one wind speed is
necessary as it is generally assumed that the ventilation rate for a wind direction is
proportional to the wind speed so that ventilation rates can be linearly scaled with wind
speeds. Also, the number of simulations may be reduced from symmetry
considerations.
The objective of the dispersion simulations in explosion analysis is to identify credible
size, concentration and location of gas clouds and establish how the flammable gas
clouds varies with the hazardous leak location, external wind speed and direction and
leak direction. Those representative gas clouds are subsequently used in the explosion
studies.
Generally, the number of parameters that can be varied is high (leak
locations/rates/directions, wind conditions) and it is unrealistic to simulate all possible
combinations so that a selection must be made. The NORSOK probabilistic approach
[21] recommends that at least 3 leak points with 6 jet directions and 1 diffuse leak
should be evaluated. At least one of the scenarios needs to consider leak orientation
against prevailing ventilation direction. It is, however, possible to reduce the number of
dispersion simulations based on symmetry considerations and the physics of the
problem.
Additionally, not all the identified scenarios (after consideration of symmetry and
engineering judgement) need to be simulated. The ‘frozen cloud’ concept can be used to
estimate the results of the scenarios not simulated. This is an assumption that gas
concentration scales with the leak rate and the inverse of the ventilation. The results
from the scenarios not simulated can then be obtained by altering the gas concentration
field in all control volumes by a constant factor. It is expected [26] that this assumption
will be reasonable in a ventilation dominated region (as opposed to a fuel dominated
region).
12 ©OGP
Although the NORSOK approach is for offshore installations, a similar approach can be
applied to explosion analysis for onshore installations. CFD modelling of ventilation
and dispersion is also useful for evaluating optimal geometry layout and location of gas
detectors [22,23]. CFD has also found some application in modelling dispersion in
complex topography (e.g. along a pipeline route), although it is not cost-effective to use
it routinely to model explicitly all scenarios typically represented in a QRA.
2.3 Fire and thermal radiation modelling

Fire modelling is typically used to calculate the flame dimensions for 2 purposes:
• As input to a thermal radiation model
• To determine whether a flame can reach a target for escalation (e.g. other
equipment)
It is important to understand the type of fire that can occur:
• Flash fire – an ignited vapour plume, whose dimensions are typically determined
directly from the dispersion modelling as the distance to LFL
• Jet fire – an intense, highly directional fire resulting from ignition of a vapour or
two-phase release with significant momentum
• Pool fire – from an ignited liquid pool2 or sea surface gas pool resulting from a
subsea gas release (e.g. from a pipeline or wellhead)
Offshore installations often have grated decks, so a liquid spill will fall through the
grating onto the sea surface. If ignited, the resulting sea fire may engulf one or more
legs of the installation as well as risers and conductors.
• Boilover – when a full surface fire occurs in an oil storage tank, heat will slowly
conduct downwards to any layer of water in the bottom of the tank; this will then
vaporise and the resulting expansion will hurl boiling oil upwards out of the tank.
• Fireball/BLEVE
Strictly, a BLEVE (Boiling Liquid Expanding Vapour Explosion) is simply explosively
expanding vapour or two-phase fluid. A BLEVE results from a “hot rupture” of a
vessel typically containing hydrocarbons such as LPG3, stored and maintained as a
liquid under pressure, due to an impinging or engulfing fire. A flammable material
will be ignited immediately upon rupture by the impinging/engulfing fire and will
burn as a fireball.
A fireball would also result from immediate ignition of a release resulting from cold
catastrophic rupture of a pressurised vessel.
The initial phase of a gas pipeline rupture should also be modelled as a fireball.
• Crater Fire – from ignition of a release from a buried pipeline. For vertical and
horizontal releases (see Section 2.1.3), the corresponding jet fire can be modelled.
For downward releases, the hole size corresponding to the low release velocity can
be taken as the diameter of a gas pool burning as a pool fire.
2
Note that it is not the liquid that burns but rather the vapour above it. The heat of the flame
vaporises the liquid beneath to provide the fuel supply.
3
BLEVEs of hydrocarbons up to butane or perhaps pentane are credible. A BLEVE of a vessel
containing a toxic material such as chlorine stored as a liquid under pressure is also credible
and should be considered if relevant. BLEVEs of heavier hydrocarbons such as crude oil or
petroleum do not occur.
©OGP 13
An appropriate model for the type of fire that could result from ignition of the release
being considered can be selected. This will also depend on the time/location of ignition:
for example, for a high momentum vapour release, ignition close to the source will
result in a jet fire; ignition at a point away from the source will result in a flash fire or
explosion (see Section 2.4), which may also burn back to a jet fire.
Whatever model is selected, the following parameters of the flame have to be
calculated:
• Flame dimensions
• Surface emissive power (not for a flash fire)
• Fireball only: duration (and possibly lift-off)
2.3.1 Simple approaches to fire and thermal radiation modelling

Some simple models for calculating flame dimensions are given in the sub-sections
below. Calculation of thermal radiation received by a target (e.g. a person) is not
straightforward, although an approximation can be used for a fireball due to its
spherical symmetry (see Section 0), and is best done using software. The simple flame
size models below are therefore best used either when only the flame dimensions are
required or to provide direct input to a flame radiation model.
2.3.1.1 Jet Fire

A simple correlation for the length L (m) of a jet flame due to Wertenbach [5]:
L = 18.5 Q0.41 [Q = mass release rate (kg/s)]
A generalised formula for different fuel types is [6]:
L = 0.00326 (Q Hc)0.478 [Hc = heat of combustion (J/kg)]
Based on calculations using the Chamberlain model [7], the following rough
relationships for distance along the flame axis to various thermal radiation levels have
been calculated:
• 37.5 kW/m2: 13.37 Q0.447
• 12.5 kW/m2: 16.15 Q0.447
• 5.0 kW/m2: 19.50 Q0.447
Some example jet fire thermal radiation results for horizontal releases are presented in
Figure 2.9 and Figure 2.10. These were obtained using DNV’s PHAST software, which
used the Chamberlain model [7].
14 ©OGP
Figure 2.9 Jet Fire Therm al Radiation Distances at Ground Level for
Propane Releases at 1 m Elevation
Figure 2.10 Jet Fire Therm al Radiation Distances at Ground Level for
Releases at 10 m Elevation
©OGP 15
2.3.1.2 Pool Fire

The diameter of an equilibrium pool fire (i.e. where all the fuel is being consumed as it is
released) is easily calculated by equating the mass release rate over the pool surface
with the burning rate. Burning rates for typical materials are given in Table 2.1.
The pool diameter D (m) is given by:
(assuming constant thickness of the pool)
Table 2.1 M ass Burning Rates for Selected Materials (29] unless indicated)
M aterial Mass Burning Burning velocity

Rate (kg/m 2 s) (m m /s)
Gasoline 0.05 0.07
Kerosene 0.06 0.07
Crude oil 0.05 0.07
Hexane1 0.08 0.11
Butane 0.08 0.13
LNG 0.14 on land [30] 0.242
0.24 on water [30] 0.422
LPG 0.11 on land 0.21
0.22 on water 0.42
Notes
1. Condensate may be taken as similar to hexane.
2. Calculated from mass burning rate using typical density of 450 kg/m3
Note that a pool fire’s size may be constrained by a bund (dike) or drainage, and also
that process areas are often constructed with the floor sloping towards a drain. In both
cases, the resulting pool will not be circular. For modelling thermal radiation from the
fire, most models assume the pool is circular with the diameter of the fire corresponding
to the surface area of the pool.
The flame length and tilt angle of a pool fire can be simply calculated using the Thomas
correlation [8]. Other models are referred to in [1].
Some example pool fire thermal radiation results are presented in Figure 2.11 and
Figure 2.12. These were obtained using DNV’s PHAST software.
16 ©OGP
Figure 2.11 Liquid Propane Pool Fire Therm al Radiation Distances at

Ground Level
Figure 2.12 Kerosene-type Liquid Pool Fire Therm al Radiation Distances at

Ground Level
2
Note: The shape of the curves for 12.5 kW/m is explained by the decreasing flame surface
emissive power with increasing pool diameter.
©OGP 17
2.3.1.3 Boilover
Boilover can be modelled as a pool fire with:
• Diameter equal to the tank diameter
• A height of 5 times the tank diameter
• Flame thermal emissive power = 150 kW/m2
However, a boilover also results in considerable rainout of burning hydrocarbon liquid
over a wide area, posing additional risk to people; this may also ignite hydrocarbon
vapours above neighbouring tanks.
2.3.1.4 Compartment Fire

For a fire inside an enclosed volume such as an offshore module, the fire size and
properties (in particular, smoke toxicity) depend on two factors:
• Whether the fire is large enough to impinge on a wall or ceiling
• Whether the fire is fuel- or ventilation-controlled4.
Figure 2.13 shows a procedure to determine the model required for a gas or 2-phase
release. A similar approach can be taken for a liquid release.
Lees [9, pp16/286ff] suggests possible approaches and other models for compartment
fires. Although written as applying to fires inside buildings, the text can also be applied
offshore.
4
In the former case there is an adequate supply of air to ensure complete combustion of the fuel;
in the latter case the ventilation is limited and the fuel is not fully combusted.
18 ©OGP
Figure 2.13 Procedure for Fire Model Selection (Gas or 2-phase Release)
Note: in a highly confined volume with limited ventilation (e.g. a platform leg), even a small fire
may be ventilation controlled.
2.3.1.5 Fireball/BLEVE
Several models for fireball duration and diameter have been developed. Most are simple
correlations between these quantities and fireball mass5. One model is due to Prugh
[10]:
Diameter, D (m): D = 6.48 M0.325 [M = fireball mass (kg)]

0.26
Duration, td (s): td = 0.825 M
Height of fireball centre, h (m): h = 0.75 D
Surface emissive power, q (kW/m2):
[P < 6 MPa; P is vapour pressure (MPa) at which failure occurs.]
5
When the release is two-phase, the fireball may not consume all the liquid. One possible
assumption is that the fireball mass is calculated assuming 3 × the adiabatic flash fraction at the
burst pressure, constraining this to be ≤ 1.0.
©OGP 19
Radiation received, I (kW/m2): I = q F τ
F = view factor: [x = distance (m) along ground]
τ = transmissivity:
2.3.2 Software for fire and thermal radiation modelling

The software packages listed in Section 2.0 model the fire types listed in Section 2.3,
apart from compartment fires. They will model the flame dimensions and orientation,
and thence the thermal radiation received.
For a compartment fire, if the fire inside the module is a diffusive fire smaller in volume
than the module, it can be modelled as a pool fire with the dimensions suggested in
Section 2.3.1.4; the surface emissive power can be taken to be the same as that of the
unimpinged jet fire.
2.3.3 CFD for fire and thermal radiation modelling

CFD models can be used to determine the fire loading on critical areas on both offshore
structures and onshore plants. The Oil and Gas UK guidance [24] provides a state-of-
the-art review of CFD fire modelling. In particular, it is stated that although CFD models
provide a more realistic representation of the flow physics, there are uncertainties
associated with modelling turbulent flow and combustion as well as in definition of fire
source and ambient conditions. Commonly used software for fire modelling include
Kameleon FireEx and CFX. Kameleon FireEx is typically used for fire modelling on
offshore platforms and onshore plants; CFX is more commonly for low geometry
scenarios, e.g. fire and smoke modelling in tunnels.
For CFD fire modelling, it may be best to reduce the size of the problem by modelling
only a subset of the installation. Otherwise, the run times for the analyses would be very
long. The procedure for running the fire analyses can be summarised in the following
steps:
1. Define leak size and select realistic leak locations;
2. Select leak directions. Typically, the analyses are run for up to 6 leak directions;
3. Run the fire simulations for different leak rates for each leak location and direction
until steady state conditions are reached.
Huser [25] describes a probabilistic procedure for the design of process against fires
using CFD modelling. The probabilistic assessment provides a Dimensioning Accidental
Load (DAL) fire that is used for design of the structure and allows for the development
of a consistent methodology (similar to explosion approach) for calculating fire loads.
The methodology is illustrated in Figure 2.14.
20 ©OGP
Figure 2.14 Probabilistic Procedure for Establishing Dim ensioning

Accidental Load (DAL) Fire and Mitigating Measures (from [25])
[25] has shown that for CFD simulations of jet fires the following parameters are
important (i.e. resulting in more than 20% variation in the heat loads when all other
parameters are kept constant):
• Initial leak rate and leak profile
• Leak and fire location
©OGP 21
• Jet direction
• Dynamic development of fire
• Geometry layout and
• Deluge
The probabilistic approach can be used to generate a fire exceedance curve from which
the DAL fire can be obtained.
2.4 Explosion modelling

For QRA and associated studies, explosions are usually taken to mean vapour cloud
explosions (VCEs). However, other types of explosion are possible (see Figure 2.1):
• Condensed phase explosions
• Dust explosions
• Runaway reactions
In addition, BLEVEs and vessel bursts generate overpressures that may be significant.
However, this section focuses on VCEs.
Huge advances in understanding and modelling of VCEs have been made in the last
decade since the Spadeadam tests. For offshore, the NORSOK standard Z-013 [11] has
established a comprehensive but computationally demanding approach to explosion
modelling, requiring use of an advanced CFD tool. Whilst originally developed
specifically for platforms in Norwegian waters, this approach is being adopted in other
areas of the North Sea. Although CFD models cannot yet be incorporated directly within
(offshore) QRAs, output from QRA is increasingly expected to be used in them.
Onshore, CFD is less well established in QRA whilst the application of simpler models
available in general purpose software is becoming more sophisticated and considered
fit for purpose. However, where design or layout decisions may critically depend on
explosion risks, use of CFD for specific scenarios would give additional robustness to,
and confidence in, the results. Another issue where CFD would assist is where terrain
effects are important, for example if a facility is built on a slope or at the foot of a hill: in
this case dispersion would be significantly modified compared with that which would
result over flat ground.
The recent advances in understand of explosions referred to above mean that the
previous classification of VCEs as unconfined, semi-confined or confined can now be
considered over-simplistic. It would be better to talk about degrees of confinement and
congestion6. TNO’s Multi-Energy model [12], discussed further in Section 2.4.2, allows
for 10 levels of confinement/congestion, ranging from the equivalent of a UVCE
(Unconfined Vapour Cloud Explosion) through to highly confined/ congested volumes
such as can be found in a densely packed process area of an onshore plant. In this and
similar models, some assessment or assumption needs to be made outside of the
model as to the maximum overpressure. In CFD modelling, the distinction between
levels of confinement/ congestion disappears since the geometry is defined and the
software itself calculates the maximum overpressure.
6
Confinement should be thought of as a solid barrier preventing flame acceleration in a certain
direction; congestion as a porous barrier, or set of discrete obstructions, inducing turbulence in
the flow and modifying (increasing) flame acceleration in a certain direction.
22 ©OGP
2.4.1 Simple approaches to explosion modelling

Historically, simple “TNT equivalence” models have been used for modelling explosion
overpressures from unconfined VCEs (UVCE) onshore. However, these require the
explosive mass to be calculated: as this is an output from dispersion modelling, manual
calculation of explosion overpressures is not likely to be undertaken.
Another old approach for onshore QRA [13] calculates the distance to specified levels
of damage directly from the explosion energy by a simple correlation. Again, this
requires the explosive mass to be calculated.
2.4.2 Software for explosion modelling

2.4.2.1 Onshore explosions
General purpose consequence modelling software (see list in Section 2.0) includes
either of both of two well established explosion models: the TNO Multi Energy model
[12] and the Baker Strehlow or Baker Strehlow Tang model [14].
In the Multi Energy m odel, a vapour cloud is divided into the regions of congestion,
or “blast sources”, they may enter and fill (or partially fill). Each of these blast sources
is treated independently of the others. The material and the volume of the cloud within
the blast source are used to calculate the explosion energy. A confined explosion
strength is assigned to the blast source by the analyst: this strength corresponds one
of 10 lines on a graph of peak side-on overpressure vs. scaled distance from the source.
The 10 lines represent a range of maximum overpressures (at the source) ranging from
0.01 to 13 bar. Selecting the correct confined explosion strength for a given situation
(e.g. a specific process unit on a refinery) is far from straightforward, although generally
no. 7 or 8 is used for process units. Guidance [15] has been developed to assist this,
although even with this it is strongly recommended to call upon experienced personnel
to make the assessment.
In the Baker Strehlow Tang model the analyst selects instead the material reactivity
(high, medium, or low), flame expansion (number of directions in which the flame can
expand), obstacle density (high, medium, or low), and ground reflection factor (1 for air
burst, 2 for ground burst and hence ground reflection). This has two advantages over
the Multi Energy model:
• Materials of different reactivities can be adequately represented
• Selection of flame expansion and obstacle density is simpler
As in the Multi Energy model, the overpressure vs. scaled distance is a set of curves (in
this case 11) that span the range of input selections.
These models are appropriate for use in studies of onshore facilities including marine
terminals.
2.4.2.2 Offshore explosions

For offshore installations, non-CFD software has been used to estimate maximum
overpressures in modules using relatively simplified methods that nevertheless take
account of the broad features of module geometry. For example, DNV have used their
programs COMEX and NVBANG in numerous studies, however these programs are not
available commercially and are not recommended for non-specialists in explosion
modelling.
However, in offshore applications the maximum overpressure itself is usually not used
directly in the risk calculations. Rather, it represents the worst case combination of
module fill, release location and ignition location. In a real situation, this combination is
©OGP 23
unlikely to be achieved and a lower overpressure will be reached. Of direct concern is

the likelihood of an explosion that will result in equipment escalation or breaching of the
TR wall, for example. This requires a probabilistic approach to estimate the likelihood
of any given explosion overpressure being exceeded at a specific location. This is the
approach set out in the NORSOK standard Z-013 [11]. CFD modelling is used to model
explosion overpressures for a number of scenarios. The results are then combined with
leak frequencies, ignition data and wind probabilities in another software package (e.g.
DNV’s EXPRESS) to develop overpressure exceedence probability curves for use in the
QRA. The same approach can be used for more specific design problems, for example
designing an ESD or deluge system to withstand the drag forces likely to result from an
explosion.
This approach requires considerable investment of effort to obtain useful and robust
results. Previous, more simplified methods have the appearance of being less costly to
achieve the same end. However, the initially more costly NORSOK approach [11] can be
used to cost-optimise the design of a module for explosions, eliminating the need for
excessive and hence costly conservatism (i.e. over-engineering).
2.4.3 CFD for explosion modelling

The representative gas clouds from the CFD dispersion analysis (see Section 2.2.3) can
be ignited and explosion analysis carried out. The Oil and Gas UK guidance [24] reports
that it is not recommended to use dispersed non-homogeneous and turbulent gas
clouds in CFD explosion simulations due to the lack of testing/validation for this
application. Instead, an equivalent quiescent stoichiometric gas cloud, that gives similar
overpressures to the non-homogeneous and turbulent clouds, has to be calculated.
As an example of how this can be done, the FLACS software automatically calculates a
parameter (referred to as “Q5”) that converts the non-homogeneous cloud into an
equivalent quiescent gas cloud. It should be noted that the duration of the equivalent
gas cloud may be shorter than the non-homogeneous one resulting in a difference in
the structural response.
The explosion simulations should be carried out for various gas cloud sizes and
shapes, gas cloud locations and ignition locations. For each gas cloud size, the gas
cloud location and ignition location should be varied. In particular, it is important to
locate the clouds close to critical and congested areas of equipment and piping.
The ignition location will also have a strong impact on the explosion loads. Generally,
the CFD analyses are run with two different locations namely ignition location at centre
of cloud and at edge of cloud. Depending on the geometry and layout, edge ignition will
sometimes produce the higher (than central ignition) explosion overpressures due to
the increased flame distance.
Results in terms of explosion overpressures can be output at monitor points at pre-
defined locations and drag forces can be obtained for design of critical equipment and
piping.
2.5 Smoke and gas ingress modelling
Modelling of smoke and gas ingress to the TR or living quarters usually forms part of an
offshore QRA and could also be used in onshore studies. More generally, modelling of
smoke generation and dispersion can be useful to determine the likelihood of escape
routes being impaired or of people out-of-doors being overcome by smoke.
Smoke and gas ingress modelling has up to 4 stages:
Source Term → Dispersion → Ingress → Effects
24 ©OGP
The source term comes from the release rate modelling (Section 2.1): directly for gas
and from suitable ratios of (mass of smoke) / (mass of hydrocarbon released).
Dispersion can be modelled as suggested in Section 2.2. Since smoke’s largest
constituent is nitrogen (i.e. the unburnt part of the air involved in combustion), one
approach used has been to model the smoke as hot, dense nitrogen, giving it a
molecular weight and temperature equal to those estimated for the combustion gases.
However, the high temperature invariably results in a rapidly rising smoke plume that
doesn’t match experience. For example, photographs of smoke from the Piper Alpha
disaster show the plume travelling almost horizontally. One possible reason is that the
soot particles in the smoke increase the plume’s density. Hence this approach is not
recommended for 3D results. However, it may be used to determine the smoke
concentration at a given distance horizontally from the release point, assuming as a
worst case that this is the centreline concentration.
2.5.1 Simple approaches to smoke and gas ingress modelling

The CMPT Guide to quantitative risk assessment for offshore installations [1] provides data
and references on smoke generation, composition, dispersion, visibility reduction,
ingress to TR and impact.
A series of linked models has been used in offshore QRAs for BP and other operators:
• Smoke generation:
− Composition from [16]: see Table 2.2
− Depends on fuel (light = gas, heavy = condensate/oil)
− Depends on whether fire is fuel-controlled, ventilation-controlled or in between
these.
Table 2.2 Sm oke Com position Data
Fire Area Type Component Fuel Type*

Light Heavy
a) Fuel Controlled Carbon Monoxide (ppm) 400 800
Carbon Dioxide (%) 10.9 11.8
Oxygen (%) 0 0
Smoke Temperature (°C) 1,000 1,000
Particulates (dB/m) 15 47
b) Ventilation Controlled Carbon Monoxide (ppm) 30,000 31,000
Carbon Dioxide (%) 8.2 9.2
Oxygen (%) 0 0
Smoke Temperature (°C) 600 600
Particulates (dB/m) 29 70
* The light composition is used for gas jet fires. The heavy composition is used for
condensate fires.
Dispersion: based on a dilution factor, which is a function of fuel burn rate and of
distance from source (does not take into account wind speed or the presence of
barriers).
• Figure 2.15 shows dilution factors, based on calculations using FLACS [17], for
different release rates.
• Smoke Ingress:
©OGP 25
− CO and CO2 build-up in the module are calculated using a CSTR model, taking as
input the smoke concentration immediately outside the TR and the TR’s
ventilation rate
− The CO2 concentration calculation also includes exhaled CO2 from personnel
inside
− The internal temperature is also calculated based on heat generated by TR
occupants
Figure 2.15 Sm oke Dilution Factors
• Smoke effects/toxicity
− Based on dose relationships given in [18]
− Considers toxicity of CO; effects of CO2, lack of oxygen and high air temperature;
visibility reduction
For gas ingress a set of dilution factors is used, equivalent to but different from those
used for smoke. A CSTR model is used for gas ingress, and fatalities in the TR are
assumed to occur if the gas concentration exceeds 60% of LFL.
2.5.2 Software for smoke and gas ingress modelling

For smoke dispersion in the open, general purpose consequence modelling software
such as the packages listed in Section 2.0 is sometimes used. However, the validity of
this approach and its superiority to the simple approach described in Section 2.5.1 are
uncertain.
For smoke and gas build-up within modules, multizone models such as COMIS can be
used. Multizone modelling involves solving mass balance equations for the flow
between different zones, thus allowing for partitioning due to smoke barriers, walls
between rooms, etc. Multizone models were developed primarily to predict airflow in
buildings, but they are also capable of predicting the transient transport of
26 ©OGP
contaminants such as smoke. The method is applied by considering a building as being

divided into a number of zones (typically rooms) that are physically separated from one
another. As with the CSTR model, each zone is treated as fully mixed. The rate at which
air flows between zones is governed by the pressure difference and the modelled
connection (i.e. doors, ducts etc.) between the rooms. Multizone models have some of
the characteristics of both CFD and the CSTR model; conceptually the approach lies
between the two in terms of resolution and complexity.
2.5.3 CFD for smoke and gas ingress modelling
CFD modelling can be used to provide a detailed prediction of the smoke distribution in
TR or living quarters. The effect of heat sources due to people and computing
equipment can be included in the analysis. However, smoke modelling using CFD can
be quite difficult due to the variability and uncertainty in the boundary conditions [26]. A
recent article by O’Donnell et. al. [27] provides a comparison of different approaches to
smoke modelling namely the CSTR model, a multizone model and a CFD model. CFX
and Kameleon FireEx can be used to carry out detailed CFD smoke modelling.
The smoke and gas dilution factors used in the models described in Section 2.5.1 were
determined using FLACS, a CFD package. This or another CFD package could be used
directly to model smoke dispersion from a source in the same way as described in
Section 2.2.3 for gas dispersion modelling in general. However, the approach described
in Section 2.5.1 has generally been accepted as fit for purpose in QRAs.
CFD is more likely to be useful in design, for example in locating HVAC air intakes to
minimise the likelihood of smoke ingress. Although best practice is to place them on
the TR face away from potential smoke sources (i.e. fires), flow around bluff bodies
results in zones of recirculation and hence of enhanced smoke concentration.
2.6 Toxicity modelling

The toxic effects of a material may be acute (resulting from accidental exposure to a
high concentration over a short period of time) or chronic (resulting from continuous
exposure to a lower concentration over a long period of time, as a result of routine
emissions or a small, undetected leak). Different toxic materials have different
physiological effects: they may inhibit respiration (causing asphyxiation) through
inhalation, they may affect the central nervous system, they may be ingested or
absorbed through the skin. For the purposes of this datasheet, the discussion is limited
to acute effects and it is not necessary to consider the nature of the physiological
effects. The discussion addresses toxicity on the basis of dose-response relationships
(see below).
Offshore, besides smoke (as discussed in Section 2.5), toxic modelling is usually limited
to the effects of sour gas, i.e. H2S.
Onshore, besides H2S (in onshore hydrocarbon production, transport and processing),
other toxic materials are potentially of concern. Toxic consequences are invariably
bound up with toxic effects: that is, a model for toxicity is a model for lethality or lesser
effects.
Toxicity data is typically encountered in two forms when required for QRA: specified
concentrations such as the IDLH (Immediate Danger to Life and Health), or
concentration-lethality levels for different species such as rats. Such data can be found
in Material Safety Data Sheets (MSDS) or online reference sources such as CHRIS
www.chrismanual.com.
©OGP 27
For QRA, a dose-response relationship is often used that relates the lethality to the dose
received at a point. At its simplest, the dose is given by (concentration × time),
assuming the concentration remains constant over time. However, for many materials,
the effect of concentration is magnified and, for concentration C and exposure time t,
the relevant dose A is given by:
Note that the exponent n is not necessarily an integer.

In its regulatory work the UK HSE (e.g. 19] uses two values of A:
• SLOT (Specified Level Of Toxicity) Dangerous Toxic Load: the dose that results in
highly susceptible people being killed and a substantial portion of the exposed
population requiring medical attention and severe distress to the remainder
exposed. It represents the dose that will result in the onset of fatality for an
exposed population (commonly referred to as LD1 or LD1-5)
• SLOD (Significant Likelihood Of Death): is defined as the dose to typically result in
50% fatality (LD50) of an exposed population and is the value typically used for
group risk of death calculation onshore.
Values of the SLOT and SLOD for selected materials are given in Table 2.3. As can be
seen in the final column, values of “n” for these materials range from 1 to 4.
Table 2.3 SLOT & SLOD Values for Selected Materials
Substance SLOT SLOD “n”

8 9
Ammonia 3.78 × 10 1.09 × 10 2
Carbon monoxide 40125 57000 1
5 5
Chlorine 1.08 × 10 4.84 × 10 2
12 13
Hydrogen sulphide 2.0 × 10 1.5 × 10 4
6 7
Sulphur dioxide 4.66 × 10 7.45 × 10 2
Hydrogen fluoride 12000 41000 1
5
Oxides of nitrogen 96000 6.24 × 10 2
Note: these values are based on concentration in ppm, time in minutes.
As stated above, the LD50 is often used in risk calculations. The HSE’s approach allows
for calculation of the LD50 for any exposure duration.
The most sophisticated approach to determining toxicity adopts the same approach to
calculating the dose but allows the lethality to be calculated for any given concentration
and duration of exposure. This is the “probit”. A probit value Pr is calculated (for a
constant release rate and hence concentration7) as:
where “a”, “b” and “n” are all material specific constants (“n” is the same as above).
These constants have been published for many commonly encountered materials in a
number of sources [e.g. 9,20]. A table relating lethalities to probits can be found in
many places e.g. [9].
7 n
For a time varying release rate and hence concentration, the (C t) can be replaced by an integral
over time.
28 ©OGP
2.6.1 Simple approaches to toxicity modelling
The toxic dose should always be calculated using the relationship discussed in
the text preceding this sub-section. It therefore requires results from dispersion
modelling (Section 2.2) together with the exposure time. Calculation of the LD50 using
the HSE approach described in the text preceding this sub-section is recommended as
the best simple approach and will be sufficient for many purposes.
2.6.2 Software for toxicity modelling

The software listed in Section 2.0 will calculate probits for toxic materials and thence
the lethality level as a function of distance from the release point or as contours of
different lethalities overlaid on a plan or map. In this way the lethality at any point can
be determined for a given wind direction.
2.6.3 CFD for toxicity modelling

CFD will provide as output the concentration at any point. This could be used together
with a SLOT/SLOD value or probit to calculate lethality at that point. Contour plots of
toxic lethality are not available from CFD software but could probably be generated from
tabular output.
3.0 Guidance on use of approaches

The approaches described in Section 2.0 are based on published sources that are
widely known and accepted.
All modelling of physical phenomena is imperfect. Any use of software must be within
the limitations set out for the software, and even then the analyst must carry out a
reality check on the results. For example: a jet fire model applied to a large, high
pressure gas release will predict a jet flame several hundreds of metres long; the
analyst must consider whether this is credible, or whether the flame will impinge on an
obstruction within this distance.
Depending on the application, a simple model may be fit for purpose, or detailed
modelling (e.g. using CFD) may be required. Whilst it may be considered desirable to
use CFD as much as possible, the resources (time, trained personnel, and budget)
required to use it effectively are rarely available; hence it is usually used to address
specific problems or to provide results for a limited set of scenarios that can be applied
or extrapolated to all the scenarios being modelled in a QRA.
In the early stages of design, the detailed design information required for CFD to give
accurate predictions of overpressures is not available and hence decisions based on
CFD results may result in under-design for the potential overpressures.
©OGP 29
3.2 Uncertainties
All modelling suffers from uncertainties. For a given set of input (initial) conditions, it is
unlikely exactly to match the physical outcome that would result in reality from the
same initial conditions. Indeed, numerous physical realisations of the same release
would give different results, whereas consequence modelling software gives the same
result each time8. Sources of uncertainty in consequence modelling for QRA include
the following:
• A QRA only models a limited range of cases, so the conditions of an actual release
are unlikely to match exactly any of the cases modelled in a QRA
• Ambient conditions (wind speed, wind direction) do not stay constant over the
duration of a release as is modelled
• Box models for dispersion, and models of equivalent complexity for other
phenomena, cannot deal with solid or porous barriers (buildings, process units,
bund walls, etc.)
• CFD cannot model sub grid scale turbulence (see Section 0)
3.3 Choosing the right approach for consequence modelling

As set out in Section 2.0, whilst simple models are available for some consequences,
and a range of numerical results for some consequences are given there, some
consequence modelling requires the use of either general purpose or CFD software. To
decide which is the best approach it is necessary to decide:
• What is the scope of the study?
• What is the required depth of the study?
• How many release scenarios will be modelled?
• Who will carry out the study?
• Will the analysis need to be updated in the future, or the results interrogated? If so,
who will do this?
If the scope is a full, detailed QRA, then most or all of the 6 steps described in Section
2.0 will need to be undertaken. This means that the output from one step of the analysis
will become the input to the next step, and it is important to make the links between the
steps as straightforward and robust as possible. This in turn suggests that general
purpose consequence modelling software where the transitions from one model to the
next are automated is preferable to using a mixture of models from different sources
(perhaps with some implemented in spreadsheets, others coded). However, in this case
the automated transitions may be “black box”-like and so the analyst needs to
understand fully how these work to ensure that the results represent physical reality.
(For example, that a modelled jet fire is a credible outcome.)
If a coarse QRA of a simple installation is to be undertaken, a simpler approach may be
acceptable. This could use the correlations given or referred to in Section 2.0, or the
consequence results presented in that section.
8
Monte Carlo modelling could be used to vary slightly the input parameters but this does not
appear to be done routinely. Another type of dispersion modelling, “random walk modelling”,
likewise does not appear to be used for QRA.
30 ©OGP
For a QRA of an offshore installation with enclosed modules, use of CFD for explosion
modelling is now routinely used. For a new installation, it will almost certainly have to
be used in order to design for explosions. For an existing installation, explosion
modelling predating the Blast and Fire Engineering for Topside Structures JIP will probably
have been revised using CFD. Thus it is likely that the necessary CFD modelling will
have been done, or at least that the geometry model has been built and it will be
relatively straightforward to obtain any additional results required.
For QRAs of onshore installations, use of the TNO Multi Energy Model or the Baker
Strehlow Tang model (see Section 2.4.2.1) is strongly recommended over use of earlier
VCE models.
For problems of a more limited nature, in particular decisions about significant
investment in relation to fire or explosion and especially in relation to offshore
structures, it is advisable to use CFD in order to maximise the robustness of the
analysis and the confidence in the results.
CFD modelling requires considerable experience and expertise to use effectively. It is
rare for a risk analyst skilled in all aspects of QRA to possess the required degree of
specialist expertise. CFD analysis should therefore be assigned or contracted to
personnel with the required expertise.
3.4 Geometry modelling for CFD

Generally, the numerical grid in CFD models is not fine enough to resolve the smaller
items of equipment and pipe work which are responsible for a large part of the
turbulence generated during an explosion. Most of the software (FLACS, EXSIM,
AutoReaGas) uses a so-called distributed porosity concept (Porosity, Distributed
Resistance (PDR) model) to account for the objects which cannot be represented by the
grid. The porosity model is used to calculate the turbulence source terms due to those
small items and the flame speed enhancement arising from flame folding in the sub grid
wake.
Explosion relief panels and yielding walls can also be represented by modifying the
porosity in the region where they occur.
It is important that all the geometric details are properly represented in a CFD model due
to their importance in pressure build-up. The particular areas where gas explosion
analyses are carried out must be modelled with a high degree of accuracy. In the early
design stages, no detailed description of the geometry exists and this may pose a
problem with regard overpressure prediction. There are two ways in which this problem
can be circumvented namely by applying a factor for equipment growth to account and
by adding anticipated congestion to obtain final expected object density and
distribution.
The Oil and Gas UK guidance [24] reports on a detailed investigation of a typical North
Sea integrated deck platform which showed that, for good prediction of overpressures,
definition of all major equipment, boundaries (decks, TR), all piping with diameters >
0.2 m, and primary/ secondary structures with cross-section dimensions > 0.13 m is
required.
In addition, it is important to define the CFD grid to extend quite a large distance from
the area of interest to avoid too strong influence from open boundaries.
©OGP 31

Key general sources for suitable consequence modelling methods are the Guide to
quantitative risk assessment for offshore installations [1] and Lees’ Loss Prevention in the
Process Industries [9]. These have been supplemented by more specific published
papers and books as listed in Section 6.1: all of these are believed to have found wide
acceptance in the QRA community including with regulatory authorities.
The general purpose software packages listed in Section 2.0 are all commercially
available. Validation data for them, if required, should be sought from the software
providers. The EU SMEDIS project [28] in particular has compared the leading
dispersion models with results from experimental measurements.
The basis of the suggested approach to modelling releases from buried pipelines
(Section 2.1.3) is confidential work carried out by DNV on behalf of clients (personal
communication). No published methodology has been found.
The basis of the suggested approach to modelling boilover (Section 2.3.1.3) is the Dyfed
Fire Brigade video of the Amoco Milford Haven refinery tank fire. The flames from the
boilover reached a height of 3000 feet, or about 10 times the tank diameter; however,
they were not continuous or constant to this height over a typical period of interest, and
were partly obscured by smoke. Hence a height of 5 times tank diameter appears
reasonable.
For explosion modelling, FLACS and AutoReaGas have been extensively validated
against experimental data, in particular from the Phase 2 and Phase 3 JIP Blast and Fire
Engineering for Topside Structures experiments carried out at Spadeadam and elsewhere.
FLACS is also currently being validated for hydrogen as part of the EU HySafe
programme. Details of FLACS and AutoReaGas validation are available on their
respective websites (see Section 2.0).

For further information, the data sources referenced in Sections 2.0 to 4.0 should be
consulted. Some additional references are given in Section 6.2.
On the subject of subsea releases, two major reports 32], [33] were published in 2007
and 2008 and should be consulted if detailed information is required (i.e. if subsea
releases appear to pose a significant risk).
6.0 References
1. Spouge, J, 1999. A guide to quantitative risk assessment for offshore installations, CMPT
publication no. 99/100, ISBN 978-1-870553-36-0 / 1 870553 36 5. Now available from
the Energy Institute www.energyinst.org.uk.
2. Czujko, J (ed.), 2001. Design of Offshore Facilities to Resist Gas Explosion Hazard
Engineering Handbook, Sandvika: CorrOcean ASA.
3. BP Amoco, CERC and BG Technology, 2000. Workbook on Gas Accumulation in a
Confined and Congested Area, Joint Industry Project Gas Build Up from High Pressure
Natural Gas Releases in Naturally Ventilated Offshore Modules. [Believed to be
available only to sponsors but summarised in the following reference.]
4. Cleaver, R P and Britter, R E, 2001. A Workbook Approach to Estimating the Flammable
Volume Produced by a Gas Cloud, Paper R416, FABIG Newsletter: Issue 30, 5-7.
32 ©OGP
5. Wertenbach, H G, 1971. Spread of Flames on Cylindrical Tanks for Hydrocarbon Fluids,

Gas and Erdgas 112.
6. API, 1982. Guide for Pressure Relieving and Depressuring Systems, American
Petroleum Institute, Recommended Practice RP 521, 2nd ed.
7. Chamberlain, G A, 1987. Developments in Design Methods for Predicting Thermal
Radiation from Flares, Chem Eng Res Des 65.
8. Thomas, P H, 1963. The Size of Flames from Natural Fires, 9th Intl. Combustion
Symposium, Combs Inst. Pittsburgh, PA, pp.844-859.
9. 2005. Lees’ Loss Prevention in the Process Industries, 3rd. ed., Mannan, S, ed., Oxford:
Elsevier Butterworth – Heinemann.
10. Prugh, R W, 1994. Quantitative evaluation of fireball hazards, Process Safety Progress
13(2), 83-91.
11. Procedure for probabilistic explosion simulation, NORSOK Standard Z-013 Rev.2
Annex G.
12. TNO 1997. Methods for the calculation of physical effects due to releases of hazardous
materials (liquids and gases) [the “Yellow Book”], eds: van den Bosch, C J H and
Weterings, R A P M, Chapter 5: Vapor Cloud Explosions, Mercx, W P M and van den
Berg, A C.
13. TNO 1979. Methods for the Calculation of the Physical Effects of the Escape of
Dangerous Material, [the “Yellow Book”], Chapter 4: Vapour Cloud Explosions,
Wiekema, B J.
14. Tang, M J, and Baker, Q A, 1999. A New Set of Blast Curves from Vapour Cloud
Explosion, Proc. Safety Progress 18(4), 235-240.
15. Mercx, W P M et al., 1998. Application of correlations to quantify the source strength of
vapour cloud explosions in realistic situations. Final report for the project: ‘GAMES’, HSE
and TNO, http://www.hse.gov.uk/research/crr_pdf/2001/crr01318.pdf.
16. SINTEF 1992. Handbook for Fire Calculations and Fire Risk Assessment in the Process
Industry.
17. FLACS, V8 (version 8), 2003, see www.gexcon.com.
18. Purser, D, 1992. Toxic Effects of Fire Cases, Conf. on Offshore Fire and Smoke
Hazards, Aberdeen.
19. HSE 2006. Indicative Human Vulnerability to the Hazardous Agents Present Offshore for
Application in Risk Assessment Of Major Accidents, SPC/Tech/OSD/30.
http://www.hse.gov.uk/foi/internalops/hid/spc/spctosd30.pdf.
20. CPD 1992. Methods for the determination of possible damage to people and objects
resulting from releases of hazardous materials [the”Green Book”], Committee for the
Prevention of Disasters caused by Dangerous Substances / TNO, The Hague:
Directorate-General of Labour of the Ministry of Social Affairs and Employment.
21. Norwegian Technology Centre, 2001. Risk and Emergency preparedness analysis,
NORSOK Z-013, http://www.standard.no/imaker.exe?id=1503.#
22. Huser, A., Oliveira, L F, Rasmussen, O, and Dries, J V D, 2002. Explosion risks in
large and widespread process areas, ERA Conference, November.
23. Huser, A, Oliveira, L F, and Dalheim, J, 2004. Cost optimisations of gas detector
systems, Proc. OMAE04, 23rd International Conference on Offshore Mechanics and Arctic
Engineering, June.
©OGP 33
24. Oil and Gas UK & HSE, 2007. Fire and Explosion Guidance, publication no. EHS24.
Available from Oil and Gas UK http://www.ukooa.co.uk/ukooa/.
25. Huser, A, 2006. Probabilistic procedure for design of process areas against fires,
FABIG Newsletter 44. Available from FABIG www.fabig.com.
26. Talberg, O, Hansen, O R, Bakke, J R, and Wingerden, K. Application of a CFD-based
probabilistic explosion risk assessment to a gas-handling plant, conference paper
available from CMR-Gexcon http://www.gexcon.com/download/ERA_00-Paper.pdf.
27. O’Donnell, K, Deevy, M, and Garrard, A, 2007. Assessment of mathematical models
for prediction of smoke ingress and movement in offshore installations, FABIG
Newsletter 48. Available from FABIG www.fabig.com.
28. Daish, N C, Britter, R E, Linden, P F, Jagger, S F, and Carissimo, B, 1999. Scientific
Model Evaluation techniques applied to dense gas dispersion models in complex
situations, Intl Conf. on Modelling the Consequences of Accidental Releases of
Hazardous Materials, CCPS, San Francisco, California, September 28 – October 1.
29. Mudan, K S, and Croce, P A, 1988. Fire Hazard Calculations for Large Open
Hydrocarbon Fires, Fire Protection Engineering, Section 2 Chapter 4, Society of Fire
Protection Engineers, National Fire Protection Association.
30. Cleaver P, & Johnson, M, 2004. LNG Behaviour, Fire and Blast Issues related to LNG,
FABIG Technical Review Meeting, London & Aberdeen, October 6 – 7.

31. CCPS 1994. Guidelines for Evaluating the Characteristics of Vapour Cloud Explosions,
Flash Fires and BLEVES, New York: American Institute of Chemical Engineers.
32. Fanneløp, T K, and Bettelini, M, 2007. Very Large Deep-Set Bubble Plumes From
Broken Gas Pipelines, Report No. 6201, Project No. 99B43, Petroleum Safety Authority
Norway.
33. Tveit, O J, and Huser, A, 2008. Risiko knyttet til gassutslipp under vann. Videreføring
2007, Spredning over havet, Petroleum Safety Authority Norway.
34 ©OGP

March 2010
Mechanical
lifting
failures
RADD – Mechanical lifting failures
Contents:
1.0 Introduction .......................................................................... 1
1.1 Application ...................................................................................................... 1
1.2 Definitions ....................................................................................................... 1
3.2 Uncertainties ................................................................................................... 3
3.3 Use of the Data................................................................................................ 4
3.4 Consequence Analysis of Objects Dropped Into the Sea........................... 4
3.5 Kinetic energy ................................................................................................. 6
5.0 References ............................................................................ 8
©OGP
Abbreviations:
WOAD World Offshore Accident Databank
©OGP
1.0 Introduction
1.1 Application
This datasheet presents information on the frequency of dropped objects resulting from
the failure of lifting devices on offshore installations. Specifically it includes dropped
load frequencies for the following types of lifting equipment:
1. Main cranes
2. Drilling derrick
3. Other devices
The data are derived from offshore operating experience in the UKCS over the period
1980 to 1999. The data are intended to be applied in quantifying the risks from lifting
operations worldwide. Consideration should be given to factoring the data up or down
where there is reasonable justification that the management of lifting operations is
significantly poorer or safer that UKCS operations.
1.2 Definitions
• Dropped loads Refers to loads (objects) either unintentionally released from

a lifting device or else swinging and impacting some part of
the installation structure (or vessel, if the lift is to/from a
vessel).
• Lifting devices Main crane, derrick main hoisting assembly, and other lifting
devices (see below).
• Other lifting BOP cranes, gantry cranes, tuggers, and a range of portable
devices devices, e.g winches, sling blocks, wirelines.
• Mobile The data for mobile installations are gathered almost entirely
Installations from experience in the operation of mobile offshore drilling
units (MODUs). These include semi-submersibles, jackups,
and drill ships.
• Fixed The data for fixed installations are gathered from a range of
Installations types of production installation ranging from integrated
platforms to wellhead platforms. The data also include
experience from FPSOs (floating production, storage and
offloading vessels) and FSUs (floating storage units).
“Main cranes” and “drilling derrick” referred to in Section 1.0 are considered self
explanatory.

Dropped object probabilities per lift on offshore installations are tabulated below for
mobile installations and fixed installations, for different load weights and by lifting
device (main crane, drilling derrick, or other device).
The data represent the probability of a dropped object per lift. Estimation of the
dropped object frequency combines the probability of a dropped object per lift with the
number of lifts carried out (for example, per year if the annual risk is required).
Note that, for drops from the main crane, in general the frequency in the Total column is
not the sum of the Installation, Sea and Vessel drop frequencies in the same row
because not all main crane lifts are between vessel and installation (some are across
©OGP 1
the installation). Each frequency in the Total column is calculated from the total number
of lifts, whereas the Sea and Vessel frequencies are calculated from the number of
external lifts (between installation and vessel) only.
Of the reported events on which the probabilities tabulated below are based, 10% of
dropped objects on mobile installations and 20% of dropped objects on fixed
installations resulted in all or part of the lifting device falling (see Section 1.2 above for
the definition of “lifting device”).
Dropped Object Probabilities for Mobile Units (per lift)
Load Lifting Drop Onto: Total

Weight device Installatio Sea Vessel
n
-5 -6 -5 -5
<1 te Main crane 3.2 × 10 8.8 × 10 1.1 × 10 4.1 × 10
-5 -7 -8 -5
Drilling 1.7 × 10 7.3 × 10 6.1 × 10 1.8 × 10
Derrick
-5 -5 -5
Other Device 8.6 × 10 1.1 × 10 0* 9.7 × 10
-6 -6 -6 -6
1 – 20 te Main crane 3.1 × 10 2.0 × 10 3.0 × 10 5.4 × 10
-6 -7 -6
Drilling 3.6 × 10 4.6 × 10 0* 4.0 × 10
Derrick
-6 -6 -5
Other Device 7.6 × 10 2.9 × 10 0* 1.1 × 10
-5 -6 -6 -5
20 – 100 te Main crane 1.2 × 10 7.1 × 10 9.5 × 10 2.0 × 10
-6 -6
Drilling 1.8 × 10 0* 0* 1.8 × 10
Derrick
-6 -6
Other Device 1.9 × 10 0* 0* 1.9 × 10
-4 -4
>100 te Main crane 2.8 × 10 0* 0* 2.8 × 10
-3 -3 -3
Drilling 4.7 × 10 1.4 × 10 0* 6.1 × 10
Derrick
-4 -4 -4
Other Device 4.9 × 10 2.4 × 10 0* 7.3 × 10
-6 -6 -6 -5
All Main crane 8.5 × 10 3.3 × 10 4.6 × 10 1.2 × 10
-5 -7 -8 -5
Drilling 1.1 × 10 6.7 × 10 3.0 × 10 1.1 × 10
Derrick
-5 -6 -5
Other Device 4.5 × 10 6.5 × 10 0* 5.2 × 10
-5 -6 -7 -5
Total All 1.2 × 10 1.4 × 10 9.4 × 10 1.4 × 10
2 ©OGP
Dropped Object Probabilities for Fixed Installations (per lift)

Load Lifting Drop Onto: Total
Weight device Installatio Sea Vessel
n
-5 -6 -5 -5
<1 te Main crane 3.8 × 10 6.9 × 10 1.1 × 10 4.5 × 10
-5 -7 -7 -5
Drilling 1.7 × 10 1.2 × 10 1.2 × 10 1.7 × 10
Derrick
-4 -6 -7 -4
Other Device 1.0 × 10 4.2 × 10 6.1 × 10 1.0 × 10
-6 -6 -6 -6
1 – 20 te Main crane 4.7 × 10 1.7 × 10 5.1 × 10 7.9 × 10
-6 -7 -6
Drilling 2.7 × 10 1.5 × 10 0* 2.9 × 10
Derrick
-5 -7 -5
Other Device 1.4 × 10 0* 7.4 × 10 1.5 × 10
-5 -6 -5 -5
20 – 100 te Main crane 1.0 × 10 6.2 × 10 1.6 × 10 2.0 × 10
-6 -6
Drilling 1.2 × 10 0* 0* 1.2 × 10
Derrick
-5 -5
Other Device 2.6 × 10 0* 0* 2.6 × 10
-5 -5
>100 te Main crane 9.3 × 10 0* 0* 9.3 × 10
Drilling 0* 0* 0* 0
Derrick
-4 -4
Other Device 6.1 × 10 0* 0* 6.1 × 10
-5 -6 -6 -5
All Main crane 1.0 × 10 2.8 × 10 6.4 × 10 1.5 × 10
-6 -7 -8 -6
Drilling 9.6 × 10 1.2 × 10 6.1 × 10 9.7 × 10
Derrick
-5 -6 -7 -5
Other Device 5.7 × 10 2.0 × 10 5.8 × 10 6.0 × 10
-5 -7 -6 -5
Total All 1.4 × 10 8.8 × 10 1.6 × 10 1.6 × 10
• In both of the above tables, either there are no recorded incidents, or the incident is
not credible. If the analyst believes it is credible, then a suitable frequency could be
obtained by pro rating a non-zero frequency, e.g. using the “All” frequencies.

The frequencies given are based on analysis of offshore lifting operations on the UK
continental shelf (see Section 4.0). They may be applied to lifting operations in other
offshore regions which comply with recognised industry good practice, as it is applied
in the UKCS.
The data for dropped objects from derricks may be applied to onshore drilling
operations where these are similar to offshore drilling activities and equipment. The
data for dropped objects from main cranes and other lifting devices are not applicable
to onshore lifting operations because the equipment used is unlikely to be similar to
that used offshore.
3.2 Uncertainties
Sources of uncertainties in the data include statistical variation and the similarity
between the operations and equipment under analysis and those represented by the
database.
©OGP 3
The calculated frequencies are derived from 1637 dropped object events in a total
experience of 3063 installation-years. This implies a total of about 111 million lifting
operations. For fixed platforms there were 690 dropped objects in 1857 platform years,
for mobile installations 947 events in 1206 installation-years experience. Therefore the
statistical uncertainty in the overall frequencies is relatively small. Some of the specific
risks are calculated from the experience of a small number of representative dropped
object accidents and correspondingly the uncertainty in the risk will be more significant.
The risks with the higher uncertainty are those with the lower likelihoods shown in
Section 2.0.
The data in the database reflect lifting equipment in operation in the UKCS. While there
is a degree of variation in the equipment used in the UKCS, it is similar in that the vast
majority is maintained and operated in accordance with international certification and
UK legal requirements. Competence requirements for operations and maintenance
personnel are generally enforced, and all operations are conducted in accordance with
documented procedures reflecting good industry practice. Where operations outside
the UK can be assumed to follow a similar standard of operation and maintenance, it is
reasonable to assume the data are valid for assessment of the dropped object risks.
3.3 Use of the Data

The dropped object probability values are an input to QRA and are used to calculate the
frequency of the initiating event for dropped object risks. The consequence of dropped
objects depends on the impact energy and the people, equipment and structures
impacted by the objects dropped.
For an object falling through air, the impact energy is calculated as the product of the
mass of the object, the height and acceleration due to gravity (≈ 10 m/s2). Generally,
people struck by falling objects can be assumed to be fatally injured, and objects
striking hydrocarbon equipment will cause a hydrocarbon release. Damage to
structures or other equipment struck by dropped objects may require a specific
assessment of the resistance of the object impacted and/or the potential for a release
from live equipment struck. However, incidents involving hydrocarbon releases are
already included in the hydrocarbon release frequencies, so such an assessment is only
recommended where the analyst identifies a particular vulnerability to dropped objects,
or a stand-alone dropped objects study is being carried out.
When using dropped object risks in a total risk assessment for a facility, the risks to
people from dropped objects may also be included in the statistical data on
occupational accidents. Where this is the case, it is appropriate to disregard the
calculated dropped object risk for immediate fatalities.
In the event of a dropped object, the lifting equipment will be out of service until the
incident can be investigated and any repair can be implemented. An operational risk
assessment should take account of this. Even for minor dropped objects with no
apparent damage, equipment downtime will be of the order of several days. In the event
of a fatality or major equipment damage, the equipment is likely to be out of service for
several weeks.
3.4 Consequence Analysis of Objects Dropped Into the Sea

The calculation of the consequences of objects dropped into the sea is more complex.
For heavy lifts (e.g. BOP or xmas tree) over the sea it is standard practice that these are
not carried out over vulnerable subsea equipment. Thus care is required in assessing
4 ©OGP
whether a dropped BOP or other heavy load can cause damage to subsea equipment or
if the precautions carried out are adequate. For other lifts, the following approach can
be followed to calculate locations at risk from dropped object impact.
Heavy, dense objects (such as BOPs) can be assumed to fall vertically and will damage
any infrastructure immediately beneath the drop site. Some other objects, such as pipe
sections and scaffolding poles, may travel a significant horizontal distance through the
water as they descend. The following model is taken from a DNV Recommended
Practice [4].
The analysis assumes that the excursion made by a dropped object can be represented
by a normal distribution:
where x is the horizontal excursion and δ the standard deviation. The standard
deviation is sensitive to the weight and shape of the object, and the water depth (d). The
derivation of δ is given by:
Here α is the spread in the descent angle given in Table 3.1.
Table 3.1 Calculation of Descent Angles
Case Object Shape Weight Descent

Description Angle
(tonnes) Spread
(deg)
1 <2 15
2 Flat/long shaped 2–8 9
3 >8 5
4 <2 10
5 Box/round shaped 2–8 5
6 >8 3
7 Box/round shaped >> 8 2
The probability that the object lands within a horizontal distance, r, of the drop point is
given by the equation:
When considering object excursion in deep water the spreading of long/flat objects,
cases no. 1 to 3, will increase down to a depth of approximately 180 m. Below this depth
spreading does not increase significantly and may conservatively be set to be vertical.
For a riser, any vertical sections will complicate the hit calculations. One way of
calculating the probability of hit to a riser is to:
1. Split the riser into different sections (normally into vertical section(s) and horizontal
section(s)), and
2. Calculate the hit probability of these sections at the respective water depths. The
final probability is then found as the sum of all the probabilities for the different
sections.
The effect of currents will become more pronounced in deep water. The time for an
object to hit the seabed will increase as the depth increases. This means that any
©OGP 5
current may increase the excursion (in one direction). At 1000 m depth the excursion is
found to increase 10 to 25 metres for an average current velocity of 0.25 m/s and up to
200 m for a current of 1.0 m/s.
The effect of currents may be included if one dominant current direction can be
identified. This may be applicable for rig operations for shorter periods, for example
during drilling, completion and intervention/construction above subsea wells. However,
for a dropped object assessment on a fixed platform, seasonal changes in current
directions may be difficult to incorporate.
When establishing a "safe distance" away from activities the effect of currents should
be included. A conservative object excursion should be determined, including
consideration of the drift of the objects before sinking, uncertainties in the navigation of
anchor handling vessel, etc.
3.5 Kinetic energy

A dropped object from a crane and hitting the topsides will have a kinetic (impact)
energy Ek given by:
Ek = m.g.h
where: Ek = kinetic energy at impact (J)
m = mass of the object (kg)
g = gravitation acceleration (9.81 m/s2)
h = height from release point to point of impact (m)
The maximum impact force depends on the object itself and the orientation when
hitting, and can be found from structural collapse calculations. The impact resistance of
structures can be found from deterministic structural strength calculations.
The kinetic energy of a dropped object on subsea installations depends on the velocity
through the water, the shape of the object and the mass in water. After approximately 50
- 100 metres, a sinking object will usually have reached its terminal velocity.
The terminal velocity is found when the object is in balance with respect to gravitation
forces, displaced volume and flow resistance. When the object has reached this
balance, it falls with a constant velocity, its terminal velocity. This can be expressed by
the following equation:
where: m = mass of the object (kg)

g = gravitation acceleration (9.81 m/s2)
V = volume of the object (the volume of the displaced water) (m3)
ρwater = density of water (typically 1025 kg/m3 for the North Sea)
CD = drag coefficient of the object
A = projected area of the object in the flow-direction (m2)
vT = terminal velocity through the water (m/s)
The kinetic energy of the object, ET, at the terminal velocity is:
Combining these to equations gives the following expression for the terminal energy:
6 ©OGP
In addition to the terminal energy, the kinetic energy that is effective in an impact, EE,
includes the energy of added hydrodynamic mass, EA. The added mass may become
significant for large volume objects such as containers. The effective impact energy
becomes:
where ma is the added mass (kg).

Tubulars are assumed to be waterfilled unless it is documented that the closure is
sufficiently effective during the initial impact with the surface, and that it will continue to
stay close in the sea.
Intact, sealed containers may not sink at all.
The drag and added mass coefficients are dependent of the geometry of the object. The
drag coefficients will affect the objects terminal velocity, while the added mass only has
influence as the object hit something and is brought to a stop. Table 3.2 gives typical
values of these coefficients.
Table 3.2 Drag and Added Mass Coefficients
Object Case Description Cd Cm

(as Table 3.1)
1,2,3 Slender shape 0.7 - 1.5 0.1 - 1.0
4,5,6,7 Box shaped 1.2 - 1.3 0.6 - 1.5
All Misc. shapes (spherical to 0.6 - 2.0 1.0 - 2.0
complex)
It is recommended that a value of 1.0 is initially used for Cd, after which the effect of a
revised drag coefficient should be evaluated.
Small equipment items (fittings, scaffolding clamps, etc.) are unlikely to do any damage
to subsea equipment if they fall into the sea.

The recommended probabilities of dropped objects presented in Section 2.0 have been
calculated by combining recorded incidents of dropped objects from the WOAD [1] and
the UK HSE’s ORION databases with data on the number of lifts carried out.
The incidents have been analysed by DNV and full reports are available in HSE research
reports [2] and [3].
The numbers of lifts per year for mobile installations (Table 4.1) are based on observed
data collected for DNV by a drilling contractor. The number of lifts per year on fixed
installations (Table 4.2) are estimated by interpretation of the data on mobile
installations combined with reasonable assumptions and consequently should be
treated with more caution. The numbers of “installation years” represented by the
ORION and WOAD data are provided by the HSE from primary records.
The experience data for mobile installations were collected over the period 1980 to 1998;
those for fixed installations were collected over the period 1991 to 1999.
Of the main crane lifts, 46% were to or from a supply vessel and 54% were across the
installation. Of the lifts to and from supply vessels, 75% were of containers, baskets
and tanks; the remainder were casing, drillpipe, collars, etc.
©OGP 7
Table 4.1 Observed Frequencies of Lifting Operations on Mobile

Installations
Lifting Device Lifts per Year

Main Crane 24,480
Drilling Derrick 28,670
Other Lifting Device 3,650
Total 56,800
Table 4.2 Calculated Frequencies of Lifts using Main Crane on Fixed

Installations (per year)
Type of installation Lifts to / from Internal Lifts

Vessels
Fixed (no drilling) 5520 8,674
Fixed (drilling for 6 months / 8400 10,937
year)
Wellhead platform 552 867
The UK HSE has also published accident data for more recent period up to and
including 2004/2005 [5, 6. 7] These data have not been subjected to the same detailed
statistical analysis as the data presented in this report and for this reason the more
recent experience is not included here. However a review of the data over the period
1980 to 2005 shows that although there is considerable variation from year to year, the
average frequency of dropped objects per installation-year remains approximately
constant. This is consistent with the observation that the technology and lifting
procedures used on offshore installations have not changed to any great extent over the
period the data were collected.
5.0 References
1. DNV, 2006. WOAD, Worldwide Offshore Accident Databank, version 5.0.1.
2. DNV, 1999. Accident statistics for mobile offshore units on the UK continental shelf in
1980-98, HSE Offshore Technology Report OTO 2000/091 / DNV Report No. 99-2490.
3. DNV, 2002. Accident statistics for fixed offshore units on the UK Continental Shelf 1991-
1999, HSE Offshore Technology Report OTO 2002/012.
4. DNV, 2002. Risk Assessment of Pipeline Protection, Recommended Practice No. DNV-
RP-F107 (amended).
5. HSE, 2006. Offshore Injury, Ill Health and Incident Statistics 2004/2005 (provisional data),
HID Statistical Report HSR 2005 001.
6. HSE, 2005. Accident statistics for Floating Offshore Units on the UK Continental Shelf
1980-2003, Research Report 353, prepared by Det Norske Veritas for the Health and
Safety Executive.
7. HSE, 2005. Accident statistics for Fixed Offshore Units on the UK Continental Shelf 1980 –
2003, Research Report 349, prepared by Det Norske Veritas for the Health and Safety
Executive.
8 ©OGP

March 2010
Land
transport
accident
statistics
RADD – Land transport accident statistics
contents
1.0 Scope and Application ........................................................... 1
2.1 Road and rail users......................................................................................... 1
2.2 Dangerous Goods Transport ......................................................................... 4
3.2 Uncertainties ................................................................................................... 5
3.2.1 Road and Rail User Casualty Frequencies .............................................................. 5
3.2.2 DG Transport .............................................................................................................. 5
3.3 Application of frequencies to specific locations ......................................... 5
3.3.1 Road and Rail Transport............................................................................................ 6
3.3.2 Dangerous Goods Transport .................................................................................... 6
4.1.1 Road Transport........................................................................................................... 7
4.1.2 Rail Transport ............................................................................................................. 8
4.1.3 Dangerous Goods Transport .................................................................................. 10
4.2.1 Road Transport......................................................................................................... 10
4.2.2 Rail Transport ........................................................................................................... 11
6.0 References .......................................................................... 12
©OGP
Abbreviations:
ACDS Advisory Committee on Dangerous Substances
DfT Department for Transport
DG Dangerous Goods
ECMT European Conference of Ministers of Transport
E&P Exploration and Production
ERA European Railway Agency
EU European Union
FEMA Federal Emergency Management Agency
FRA Federal Railroad Administration
GB Great Britain
HGV Heavy Goods Vehicle
IRF International Road Federation
KSI Killed or Seriously Injured
LGV Light Goods Vehicle
mm millimetre
OECD Organisation for Economic Co-operation and Development
OG&P Oil and Gas Producers
ORR Office of Rail Regulation
RSSB Rail Safety and Standards Board
UIC International Union of Railways
UK United Kingdom
US(A) United States (of America)
(V) km (Vehicle) kilometre
©OGP
1.0 Scope and Application

This datasheet provides information on land transport accident statistics for use in
Quantitative Risk Assessment (QRA). The datasheet includes guidelines for the use of
the recommended data and a review of the sources of the data. Most of the data concern
motor vehicles and rail transport, although some data for cyclists are also presented.
Data excludes pedestrians; if this is needed local data will need to be examined.
The data in this sheet are intended for two main uses:
• Assessing the risk of transporting personnel; data relating to the frequency of
fatalities and serious injuries to road and rail users are presented.
• Assessing the risks of transporting Dangerous Goods (DG); data on the frequency of
releases of hazardous materials from rail and road tankers are presented.
In the sections below the following definitions are used:
• Seriously Injured: Any person not killed, but who sustained an injury as result of an
accident, normally needing medical treatment.
• Killed: Any person killed immediately or dying within 30 days as a result of an
accident.
• Road Injury Accident: Any accident involving at least one road vehicle in motion on
a public road or private road to which the public has right of access, resulting in at
least one injured or killed person.

It is best to try and obtain local data where possible. In the absence of local data the
following data can be used.
2.1 Road and rail users
• Road user (Table 2.1, Table 2.2, and Table 2.3)
• Rail user (Table 2.4)
©OGP 1
Table 2.1 Road Accident Fatality and Injury Rates, Selected Countries, All
Vehicles All Rates in deaths or injuries per 10 9 vehicle kilom etres
Country Year Traffic Frequency of Injury Rate Fatality Rate

9 9
Volume Accidents per 10 vehicle per 10 vehicle
9
10 vehicle kilo- Resulting in kilometres kilometres
metres Injury
9
per 10 vehicle
kilometres
Europe
Austria 2004 47.8 892.0 1168.0 18.4
Belgium 2004 93.5 520.5 673.7 12.4
Denmark 2005 45.5 118.9 144.7 7.3
Estonia 2005 8.1 288.1 366.6 20.8
Finland 2005 51.6 136.0 174.0 7.3
France 2005 547.6 154.3 197.2 9.7
Latvia 2005 10.2 439.2 550.7 43.5
Lithuania 2005 8.5 796.1 995.4 90.7
Romania 2004 67.9 101.1 82.4 35.6
Slovenia 2005 11.1 928.4 1289.1 23.2
Sweden 2005 73.8 245.3 358.7 6.0
Switzerland 2005 59.9 362.6 446.9 6.8
Turkey 2005 61.1 8732.2 2520.8 74.0
United Kingdom 2005 493.5 402.7 549.2 6.5
Africa
Egypt, Arab Rep. 2004 28.7 72.5 264.9 46.0
Ghana 2001 15.3 1022.9 472.5* 81.1
Senegal 2000 4.0 1497.9 1114.6* 161.0
South Africa 2005 123.4 1067.9 1597.5 116.0
America
Colombia 2004 15.6 14696.9 - 351.6
Mexico 2005 91.0 323.9 354.7 51.8
United States 2005 4794.3 386.8 563.0 9.1
Asia/ Middle East
Armenia 2005 0.4 2978.4 4027.2 703.7
Bahrain 2002 5.3 308.9 540.0 15.2
China, HK 2005 10.8 1392.8 1763.3 14.0
Israel 2005 41.1 413.5 863.5 10.9
Japan 2004 781.7 1218.1 - 10.9
Korea, Rep. 2005 314.9 680.1 1086.8 20.2
Kyrgyz Republic 2005 10.2 365.4 449.3 87.8
Mongolia 2002 2.3 2897.3 2148.8* 178.8
Singapore 2005 13.8 486.6 596.8 12.6
Ukraine 2005 14.0 3319.7 3999.1 516.3
Oceania
New Zealand 2005 40.6 266.1 355.8 9.9
* These appear to be incorrect values as the injury rate should be higher than the injury accident
rate in the previous column.
2 ©OGP
Table 2.2 Recom m ended Road Accident Fatality/Injury Rates:

Rates by Road Class, Road User Type, Injury Severity
All Rates in deaths or injuries per 10 9 vehicle kilom etres
Road User Urban roads Rural Roads Motorways All Roads

Death Seriou Death Seriou Death Seriou Death Seriou
s s s s
Injury Injury Injury Injury
Pedal Cycle 24 490 58 520 - - 32 500
Motor Cycle 65 1220 200 1220 51 300 120 1140
Car 2 28 7 44 2 9 4 31
Bus or Coach 4 110 3 29 41 11 4 75
LGV 11 6 1 11 1 5 1 8
HGV 11 11 2 17 1 7 1 12
All Vehicles 3 51 8 52 2 10 5 44
In some circumstances a QRA may require road user casualty rates in different units
which take more account of the specific numbers of passengers being transported.
Thus Table 2.3 presents recommended road user casualty rates per billion passenger
kilometres.
Table 2.3 Recom m ended Road Accident Fatality/Injury Rates:

Rates by Road User Type, Injury Severity All Rates in deaths or injuries per 10 9
passenger kilom etres
Road User Death KSI*

Pedal Cycle 36 684
Motor Cycle 111 1360
Car 2.7 31
Bus or 0.3 11
Coach
LGV/ HGV 0.9 11
* KSI = Killed or Seriously Injured
The values in Tables 2.2 and 2.3 are based on UK data and considered representative of
developed countries with good road safety records. The values from Table 2.1 can be
used to generate appropriate modification factors for the rates in Tables 2.2 and 2.3
when applied in different countries. Clearly in any specific situation there will be a
number of factors which will influence accident rates such as driver experience, age,
etc. No data has been found which could represent these influences explicitly.
Table 2.4 Recom m ended Rail Accident Fatality/Injury Rates

All Rates in deaths or injuries per billion passenger kilom etres
Vehicle Type Death Injury

Rail 0.4 15
1
See footnote 3 on page 7 for explanation of data derivation
©OGP 3
These rail accident data are considered representative of developed countries. In less
developed parts of the world the accident rates may be larger, but no data sources have
been found to enable them to be quantified.
2.2 Dangerous Goods Transport

The data below refers to releases while in transit, not during loading or unloading.
Table 2.5 Recom m ended Rail Tanker Release Frequencies
TANKER TANK SHELL PUNCTURE EQUIPMENT LEAK

TYPE (per loaded tank wagon (per loaded tank wagon
km) hour)
-8
Motor spirit 6.3 × 10 -
-9 -10
LPG 2.5 × 10 8.3 × 10
-9 -9
Ammonia 2.5 × 10 1.3 × 10
-10 -9
Chlorine 9.0 × 10 3.1 × 10
90% of the punctures are taken to be 50 mm diameter holes, the remaining 10%
catastrophic ruptures. The lower chlorine release frequencies are due to higher level of
engineering controls, and possibly safer procedural controls related to handling and
route management. Data on the causal breakdown of the release frequencies is not
available; both internal causes and causes external to the tanker are reflected in the
overall frequencies.
Table 2.6 Recom m ended Flam m able Liquid Road Tanker Release
Frequencies
SPILL SIZE RELEASE

FREQUENCY
(per loaded vehicle
km)
-9
5 - 15 kg 6.0 × 10
-8
15 - 150 kg 2.6 × 10
-9
150 - 1500 kg 7.0 × 10
-8
> 1500 kg 2.1 × 10
-8
TOTAL 6.0 × 10
Table 2.7 Recom m ended LPG Road Tanker Release Frequencies (not
cylinders)
FAILURE CASE RELEASE

FREQUENCY
(per loaded vehicle
km)
-12
BLEVE 2.7 × 10
-9
Cold rupture* 2.6 × 10
-8
Large* liquid space leak 1.8 × 10
-9
Large* vapour space leak 2.1 × 10
* Rupture modelled as instantaneous release and large leak modelled as 50 mm diameter hole
4 ©OGP

If transport risk is a relatively small contribution to an overall risk study, the data above
may be sufficient. However, if transport risk is the object of the study, local data
become very important.
As discussed below in Section 3.3, it is strongly recommended that local data sources
on accidents and transport risk are obtained. This is because there can be large local
variations. In recommending the data in Tables 2.5 to 2.7 on DG transport, there is an
implicit assumption that tanker equipment is built to recognised international standards
and operated in line with relevant national DG regulations.
3.2 Uncertainties
3.2.1 Road and Rail User Casualty Frequencies
Due to the relatively large number of road traffic casualties (see Table 4.1 below), the
statistical uncertainties associated with the values in Table 2.2 and Table 2.3 are small
compared to the variations between countries.
In contrast, national statistics for rail passenger fatalities are generally very low.
However, low frequency but high consequence events can have a very large effect on
average passenger risk levels. Thus it is important to consider data over a reasonably
long time period. The data from Table 2.4 are based on British data 1996-2005 which
includes a number of major rail accidents; thus it is considered to be representative
with respect to such events.
Uncertainties for road and rail user casualty rates will be dominated by local variations.
Even within geographically close countries, such as within the EU, variations can be
large (see Section 4.0).
A further source of transport uncertainty arises from use of frequency units (e.g. per
vehicle km or per passenger km). The relative risk of various transport modes can be
highly dependent on the frequency units adopted. Thus, it is recommended that any
conclusions are tested for their sensitivity to units (see Table 2.2 and Table 2.3).
3.2.2 DG Transport
The frequency of releases of hazardous material during transport is much lower than
the frequency of road traffic accidents. Hence the statistical uncertainty will be larger,
similar to typical major hazard QRA uncertainties. In addition, these frequencies will be
influenced by local variations in road and rail accident rates. Thus, local data should be
obtained wherever practicable.
3.3 Application of frequencies to specific locations

This datasheet contains global data plus more detailed national data. When using these
data, it should be realised that they may not be directly applicable to the specific
location under study.
It is therefore strongly recommended that local data sources on accidents and transport
risk from governmental or other national or regional institutions are obtained before
using the data given in this sheet.
Should these local data not be accessible, or their reliability/applicability be uncertain,
then the data in this data sheet could be used after factoring for local circumstances.
©OGP 5
However, data which have been adjusted to allow for local circumstances should always
be used with caution.
3.3.1 Road and Rail Transport

In assessing the risks of personnel transport the following steps are recommended:
1. Obtain local data if practicable.
2. If not, use the data in Tables 2.1 to 2.4. For road risks the casualty frequencies can
be adjusted for location using the factors suggested in Section 2.0 and presented in
more detail in Section 4.0 below. Some location specific data for rail are also
presented in Section 4.0, but it is unclear if the variations are real or are a feature of
definitions and reporting criteria.
3. Analyse the proposed personnel journey patterns in terms of vehicle types, road
types, vehicle kilometres and/ or passenger kilometres (for rail only passenger
kilometres are required).
4. Multiply the frequencies from steps 1 or 2 with the journey pattern data in step 3 to
obtain overall personnel transport risks. Conduct sensitivity tests using the different
units in Table 2.2 and Table 2.3 (if relevant) and alternative data sources discussed
in section 4.02.
Example: estimate the fatality rate per year for an operation involving 30
personnel being transported 4 times a month by bus/ coach along 300km of
m otorway grade road in North Africa.
Assuming local data specific to this type of operation are not available steps 2 to 4 are
illustrated below.
• From Table 2.2 for bus/coach the fatality rate is 4 × 10-9 per vehicle-km. This is
based on UK data. From Table 2.1 the overall fatality rates in Egypt are 7.1 times
greater than UK. This is taken as an appropriate multiplication factor. Thus the
fatality rate is 28.4 × 10-9 per vehicle-km.
• Based on the example information above the number of vehicle-kms per year is 300
× 4 × 12 = 14,400.
• Thus the annual predicted fatality rate would be 28.4 × 10-9 × 14,400 = 4.1 × 10-4.
Using the data from Table 2.3 which gives a fatality rate per passenger-km gives a
fatality rate per year of 9.2 × 10-4.
3.3.2 Dangerous Goods Transport

In assessing the DG transport release frequencies the following steps are
recommended:
1. Obtain local data if practicable.
2. If not, use the data in Tables 2.5 to 2.7 and adjust the release frequencies for location
using fault tree analysis, expert judgements (e.g. based on relative transport
accident rates), or other appropriate methods.
3. Analyse the proposed DG transport patterns in terms of transport mode (rail/ road),
wagon/ vehicle kilometres, loaded tanker hours, etc.
2
While there is uncertainty concerning the location variations in the rail data, as noted above,
the location specific data may be used in sensitivity testing.
6 ©OGP
4. Multiply the frequencies from steps 1 or 2 with the DG transport data in step 3 to
obtain overall release frequencies.
Example: Estimate the frequency per year of large vapour space leaks in an
LPG operation that involves 5 tankers operating each 7 times a week on a
200km route fully loaded.
Assuming local data specific to this type of operation are not available steps 2 to 4 are
illustrated below.
• From Table 2.7 the large vapour space leak frequency is 2.1 × 10-9 per loaded
vehicle-km. Assume that expert judgement concludes that this frequency is
appropriate.
• Based on the example information above the number of loaded vehicle-kms per year
is 5 × 7 × 52 × 200 = 364,000.
• Thus the estimated annual leak frequency is 2.1 × 10-9 × 364,000 = 7.6 × 10-4.

4.1.1 Road Transport
Table 2.1 is based on the International Road Federation’s (IRF) 2007 report [10]. For all
countries except Turkey, the most recent year’s data presented in this report is taken as
representative and presented in Table 2.1 (2005 data for Turkey appears to have an error
in the injury rate). This report also provides accident rates per 100,000 head of
population for a wider range of countries. The data in this table can be compared for
trends to the data in the previous Technical Note for E&P Forum which used the IRF’s
1994 report [3].
Table 2.2 and Table 2.3 are based on British data from the Department for Transport’s
2006 report [1]3. Table 4.1 shows the number of fatalities per vehicle type for 2006 on
which the casualty rates are based.
Table 4.1 GB Num bers of Fatalities 2006: Num bers by Road User Type &
Severity
Road User Death KSI*

Pedal Cycle 153 2568
Motor Cycle 634 6992
Car 2580 26713
Bus or Coach 122 1260
LGV 280 2322
HGV 419 2119
All vehicles 3172 31845
* KSI = Killed or Seriously Injured
[1] also provides a much greater range of data including trends over time, accident rates
as a function of age, gender, alcohol levels etc.
One of the E&P Forum (as was) member companies collected statistical data in the
1990s from which accident rates for desert driving conditions can be calculated. This
3
In Table 2.1 in 2006 there were no fatalities on urban roads for LGVs and HGVs and no fatalities
on motorways for bus/ coach. For these cells of the table, the recommended fatality rates have
been set to the “All Roads” value. In Table 2.2 the rates are based on 1996-2005 data; as no
separate value for HGV is given in Ref. [1] it has been set at the LGV value.
©OGP 7
data covers a period between 1992 and 1994. The derived desert driving accident and
fatality rates are shown in Table 4.2 below and relate to company and contractor work
related accidents.
Table 4.2 Desert Driving Accident and Fatality Rates
Year Road Traffic Road Traffic Injuries Fatalities Fatality Rate

(108 V km) Accidents (per 108 V km)
1992 0.79 137 56 4 5.1
1993 0.89 135 42 2 2.3
1994 0.86 111 26 0 0.0
The downward trend in the fatality rate was considered to be the result of improved
induction training, the fitting of roll-over bars and speed governors to all LGVs and the
near 100% usage of seat-belts. This needs to be taken into account when applying the
rates for desert driving at other locations. Deriving an average over the 3 years of 2.4
fatalities per 108 vehicle kilometres, this is approximately 5 times higher than the
average all-vehicle GB fatality rate.
4.1.2 Rail Transport

Table 2.4 is based on British data from 1996 to 2005 [1].
In analysing rail casualty data, care needs to be taken to distinguish casualties caused
in train incidents, non-train incidents and vandalism/ suicide. Overall fatality numbers
are dominated by the latter category. In addition, statistics may include passengers,
staff and “others” (third parties who were neither passengers nor staff, but who were
killed or injured due to rail related activity).
Also there is the need to allow for low frequency but high consequence events which
are characteristic of rail operations. A national railway may experience several years of
very few fatalities and then have one event which kills many tens of people.
It is often difficult to determine what has been included in summary statistics. Table 2.4
above is a subset of DfT data comparing various transport modes. It is averaged over
10 years and therefore takes account of low frequency/ high consequence events (e.g.
Ladbroke Grove, where there were 31 fatalities). The casualty rates relate just to train
passengers, but from all accident causes not only train accidents such as collisions,
derailments, fires etc.
Further details of UK rail accident rates are provided in the UK Office of Rail Regulation
Annual reports [4]. These split out incidents involving passengers, staff and members of
the public, and provide train incident rates, as well as other accident categories such as
trespass and vandalism.
The GB data is considered representative of average EU data. Figure 4.1 below is taken
from the RSSB strategic plan [5] and compares UK passenger fatality rates against the
25 EU countries’ averages. The UK values are shown to be consistent with the EU
values except in years when there are major UK disasters. If the major disasters were to
be averaged over a few years, there would be an even closer match.
In recent years the European Railway Agency has begun to collect statistics from all the
European countries. The 2004-2005 Rail Statistics are summarised in Figure 4.2 below
[6]. These data would appear to indicate significant differences between EU countries.
However, there is a need to be cautious. The variation could be because of inconsistent
reporting criteria or it could reflect low frequency/ high consequence events affecting a
8 ©OGP
few countries in the time period 2004-2005. Given this uncertainty no potential
modification factors are suggested in this datasheet.
Figure 4.1 Com parison between GB and EU Average Rail Fatality Rate [5]
Figure 4.2 EU States Rail Fatality Rate [6]
©OGP 9
US data from the Federal Railroad Administration [7] for 2006 indicates 2 passenger
fatalities in 16,211,393,401 passenger miles = 0.08 fatalities per billion passenger km.
This is also consistent with UK data for 2004-2005.

Tables 2.5 to 2.7 present a selection of available data suitable for use only where
transport risks form a small contribution to a process QRA. They should not be used for
transport QRA without detailed consideration of the applicability of the data. In
particular local variations in transport accident rates should be analysed.
4.1.3.1 Rail Tankers

The Advisory Committee on Dangerous Substances (ACDS) of the UK Health & Safety
Commission produced a report in 1991 [8] which provides a detailed QRA of road and
rail transport of motor spirit, LPG, ammonia and chlorine in Great Britain, including
puncture frequencies based on modified UK experience and equipment leak frequencies
based on fault tree analysis.
[8] estimated frequencies of tank shell punctures and equipment leaks from tank
wagons carrying dangerous goods, based on modified UK data (Table 2.5). The
punctures are taken to be 50 mm diameter holes (90%) or catastrophic ruptures (10%).
4.1.3.2 Liquid Tankers

The best available estimate of leak frequencies from tankers carrying non-pressurised
liquids is also given by [8], based on spills from UK motor spirit tankers (Table 2.6).
4.1.3.3 LPG Road Tanker Leak Frequencies

A DNV Technica report [9] compared various sources of leak frequency data for LPG
road tankers, and developed a fault tree model to take account of the main influences.
Table 2.7 gives the failure case frequencies for a tanker with passive fire protection,
based on Hong Kong road traffic accident rates.

4.2.1 Road Transport
The International Road Federation in Geneva collects world road statistics including
data on road accidents from a large number of countries [10]. The data include the
annual number of accidents, annual number of injured and killed people as well as the
number of injury accidents, persons injured or killed per 100 million vehicle kilometres
(108 V km).
The Organisation for Economic Co-operation and Development (OECD) maintains road
safety statistics [2]. It presents international fatality information for different road types.
The OECD website [2] also presents injury rates and fatalities per 100,000 of the
population.
The European Conference of Ministers of Transport [11] gives death rates and casualty rates per capita
and per vehicle for European countries and Australia, Canada, Japan, Russia and USA. However, it does
not have any estimates of vehicle-km.
Davies & Lees [12] give a variety of accident statistics for heavy goods vehicles, drawn
mainly from national accident statistics.
10 ©OGP
Koornstra [24] presents a passenger transport model which includes road transport
risk. Reference risks are first determined based on data from the original 15 EU
countries. Multiplication factors are then developed relating road fatality risks to the
Gross National Income per person (GNI/p) and plotted on a graph with a fitted function.
Corrections are made for estimated underreporting. The report notes a rather wide
scatter of fatality rates for individual countries about the curve. For certain countries
there is a difference between the predicted and reliably established risks (where country
specific data exists). Thus the report proposes an additional multiplication factor where
there are strong indications that a country is relatively less safe or relatively safer than
other countries with a comparable GNI/p level. Finally a multiplication factor for road
type proportions is proposed based on the variation in risk that is seen on different road
types. In principle this method can estimate road transport risks for any country in the
world and could be useful when country specific data is not available. The reference
risks are consistent with those presented in this report.
4.2.2 Rail Transport

A Statistical Analysis of Fatal Collisions and Derailments of Passenger Trains on British
Railways [13] provides a detailed analysis of the comparative safety of different designs
of passenger carriage on British Railways, including accidents per passenger mile and
fatalities per accident.
Frequency of Railway Accidents in the German Federal Railways Network: Goods Traffic and
Shunting Operations [14] provides a detailed analysis of accident frequencies and
involvement probabilities for wagons in goods trains in Germany.
Light Rail Accidents in Europe and North America [15] has a detailed comparison of
accident frequencies on light rail systems in different countries.
The report by Koornstra [24] also includes rail transport risk. Reference risks are
determined based on data from the original 15 EU countries. Multiplication factors are
again developed relating rail fatality risks to the Gross National Income per person
(GNI/p). However there is less country data than for road fatalities on which to base
these multiplication factors. Thus, as with road, the report proposes using an
additional multiplication factor where there are strong indications that a country is
relatively less safe or relatively safer than other countries with a comparable GNI/p
level.
Further international information on rail transport safety is available from International
Union of Railways (UIC) at http://www.uic.asso.fr/.

There are a large number of other data sources with information relevant to DG
transport, but generally they are older or less generally applicable than the values given
in Section 2.0.
The Federal Emergency Management Agency (FEMA) [16] provides information for
explosive, flammable and otherwise dangerous chemicals. It presents failure rates
which originate from several sources. The age of the background data and the
individual sources may no longer reflect the reliability of transport vehicles on the roads
and railways today because of stricter safety regulations for both vehicles and materials
transportation. The individual sources contain information about accident rates for
trucks used in the petroleum industry and for transporting bulk hazardous materials
([17] to [23]).
©OGP 11

The references used for the recommended data in Section 2.0 are shown in bold in
Section 6.0.
6.0 References
[1] Departm ent for Transport 2006. Road Casualties Great Britain 2006
http://www.dft.gov.uk/162259/162469/221412/221549/227755/rcgb2006v1.pdf
[2] OECD, International Traffic Safety Data and Analysis Group
http://cemt.org/IRTAD/IRTADPublic/we2.html
[3] International Road Federation (IRF) 1994. World Road Statistics 1980-1993
[4] Office of Rail Regulation (ORR) 2006. Annual Report on Railway Safety
2005. http://www.rail-reg.gov.uk/upload/pdf/296.pdf
[5] UK Rail Safety and Standards Board (RSSB) 2007. The Railway Strategic Safety Plan
2008-2010.
[6] European Railway Agency (ERA) 2006. A Summary of 2004-2005 EU Statistics on
Railway Safety.
http://www.era.europa.eu/public/Documents/Safety/Safety_Performance/07-
05%20ERA-Report2.pdf
[7] US Federal Railroad Administration website:
http://safetydata.fra.dot.gov/OfficeofSafety/
[8] ACDS 1991. M ajor Hazard Aspects of the Transport of Dangerous
Substances, Advisory Com m ittee on Dangerous Substances, Health &
Safety Com m ission, HMSO.
[9] DNV Technica 1996. Quantitative Risk Assessment of the Transport of
LPG and Naphtha in Hong Kong - Methodology Report, Report for
Electrical & Mechanical Services Departm ent, Hong Kong Governm ent,
Project C6124.
[10] International Road Federation 2007. The IRF W orld Road Statistics
2007, Data 2000-2005.
[11] ECMT 1998. Statistical Report on Road Accidents 1993/1994, European Conference of
Ministers of Transport, OECD, Paris.
[12] Davies, P.A. & Lees, F.P. 1992. The Assessment of Major Hazards: The Road
Transport Environment for Conveyance of Hazardous Materials in Great Britain, J.
Haz. Mat., 32, 41-79.
[13] Evans, A.W. 1997. A Statistical Analysis of Fatal Collisions and Derailments of
Passenger Trains on British Railways: 1967-1996, Proc. Inst. Mech. Eng., 211 Part F.
[14] Fett, H-J & Lange, F 1992. Frequency of Railway Accidents in the German Federal
Railways.
[15] Walmsley, D.A. 1992. Light Rail Accidents in Europe and North America, Research
Report 335, Transport & Road Research Laboratory, Crowthorne, UK
[16] Federal Emergency Management Agency. Handbook of Chemical Hazard Analysis
Procedures, available from Federal Emergency Management Agency, Publications
Office, 500 C Street, SW, Washington, DC 20472
[17] American Petroleum Institute 1983. Summary of Motor Vehicle Accidents in the
Petroleum Industry for 1982.
[18] Dennis, A.W. et al. 1978 Severities of Transportation Accidents Involving Large
Packages, Sandia Laboratories, NTIS SAND-77-0001.
[19] Rhoads, R.E. et al. 1978 An Assessment of the Risk of Transporting Gasoline by Truck,
prepared by Pacific Northwest Laboratory for the U.S. Department of Energy, PNL-
2133.
12 ©OGP
[20] Smith, R.N. and E.L. Wilmot 1982. Truck Accident and Fatality Rates Calculated from
California Highway Accident Statistics for 1980 and 1981, prepared by Sandia National
Laboratories for the U.S. Department of Energy, SAND-82-7066.
[21] National Safety Council. 1988 Accident Facts.
[22] Ichniowski T. 1984 New Measures to Bolster Safety in Transportation, Chemical
Engineering, pp. 35-39.
[23] Urbanek, G.L. and E.J. Barber 1980. Development of Criteria to Designate Routes for
Transporting Hazardous Materials, prepared by Peat, Marwick, Mitchell and Co. for
the Federal Highway Administration, NTIS PB81-164725.
[24] Koornstra, M.J. 2008. A Model for the Determination of the Safest Mode of Passenger
Transport between Locations in any Region of the World. Report for Shell International
Exploration and Production B.V.
©OGP 13

March 2010
Water
transport
accident
statistics
RADD – Water transport accident statistics
contents
1.1 Scope ............................................................................................................... 1
1.2 Application ...................................................................................................... 1
1.3 Definitions ....................................................................................................... 1
2.1 Personnel Risk ................................................................................................ 3
2.2 Vessel Accident Frequencies ........................................................................ 3
2.3 Oil Spill Frequencies ...................................................................................... 4
3.2 Uncertainties ................................................................................................... 5
3.3.1 Personnel Risk ........................................................................................................... 6
3.3.2 Ship Accidents and Oil Spill Frequencies ............................................................... 6
4.1.1 Personnel Transport .................................................................................................. 6
4.1.2 Vessel Incidents and Accidents.............................................................................. 10
4.1.3 Oil Spills .................................................................................................................... 12
4.2.1 Personnel Transport ................................................................................................ 13
4.2.2 Vessel Casualties ..................................................................................................... 15
4.2.3 Oil Spills .................................................................................................................... 15
6.0 References .......................................................................... 16
©OGP
Abbreviations:
ACDS Advisory Committee on Dangerous Substances
BSP Brunei Shell Petroleum
CALM Catenary Anchor Leg Mooring
ERRV Emergency Response & Rescue Vessel
FAR Fatal Accident Rate
GB Great Britain
GT Gross Tonnage
IR Individual Risk
LMIS Lloyd’s Maritime Information Services
MBC Marine Breakaway Coupling
MSMS Marine Safety Management System
NPC National Ports Council
OGP Oil and Gas Producers
P&I Protection & Indemnity
SAFECO Safety of Shipping in Coastal Waters
SPM Singe Point Mooring
SSB Sarawak Shell Berhad
UK(CS) United Kingdom (Continental Shelf)
USCG United States Coast Guard
©OGP

1.1 Scope
This datasheet provides information on water transport accident statistics for use in
Quantitative Risk Assessment (QRA). The data sheet includes guidelines for the use
of recommended data and a review of the sources of the data.
The data in this sheet are intended for three main uses:
• Assessing the risk of personnel on board vessels;
• Assessing the frequencies of vessel/ship accidents;
• Assessing the frequencies of oil spills.
Relevant personnel are crew boat passengers being transported to offshore facilities
and crew who work on vessels. The main focus in terms of vessel types is on supply
vessels, stand-by vessels (now commonly known within the UK as Emergency
Response & Rescue Vessels (ERRV)), crew vessels, anchor handling vessels, diving
support vessels and tankers. Drilling rigs, flotels, and production and storage vessels
are not included.
1.2 Application
This datasheet contains global data plus more detailed regional/national data where
relevant or where available. When using these data, it should be noted that they may
not be directly applicable to the specific location under study. Guidance on using
location specific data is given in Section 3.3.
The data presented are applicable to activities in support of operations within
exploration for and production of hydrocarbons.
1.3 Definitions
The primary source of ship accident data is the ship casualty database maintained by
Lloyd’s Maritime Information Services (LMIS). Loss frequencies can be obtained by
combining with fleet data from the Lloyd’s Register annual World Fleet Statistics [1].
These sources cover all self-propelled sea-going merchant ships over 100 GT.
Accidents to the ship are defined in terms of the following severity categories:
• Incidents Any event reported to LMIS and included in the

database. This is usually because the event may
involve some cost to the shipowner and may lead to an
insurance claim. In this analysis, the term “incident” is
taken to include serious casualties, while the term
“non-serious incident” excludes serious casualties.
Incidents are only recorded in the LMIS database for
tankers and passenger ships.
• Serious casualties Incidents involving total loss (see below); breakdown
resulting in the ship being towed or requiring
assistance from ashore; flooding of any compartment;
or structural, mechanical or electrical damage requiring
repairs before the ship can continue trading.
©OGP 1
• Total loss Where the ship ceases to exist after a casualty, either
due to it being irrecoverable (actual total loss) or due to
it being subsequently broken up (constructive total
loss). The latter occurs when the cost of repair would
exceed the insured value of the ship.
Incidents in the LMIS database are categorised according to the following codes:
• Collision Striking or being struck by another ship, whether under
way, anchored or moored. This excludes striking
underwater wrecks.
• Contact Striking or being struck by an external object, but not
another ship or the sea bottom. It includes striking
offshore rigs/platforms, whether under tow or fixed.
• Foundered Sinking due to rough weather, leaks, breaking in two
etc, but not due to other categories such as collision
etc.
• Fire/explosion Where the fire/explosion is the first event reported, or
where fire/explosion results from hull/machinery
damage. In other words, it includes fires due to engine
damage, but not fires due to collision etc.
• Hull/m achinery dam age Where the hull/machinery damage is not due to other
categories such as collision etc. Also termed
“Structural failure” in sections below.
• W ar loss/dam age Includes damage from all hostile acts.
• W recked/stranded Striking the sea bottom, shore or underwater wrecks.
Also termed “Grounding” in sections below.
• Miscellaneous Events not classified due to lack of information or not
included above, e.g. oil spill, flooding.
Personnel risks are presented as Fatal Accident Rates (FAR), defined as fatalities per
108 exposed hours.

• Personnel Risk (Section 2.1) – relevant personnel are crew boat passengers being
transported to offshore facilities and crew who work on vessels.
• Vessel Accident Frequencies (Section 2.2)
• Oil Spill Frequencies from tankers and during transfer operations (Section 2.3)
2 ©OGP
2.1 Personnel Risk

The recommended FAR for marine personnel (boat crew) is 3.
Where crew boats are used to transport other personnel to and from offshore
facilities, the risk to these offshore personnel can be expressed as follows:
FAR (fatalities per 108 exposed hours) = 30 + 26/Transit time per journey (hours).
Section 3.3.1 illustrates the use of this FAR format1.
These fatality rates for offshore personnel could be up to three times higher in certain
parts of the world. For seafarers not directly connected to the offshore industry the
fatality rates in some parts of the world could be a factor of up to 40 higher than the
FAR of 3.
2.2 Vessel Accident Frequencies

Table 2.1 Vessel Accident Frequencies (per ship year)
Vessel/Accident Type Total Loss Serious Casualty

per ship year per ship year
-3 -3
All Sea-Going merchant ships > 100 3.0 × 10 9.3 × 10
GT
-3 -2
Oil Tankers 1.9 × 10 1.1 × 10
-4 -3
Tanker fire/explosion 7.2 × 10 2.6 × 10
Table 2.2 Causal Breakdowns for Total Losses
Accident Type % of Total Losses
Foundered 48
Missing 1
Fire/Explosion 14
Collision 12
Wrecked/Stranded 18
Contact 2
Other 5
TOTAL 100
1
1. It is important to note that this equation comprises 2 elements: one for the actual transit
(30) + one for embarking and disembarking (26/Transit time). The first of these is
8
proportional to the transit time per journey; as the FAR is defined to be per 10 exposed
hours, it is constant. The second is proportional to the number of journeys made, which is
8
inversely proportional to transit time for a fixed total time exposure (i.e. 10 hours).
©OGP 3
2.3 Oil Spill Frequencies

Table 2.3 Oil Tanker Oil Spill Frequencies
ACCIDENT TYPE OIL SPILL OIL SPILL RATE AVERAGE OIL

FREQUENCY (tonnes per ship SPILL SIZE
(spills per ship year) (tonnes)
year)
-3
Collision 1.5 × 10 4.49 2922
-4
Contact 7.2 × 10 0.11 148
-4
Fire/explosion 5.1 × 10 1.52 2973
-5
War Loss 5.1 × 10 0.001 27
-3
Structural failure 1.3 × 10 5.68 4435
-3
Transfer spill 1.7 × 10 0.23 133
-4
Unauthorised discharge 5.1 × 10 0.21 408
-4
Grounding 5.6 × 10 5.20 9227
-3
TOTAL 6.9 × 10 17.43 2522
Table 2.4 Offshore Crude Loading Spills (non-CALM system s)
SPILL SOURCE MEAN SIZE FREQUENCY

SIZE RANGE (spills per
(barrels) (barrels) cargo)
-2
Storage on platform 121 0.1 to 4000 1.1 × 10
2 -4
Pipeline to loading facility 19 NA 3.0 × 10
-3
Loading buoy or facility 946 0.25 to 9400 3.0 × 10
-3
Transfer hose and coupler 78 0.5 to 500 4.1 × 10
-4
Tanker 4 2 to 5 6.0 × 10
-2
TOTAL 237 0.1 to 9400 1.9 × 10
The following frequencies are given for pollution events during loading at Single Point
Moorings (SPM; all categories including CALM included) in relation to Marine
Breakaway Couplings (MBC):
• 1 event (tanker breakout or surge event) every 3,518 operating days without MBC
• 1 event every 5,621 operating days with MBC
• Spill quantity with MBC fitted is 1/35 that without MBC
Note that ‘operating days’ refers to the number of days a tanker occupies the SPM.
Typically a shuttle tanker loading operation lasts less than 24 hours; it is suggested
that operating days be used as a surrogate for number of cargoes loaded.
2
Only one event, hence no range
4 ©OGP

If transport risk is a relatively small contribution to an overall risk study, the data
above may be sufficient. However, if transport risk is the object of the study, local
data become very important. It is strongly recommended that local data sources on
accidents and transport risk are obtained. This is because there can be large local
variations.
3.2 Uncertainties
With respect to the personnel risk values in Section 2.1, the main uncertainties are
associated with estimating the exposed populations for each type of worker. These
population uncertainties could lead to a factor of 2 in the uncertainty in the frequency
estimates. Other factors which are relevant are the uncertainty in trends with time, the
differences between different types of vessel (e.g. supply, standby, anchor handling
etc.) and the uncertainties due to different locations around the world.
Concerning vessel accident frequencies in Section 2.2, there are uncertainties over
when a vessel loss is defined as a total loss. Statistics dealing with total loss of
vessels may give lower figures for the latest years due to the fact that not all vessels
will be written off immediately after an accident. In some cases, the vessel may be
categorised as ‘out of service’, and after some time a decision to write it off or bring it
back in service will be made. There is a lack of consistency as to the year the vessel
may be written off; i.e. the year when the accident took place or the year when the
decision was made. In some cases the source may change the rules as to which year
the vessel will be classified as total loss without correcting the previous data.
Attempts have been made to take account of this in the analysis below. The total
population with regard to vessels is also difficult to assess. Most statistics available
have been collected and registered with regard to the flag, and not the region where
the vessels were sailing or where the accident took place. Worldwide frequencies
have been used to overcome these problems.
Oil spills not resulting from ship damage (e.g. transfer spills) are not covered
comprehensively in the LMIS database. Reporting of oil spills could be variable
especially for smaller spills. North Sea data which are considered better reported than
world averages have been used to try and reduce reporting uncertainty on transfer
spills.

This datasheet contains global data plus more detailed regional data where relevant.
When using these data, it should be realised that they may not be directly applicable
to the specific location under study. It is therefore strongly recommended that local
data sources on accidents and transport risk from governmental or other national or
regional institutions are obtained before using the data given in this sheet.
Should these local data not be accessible, or their reliability/applicability be uncertain,
then the data in this data sheet could be used after factoring for local circumstances.
However, data which have been adjusted to allow for local circumstances should
always be used with caution: the assumptions made are likely to be judgemental and
hence may reduce the reliability of the adjusted data vis–à-vis reality. Each
assumption shall be clearly documented so that an audit trail is maintained.
©OGP 5
3.3.1 Personnel Risk
The Boat Crew FAR in Section 2.1 can be used in just the same way as all the other
FAR data in these OGP datasheets.
The FAR equation for transferring other personnel by crew boats in Section 2.1 can be
understood through the following example. Assume a transit time of 1.5 hours. The
FAR from Section 2.1 can be used to generate an individual risk per journey as
follows:
IR per journey = FAR × 10-8 × Transit time per journey (hours)
= (30 + 26/1.5) ×10-8 × 1.5 = 7.1×10-7
Hence the expression for IR per journey can be generalised to:

IR per journey = 2.6 x 10-7 + 3.0 × 10-7 × Transit time (hours)
For the example journey above, with a transit time of 1.5 hours the individual risk is
again 7.1 × 10-7 per journey.
Location adjustments can make use of worldwide FAR data shown in Table 4.3 below.
The data presented below in Section 4.1.1.2 are not sufficient to distinguish between
transfers from shore to shore, shore to offshore and offshore to offshore.
3.3.2 Ship Accidents and Oil Spill Frequencies
The accident and spill rates in Sections 2.2 and 2.3 can be applied directly in generic
risk assessments. Ship accident rates could however be dependent on factors such
as location/ route, flag, ship operator SMS. If a detailed marine QRA is being
undertaken the data would need to be reviewed for local relevance.

4.1.1 Personnel Transport
4.1.1.1 Marine Personnel Associated with Offshore Industry
Table 4.1 presents an analysis of fatalities on vessels operating on the UKCS [2].
Table 4.1 Location of Fatal Marine Related Accidents on UKCS, 1977-96
Location Events Fatalities

Single point mooring 2 4
Barge 5 5
Diving support vessel 9 10
Supply vessel 13 14
Stand-by vessel / ERRV 3 4
Anchor handling vessel 3 3
6 ©OGP
Based on these numbers of fatalities and estimates of offshore workforce together

with a consideration of trends with time, [2] made an estimate of an FAR of 3 for boat
crew working on the UKCS. Note that there is significant uncertainty on the
percentage of the workforce in the various occupations and hence this FAR is
probably +/- a factor of 2. There was insufficient exposure data in [2] to distinguish
between crew in the different locations in Table 4.1.
4.1.1.2 Crew Boat Transfers

The only data available on experience with crew boats is for Brunei Shell Petroleum
(BSP) and Sarawak Shell Berhad (SSB) in Malaysia [3].
Operator 1 (Asia Pacific region) Experience

Operator’s crew boat experience during 1971-91 has been estimated as:
40,000 boat hours in transit
88,000 boat stages
There were on average 7.3 passengers on each boat stage, giving passenger
experience of:
292,000 passenger hours in transit
644,000 passenger transfer stages
Here, a stage consists of an embarkation and a disembarkation. In this period there
have been no fatalities on crew boats at all. Recent information indicates that
between 1991 and 2008 there have also been no fatalities.
Operator 2 (Asia Pacific region) Experience

Operator’s crew boat experience prior to 1991 amounted to at least:
2,000,000 passenger hours
2,000,000 passenger transfer stages
As with Operator 1, Operator 2 had no fatalities associated with crew boats in that
period. Recent information indicates that between 1991 and 2008 Operator 2
experienced one crew member fatality but no passenger fatalities.
Given the limited size of these datasets they have been combined.
Crew Boat Accident Frequencies

Where no accidents have occurred, the frequency may be estimated using statistical
techniques based on the Poisson distribution. The most likely frequency is equivalent
to assuming that 0.7 accidents have occurred to date, i.e. that the operation is 70% of
the way to its first accident. The confidence interval on this value is of course very
wide.
Since accidents in transit (such as the boat sinking) arise from different mechanisms
than accidents in transfer (such as crew members being crushed while transferring), it
may be appropriate to assume that both parts of the operation are independent and
70% of the way to an accident. This is pessimistic (for crew boats) and requires
careful sensitivity-testing.
©OGP 7
The above approaches yield accident frequency estimates for crew boats as given in
Table 4.2 based on prior 1991 data. The 90% confidence intervals are also shown. The
recent information indicates a further 17 years of operations by Operators 1 and 2
(referred to above) with no passenger fatalities. Thus as a sensitivity test one could
half the values given below assuming that the marine operations have maintained
their pre-1991 volume. Such a test would be within the 90% confidence band below.
However, given that a significant event could cause multiple passenger fatalities it is
recommended to maintain the values below as cautious best-estimates.
Table 4.2 Crew Boat Accident Frequencies (1971-1991)
Fatalities in Transit Fatalities in Transfer

(Per Passenger Hour) (Per Passenger Transfer
Stage)
-8 -8
Lower 5% value 2.2 × 10 1.9 × 10
-7 -7
Best estimate 3.0 × 10 2.6 × 10
-6 -6
Upper 5% value 1.3 × 10 1.1 × 10
4.1.1.3 Other Seafarers

[4] provides fatality rates for seafarers on UK merchant vessels and compares these
to other merchant fleets. For 1996-2005 there were 32 fatalities in accidents on UK
vessels:
• 23 personal occupational accidents while on duty
• 8 off duty personal accidents
• 1 in a shipping accident (an explosion)
These numbers exclude deaths due to disease, suicide and unexplained events (e.g.
disappeared overboard).
The 32 fatalities equate to a rate of 11 fatalities per 100,000 seafarer-years (see Table
4.3 under UK 1996-2005). Assuming an average of 4000 hours onboard a vessel per
seafarer year this equates to a FAR of 3. Table 4.3 indicates that this value is near the
bottom of the range of surveyed fleets; values up to a factor 40 higher would be
appropriate for other parts of the world.
8 ©OGP
Table 4.3 Seafarer Fatal Accident Rates (from [4])
Merchant Fleet Time No. of deaths Fatal Accident rate

Period from (per 100,000 seafarer-
accidents years)
India 1990-1996 282 426
Hong Kong 1990-1995 68 253
Singapore 1984-1989 101 162
Greece 1990-1994 339 162
West Germany 1960-1972 820 148
Norway 1990-1994 156 102
Poland 1985-1994 49 100
Singapore 1990-1995 98 99
West Germany 1974-1976 - 92
Denmark 1996-2005 72 90
Poland 1996-2005 52 84
Poland (2 main companies) 1990-1995 35 80
Poland 1960-1999 412 72
UK seafarers in non-UK fleets 1986-1995 63 66
Belgium 1996-2005 3 63
Denmark 1986-1993 63 62
Japan 1990-1994 121 58
Hong Kong 2000-2005 44 56
UK 1976-1985 407 53
Hong Kong 1980-1989 36 48
Isle of Man 1988-2005 33 44
Netherlands 1990-1994 15 39
Germany 1990-1994 35 39
UK 1986-1995 100 39
Sweden 1984-1988 27 37
Canada 1996-2005 16 22
France 1990-2004 6 20
India 1996-2005 26 18
Spain 1990-1994 7 16
Sweden 1996-2005 19 13
UK 1996-2005 32 11
Australia 1990-1994 3 10
Sweden 1990-1994 9 10
4.1.1.4 Effect of Location
Overall FARs in exploration and production for oil & gas world-wide have been
produced by OGP [5], The ratios of offshore FARs in the different areas are
considered to be a suitable basis for modifying the fatality rates for marine personnel
associated with the offshore industry above. Table 4.4 has the relevant values from
the “Occupational Risk” datasheet. For other seafarers the values in Table 4.3 can be
used.
©OGP 9
Table 4.4 FAR Multiplication Factors Offshore for Different Regions
Personne Africa Asia/ Europ FSU Middle North South

l Austr- e East America Americ
alasia a
All 1.22 0.56 1.05 0.69 0.82 1.52 0.92
Company 1.00 0.72 2.94 0.00 0.00 0.47 0.00
Contract 1.17 0.53 0.88 0.68 0.84 1.86 1.10
or
4.1.2 Vessel Incidents and Accidents

The most readily available analysis of accidents is in the Lloyd’s Register annual
World Casualty Statistics. This gives the total losses in the current year and several
previous years. Loss frequencies can be obtained by combining with fleet data from
the Lloyd’s Register annual World Fleet Statistics. These sources cover all self-
propelled sea-going merchant ships over 100 GT.
Figure 4.1 shows the total loss frequency for all ships over 100 GT world-wide
between 1974 and 1998. It shows a generally declining trend. Some of the fluctuations
can be attributed to the Iran-Iraq War (1980-88, with particular effects on shipping in
1982) and the Gulf War in Kuwait in 1991.
Based on this graph and allowing for the under-reporting effect of the last two years a
total loss frequency of 3.0 × 10-3 per ship year has been estimated; this is the
recommended value given in Section 2.2. Data for 1999 and 2000 gives total loss rates
of 1.5 × 10-3 and 1.9 × 10-3 per ship year respectively. This indicates a potentially
reducing loss rate with time which could be used as a sensitivity test.
Figure 4.1 Trend in Total Loss Frequency for All Ships
10 ©OGP
LMIS also provides information related to specific ship types. Based on the worldwide
LMIS database from 1992-1997 [6] made an estimate for oil tankers of a total loss
frequency of 1.9 × 10-3 per ship year. Of this fire/ explosion caused total losses with a
frequency of 7.2 × 10-4 per ship year. The serious casualty rates in Section 2.0 also
come from this source.
In terms of the impact of fleet on these rates, Table 4.6 (from [4]) can be used to derive
modification factors. Fatal casualty rates per ship year can be derived for each of the
fleets in Table 4.6. The maximum rate is 3.0 per 1000 ship years for Cambodia and 0.1
per 1000 ship years for UK and The Netherlands. The average rate is 0.8 per 1000 ship
years. Thus a modification range of a factor of 4 above the world average and a factor
of 8 lower than the world average is judged reasonable.
The effect of ship age is illustrated in Figure 4.2 below for oil tankers [6]. The effects
are expressed as the ratio of the frequency for specific age groups to the average
frequency for the whole fleet. The graph plots these ratios on a base of ship age,
using the mid-point of each group, and plotting the ratio for the 25+ age group at 27.5
years. This shows the pattern of low frequencies early in the ship’s life, rising in mid-
life and declining for older ships. This reduction for older ships is attributed to a
higher fraction of older ships being laid-up or used for storage, and hence being less
exposed to hazards.
Figure 4.2 Effect of Oil Tanker Age on Accident Frequencies
[6] also reviewed the impact of size on oil tanker accident rates, but did not find a
significant effect.
©OGP 11
4.1.3 Oil Spills

4.1.3.1 Tankers
The oil spill data in Table 2.3 is based on a database of worldwide oil spills for 1992-
94. They are assumed to refer to spills over 1 tonne, but it is likely that the spill
frequency is under-estimated for smaller spill sizes. Figure 4.3 shows a frequency
size curve for the spills based on 1992-97 data.
Figure 4.3 Frequency Size Curve for Oil Spills from Oil Tankers (1992-
1997)
4.1.3.2 Offshore Loading

Release or spill into the sea from vessels engaged in the offshore activities may have
as its source spills during oil lifting/loading, accidental discharges overboard or
ruptured tanks. Most reporting systems of accidental release or spill into the sea have
few details of the unit involved or the cause of the accident. No reliable data has been
found on accidental discharges or ruptured tanks. However, one study [7] on
lifting/loading has been identified. It is based on UK offshore loading from 1975-93. It
was noted that pollution incidents associated with lifting should be grouped
according to the lifting system; and the study mainly covers non-CALM (Catenary
Anchor Leg Mooring) systems, as the CALM system was a first generation system and
have been phased out. This data forms the basis for Table 2.4.
More recent data have been published by OCIMF 15. In 2006 OCIMF conducted a
survey of member companies operating offshore terminals to collect information on
MBC operating experience. The information given in Section 2.3 is based on survey
returns from 9 operating companies representing 125,561 tanker/SPM operating days.
12 ©OGP

4.2.1 Personnel Transport
Passenger casualty data from the Department for Transport’s 2006 report [8] for UK
registered merchant vessels gives a fatality rate of 0.3 per billion passenger
kilometres and Killed or Seriously Injured (KSI) of 43 per billion passenger kilometres.
This is based on 1996-2005 averages. It could be used as a sensitivity test for crew
boat passenger transport.
The Department for Transport’s website (www.dft.gov.uk) contains a table from its
Marine Accident Investigation Board showing the number of injuries from 1991 to 2004
on UK flagged vessels recorded by the Marine Accident Investigation Board as
"Associated with Offshore Industry". This is shown in Table 4.5. As above there is a
problem with exposed population; no data is given that would enable FARs or injury
rates to be estimated.
[4] also contains data about seafarer fatalities arising only from shipping casualties,
i.e. not including personal accidents, from merchant fleets around the world. These
are shown in Table 4.6.
Table 4.5 Injuries on UK flagged vessels Associated with Offshore

Industry (1991-2004)
Injury Type Total Number

of Injuries
Amputation of hand/ fingers/ toe 5
Bruising 49
Burns/ scalds – other 3
Chemical poisoning/ burns from contract or inhalation 4
Concussion/ unconsciousness due to head injury 7
Crush injury 32
Cuts/ wound/ lacerations 51
Death - confirmed 6
Dislocations 10
Eye injuries 5
Fracture – of the skull/ spine/ pelvis/major bone in arm or leg 31
Fracture – other 60
Hypothermia – body temperature too cold 4
Other 27
Strains – other strains/ sprains/ torn muscles/ ligaments 40
Strains – strained back 40
Unknown 38
Total 412
Koornstra [14] presents a passenger transport model which includes maritime

transport risk. Reference risks for ferries and cargo/ passenger ships are first
determined based on data from ships using European waters. Reference risks for
hopper and supply boats are based on assumptions about how they compare to
ferries and cargo/ passenger ships. Multiplication factors are then developed relating
maritime fatality risks to the Gross National Income per person (GNI/p). The report
proposes using an additional multiplication factor where there are strong indications
that a trip by a particular ship in a specific region is relatively less safe or relatively
safer than comparable ships in other countries with a comparable GNI/p level.
©OGP 13
Table 4.6 Fatalities Arising From Ship Casualties (from [4])
Merchant Fleet No. of deaths (Corresponding No. of cargo Mortality rate

from no. of shipping ships in from shipping
shipping casualties) 2000 casualties per
casualties 1,000 ship-
(1996-2005) years (1996-
2005)
Cambodia 76 (10) 335 22.7
Taiwan 54 (4) 370 14.6
Cyprus 154 (19) 1373 11.2
South Korea 116 (16) 1123 10.3
Syria 22 (5) 219 10.0
St Vincent 105 (21) 1147 9.2
Belize 98 (21) 1107 8.9
India 61 (6) 745 8.2
Indonesia 143 (16) 1924 7.4
Panama 393 (62) 5713 6.9
Honduras 61 (14) 899 6.8
PR China 175 (18) 2604 6.7
DIS (Denmark) 31 (7) 491 6.3
Malta 89 (18) 1452 6.1
Malaysia 40 (3) 768 5.2
Singapore 68 (11) 1677 4.1
Thailand 19 (4) 489 3.9
Turkey 38 (13) 1047 3.6
Antigua & Barbuda 27 (4) 756 3.6
Hong Kong 16 (5) 448 3.6
Ukraine 20 (5) 582 3.4
Greece 34 (11) 1055 3.2
Isle of Man 7 (2) 218 3.2
Vietnam 19 (6) 616 3.1
Norway 18 (5) 604 3.0
Bahamas 34 (11) 1157 2.9
Liberia 44 (10) 1523 2.9
Marshall Islands 8 (3) 291 2.7
Philippines 30 (7) 1093 2.7
Azerbaijan 6 (1) 228 2.6
Romania 5 (3) 219 2.3
UAE 7 (1) 337 2.1
Vanuata 5 (2) 248 2.0
Norway 10 (4) 648 1.5
Russia 36 (10) 2417 1.5
France 4 (1) 280 1.4
Italy 11 (5) 897 1.2
Egypt 4 (2) 353 1.1
Iran 4 (1) 369 1.1
USA 18 (8) 2412 0.7
Spain 2 (2) 334 0.6
Japan 28 (13) 5689 0.5
Canada 2 (1) 145 0.5
Germany 3 (3) 708 0.4
Netherlands 3 (1) 903 0.3
UK 0 (0) 811 0.0
14 ©OGP
4.2.2 Vessel Casualties

The Safety of Shipping in Coastal Waters (SAFECO) Project [9] provides an analysis of
the LMIS database, giving frequencies of serious casualties for each major ship type,
based on the period 1991-95.
The UK Protection & Indemnity (P&I) Club produces a Major Claims Analysis,
examining the causes of third-party claims over $100,000. A summary is on the P&I
Club website www.ukpandi.com. It gives the number and value of claims, broken
down by claim type, claim value, ship type, incident cause, ship age, flag etc. No
population data is available.
The Swedish Club website www.swedishclub.com includes a brief analysis of claims
on hull & machinery and P&I insurance. It gives the number and average cost of
claims, broken down by claim type. It also gives information on the number of vessels
insured.
4.2.3 Oil Spills

The US Coast Guard maintains a Marine Safety Management System (MSMS) database
of oil and chemical spills in US waters reported under the Federal Water Pollution
Control Act. It includes spills into navigable inland waters and the sea up to 12 miles
from the shore, and also spills threatening this area. It covers ships, pipelines and
installations. It gives comprehensive coverage of spills since 1973, but also includes
some earlier accidents.
The USCG website www.uscg.mil/hq/g-m/nmc/response/stats/aa.htm gives summary
statistics on the number and quantity of oil and chemicals spilled, broken down by
spill size band, oil type, location, water body and source. The annual data mentions
the largest individual incident in each year and its size. The database covers a wide
variety of installations and marine environments. The summary statistics do not allow
simultaneous breakdowns (say, for oil tankers in the Great Lakes), and no population
data is available. As a result, no use is apparent for the internet data at present. USCG
might give more useful results on request from the database itself.

The National Ports Council [10] analysed incidents in 10 UK ports, obtaining incident
frequencies. The ports were categorised as river (e.g. Thames, Medway, Mersey,
Tees), estuarine (Southampton, Harwich and Milford Haven) and open sea (Swansea
only). The analysis included many minor incidents, including 33% that caused no
appreciable damage and 54% slight damage such as minor dents or split harbour
facing timbers. Hence only about 13% of the incidents would be comparable with the
LMIS incident category.
The Advisory Committee on Dangerous Substances (ACDS) of the UK Health & Safety
Commission produced a report in 1991 [11] which incorporates a detailed QRA
conducted by DNV Technica of risks to people ashore from tankers and liquefied gas
carriers in ports, including frequency data based on LMIS and NPC.
AEA Technology published an analysis of Incident Probabilities on Liquid Gas Ships
[12] using data from the LMIS database for 1975-87. This gives means and confidence
limits for incident frequencies broken down by gas carrier type, size and age, and by
year and cause of the incident, and expressed as frequencies per ship year and per
voyage. It covers all reported incidents, but also identifies serious casualties.
©OGP 15
AEA Technology published an analysis of Marine Incidents in Ports and Harbours in

Great Britain [13] using data gathered directly from the ports for 1988-92. It gives
incident frequencies broken down by port type, ship type, and by severity and cause
of the incident, expressed as frequencies per ship visit.

For further information, the data sources used to develop the frequencies presented in
Section 2.0 and discussed in Section 4.0 should be consulted. The references used
for the recommended data in Section 2.0 are shown in bold in Section 6.0.
6.0 References
1. Lloyd’s Register 2005: W orld Fleet Statistics 2004, Lloyds Register –
Fairplay Lim ited, also corresponding annual reports for 1996-2003 data.
2. CMPT 1998: A Guide to Quantitative Risk Assessment of Offshore
Installations, Centre for Marine and Petroleum Technology, London.
3. Spouge, J.R., Sm ith, E.J. & Lewis, K.J. 1994: Helicopters or Boats - Risk
Managem ent Options for Transport Offshore, SPE Paper No 27277,
Conference on Health, Safety & Environm ent in Oil & Gas Production,
Society of Petroleum Engineers, Jakarta.
4. Roberts, S.E. & W illiam s, J. C. 2007: Update of Mortality for W orkers in
the UK Merchant Shipping and Fishing Sectors, Report for the Maritim e
and Coastguard Agency and the Departm ent for Transport, Research
Project 578.
5. OGP, 2007. Safety perform ance indicators – 2006 data, Report No.
391. Also corresponding reports for 2001-2005 data.
http://www.ogp.org.uk/Publications/index.asp
6. DNV 2001: Formal Safety Assessment of Tankers for Oil, Project
C383184/4.
7. E&P Forum 1996: Quantitative Risk Assessment Datasheet Directory, E&P
Forum Report No 11.8/250.
8. Department for Transport 2006: Road Casualties Great Britain 2006,
http://www.dft.gov.uk/162259/162469/221412/221549/227755/rcgb2006v1.pdf.
9. DNV 1997, SAFECO, WP III.2, Statistical Analysis of Ship Accidents, Technical Report
97-2039.
10. NPC 1976: Analysis of Marine Incidents in Ports and Harbours, National Ports Council,
London.
11. ACDS 1991: Major Hazard Aspects of the Transport of Dangerous Substances,
Advisory Committee on Dangerous Substances, Health & Safety Commission,
HMSO.
12. Borrill, E., Gould, J.H., Blything, K.W. & Lelland, A.N. 1994: Incident Probabilities on
Liquid Gas Ships, AEA Report AEA/CS/HSE R1014.
13. Robinson, R.G.J. & Lelland, A.N. 1995: Marine Incidents in Ports and Harbours in
Great Britain, 1988-1992, Report AEA/CS/HSE-R1051, AEA Technology.
14. Koornstra, M.J. 2008. A Model for the Determination of the Safest Mode of Passenger
Transport between Locations in any Region of the World. Report for Shell International
Exploration and Production B.V.
15. OCIMF 2008. Information Paper, Marine Breakaway Couplings, Oil
Com panies International Marine Forum .
16 ©OGP
Report No. 434 – 11.1

March 2010
Aviation
transport
accident
statistics
RADD – Aviation transport accident statistics
contents
1.1 Scope ............................................................................................................... 1
1.2 Application ...................................................................................................... 1
1.3 Definitions ....................................................................................................... 1
2.1 Helicopter Transport....................................................................................... 2
2.2 Fixed Wing Aircraft Transport ....................................................................... 4
3.2 Uncertainties ................................................................................................... 6
3.3.1 Helicopter Risk ........................................................................................................... 7
3.3.2 Fixed Wing Aircraft Risk............................................................................................ 8
4.1.1 Helicopter Transport .................................................................................................. 9
4.1.2 Fixed Wing Aircraft Transport................................................................................. 15
4.2.1 Helicopter Transport ................................................................................................ 18
4.2.2 Fixed Wing Aircraft Transport................................................................................. 18
6.0 References .......................................................................... 19
6.1 Helicopter References .................................................................................. 19
6.2 Fixed Wing Aircraft References................................................................... 19
6.3 Other References .......................................................................................... 20
Appendix I – Statistical Methods .................................................... 21
©OGP
Abbreviations:
CAA (UK) Civil Aviation Authority
GoM Gulf of Mexico
ICAO International Civil Aviation Organisation
IR Individual Risk
MTOW Maximum Take Off Weight
NATS National Air Traffic Services
POB Personnel On Board
PLL Potential Loss of Life
TO/L Take-Off and Landing

UK(CS) United Kingdom (Continental Shelf)
WAAS World Aircraft Accident Summary
©OGP

1.1 Scope
This datasheet provides information on aviation transport accident statistics for use in
Quantitative Risk Assessment (QRA). The data sheet includes guidelines for the use
of recommended data and a review of the sources of the data.
The data in this sheet are intended for two main uses:
• Assessing the risk of helicopter transport;
• Assessing the risk of fixed wing transport.
1.2 Application
This datasheet contains global data plus more detailed regional/national data where
relevant or where available. When using these data, it should be noted that they may
not be directly applicable to the specific location under study. Guidance on using
location specific data is given in Section 3.3.
1.3 Definitions
The data presented in Section 2.0 are for persons travelling by air during take-off,
flight and landing. They exclude risks to persons on the ground: ground staff,
flight/cabin crew and passengers boarding/leaving the air transport. Helicopter
transport risks also exclude non transport activities such as search and rescue
missions and winching.
Transport risks to persons are presented as:
• Individual Risk (IR): risk per year of fatality to a specific individual
• Fatal Accident Rate (FAR): risk of fatality per 108 exposed hours1
The following are used in the risk models presented in Sections 2.0 and 3.0:
• Probability of fatal accident Probability that an accident results in at least
one fatality
• Probability of death in fatal accident Probability of death for one individual
on board aircraft/helicopter involved in fatal
accident
1
It should be noted that FARs are convenient for describing the risk in individual activities
(e.g. working on the drill floor, flying in a helicopter). Unlike individual risks per year, they do
not require any assumptions about what the individual does for the rest of the year. However,
they may be misleading because they represent a rate of risk per unit time in the activity. FAR
values for offshore workers are typically based on 26 weeks’ exposure per year (for a 2 weeks
on, 2 weeks off rota pattern), equivalent to 4380 hours per person per year; the corresponding
helicopter transport exposure is of the order of 30 hours per year. Hence, in contrast to
individual risks per year, FARs cannot sensibly be added together. Whereas FAR values are in
the range 144 to 815 for offshore transport (see Table 2.3), the total FAR in offshore activities
may be only 10 to 20. Adding these values would give a misleading impression of the relative
contribution of helicopter risk to the overall risk. Although it may still be a significant
contributor to the total IR and PLL, it should be judged in the context of those measures, and
the helicopter FAR value should not be added to the FAR values from other risks. However, it
may be compared with FAR values for other modes of transport (e.g. fixed wing aircraft.)
©OGP 1
Data for the following helicopter activities are presented in Sections 2.1 and 4.1.1:
• Offshore (all offshore helicopter activity)
• Seism ic (onshore seismic surveys)
• Geophysical (onshore geophysical activity)
• Pipeline (onshore pipeline surveys and support)
• Other (all other onshore activity, e.g. crew changes, rig moves, non seismic
external loads)

• Helicopter Transport (Section 2.1)
• Fixed Wing Aircraft Transport (Section 2.2)
2.1 Helicopter Transport

The following model is recommended.
Individual risk (IR) per journey = In-flight IR + Take-off & landing (TO/L) IR
In-flight IR = Accident frequency in-flight (per hour) ×
Flight time (hours) ×
Probability of fatal accident ×
Probability of death in fatal accident
TO/L IR = Accident frequency in TO/L (per flight stage) ×
No of flight stages per journey ×
Probability of fatal accident ×
Probability of death in fatal accident
Wherever possible, local (country/regional or air transport operator) data should be

used (but see Section 3.3.1). Where these are not available, the frequencies and
probabilities recommended for use in this model are set out in Table 2.1 (offshore
transport) and Table 2.2 (other activities). The basis for the values in these tables is
set out in Section 4.1.1. No trend over time can be identified in the 9 years’ data
analysed.
2 ©OGP
Table 2.1 Offshore Helicopter Transport Flight Accident Data for

Risk Estim ation Model
Region Flight Frequency unit Probability Probability

Phase of Fatal of Death in
Accident Fatal
Accident
-6
North Sea In-flight 8.5 × 10 per flight 0.20 0.85
hour
-7
Take-off & 4.3 × 10 per flight 0.17 0.48
Landing stage
-6
Gulf of In-flight 8.5 × 10 per flight 0.33 0.59
Mexico hour
-6
Landing stage
-6
Rest of World In-flight 8.5 × 10 per flight 0.74 0.87
hour
-6
Landing stage
Table 2.2 Other Activities Helicopter Flight Accident Data for Risk
Estim ation Model
Activity Flight Frequency unit Probability Probability

Accident Fatal
Accident
-5
Seismic In-flight 4.1 × 10 per flight 0.26 0.54
hour
-5
Landing stage
-5
Geophysical In-flight 1.1 × 10 per flight 1.00 0.86
hour
-6
Landing stage
-5
Pipeline In-flight 6.3 × 10 per flight 0.36 0.62
hour
-5
Landing stage
-5
Other In-flight 4.1 × 10 per flight 0.26 1.00
hour
-5
Landing stage
©OGP 3
Table 2.3 gives FAR values for helicopter transport.
Table 2.3 Estim ated FAR Values for Helicopter Transport
Activity Region FAR

Offshore Transport North Sea 144
Gulf of Mexico 454
Rest of World 815
All 509
Seismic All 5268
Geophysical All 4792
Pipeline All 8883
Other All 2487
All except Offshore Transport All 3670
2.2 Fixed Wing Aircraft Transport

Table 2.4 presents basis accident, individual risk and FAR data.
Table 2.4 Average W orldwide W estern Jet Data (excluding hostile attacks
and personal accidents 1 )
Measure Value
2 -7
Fatal accident frequency per flight 6.2 × 10
2 -7
Fatal accident frequency per flight hour 3.4 × 10
-7
Individual risk per person flight 4.1 × 10
-7
Individual risk per person flight hour 2.3 × 10
FAR 23
Notes
1. Such as ground crew fatal injuries, slips, trips and falls.
2. Defined as fatality within 30 days of the accident. Excludes
fatal illnesses on board aircraft.
There appears to be a downward trend in accident frequencies of 4.5% a year [10].

Hence, as these values are based on 1990-2002 data (see Section 4.1.2), for 2008 a
modification factor of 0.58 (4.5% decrease/year × 12 years since the mid-point of the
dataset) could be used.
A number of other factors could have an impact on the accident frequencies. The
tables below address:
• the type of accident considered (Table 2.5);
• the operating region/location (Table 2.6);
• the type of operation – scheduled, cargo etc. – (Table 2.7); and
• the type of aircraft used (Table 2.8).
4 ©OGP
Table 2.5 M ultiplication Factors for Accident Frequencies
Frequency Type Modification Factor
Frequency of fatal accidents including hostile 1.15

acts and personal accidents
Frequency of ICAO defined accidents (i.e. 3.53
involving substantial damage to the aircraft
and/or serious/fatal injury to people)
Frequency of hull loss (i.e. events where the 1.37
aircraft is missing or damaged beyond economic
repair)
Table 2.6 M ultiplication Factors for Operating Regions
Operating Region (Operator Domicile) Modification Factor

Western Europe, North America and Australasia 0.36
Middle East and Asia (excluding China) 1.8
Latin America 2.4
Eastern Europe (including Russia), Africa and 3.9
China
Table 2.7 M ultiplication Factors for Types of Operation
Operation Modification Factor

Scheduled passenger (e.g. major airlines) 0.83
Non-scheduled passenger (e.g. charter flights) 2.1
Scheduled cargo (e.g. UPS, FedEx, DHL etc) 2.0
Non-scheduled cargo 5.3
Table 2.8 M ultiplication Factors for Types of Aircraft
Aircraft Type Modification

Factor
First generation Western jets (e.g. B707, DC-8)* 11.8
Second generation Western jets (e.g. B727, DC-9, F28)* 1.25
Early widebody Western jets (e.g. B747, DC-10)* 2.24
Current Western jets (e.g. B757/767/777, A330/340, F100)* 0.65
Eastern built jets (e.g. Il76, Tu154) 2
Executive jets (e.g. Citation, Gulfstream, Learjet) 13
Early turboprops first delivered before 1970 (e.g. BAe 748, 4
F27)
Modern turboprops first delivered since 1970 (e.g. DH-8, 1.2
F50)
Piston-engine aircraft (e.g. Islander, Cessna 150, PA28) 19
* See Section 4.1.2.4 for a full list of aircraft types covered by these definitions.
©OGP 5

If transport risk is a relatively small contribution to an overall risk study, the data
above may be sufficient. However, if transport risk is the object of the study or is
believed to be significant, local data become very important. It is strongly
recommended that local data sources on accidents and transport risk are obtained
wherever possible (but see Section 3.3.1). This is because there can be large local
variations. In the absence of local data, the data presented in Section 2.0 can be used.
3.2 Uncertainties
With respect to the helicopter accident data in Section 2.1, the main uncertainties
arise from the relatively limited number of fatal accidents that have occurred in the
regions mentioned in Table 2.1, and from the small numbers of flights and of fatal
accidents in some of the activities mentioned in Table 2.2. These are discussed
further in Section 4.1.1.
The data presented in Section 2.1 are based on information provided to OGP by OGP’s
members, and may not be representative in all geographical areas.
Variations may exist between different helicopter types: this is examined in Section
4.1.1. It is suggested there that there are no significant systematic variations in
accident rates between different helicopter types but it may be desirable to use type
specific data where available, at least as a sensitivity.
Regarding the fixed wing aircraft accident frequencies in Section 2.2, there are
significant uncertainties concerning the modification factors. It is preferable to
incorporate them in the analysis by some means rather than to use the basis
frequencies (Table 2.4) without modification for the specific situation addressed by
the QRA. The available data (see Section 4.1.2) do not permit rigorous analysis of the
all the factors involved and of possible correlations between them. Two possible
approaches may be adopted:
1. As a simple approach, it could be assumed that the above sets of modification
factors are independent and can be combined to estimate the risks in specific
cases. However, many of the factors could be correlated. For example, much of the
observed downward trend in accident frequency has resulted from the introduction
of current generation aircraft, which have been used mainly for scheduled
passenger services in Western countries. Meanwhile, older jets are used mainly in
developing countries and for cargo operations. Hence, the combination of factors
will tend to over-estimate the effects in cases where several factors all increase or
reduce the risk.
2. An alternative approach would be to select what are judged the most significant
issues and just use one or two modification factors. This is illustrated below in
Section 3.3.

This datasheet contains global data plus more detailed regional data where available.
When using these data, it should be realised that they may not be directly applicable
to the specific location under study. It is therefore strongly recommended that local
data sources on accidents and transport risk be obtained before using the data given
in this sheet (but see Section 3.3.1). Local sources could include governmental or
6 ©OGP
other national or regional institutions, or the facility operator's or local air transport
operator's data.
Should local data not be available, or their reliability/applicability be uncertain, then
the data in this datasheet could be used after factoring for local circumstances.
However, data which have been adjusted to allow for local circumstances should
always be used with caution: the assumptions made are likely to be judgemental and
hence may reduce the reliability of the adjusted data vis-à-vis reality. Each
assumption should be clearly documented so that an audit trail is maintained.
3.3.1 Helicopter Risk
In Sections 3.1 and 3.3 the use of local data wherever possible is recommended.
However, the number of fatal accidents is relatively small. It is therefore
recom m ended that local accident frequencies, where available, are
com bined with the generic probabilities given in Section 2.1.
The following example illustrates how the data in Section 2.1 can be used to estimate
helicopter transport annual risks.
A North Sea installation crew member works 2 weeks on, 2 weeks off. The flight from
the heliport to their installation is in 2 stages (i.e. via another installation) and the total
time in the air is 1 hour. Their IR would be calculated as follows.
Total flight stages = 13 offshore trips/year × 2 flights/trip × 2 stages/flight = 52 stages/year
Total flight time = 13 offshore trips/year × 2 flights/trip × 1 hour/flight = 26 hours/year
In-flight IR = Accident frequency in-flight (8.5 × 10-6 per flight hour) ×
Flight time (26 hours/year) ×
Probability of fatal accident (0.20) ×
Probability of death in fatal accident (0.85)
-5
= 3.8 × 10 per year
TO/L IR = Accident frequency in TO/L (1.0 × 10-5 per flight stage) ×
No of flight stages (52/year) ×
× Probability of fatal accident (0.17) ×
× Probability of death in fatal accident (0.48)
-5
= 4.2 × 10 per year
Total IR = 3.8 × 10-5 + 4.2 × 10-5 per year = 8.0 × 10-5 per year
The annual PLL (Potential Loss of Life) from helicopter transport for the installation
can be calculated with the following additional information.
The platform POB is 48. 2 crews operate back-to-back. Helicopter transport is
provided by the S-76, which has a passenger capacity of 12. Hence each crew change
requires 4 helicopter flights.
Total PLL = Total IR × no. of crews × flights/crew × passengers/flight
=8.0 × 10-5 per year × 2 × 4 × 12 = 7.7 × 10-3
©OGP 7
However, it should be noted that in practice not all personnel visiting a platform work
exactly 2 weeks on, 2 weeks off. Additional personnel may be flown out for specific
tasks lasting perhaps just a few days; there may be visitors to the platform, perhaps
arriving and departing within the same day. Hence true risk estimates may vary
between individuals.
3.3.2 Fixed Wing Aircraft Risk

To illustrate how the fixed wing data in Section 02.2 could be used, four examples are
set out below.
1. Worldwide average individual risks travelling on Western Jet in 2008
Basic FAR = 23
Trend factor × 0.58 (see Section 2.2)
Current FAR = 13
2. Scheduled passenger jet flight in Western Europe, N. America, Australasia

Basic FAR = 23
Scheduled passenger × 0.83 (from Table 2.7)
Operating Region × 0.36 (from Table 2.6)
Local FAR =7
N.B. Modification factors are based only on accident rates and not accident
consequences (probability of fatality in an accident) as the latter show relatively small
variations. In the above calculation the trend factor is not used, as the use of modern
aircraft has been widespread in these regions for some time.
3. Worldwide average individual risks travelling on Non scheduled passenger

flight in 2008
Basic FAR = 23
Trend factor × 0.58 (see Section 2.2)
Non scheduled passenger × 2.1 (from Table 2.7)
Current Local FAR = 28
4. Specific individual risks travelling on Non scheduled passenger flight in older

style of aircraft in Middle East
Basic FAR = 23
Non scheduled passenger × 2.1 (from Table 2.7)
Operating Region × 1.8 (from Table 2.6)
Specific Local FAR = 87
Sensitivity tests can involve applying extra (or fewer) modification factors to obtain
realistic ranges. For example in example 4 above, no trend factor was applied as older
8 ©OGP
aircraft were being assessed; however, if it were considered that operational

standards were equivalent to today’s standards the trend factor could be applied (×
0.58) leading to a FAR range of 50 to 87.

4.1.1 Helicopter Transport
4.1.1.1 Principal Analysis
The main source of data is the annual reports produced by OGP [1][2][3][4][5][6][7][8]
for each year 1998 to 2006 apart from 1999. These have been supplemented by
operational data for 1999 and more detailed accident information provided on behalf
of OGP [9].
The operational data are presented by region for offshore activities and aggregated
worldwide for other activities.
The detailed accident data give: date, helicopter operator, activity, helicopter model
and type (see Section 4.1.1.2), country, nos. of passenger and crew injuries and
fatalities, flight phase, and a brief description of the accident cause. They do not give
the number of passengers carried on the flight.
Table 4.1 and Table 4.2 summarise the operational and accident data for offshore
transport and other activities respectively. These form the basis of the analysis
presented in this datasheet.
Table 4.3 and Table 4.4 present the raw analysis of the data given in Table 4.1 and
Table 4.2 respectively. It will be noted that in some cases entries appear as 0.
Furthermore, given the limited accident data, it can be questioned whether the
differences between regions for offshore helicopter transport, and between activities
for other activities, are statistically significant. Figure 4.1 shows the accident
frequencies for offshore activities by region and overall, with error bars showing 90%
confidence limits (see Appendix I). From this it was concluded as follows:
• The difference in in-flight accident frequencies between the three regions is not
statistically significant, so the overall value has been substituted in Table 2.1 for
the region specific values in Table 4.3.
• The difference in take-off/landing accident frequencies between the GoM and
Other regions is not statistically significant, so the overall value for these two
regions has been substituted in Table 2.1 for the region specific values in Table
4.3.
©OGP 9
Table 4.1 Sum m ary of Offshore Operational and Accident Statistics 1998-2006
North Sea Flight Hours Take-Offs and Landings Accidents by heli type Fatals by heli type
Flight Accidents SE Fatal Fatalitie
Phase SE LT MT HT SE LT MT HT LT MT HT s SE LT MT HT s
In-flight 0 414 341,470 971,320 - - - - 10 0 0 3 7 2 0 0 2 0 18
Take-off - - - - - - - - 1 0 0 0 1 0 0
Landing - - - - - - - - 0 0 0 0 0 0 0
TO/L - - - - 0 456 1,284,244 1,066,270 1 0 0 0 1 0 0 0 0 0 0
GoM Flight Hours Take-Offs and Landings Accidents by heli type Fatals by heli type
In-flight 2,598,714 285,614 719,222 95,609 - - - - 36 30 2 4 0 12 10 1 1 0 27
Take-off - - - - - - - - 14 13 1 0 0 3 3 0 0 0 6
Landing - - - - - - - - 21 18 1 2 0 4 4 0 0 0 7
TO/L - - - - 9,812,645 942,850 1,542,599 159,899 35 31 2 2 0 7 7 0 0 0 13
Other Flight Hours Take-Offs and Landings Accidents by heli type Fatals by heli type
In-flight 401,561 117,569 2,127,399 464,692 - - - - 23 3 1 16 3 17 3 1 11 2 99
Take-off - - - - - - - - 8 2 2 2 2 2 1 0 1 0 13
Landing - - - - - - - - 15 1 0 11 3 5 0 0 3 2 12
TO/L - - - - 2,482,319 240,428 5,334,178 832,160 23 3 2 13 5 7 1 0 4 2 25
SE = Single Engine; LT = Light Twin; MT = Medium Twin; HT = Heavy Twin
10 ©OGP
Table 4.2 Sum m ary of Other Operational and Accident Statistics 1998-2006
Seismic Flight Hours Take-Offs and Landings Accidents by heli type Fatals by heli type
In-flight 317,127 7,071 67,927 6,029 - - - - 18 17 0 1 0 5 4 0 1 0 7
Take-off - - - - - - - - 13 11 0 2 0 2 1 0 1 0 5
Landing - - - - - - - - 11 11 0 0 0 1 1 0 0 0 1
TO/L - - - - 1,221,253 9,046 146,785 9,072 24 22 0 2 0 3 2 0 1 0 6
Geophysica Accidents by heli type

l Flight Hours Take-Offs and Landings Fatals by heli type
In-flight 68,988 8,485 8,580 2,232 - - - - 1 1 0 0 0 1 1 0 0 0 2
Take-off - - - - - - - - 0 0 0 0 0 0 0 0 0 0 0
Landing - - - - - - - - 0 0 0 0 0 0 0 0 0 0 0
TO/L - - - - 63,881 6,815 6,028 2,633 0 0 0 0 0 0 0 0 0 0 0
Pipeline Flight Hours Take-Offs and Landings Accidents by heli type Fatals by heli type
In-flight 183,288 6,832 25,312 6,138 - - - - 14 11 0 1 2 5 2 0 1 2 16
Take-off - - - - - - - - 1 1 0 0 0 1 1 0 0 0 1
Landing - - - - - - - - 7 5 0 1 1 1 0 0 1 0 4
TO/L - - - - 189,149 8,144 96,940 18,385 8 6 0 1 1 2 1 0 1 0 5
Other Flight Hours Take-Offs and Landings Accidents by heli type Fatals by heli type
In-flight 175,687 21,465 99,741 131,271 - - - - 16 11 1 3 1 4 2 1 0 1 28
Take-off - - - - - - - - 5 4 0 0 1 1 1 0 0 0 3
Landing - - - - - - - - 12 8 1 1 2 2 0 0 1 1 2
TO/L - - - - 292,044 24,774 396,507 158,576 17 12 1 1 3 3 1 0 1 1 5
©OGP 11
Table 4.3 Offshore Transport Flight Accident Data
Region Flight Frequency unit Probability Probability

Accident Fatal
Accident
North Sea In-flight 8.5 × 10-6 per flight 0.20 1.00
hour
Take-off & 4.3 × 10-7 per flight 0 0
Landing stage
Gulf of In-flight 9.7 × 10-6 per flight 0.33 0.59
Mexico hour
Take-off & 2.8 × 10-6 per flight 0.20 0.53
Landing stage
Rest of In-flight 7.4 × 10-6 per flight 0.74 0.87
World hour
Landing stage
Table 4.4 Other Activities Flight Accident Data
Activity Flight Frequency unit Probability Probability

Accident Fatal
Accident
Seismic In-flight 2.7 × 10-5 per flight 0.28 0.54
hour
Landing stage
Geophysical In-flight 1.1 × 10-5 per flight 1.00 0.86
hour
Take-off & 0 per flight 0 0
Landing stage
Pipeline In-flight 6.3 × 10-5 per flight 0.36 0.62
hour
Landing stage
Other In-flight 3.7 × 10-5 per flight 0.25 1.00
hour
Landing stage
12 ©OGP
Figure 4.1 Offshore Helicopter Accident Frequencies
No accidents on take-off and landing have occurred during geophysical activities

(Table 4.4); an accepted statistical technique of assuming 0.7 accidents to date (see
Appendix I) has been applied.
The significance of statistical differences in accident frequencies has been analysed
for other activities in similar manner to that above for offshore transport, as shown in
Figure 4.2. From this it was concluded that:
• The differences in in-flight and take-off/landing accident frequencies between
Seismic and Other activities (i.e. apart from pipeline and geophysical activities) is
not statistically significant, so the overall values for these two activities have been
substituted in Table 2.2 for the activity specific values in Table 4.4.
Similar analysis can be applied to the fatal accident probabilities and the fatalities/fatal
accident fractions. Addressing first the zeroes in Table 4.3 and Table 4.4:
• For take-off/landing accidents in the North Sea, the longer-term UK averages
based on CAA accident and exposure data have been used in Table 2.1.
• The same has been done for the fatality rate in fatal in-flight accidents in the
North Sea.
• For take-off/landing accidents in geophysical activities, the averages for all
non offshore transport activities have been used in Table 2.2.
Next, considering the significance of statistical differences, it was concluded that:
• The differences in fatal accident probabilities for in-flight and take-off/landing
accidents during Seismic and Other activities are not statistically significant, so
the overall value for these two activities has been substituted in Table 2.2 for the
activity specific values in Table 4.4.
Apart from the above exceptions, the values in Table 2.1 and Table 2.2 are the same as
those in Table 4.3 and Table 4.4.
©OGP 13
Figure 4.2 Other Activities Helicopter Accident Frequencies
4.1.1.2 Effect of Helicopter Type

Helicopters are categorised as:
• SE (Single Engine), e.g. AS350B Squirrel
• LT (Light Twin), e.g. Eurocopter AS355
• MT (Medium Twin), e.g. Sikorsky S-76A
• HT (Heavy Twin), e.g. SA332 Super Puma
The OGP data enable comparisons to be made between these 4 categories. The
accident frequencies are shown in Figure 4.3. From this it would be reasonable to
conclude that there are no significant differences in accident frequencies for the
different helicopter types (although the in-flight frequency for SE helicopters and take-
off/landing frequency for MT helicopters could be considered to be significantly
different to the overall frequencies for the other types.) Hence no variation by
helicopter type is suggested.
14 ©OGP
Figure 4.3 Helicopter Accident Frequencies by Type (all activities)
4.1.2 Fixed Wing Aircraft Transport

4.1.2.1 Large Western Jets
4.1.2.1.1 Fatal Accident Frequencies
The values in Section 2.2 are taken from [10], which uses the Airclaims World Aircraft
Accident Summary (WAAS) [11] as the primary data source. This was checked for
omissions using data from Boeing [12] and the websites PlaneCrashInfo
(www.planecrashinfo.com/) and Aviation Safety Network (http://aviation-
safety.net/statistics/). There are relatively few convenient sources of flight exposure
data. The main ones are reviewed by NATS [13]. The most convenient source is
Boeing [12], which covers large Western passenger jets (defined below).
[10] summarises 148 fatal accidents on Large Western Commercial Jets, 1990-2002. Of
these 19 were either hostile acts or personal accidents. Thus the total was 129
excluding these events.
During 1990-99 there were 157.5 million departures [12]. Departures in the subsequent
3 years have been reported as 18.14, 16.88 and 16.52 million [12], giving a total of
209.05 million during 1990-2002. The number of flight hours in the Boeing data during
1990-2002 has been estimated as 380 million. This gives an average flight length of
380/209 = 1.82 hours. This value has increased during the period, and appears to be
approximately 2.0 hours in 2002. This is significantly higher than the standard value of
1.5 hours quoted by Boeing [12], which seems to be based on much older data.
Based on the 129 fatal accidents and the exposure data above the Fatal accident
frequency per flight = 6.2 × 10-7 and the Fatal accident frequency per aircraft flight hour
is 3.4 × 10-7 as shown in Table 2.4.
The individual risk values in Table 2.4 are derived from the same data sources. The
relevant data are shown in Table 4.5.
©OGP 15
Table 4.5 Individual Risks on Large W estern Com m ercial Jets, 1990-2002
Individual Risk per flight Individual Risk per flight

hour
Fatalities 8213
10 10
Exposure 2.0 × 10 person flights 3.6 × 10 person flight hours
-7
Risk -7 2.3 × 10 per person flight hr
4.1 × 10 per person flight
FAR = 23
4.1.2.1.2 Aircraft Accident Frequencies

“Aircraft accidents” are events causing substantial damage to the aircraft or
serious/fatal injury to people. The Boeing database [5] for 1959-2002 includes 1337
aircraft accidents, of which 509 were fatal, i.e. 2.63 accidents per fatal accident. For
1993-2002 there were 385 accidents, of which 109 were fatal, i.e. 3.53 accidents per
fatal accident. This trend probably reflects improved reporting, so the more recent
number is used in Table 2.5.
4.1.2.1.3 Hull Loss Frequencies

“Hull losses” (also known as “total losses”) are events where the aircraft is missing,
inaccessible or damaged beyond economic repair.
The Boeing database [12] for 1959-2002 includes 695 hull losses, compared to 509
fatal accidents, i.e. 1.37 hull losses per fatal accident.
4.1.2.2 Impact of Operating Regions

[14] gives fatal accident frequencies for all commercial aircraft over 5700 kg MTOW
during 1980-2001 broken down by operator domicile. This data is used to develop the
modification factors summarised in Section 02.2.
It should be noted that local air traffic control is not a significant primary cause of
accidents (see e.g. [15]) and that the operator domicile dominates any geographic
factors.
4.1.2.3 Impact of Types of Operations

[16] presents frequencies of hull loss and/or fatal accidents on Western jets and
turboprops over 5700 kg MTOW world-wide during 1970-99 for different types of
operator:
• Major operators, with large jet fleets, mainly scheduled passenger.
• Integrators, with large scheduled cargo fleets (e.g. UPS, FedEx, DHL).
• Supplemental air carriers, with mainly commuter turboprops.
• Ad-hoc operators, with mainly unscheduled charter flights.
This shows that unscheduled (i.e. ad-hoc) passenger operations have an accident
frequency 2.5 times higher than scheduled (i.e. other) passenger operations. These
values have been used to derive the modification factors in Table 2.7.
16 ©OGP
4.1.2.4 Impact of Aircraft Type

The Boeing analysis includes hull loss frequencies for individual jet types. In most
cases the differences are either not statistically significant or reflect operating
features specific to the aircraft type (e.g. higher rates per departure for short-haul
types).
Boeing also groups the aircraft by generation, as follows:
• First generation – B707/720, DC-8.
• Second generation – B727, B737-100/200, DC-9, BAC 1-11, F-28.
• Early widebody - B747-100/200/300/SP, DC-10, L-1011, A300
• Current – B717, B737-300 and later, B747-400, B757/767/777, MD-11/80/90, A300-
600, A310/319/320/321/330/340, F-70, F-100, BAe 146, RJ-70, RJ-85, RJ-100.
The different rates Boeing derived have been used to derive the first 4 values in Table
2.8.
[14] shows the fatal accident frequency for Eastern built aircraft (jets and turboprops
over 5700 kg MTOW) roughly equal to that of Western built aircraft during 1980-89. The
difference appeared to widen in about 1990, and during the period 1990-2001 the fatal
accident frequency for Eastern built aircraft has been approximately a factor of 2
higher than for Western built aircraft.
Business (or executive) jets are used for business or private transport, typically less
than 20 tonnes. They include Bombardier (Canadair) Challenger and Learjet. [13]
estimates a first-world airport-related crash frequency for executive jets of 2.2 crashes
per million movements, a factor of 15 higher than for Western jets (excluding first
generation jets) on scheduled passenger services. Since scheduled passenger
services have a modification factor of 0.83 compared to the basis dataset (Table 2.7),
the appropriate modification factor for executive jets is 15 × 0.83 = 13.
[13] categorises Western airliner turboprops as follows:
• Early turboprops (T2) first delivered before 1970 – BAe 748, Vanguard, Viscount,
Convair 540/580/600/640, Dart Herald, DH Twin Otter, Fairchild F27, FH227,
Fairchild Metro, Fokker F27, Gulfstream 1, Hercules, Electra, Skyvan.
• Other turboprops (T1) first delivered in or after 1970 – ATR 42, ATP 72, BAe ATP,
Jetstream 31/41, DH Dash 7/8, Do 228/328, EMB 110/120, Fokker F50, Saab
340/2000, Shorts 330/360.
Airport-related crash frequencies on Western airliner turboprops over 5700 kg MTOW
on scheduled passenger services during 1979-97, for first-world and world-wide, are
shown in [6] enabling the modification factors in Table 2.8 to be derived.
[6] estimates a UK airport-related crash frequency for piston-engine aircraft in
commercial use during 1985-97 of 3.27 crashes per million movements, 22 times
higher than for Western jets (excluding first generation jets) on scheduled passenger
services in the first world. This was assumed applicable to all piston-engine
operations in the UK. Since scheduled passenger services have a modification factor
of 0.83 compared to the basis dataset, the appropriate modification factor is 22 × 0.83
= 19 (see Table 2.8).
©OGP 17

4.2.1 Helicopter Transport
DNV has carried out a more detailed analysis of UK helicopter accident rates for one
OGP member based on data for the years 1970-2006 using the UK Civil Aviation
statistical reports up to the last year of their publication (2002 data) and for 2003
onwards by direct request to the CAA for the accident data. The CAA’s exposure data
is tabulated by helicopter model as “Public Transport Air Taxi Operations”, which
cover mainly but not exclusively offshore transport operations.
DNV has previously analysed data for Norway, Denmark and The Netherlands. The
analysis was based on a combination of CAA and OGP data, which can be obtained by
country.
DNV also analysed Gulf of Mexico data in more detail. Gulf of Mexico helicopter
accident statistics were obtained from WAAS [11] and the NTSB accident database
[18]; flight exposure data was obtained from OGP.
As an example of using operator specific data, DNV estimated historical accident
frequencies in one company’s offshore operations. Its experience prior to 1993
amounted to approximately 56,000 flying hours and 105,000 flight stages [19]. In that
time there were 2 crashes, one of which was on landing and one on flight. There were
no fatalities. This gives accident frequencies as follows:
At the time of the analysis, these accident frequencies were not significantly different
from the frequencies for other regions. Note that, compared with the exposure and
accident statistics given in Table 4.1 and SE = Single Engine; LT = Light Twin; MT =
Medium Twin; HT = Heavy Twin
Table 4.2, the numbers of flights and accidents are small, giving wide confidence
limits on the results.
4.2.2 Fixed Wing Aircraft Transport

[20] derived individual risks on UK airlines doing international flights 1975-92 as a
FAR of 15.
[21][21] studied annual individual risk for workers in the USA during 1979-83 which
gave 9.0 × 10-4 for pilots and 1.6 × 10-4 for stewardesses. The difference between the
figures for pilots and stewardesses may result from the inclusion of general aviation
pilots.

For further information, the data sources used to develop the frequencies presented in
Section 2.0 and discussed in Section 4.0 should be consulted. The references used
for the recommended data in Section 2.0 are shown in bold in Section 6.0.
18 ©OGP
[22] provides an interesting model for comparing risks of using different transport
modes. However, it does not present any advantages or improved data analysis
compared with those presented in the preceding sections (and in the datasheets Land
Transport Accident Statistics and Water Transport Accident Statistics).
6.0 References
6.1 Helicopter References
[1] OGP 1999. Safety performance of helicopter operations in the oil & gas
industry 1998, Report No. 6.83/300. http://www.ogp.org.uk/pubs/300.pdf
(No report published with 1999 data; see [9].)
industry: 2000 data, Report No. 6.61/333.
http://www.ogp.org.uk/pubs/333.pdf
industry: 2001 data, Report No. 341.
[9] OGP, private com m unication, 2008. Helicopter operational data for
1999; additional data on helicopter accidents.
6.2 Fixed Wing Aircraft References

[10] DNV 2004. Aircraft Accident Risks, Technical Note T25
[11] Airclaim s 2003. W orld Aircraft Accident Sum m ary 1990-2002, CAP 479,
Airclaim s Ltd, London (updated annually).
[12] Boeing 2003. Statistical Summary of Commercial Jet Airplane
Accidents, W orldwide Operations, 1959-2003, Boeing Com m ercial
Airplanes Group, Seattle, W A, USA (updated annually).
[13] NATS 2000. A Methodology for Calculating Individual Risk due to
Aircraft Accidents Near Airports, P.G. Cowell et al, R&D Report 0007,
National Air Traffic Services Ltd, London.
[14] IVW 2002. Civil Aviation Safety Data 1980-2001, Inspectie Verkeer en
W aterstaat, Hoofddorp, Netherlands.
[15] Eurocontrol, 2005. ATM Contribution to Aircraft Accidents / Incidents,
Review and Analysis of Historical Data, SRC Docum ent 2, 4 th ed.
http://www.eurocontrol.int/src/gallery/content/public/documents/deliverables/srcdoc2_e40_ri_web.
pdf
©OGP 19
[16] Roelen, A.L.C., Pikaar, A.J. & Ovaa, W ., 2000. An Analysis of the
Safety Performance of Air Cargo Operators, Report NLR-TP-2000-210,
National Aerospace Laboratory.
[17] CAA, UK Airline Statistics, Table 1 13 Public Transport Air Taxi Operations:
http://www.caa.co.uk/default.aspx?categoryid=80&pagetype=88&pageid=1&sglid=1
[18] NTSB. Accident Database and Synopses, 1962-present; query using
http://ntsb.gov/ntsb/query.asp
[19] Spouge, J.R., Smith, E.J., & Lewis, K.J., 1994. Helicopters or Boards – Risk
Management Options for Transport Offshore, SPE Paper No. 27277, Conf. on Health,
Safety & Environment in Oil & Gas Production, Jakarta, Society of Petroleum
Engineers.
[20] Collings, H., 1994. Comparative Accident Rates for Passengers by Model of
Transport – A Re-Visit, in Transport Statistics Great Britain 1994, Department of
Transport, London: HMSO.
[21] Leigh, J.P., 1995. Causes of Death in the Workplace, Quorum Books, Westport
CT, USA.
6.3 Other References

[22] Koornstra, M.J., 2008. A Model for the Determination of the Safest Mode of
Passenger Transport between Locations in any Region of the World, Report for Shell
International Exploration and Production B.V.
20 ©OGP
Appendix I – Statistical Methods

I.1 Outline
Historical frequencies are estimated from experience of actual events and associated
exposure. In simple terms, the event frequency is given by:
The events may be accidents of a particular type, minor incidents with the potential to
lead to an accident, component failures or near misses. Examples are pipe leaks,
pump trips, ship collisions, lightning strikes, etc.
The associated exposure is a measure of size of the population from which the events
have been recorded. This is usually a number of items and/or a number of years. Both
the accident experience and the exposure must be comprehensive collections from
the same population.
I.2 Frequency Estimates

The observed events are used to estimate an underlying event frequency (or failure
rate), which can never be known exactly since the experience is limited. Normally the
event frequency F is calculated directly from the number of events N and the exposure
period Y as:
This is a simple and convenient estimate, but may be an under-estimate if there are
few or no failures in the observed period. A more conservative estimate, which
assumes that a further failure was about to occur when the end of the period was
reached, is:
However, this is not normally used in QRA since it appears counter-intuitive, and is a
negligible correction for large numbers of failures.
I.3 Frequency Estimates with No Failures

Where there have been no failures in the observed period, the above approach may
still be used, assuming a failure was about to occur at the end of the observed period.
A slightly less conservative (and more intuitively reasonable) estimate of the
underlying frequency is given by the 50% confidence limit on the true mean of a
Poisson distribution when no failures have been observed (also equal to the 50%
point on a chi-square distribution with 1 degree of freedom). This is:
In colloquial terms, this assumes that the system was '70% of the way to its first
failure' at the end of the observed period, or that '0.7 events' occurred in the period.
©OGP 21
It might be thought that the 95% confidence limit would be more appropriate for a
cautious best-estimate than the 50% limit. However, this would result in a frequency
equivalent to 3 events having occurred in the observed period (see below), which is
usually considered excessively conservative.
I.4 Confidence Limits on Frequency Estimates

Statistical confidence limits may be attached to the frequency estimate, which reflect
the uncertainty in estimating the underlying frequency from a small sample of events.
Techniques for calculating confidence limits are presented in [23] and [24]. For QRA, a
90% confidence range is usually adequate, extending between a lower (5%) and an
upper (95%) confidence limit, defined in terms of a chi-square distribution as follows:
These imply a 90% chance that the true frequency lies within the stated range, a 5%
chance of it being lower than the lower limit, and a 5% chance of it being above the
upper limit. The upper limit as defined above takes account of the possibility that the
next event was about to occur when the end of the period was reached.
When no failures have occurred, the confidence limits cannot be expressed as
fractions of the mean (since this is zero). However, using a consistent approach, the
90% confidence range on the number of failures is then 0.05 to 3.0, with the 50%
confidence value being 0.7 as above.
These confidence ranges only take account of uncertainty due to estimating the
frequency from a small number of random events, assuming the underlying frequency
is constant. They do not take account of numerous other sources of uncertainty, such
as incomplete event data, inappropriate measures of exposure, trends in the
frequency etc. Therefore, the total uncertainty in the frequency may be much higher
than indicated, and the confidence limits estimated above may be misleading.
I.5 References
[23] Lees, F.P., 1996. Loss Prevention in the Process Industries, 2nd. ed., Oxford:
Butterworth-Heinemann.
[24] CCPS, 1989. Chemical Process Quantitative Risk Analysis, Centre of Chemical
Process Safety, New York: American Institute of Chemical Engineers.
22 ©OGP

March 2010
Occupational
risk
P ublications
Global experience


Disclaimer
Copyright notice
England and Wales.
RADD – Occupational risk
contents
1.1 Application ...................................................................................................... 1
1.2 Definitions ....................................................................................................... 1
2.1 Fatal Accident Rates....................................................................................... 2
2.2 Causes of Fatal Accidents ............................................................................. 3
3.2 Uncertainties ................................................................................................... 5
3.3 Risk calculation for QRA................................................................................ 5
5.0 Recommended data sources for further information .............. 6
6.0 References ............................................................................ 7
6.1 References for Sections 2.0 to 4.0 ................................................................ 7
6.2 References for other data sources................................................................ 7
©OGP
Abbreviations:
CMPT Centre for Marine and Petroleum Technology
CS Continental Shelf
FSU Former Soviet Union
IRPA Individual Risk Per Annum
LTIF Lost Time Injury Frequency
OGP International Association of Oil & Gas Producers
OSHA (US) Occupational Safety and Health Administration
UK United Kingdom
©OGP

1.1 Application
This datasheet presents (Section 2.0) occupational risks in the global E&P (Exploration
& Production) industry, for both onshore and offshore facilities.
The occupational risks include transport risks, which are often analysed separately in
QRAs. Some indication is given as to how the occupational risks presented can be
adjusted to remove transport risks.
1.2 Definitions
Fatality risks are presented in terms of the FAR (Fatal Accident Rate). This is defined
as:
FAR = number of fatalities per 108 exposed hours.
• Onshore, “exposed hours” are working hours.
Onshore work [1]: All activities and occupations that take place within a land
mass, including those in swamps, rivers and lakes. Activities in bays, major inland
seas, or in other inland seas directly connected to oceans are counted as offshore
(see below).
• Offshore, “exposed hours” are sometimes defined (e.g. by OSHA) as offshore
working hours only (12 hours per day), elsewhere (e.g. Norway) as all hours spent
offshore (24 hours per day). The offshore FAR values presented in Section 2.0 are
for working hours only.
Offshore work [1]: All activities and occupations that take place at sea, including
major inland seas (e.g. Caspian Sea) and other inland seas directly connected with
oceans. Includes transportation of people and equipment from shore to the
offshore location either by vessel or helicopter.
Factors are given to modify the overall fatality risks presented for different functions:
Exploration, Drilling and Production, defined as follows in [1]:
Exploration: Geophysical, seismographic and geological operations, including
their administrative and engineering aspects, construction, maintenance, materials
supply, and transportation of personnel and equipment; excludes drilling.
Drilling: All exploration, appraisal and production drilling and workover as well as
their administrative, engineering, construction, materials supply and
transportation aspects. It includes site preparation, rigging up and down and
restoration of the drilling site upon work completion. Drilling includes ALL
exploration, appraisal and production drilling.
Production: Petroleum and natural gas producing operations, including their
administrative and engineering aspects, minor construction, repairs, maintenance
and servicing, materials supply, and transportation of personnel and equipment. It
covers all mainstream production operations including wireline. It does not cover
production drilling and workover.
©OGP 1

It is recommended, wherever possible, to use local operator specific data for
occupational risk (see Section 5.0). Where these are not available, the data presented
below can be used.
2.1 Fatal Accident Rates
Table 2.1 presents overall worldwide FAR values by work location (onshore/offshore) for
all personnel and separately for company employees and contractors. Note that these
values include fatalities due to air and land transport incidents, except where indicated.
Table 2.2 presents modification factors that can be used to factor the values in Table 2.1
for different functions: exploration, drilling, production and offshore catering/stewards
(but see also Table 2.4 for drilling FAR values). Table 2.3 gives multiplication factors for
different regions of the world that can be applied to the worldwide FAR values given in
Table 2.1 to obtain region-specific FAR values. Note that the values presented in Table
2.1 and Table 2.3 are based on data published by OGP and the data presented in Table
2.4 are based on data published by IADC: see Section 3.1 regarding their validity.
Table 2.1 Overall W orldwide FAR Values
Personnel All
Events Onshore Offshore
Locations
All* 4.44 4.71 3.56
Excl. Air
4.16 - -
All Personnel Transport†‡
Excl. Land
N/A 3.13 N/A
Transport†
Com pany
All* 2.08 2.24 1.37
Em ployees
Contractors All* 5.34 5.74 4.15
* See Section 4.0 for definition of ‘All’.
†
These values are given as often air and land transport are analysed separately in a QRA.
‡
No separate values are given for onshore and offshore as the relative contributions to each
cannot be determined from the data.
Table 2.2 Modification Factors for Specific Functions
Function Modification Factor

W orldwide North
Onshore & Sea
Offshore Offshore
Exploration 1.1 -
Drilling 1.1 1.6
Production 0.7 1.6
Offshore 0.1 0.1
Catering/Stewards
2 ©OGP
Table 2.3 Multiplication Factors for Different Regions 1 (Apply to Table 2.1
FAR Values)
Personne Locatio Africa Asia/ Europ FSU Middle North South

l n Austr- e East America America
alasia
All Onshore 1.54 0.36 0.71 1.38 0.98 0.74 0.86
Offshore 1.22 0.56 1.05 0.69 0.82 1.52 0.92
All 1.49 0.40 0.79 1.42 0.98 0.90 0.88
Company Onshore 1.19 0.29 0.75 2.14 1.19 0.41 0.64
Offshore 1.00 0.72 2.94 0.00 0.00 0.47 0.00
All 1.17 0.35 1.14 2.25 1.15 0.41 0.55
Contract Onshore 1.46 0.35 0.93 1.28 0.94 0.97 0.82
or
Offshore 1.17 0.53 0.88 0.68 0.84 1.86 1.10
All 1.42 0.39 0.81 1.32 0.95 1.17 0.88
Table 2.4 FAR Values for Personnel Engaged in Drilling Operations
Country/Region FAR values

Onshore Offshore Com bined
USA 16.10 7.30 13.17
Canada 18.68 0.00 12.19
Central / South America 5.53 5.13 5.41
Europe 3.68 2.21 2.45
Africa 7.11 6.06 6.49
Middle East 3.08 5.44 3.69
Asia Pacific 6.53 5.96 6.17
Industry Average - - 7.53
For the UK and Norway Continental Shelfs (offshore), Alberta, Canada (onshore), and
the USA (oil and gas extraction), the following FAR values are available. Note that these
exclude helicopter accidents and are based on 2000 working hours per year.
UKCS: FAR = 3.78 Norway: FAR = 0.94 Alberta: FAR = 8.26 USA: FAR = 11.42
2.2 Causes of Fatal Accidents

Figure 2.1 shows the proportions of fatal accidents due to different causes. They apply
to the FAR value in Table 2.1 for all events, all locations (i.e. onshore and offshore).
Transport fatalities account for almost 24% of the total. Figure 2.2 shows the causal
breakdown excluding transport (air and vehicle incidents) and unknown causes.
1
Note that, as these are ratios of FAR values rather than absolute values, the ‘All’ values do not
necessarily lie between the corresponding ‘Onshore’ and ‘Offshore’ values.
©OGP 3
Figure 2.1 Causes of Fatal Accidents
Figure 2.2 Causes of Fatal Accidents, excluding Transport and Unknown
4 ©OGP

The occupational risk values given in Table 2.1 and Table 2.3 can be applied to E&P
facilities worldwide or in the specific regions presented in Table 2.3. However, they are
based on data provided to OGP by OGP’s members, and may not be representative in all
geographical areas.
The occupational risk values given in Table 2.4 for personnel engaged in drilling
operations are based on data provided to IADC by IADC’s members. If drilling
operations are undertaken by a contractor that is not a member of IADC, the values in
Table 2.4 may not be applicable.
3.2 Uncertainties
The data presented in Section 2.0 are in the main based on that obtained by OGP from
its members. OGP’s reports [1] do not discuss data quality, i.e. whether the data from
each of the members and the countries where each member operates are subject to
consistent reporting criteria and verification. Discrepancies may also occur in that not
all companies report contractor hours. A further consideration is that the data do not
reflect non OGP members and so may not be representative of the industry as a whole.
The overall size of the database, as regards both working hours and fatalities, is
sufficiently large (see Section 4.0) that the statistical uncertainties associated with the
FAR values in Table 2.1 are small compared to the variations between regions and
operators. Uncertainties are dominated by local variations. Even within geographically
close countries, such as within the EU, variations can be large. Hence, as discussed in
Section 5.0, it is preferable wherever possible to use local operator specific data.
3.3 Risk calculation for QRA

In QRAs, risks are frequently calculated and presented in terms of Individual Risk Per
Annum (IRPA). FAR values therefore need to be converted to IRPA values using actual
work pattern data. For example:
• Working 2000 hours per year:
• Offshore, as personnel are exposed to risk whilst off shift and in the TR, their risks
are sometimes presented on the basis of 24 hours per day exposure whilst offshore.
In this case, the contributions from the on shift and off shift FAR values need to be
summed. The off shift FAR value for all workers can be estimated by applying the
factor given in Table 2.2 for catering/stewards to the appropriate FAR value in Table
2.1.

The principal source of the data presented in Section 2.0 is the data published by OGP
[1] for the period 2002-6. During this period, the worldwide FAR has been roughly
constant, and significantly lower than in the 1990s. It is therefore believed that it is
reasonably representative of current occupational risks. The data for the individual
years (both exposure and fatalities) have been summed over the 5-year period to
calculate the FAR values given in Section 2.1.
©OGP 5
The database from which the OGP reports [1] are drawn contains records of incidents
resulting in 532 fatalities over 12 × 109 working hours during that period. Fatalities due
to all causes are included, including vehicle incidents and air transport as well as being
struck, explosion/burn, electrical, drowning, falls, and ‘caught between’.
Fatality rate data are available going back to 1997, facilitating trend analysis. In the
most recent report, the data have been contributed by 41 companies representing
activities in 84 countries. Data quality is not discussed in the OGP reports and hence
judgment as to its completeness cannot be presented here. However, from a review of
other potential sources and bearing in mind that activities of OGP members extend
worldwide, this is believed to be the most comprehensive source.
To determine the modification factors by function for the North Sea (Table 2.2), more
local sources [2],[3],[4] were compared and approximate averages taken. The same
value for offshore catering/stewards is also suggested for Worldwide use; the other
factors in Modification Factors for Specific Functions come from the OGP data.
The United Kingdom and Norway Continental Shelf FAR values are given in [5]. They
are for the period 2001 to the first half of 2007. The Alberta FAR can be calculated from
data given in [6]. The USA oil and gas extraction FAR was calculated from data given in
[7]: these data give fatalities per 100,000 employees and it is necessary to make an
assumption about annual working hours per employee: for consistency with the OGP
data, 2000 hours were assumed.

Lost time injury frequencies (LTIFs) for specific countries are given in the OGP reports
[1], however there is no breakdown by company/contractor, onshore/offshore or
function. It might be thought that the FAR/LTIF ratio could be used as a surrogate either
to obtain country specific FAR values or to obtain a more detailed breakdown of LTIF
values. However, a review of the data shows a wide variation in that ratio such that this
would be an unreliable approach.
Country specific data are available from some statutory authorities (see Section 6.2 for
references and URLs):
• UK
• Norway
• Denmark
• Netherlands
• USA
• Canada
As most operators maintain incident databases (data from which have been gathered
into the OGP database [1]), it may be preferable to use operator specific data. However,
if these have not been analysed in a form suitable for QRA, the values presented in
Section 2.0 can be used. In any case, these should be used as to validate any operator
specific risks calculated.
6 ©OGP
6.0 References
[1] OGP, 2007. Safety performance indicators – 2006 data, Report No. 391. Also corres-
ponding reports for 2001-2005 data. http://www.ogp.org.uk/Publications/index.asp.
[2] Spouge et al., 1999. A Guide to Quantitative Risk Assessment for Offshore Installations,
App. XIV, ISBN 1 870553 365, Publication 99/100, Centre for Marine and Petroleum
Technology (CMPT). Now available from the Energy Institute:
http://www.energyinst.org.uk/index.cfm?PageID=5.
[3] DNV, 2000. Occupational Risks for Workers on Offshore Installations, Revision 0, report
for BP Amoco, DNV Order No. 30400100.
[4] BP, 2003. Occupational Risk for Offshore Workers, Rev 0, BP Report No. D/UTG/051/03.
[5] Petroleum Safety Authority Norway, 2008. Risk Levels in the petroleum industry –
Summary Report Norwegian Continental Shelf 2007, Ptil-08-03:
http://www.ptil.no/getfile.php/PDF/Summary_rep_2008.pdf.
[6] Alberta Employment, Immigration and Industry, 2007. Lost-Time Claims, Disabling
Injury Claims and Claim Rates, Upstream Oil and Gas Industries 2002 to 2006.
http://employment.alberta.ca/documents/WHS/WHS-PUB_oid_2006_oil_and_gas.pdf
[7] Bureau of Labor Statistics, 2007. Census of Fatal Occupational Injuries (CFOI):
http://www.bls.gov/iif/oshwc/cfoi/CFOI_Rates_2006.pdf. Previous years’ reports can
be found at: http://www.bls.gov/iif/oshcfoil.htm.

UK
http://www.hse.gov.uk/offshore/statistics/hsr0607.pdf (2006/7; earlier years also
available)
Norway
[5] above: follow link to The Trends in Risk Levels report 2006; summary report in
English; the full report is only in Norwegian, available via the following link:
http://www.ptil.no/nyheter/risikonivaaet-2007-god-utvikling-men-flere-alvorlige-hendelser-article4466-24.html
Denm ark
http://www.ens.dk/graphics/Publikationer/Olie_Gas_UK/Oil_and_Gas_Production_in_De
nmark_2006/html/chapter05.htm
Netherlands
http://www.sodm.nl/data/jvs/jvs2006_eng.pdf: see Appendix F.
USA
http://www.mms.gov/incidents/IncidentStatisticsSummaries.htm#2006-2010:
presentation of
inform-ation lacks exposure data. Also available to purchase: API - Survey on
Petroleum Industry Occupational Injury and Illness Report:
http://www.api.org/ehs/health/measuring/index.cfm
©OGP 7

March 2010
Structural
risk for
offshore
installations
RADD – Structural risk for offshore installations
contents
1.1 Application ...................................................................................................... 1
2.1 Worldwide (including UKCS) Structural Failure Frequencies .................... 2
2.1.1 All Unit Types ............................................................................................................. 2
2.1.2 Fixed Units .................................................................................................................. 2
2.1.3 Non Fixed Units .......................................................................................................... 3
2.2 UKCS Structural Failure Frequencies........................................................... 3
2.2.1 Fixed Units .................................................................................................................. 3
2.2.2 Non Fixed Units .......................................................................................................... 3
2.3 Worldwide Mooring / Anchor Failure Frequencies ...................................... 3
2.4 UKCS Mooring / Anchor Failure Frequencies .............................................. 3
3.2 Uncertainties ................................................................................................... 4
4.1 Worldwide........................................................................................................ 6
4.1.1 Likelihood of Severe and Total Loss Situations ..................................................... 7
4.1.2 Likelihood of Mooring / Anchor Failure ................................................................. 10
4.2 UK Continental Shelf .................................................................................... 10
4.2.1 Likelihood of Severe and Total Loss Situations ................................................... 12
4.2.2 Likelihood of Mooring / Anchor Failure ................................................................. 13
4.3 Comparison of Worldwide and UKCS Frequencies................................... 13
4.3.1 Structural Failures.................................................................................................... 13
4.3.2 Mooring / Anchor Failures....................................................................................... 14
6.0 References .......................................................................... 14
©OGP
Abbreviations:
FPSO Floating Production, Storage and Offloading
FSU Floating Storage Unit
GoM Gulf of Mexico
HSE UK Health & Safety Executive
MODU Mobile Offshore Drilling Unit
MOPU Mobile Offshore Production Unit
NPD Norwegian Petroleum Directorate
NS North Sea
OSHA Occupational Safety & Health Administration
TLP Tension Leg Platform
WOAD Worldwide Offshore Accident Databank
WWx Worldwide excluding US GoM and NS
©OGP

1.1 Application
This datasheet presents information on structural events statistics for use in
Quantitative Risk Assessment (QRA). The datasheet includes guidelines for the use of
the recommended data and a review of the sources of the data.
The data are applicable to offshore installations only.
The following damage categorisation as extracted from the Worldwide Offshore
Accident Databank (WOAD [1]) is used, as applied to all accident types:
• Total Loss: Total loss of the unit including constructive total loss from an
insurance point of view, however the unit may be repaired and put into operation
again.
• Severe Dam age: Severe damage to one of more modules of the unit; large
/medium damage to loadbearing structures; major damage to essential equipment.
• Significant Dam age: Significant/serious damage to module and local area of the
unit; minor damage to loadbearing structures; significant damage to single essential
equipment; damage to more essential equipment.
• Minor Dam age: Minor damage to single essential equipment; damage to more non-
essential equipment; damage to non-loadbearing structures.
• Insignificant Dam age: Insignificant or no damage: damage to part(s) of essential
equipment; damage to towline, thrusters, generators and drives.
The datasheet addresses all forms of structural failure but specifically concentrates on
Total Loss and Severe Damage Category events. It also addresses mooring line failures
for mobile units on location. Towing failures for mobile units are addressed in the
Fabrication, Construction & Installation Risks datasheet.
Total Loss structural failure events are when an installation loses its ability to support
its topside as a result of operational and environmental loading. Possible causes
include:
• Extreme weather
• Marine corrosion
• Fatigue
• Foundation failure
• Construction defects
• Design errors
• Earthquakes
In reviewing events classed as Severe Damage within WOAD, the detailed records have
been reviewed and the following additional criteria have been added as some records
classed as a severe accident within WOAD would not necessarily constitute severe
structural failure:
• Shipyard or dockside repair of mobile installation required
• Production or operation shutdown for more than a week
• Precautionary evacuation required or restrictions placed on manning
©OGP 1
There are cases where an event was initially classified as structural failure; however,
following a thorough review of their description some were deemed as irrelevant and
hence not counted in the statistics. Events categorised as insignificant were also
discounted.
The data exclude topsides structural failure events arising from escalating events such
as fires and explosions.
The frequency data exclude structural failures that have arisen as a result of other
primary events such as ship collisions, loss of mooring systems, loss of towing
facilities as these are typically analysed as separate events within an offshore QRA.
The frequency data is associated with structural failures which arise when installations
are manned to support personal risk estimation within QRAs. This excludes structural
failures of installations in hurricane conditions when the installations have been
demanned.

Structural failure frequencies for Severe Damage and Total Loss are presented
worldwide (Section 2.1) and for the UKCS (Section 2.2). As there have been relatively
few structural failures resulting in Severe Damage / Total Loss, there are insufficient
data to permit other regional analysis such as GoM data.
Mooring/Anchor failure frequencies are likewise presented worldwide (Section 2.3) and
for the UKCS (Section 2.4). The same considerations regarding other regional analysis
as for structural failure frequencies apply.
2.1 Worldwide (including UKCS) Structural Failure Frequencies

2.1.1 All Unit Types
Frequency of all Severe structural failure (excl. towing) 4.55 × 10-5 per
year
Frequency of Severe structural failure caused by weather (excl. towing) 3.25 × 10-5 per
year
Frequency of Total Loss (excl. towing) 4.55 × 10-5 per year
Frequency of Total Loss caused by weather (excl. towing) 1.30 × 10-5 per
year
2.1.2 Fixed Units

year
Frequency of Severe structural failure caused by weather (excl. towing) 0 per year
Frequency of Total Loss (excl. towing) 0 per year
Frequency of Total Loss caused by weather (excl. towing) 0 per year
2 ©OGP
2.1.3 Non Fixed Units

year
year
year
2.2 UKCS Structural Failure Frequencies
2.2.1 Fixed Units
Severe structural damage frequency 1.09 × 10-3 per year
Severe structural damage frequency (weather related) 3.63 × 10-4 per year
2.2.2 Non Fixed Units

Severe structural damage frequency 1.09 × 10-2 per year
Severe structural damage frequency (weather related) 3.28 × 10-3 per year
No Total Loss frequency data is generated for the UK, but reference to the Worldwide
frequency data can be made, as detailed in Section 2.1.
2.3 Worldwide Mooring / Anchor Failure Frequencies

Frequency of failure of mooring or anchor whilst in operation (drilling/production):-
5.78 × 10-3 per year
76% of the recorded incidents appear from the data to have been weather related.
Outside the UKCS, however, only 64% appear to have been weather related.
Additional probabilities are given in Table 2.1.
Table 2.1 Probabilities for W orldwide Mooring Failures
Damage levels Insignificant Minor Significant Severe Total Loss

0.29 0.64 0.27 0 0
Single/multiple Single Multiple
line failures 0.70 0.30
2.4 UKCS Mooring / Anchor Failure Frequencies

Frequency of failure of mooring or anchor whilst in operation (drilling/production):-
1.04 × 10-2 per year
All but one of the 18 recorded incidents in the UKCS appear from the data to have been
weather related.
©OGP 3
Additional probabilities are given in Table 2.2.
Table 2.2 Probabilities for UKCS Mooring Failures

0.17 0.50 0.33 0 0
line failures 0.60 0.40

The structural failure frequency values given in Sections 2.1 and 2.2 are applicable to
the offshore oil and gas industry worldwide and specifically on the UKCS.
However, it is recommended that data to be used on particular studies is localised to the
country where the unit will be deployed as there are variations and trends on the
frequencies calculated. For example, in exposure data for submersible drilling units, the
US GoM dominates as there are 427 unit years for this category out of 532 unit years
worldwide. The same applies to semisubmersible production units since the majority of
these are located in Central & South America.
3.2 Uncertainties
In some cases the exposure data available makes no distinction between unit categories
e.g. in [2], for Monohull units there is no distinction between FPSO and FSU. The same
situation occurs for WOAD exposure data for fixed units. [2] provides a summary of
exposure data used to calculate worldwide structural failure accident frequencies.
Hence, by making no distinction in the exposure data the calculated frequency might be
overestimated or underestimated for FSPO, FSU and Fixed units within WOAD [1].
4 ©OGP
Table 3.1 Floating and Fixed Units Exposure Data
MODUs MOPUs Monohull Fixed Units
Accommodation
Drilling Platform
Semisubmersibl
Semisubmersibl
Submersibles
Drill Barges
Tension-leg
Production
Drill Ships
Platform
Platform
Jackup
Jackup
FPSO
FSU
e
e
Unit Unit Unit Unit Unit Unit Unit Unit Unit Unit Unit Unit Unit
Years Years Years Years Years Years Years Years Years Years Years Years Years
UKCS Exposure
586.5 938 8.6 N/A N/A 17.8 92.2 17.8 123.3 46.7 455 2107 194
data 1980-2005
WOAD Exp. data
1058 1516 26 0 0 12.3 102 36 94.6 7074
NS 1980-2002
WOAD Exp. data
4136 941 160 427 25 2 0 52.3 0 85480
GoM 1980-2002
WOAD Exp. data
10743 4305 1217 532 966 88.5 362.7 88.3 445 135122
WW 1980-2002
WOAD Exp. data
5549 1848 1031 105 941 74.2 260.7 0 350.4 42568
WWx 1980-2002
©OGP 5

The principal source of the data presented in Section 2 is the data published in WOAD
[1] for the period 1980-2002 and the HSE [3],[4] for 1980-2005. Databases available
worldwide were thoroughly reviewed and interrogated appropriately in producing these
documents. It is therefore believed that they are reasonably complete in recording
accidents and incidents worldwide and on the UKCS for offshore units.
4.1 Worldwide
For this section statistics are presented in four groups: North Sea1, Gulf of Mexico2
(GoM), Worldwide data and Worldwide excluding North Sea and GoM (WWx). These
statistics are based on the numbers of incidents evident within WOAD [1] and the
exposure data (number of unit years) [2]. Accident data used cover the time period from
1980 to 2002 as this is the basis of the exposure data.
A visual categorisation of these units and their purpose is presented in Figure 4.1. This
figure includes submersibles and drill barges. WOAD [1] contains records that
distinguish semi-submersibles from submersibles; the associated exposure data have
this distinction also, hence these two types of units are considered separately. Non
fixed accommodation units are discounted as there is no exposure information available
for this kind of unit.
Figure 4.1 Categorisation of W orldwide Offshore Units
The worldwide recommended statistics consider the first chain of events and discount
those cases deemed as not significant or irrelevant to the data sheet.
1
North Sea states comprise the United Kingdom, Denmark, Norway, Germany and the
Netherlands.
2
Gulf of Mexico refers to the United States of America side only.
6 ©OGP
Table 4.1 presents the data for all structural failures: the numbers of relevant cases (N)
that occurred during the time period 1980-2002 and the corresponding associated
frequencies (F) for selected worldwide geographies. In this datasheet frequency is
defined as the number of cases divided by the number of unit years for each type of
unit.
Table 4.1 W orldwide – All Structural Failures (per unit year)
Worldwide Data Geographical Area

North Sea US GoM World WW excl.
Wide GoM,
(WW) North Sea
Non MODUs Jackup N 6 10 59 43
Fixed F 5.67 × 10
-3
2.42 × 10
-3
5.49 × 10
-3
7.75 × 10
-3
Offshore Semisubmersible N 3 3 7 1
Units F -3 -3 -3 -4
1.98 × 10 3.19 × 10 1.63 × 10 5.41 × 10
Drill Ships N 0 1 7 6
F 0 6.25 × 10
-3
5.75 × 10
-3
5.82 × 10
-3
MOPUs Jackup N 0 0 2 2
F 0 0 2.26 × 10
-2
2.70 × 10
-2
Semisubmersible N 4 0 4 0
F 3.92 × 10
-2
0 1.10 × 10
-2
0
Tension-leg N 0 0 0 0
Platform F 0 0 0 0
Monohull FPSO N 0 0 1 1
F 0 0 2.25 × 10
-3
2.85 × 10
-3
FSU N 0 0 0 0
F 0 0 0 0
Fixed Drilling Platform N 7 7 15 1
Offshore F 9.90 × 10
-4
8.19 × 10
-5
1.11 × 10
-4
2.35 × 10
-5
Units Production Platform N 2 29 34 3

F 2.83 × 10
-4
3.39 × 10
-4
2.52 × 10
-4
7.05 × 10
-5
Accommodation N 0 2 2 0
F 0 2.34 × 10
-5
1.48 × 10
-5
0
4.1.1 Likelihood of Severe and Total Loss Situations

The frequencies given in Table 4.1 indicate the frequency of all types of structural
failures which includes minor, significant, severe and total loss situations. Minor and
significant structural failures are unlikely to pose significant risks to individuals on the
units and their inclusion within personnel risk calculations is not normally undertaken
within a QRA. The associated data also features many US GoM hurricane events where
there had been timely warnings and the units had been totally evacuated before
structural failures occurred. Again inclusion of these data as part of QRA personnel risk
calculations is not normally undertaken. A significant proportion of structural events
featured in the data stem from the loss of towing mobile units in severe weather which
then has resulted in structural failures. The fatality rates for towing events are typically
©OGP 7
considered as a separate accident category within a QRA and it is inappropriate to

double count their contribution within structural failure risks. The WOAD data have
therefore been reviewed in detail to determine the number of events which genuinely
contribute to severe and total loss situations where occupants have been at risk. The
following data are derived for worldwide activity for all unit types, and can be used to
derive worldwide average frequencies as set out below:
Number of Severe structural failures 16

Number of Severe structural failures associated with weather
8
Number of Severe structural failures (excl. towing)
7
Number of severe structural failures (excl. towing) associated with weather
5
Number of Total Loss (excluding hurricanes) structural failures

13
Number of Total Loss structural failures associated with weather
10
Number of Total Loss structural failures (excl. towing) 7
Number of Total Loss structural failures (excl. towing) associated with weather
2
Applying the above data to the unit years the following frequencies are derived based
on the worldwide exposure time of 153870 unit years:
year
year
year
The above frequencies are based on the total number of unit years for all types of unit.
Splitting these by fixed and non fixed units the following results are obtained, noting
that for Total Loss failures none have been attributed to fixed units
W orldwide Fixed Units

year
8 ©OGP
Frequency of Severe structural failure caused by weather (excl. towing) 0 per year
Frequency of Total Loss (excl. towing) 0 per year
Frequency of Total Loss caused by weather (excl. towing) 0 per year
W orldwide Non Fixed Units

year
year
year
The data have not been further broken down and analysed by unit type and
geographical location. Further detailed analysis would however indicate that the risks of
structural failure are higher for Jackups and lower for all other types of unit, although
the statistical uncertainties begin to increase on further breakdown on the analysis.
For very approximate guidance on the frequencies attributable to unit types and
regions, data in Table 4.1 can be used. For example: a total of 229 structural events of
all types worldwide is evident of which 13 are associated with Total Loss, giving a
worldwide probability of Total Loss of approximately 0.06. If this is then applied to
Jackups in the GoM when the frequency of all structural failures is approximately 0.01
per unit year, the frequency of Total Loss can be estimated as 5.68 × 10-4 per unit year
(when numerical rounding is removed).
No fatalities have arisen from worldwide severe structural failures (excluding towing)
and 145 fatalities have arisen from all worldwide total losses resulting from structural
failure (excluding towing) in the period stemming from 2 events only, but on average 21
persons for each Total Loss event.
Table 4.2 summarises the documented Total Loss Structural failure accidents.
Table 4.2 Fatal Structural Failure Accidents (reproduced from W OAD [1])
Date Event Description Fatalities

During the typhoon "Fred", 100-125 knots wind and
15th August 22
18 m waves, the barge involved in pipelaying work sank
1991
105 km NE of Hong Kong. 191 people onboard were
tossed into the sea and 4 divers in a diving bell beneath
the barge went down with the barge. The barge…
16th March 1980 Due to bad weather, the ALK (Alexander Keilland) was 123
shifted away from Edda and (the) gangway (was)
hoisted onboard ALK Time 1750. 40 mins later bracing
to leg D broke and shortly after lost leg. ALK rapidly
listed 30/35 deg. After 20 mins the platform turned
upside down.
©OGP 9
4.1.2 Likelihood of Mooring / Anchor Failure

Table 4.3 presents mooring and anchor failures worldwide during the period 1980-2002,
taken from WOAD [1]. All have occurred on semisubmersible drilling units; 18 out of 28
appear from the WOAD data to have been weather related.
The corresponding exposure is 4305 unit years for MODUs and 363 unit years for
MOPUs, taken from [2]. These have been combined to give a frequency of
mooring/anchor failure for semisubmersible units of 5.78 × 10-3 per year.
The incidents have been broken down by damage category and single/multiple line
failure as set out in Table 4.4, yielding the probabilities given in Table 2.1.
Table 4.3 Mooring / Anchor Failures W orldwide, 1980 – 2002 (from W OAD
[1])
Operation No. of Incidents

Development Drilling 9
Exploration drilling 12
Well workover 2
Other 5
TOTAL 28
Table 4.4 Breakdown of W orldwide Mooring Failure Statistics (Num bers of

Incidents)

13 20 12 0 0
line failures 23 10 (not specified: 12)
Note that these data do not include two further incidents of mooring line failure in the
Gulf of Mexico in 2005 as a result of Hurricanes Katrina and Rita respectively. Damage
levels are not available for these incidents.
4.2 UK Continental Shelf

For UK facilities, two different sources of information related to the United Kingdom
Continental Shelf (UKCS) were used to examine the data as follows:
• Accident statistics for fixed offshore units on the UK Continental Shelf 1980-2005, HSE [3]
• Accident statistics for floating offshore units on the UK Continental Shelf 1980-2005, HSE
[4]
The main objective of these two references was to obtain complete statistics for
accidents and incidents that occurred on floating and fixed units in the oil and gas
activities on the UKCS in the period 1980-2005.
10 ©OGP
These reports were produced using different databases for interrogation with respect to
both population and accident data. Such databases were:
• ORION (the former Sun Safety System): HSE (www.hse.gov.uk) Offshore Safety
Division
• MAIB accident database: UK Marine Accidents Investigation Bureau
(www.maib.gov.uk)
• Offshore Blowout Database BLOWOUT: SINTEF, Norway (www.sintef.no)
• Worldwide Offshore Accident Databank (WOAD) [1]: DNV Norway
Offshore units for the UKCS are defined as comprising Jackups, Semi-Submersibles,
Drill Ships, Tension-Leg Platforms (TLP), Floating Production, Storage and Offloading
(FPSO), Floating Storage Units (FSU), and Platforms. A visual categorisation of the
classification of these units is presented in Figure 4.2.
Figure 4.2 Categorisation of UKCS Offshore Units
It is important to note that the classification of events reviewed was made according to
the WOAD concept where one accident may comprise a chain of consecutive events.
This means that a single accident or incident may give rise to several outcomes.
However, for this report only the first event of the chain was considered.
Table 4.5 presents the data for all structural failures: the numbers of relevant cases (N)
that occurred during the time period 1980-2005 and the corresponding associated
frequencies (F) for the UK Continental Shelf. In this datasheet frequency is defined as
the number of cases divided by the number of unit years for each type of installation.
No statistics are presented for non fixed accommodation units as there are no available
data specific for units built solely for this purpose.
©OGP 11
Table 4.5 UKCS – All Structural Failures Frequencies (per unit year)
UKCS Data Geographical

Area
UK Continental
Shelf
Non MODUs Jackup N 21
Fixed F 3.58 × 10
-2
Offshore N 25
Units Semisubmersible
F 2.67 × 10
-2
N 0
Drill Ships
F 0
MOPUs Jackup N 0
F 0
Semisubmersible N 3
F 3.25 × 10
-2
Tension-leg N 1
Platform F 5.62 × 10
-2
Monohull FPSO N 3
F 2.43 × 10
-2
FSU N 2
F 4.28 × 10
-2
Fixed Drilling Platform N 12

Offshore F 2.64 × 10
-2
Units Production Platform N 3

F 1.42 × 10
-3
Accommodation N 1
F 5.15 × 10
-3
4.2.1 Likelihood of Severe and Total Loss Situations

The frequencies given in Table 4.5 indicate the frequency of all types of structural
failures which includes minor, significant, severe and total loss situations. Minor and
significant structural failures are unlikely to pose significant risks to individuals on the
facilities and their inclusion within personnel risk calculations is not normally
undertaken within a QRA.
A detailed review of the incident records shows no Total Loss structural failure events
for UK Fixed or Floating facilities in the period. For UK Floating facilities a total of 20
severe structural failure scenarios have been identified of which 6 have been clearly
associated with adverse weather. For UK Fixed units 3 severe structural failure
scenarios have been identified of which only 1 is clearly associated with adverse
weather. The following failure frequencies have been derived:
UK Fixed Units
Severe structural damage frequency = 3/2756 = 1.09 × 10-3 per year
Severe structural damage frequency (weather related) = 1/2756 = 3.63 × 10-4 per year
12 ©OGP
UK Non Fixed Units

Severe structural damage frequency = 20/1831 = 1.09 × 10-2 per year
Severe structural damage frequency (weather related) = 6/1831 = 3.28 × 10-3 per year
No fatalities have arisen from UK fixed unit severe structural failures and 3 fatalities
have arisen from UK non fixed unit severe structural failures.
No Total Loss frequency data have been generated for the UK, but reference to the
Worldwide frequency data can be made, as detailed in section 4.1.1.
4.2.2 Likelihood of Mooring / Anchor Failure

Table 4.6 presents mooring and anchor failures worldwide during the period 1980-2005
taken from [4]. All have occurred on semisubmersible drilling units; all but one appear
from the data to have been weather related.
The corresponding exposure is 4305 unit years for MODUs and 363 unit years for
MOPUs, also taken from [4]. These have been combined to give a frequency of
mooring/anchor failure for semisubmersible units of 5.78 × 10-3 per year.
The incidents have been broken down by damage category and single/multiple line
failure as set out in Table 4.7, yielding the probabilities given in Table 2.2.
Table 4.6 Mooring / Anchor Failures in UKCS, 1980 – 2002 (from W OAD [1])
Operation No. of Incidents

Development Drilling 8
Exploration drilling 8
Other 2
TOTAL 18
Table 4.7 Breakdown of UKCS Mooring Failure Statistics (Num bers of

Incidents)

3 9 6 0 0
line failures 9 6 (not specified: 3)
4.3 Comparison of Worldwide and UKCS Frequencies

4.3.1 Structural Failures
There have been no Total Loss events within the UKCS, so reference has to be made to
the worldwide data or adopt more detailed predictive theoretical methods to determine
the associated Total Loss frequency.
©OGP 13
For severe damage events, UKCS frequencies are significantly higher than worldwide
average values. This difference is believed to arise from the harsher water environment
of the UKCS compared with the average worldwide offshore environment (removing
hurricane influences), and with the possibly higher reporting standards within the UKCS
compared with worldwide average reporting systems.
4.3.2 Mooring / Anchor Failures

The frequency of mooring/anchor failure on the UKCS is almost double the worldwide
average. Given that all but one of these incidents appear to have been weather related,
compared with 64% worldwide (outside the UKCS), the harsher water environment of the
UKCS and the possibly higher reporting standards within the UKCS would account for
this as it does for structural failures (see Section 4.3.1).

Country-specific accidents and incidents data bases may be interrogated depending on
the area that the installation will be deployed. As a starting point WOAD [1] is a reliable
source of information that can be interrogated in a variety of ways. There are more
sources of data including, but not limited to, the HSE in the United Kingdom, the
Occupational Safety & Health Administration (OSHA) in the United States of America,
and the Norwegian Petroleum Directorate.
6.0 References
[1] DNV. WOAD - Worldwide Offshore Accident Databank, v5.0.1.
[2] DNV, 2004. Exposure Data for Offshore Installations 1980-2002, Technical Note 22, DNV
internal documentation.
[3] DNV, 2007a. Accident statistics for fixed offshore units on the UK Continental Shelf 1980-
2005, HSE Research Report RR566, Sudbury, Suffolk: HSE Books.
[4] DNV, 2007b. Accident statistics for floating offshore units on the UK Continental Shelf
1980-2005, HSE Research Report RR567, Sudbury, Suffolk: HSE Books.
14 ©OGP
Report No. 434 – 14.1

March 2010
Vulnerability
of humans
P ublications
Global experience


Disclaimer
Copyright notice
England and Wales.
RADD – Vulnerability of humans
contents
1.1 Application ...................................................................................................... 1
1.2 Definitions ....................................................................................................... 1
2.1 Fire ................................................................................................................... 2
2.1.1 Engulfment by fire...................................................................................................... 3
2.1.2 Thermal radiation ....................................................................................................... 3
2.1.3 People inside buildings ............................................................................................. 5
2.2 Explosion......................................................................................................... 7
2.3 Toxic gases ................................................................................................... 10
2.3.1 General ...................................................................................................................... 10
2.3.2 Hydrogen Sulphide .................................................................................................. 11
2.4 Smoke ............................................................................................................ 13
2.4.1 Smoke Inhalation...................................................................................................... 13
2.4.2 Smoke Obscuration ................................................................................................. 16
2.5 Vulnerability inside a Temporary Refuge ................................................... 16
2.5.1 Smoke ingress.......................................................................................................... 16
2.5.2 Heat build-up ............................................................................................................ 18
2.5.3 Ingress of unignited hydrocarbon gas................................................................... 18
2.5.4 Structural collapse ................................................................................................... 18
2.6 Cold Water ..................................................................................................... 18
3.2 Uncertainties ................................................................................................. 19
6.0 References .......................................................................... 19
Appendix I – Relationship between Lethality and Probit ................. 21
©OGP
Abbreviations:
BR Breathing Rate
CIA Chemical Industries Association
CO Carbon Monoxide
CO2 Carbon Dioxide
COHb Carboxyhaemoglobin
CSTR Continuous Stirred Tank Reactor
DTL Dangerous Toxic Load
ERPG Emergency Response Planning Guideline
IDLH Immediate Danger to Life or Health
LCx Lethal concentration resulting in x% fatalities
LDx Lethal dose resulting in x% fatalities
LFL Lower Flammable Limit
O2 Oxygen
SFPE Society of Fire Protection Engineers
SLOD Significant Likelihood of Death
SLOT Specified Level of Toxicity
tdu Thermal Dose Units
TNO Nederlandse Organisatie voor Toegepast Natuurwetenschappelijk
Onderzoek
(Netherlands Organization for Applied Scientific Research)
TR Temporary Refuge
VROM (Dutch) Ministerie van Volkshuisvesting, Ruimtelijke Ordening en
Milieubeheer
©OGP

1.1 Application
This datasheet provides information on the vulnerability of humans to the
consequences of major hazard events at onshore and offshore installations, primarily
those producing and/or processing hydrocarbon fluids. The focus is on fatality criteria
as QRAs generally address fatality risks, however injury thresholds are also identified
where appropriate. Information is presented relating both to people who are out of
doors and people within buildings. The following consequences are considered:
• Fire
• Explosion
• Toxic gases
• Smoke
Information on vulnerability within a Temporary Refuge and vulnerability following entry
to water (e.g. during evacuation/escape from an offshore installation) is also presented.
For onshore installations, the information presented applies both to personnel working
within the installation and to third parties outside the installation boundary fence. It can
therefore be used for QRAs addressing onsite and offsite risks.
The focus of this datasheet is vulnerability to the consequences described in the
Consequence Modelling datasheet. Vulnerability to other potentially fatal events such as
dropped loads and vehicle impacts are not addressed here; information on these can be
found in other datasheets.
1.2 Definitions
• Fatality is used to refer to qualitative effect
• Lethality refers to the quantitative effect, namely the fraction/percentage of the
exposed population who would suffer fatality on exposure to a given consequence
level.
• Radiation is here always used to refer to thermal radiation. The effects of ionising
radiation are not considered in this datasheet.
• Probit: a function that relates lethality to the intensity or concentration of a
hazardous effect and the duration of exposure. It typically takes the form:
Pr = a + b ℓn V
where: Pr = probit
a, b are constants
V = “dose”, typically:
For toxic materials:
V = (cnt) where c = concentration, n = constant, t = exposure duration
For thermal radiation:
V = (I4/3t) where I = thermal radiation, t = exposure duration
Lethality is related to probit as shown in Appendix I.
©OGP 1

The data presented in this section are set out as follows:
• Fire (engulfment, thermal radiation, and exposure of buildings): Section 2.1
• Explosion (effects of overpressure): Section 2.2
• Toxic gases (excluding smoke): Section 2.3
• Smoke: Section 2.4
• Vulnerability inside a Temporary Refuge (including smoke and unignited gas):
Section 2.5
• Cold water immersion: Section 2.6
2.1 Fire
Depending on the duration, intensity and area of exposure, the effects of fire range from
pain, through 1st, 2nd and 3rd degree burns, to fatality. 2nd degree burns may result in
fatality in a small number of cases (1% lethality for average clothing); 3rd degree burns
are likely to result in fatality (50% lethality for average clothing).
As identified in the Consequence Modelling datasheet, several different types of fire are
potentially of concern depending on the release material and scenario:
• Flash fire • Pool fire
• Jet fire • Fireball/BLEVE
Humans are vulnerable to fire in the following ways:
• Engulfment by the fire
• Thermal radiation from the fire (outside the fire)
• Inside a building that is exposed to fire/radiation
The relationship between fire type and potential vulnerability can be illustrated thus as
shown in Table 2.1.
Table 2.1 Relationships between Fire Types and Potential Vulnerabilities
Fire type Potential Vulnerability

Engulfm ent Radiation Inside
Building
Flash fire   possibly
Jet fire   
Pool fire   
Fireball/BLEVE   possibly
2 ©OGP
2.1.1 Engulfment by fire

A person momentarily and only partially exposed directly to fire is most likely to suffer
pain and non-fatal burns.
A person fully or substantially engulfed by fire can be considered to suffer fatality.
For the purposes of QRA, the following lethality levels are recommended:
• 100% lethality for people outdoors engulfed by a jet fire, pool fire or
fireball
• 100% lethality for m em bers of the public outdoors engulfed by a flash
fire
• 50% to 100% lethality, depending on ease of escape, for workers
wearing fire resistant clothing m ade from fabrics m eeting the
requirem ents of NFPA 2112 [11] or equivalent
People indoors are considered separately in Section 2.1.3
2.1.2 Thermal radiation

The effects of thermal radiation depend strongly on the thermal radiation flux, the
duration of exposure, the type of clothing worn, the ease of sheltering, and the
individual exposed. Hence the information provided below provides guidance on the
range of effects rather than exact relationships between thermal radiation and effects
valid in all circumstances.
Table 2.2 summarises thermal radiation exposure effects over a range of radiation
fluxes. Table 2.3 sets out thermal radiation criteria applicable to longer fire durations,
i.e. to jet fires and pool fires, for which the exposure duration is more dependent on the
ability to esc ape than on the fire duration. Figure 2.1 shows exposure times to the pain
threshold and 2nd degree burns for different thermal radiation levels. ANSI/API Standard
521 [3] sets out permissible design levels for thermal radiation exposure to flares.
Table 2.2 Therm al Radiation Exposure Effects [1]
Thermal Effect
Radiation
2
(kW/m )
1.2 Received from the sun at noon in summer
2 Minimum to cause pain after 1 minute
Less than 5 Will cause pain in 15 to 20 seconds and injury after 30 seconds’
exposure
Greater than 6 Pain within approximately 10 seconds; rapid escape only is possible
12.5 • Significant chance of fatality for medium duration exposure.
• Thin steel with insulation on the side away from the fire may reach
thermal stress level high enough to cause structural failure.
• Wood ignites after prolonged exposure.
25 • Likely fatality for extended exposure.
• Spontaneous ignition of wood after long exposure.
• Unprotected steel will reach thermal stress temperatures that can
cause failure.
35 • Significant chance of fatality for people exposed instantaneously.
• Cellulosic material will pilot ignite within one minute’s exposure.
©OGP 3
Table 2.3 Therm al Radiation Criteria (use for jet/pool fires)
Therm al Effect
Radiation
(kW /m 2 )
35 Immediate fatality (100% lethality)
20 Incapacitation, leading to fatality unless
rescue is effected quickly
12.5 Extreme pain within 20 s; movement to
shelter is instinctive; fatality if escape is
not possible.
Outdoors/offshore: 70% lethality
Indoors onshore: 30% lethality*
6 Impairment of escape routes
4 Impairment of TEMPSC embarkation areas
* People indoors are only vulnerable if they have line-of-sight exposure to
thermal radiation, hence a lower lethality than for people outdoors.
Figure 2.1 Tim es to Pain Threshold and 2 nd Degree Burns [2]
4 ©OGP
For short exposures (up to a few tens of seconds, typical of fireballs), therm al
radiation dose units (tdu) should be used:
Dose (tdu) = (I4/3)t
where: I = incident thermal flux (kW/m2)
t = duration of exposure (s)
Thermal dose units thus have the units (kW/m2)4/3s.
Table 2.4 sets out thermal dose criteria, which should be used for fireballs.
Table 2.4 Therm al Dose Fatality Criteria (use for fireballs)
Therm al Dose Effect

Units
((kW /m 2 ) 4/3 s)
1000 1% lethality
1800 50% lethality, members of the
public
2000 50% lethality, offshore workers
3200 100% lethality
2.1.3 People inside buildings

Besides being vulnerable to thermal radiation if they have a direct line of sight to a jet or
pool fire, people inside buildings may be vulnerable to the building catching fire if
combustible building material is exposed to the fire (either to a directly impinging fire or
to radiation).
Two types of ignition are recognised:
• Piloted ignition, resulting from the flame impinging directly on a surface
• Spontaneous ignition, resulting from exposure to thermal radiation from a fire
Table 2.2 indicates thermal radiation levels for ignition of wood and cellulosic material.
Figure 2.2 shows, as an example, the relationship between thermal radiation and time to
ignition (both piloted and spontaneous) for oak.
Personnel inside a building are vulnerable to the building catching fire if they cannot
escape in sufficient time. This will depend on the time to ignition as compared to the
time to alert the people inside to the source fire and evacuate them.
People inside a building are also vulnerable if escape routes are exposed to thermal
radiation: in this case the criterion of 6 kW/m2 given in Table 2.3 can be applied.
©OGP 5
Figure 2.2 Exam ple Tim es to Ignition of Oak
6 ©OGP
2.2 Explosion
Explosions generate overpressures and drag forces that in turn result in damage to
buildings and structures, and generate missiles (fragments of damaged structures,
window glass shards, or loose objects). The effects of overpressure on humans are
normally categorised as follows:
• Direct or Primary: injury to the body as a result of the pressure change
• Secondary: injury as a result of fragments or debris produced by the
overpressure impacting on the body
• Tertiary: injury as a result of the body (especially the head) being thrown by
the explosion drag and impacting on stationary objects or
structures
For QRA, lethality is not typically estimated independently for these effects; instead,
an overall lethality is estimated based on the combination of these effects.
Casualties requiring medical treatment from direct blast effects are typically
produced by overpressures between 1.0 and 3.4 bar. However, other effects (such
as secondary effects and thermal injuries) are so predominant that casualties with
only direct blast injuries make up a small part of an exposed group.
For people onshore, outdoors and in the open, the following lethality levels are
recommended:
• 0.35 bar overpressure: 15% lethality for people outdoors, in the open
• 0.5 bar overpressure: 50% lethality for people outdoors, in the open
For people onshore, outdoors but adjacent to buildings or in unprotected structures (e.g.
process units), the following lethality levels are recommended:
• 0.35 bar overpressure: 30% lethality for people outdoors
• 0.5 bar overpressure: 100% lethality for people outdoors
For people indoors, the lethality level depends on the building type as well as the
overpressure. Two frequently used sets of relationships between lethality level and
over-pressure are presented below: Figure 2.3 shows that from API RP 752 [4], Figure
2.4 that from the CIA Guidance [6]. Both differentiate between building construction
types.
For personnel offshore in modules affected by an explosion, the following approach is
suggested:
• 100% lethality for personnel in the m odule where the explosion occurs,
if the explosion overpressure exceeds 0.2 to 0.3 barg
• 100% lethality in adjacent m odules if the intervening partition (wall or
deck) is destroyed by the explosion.
A more sophisticated approach could involve more detailed study of other explosion
characteristics: overpressure phase duration and impulse. A probabilistic approach is
recommended to estimate the likelihood of exceeding overpressures that could result in
immediate fatality, escalation within the module, and escalation to adjacent areas.
©OGP 7
Figure 2.3 Overpressure – Lethality Relationships from API 752* [4]
Building Types
B1: Wood-frame trailer or shack.
B2: Steel-frame/metal siding or pre-engineered building.
B3: Unreinforced masonry bearing wall building.
B4: Steel or concrete framed with reinforced masonry infill or cladding.
B5: Reinforced concrete or reinforced masonry shear wall building.
* Note that API RP 753 [5] has superseded API RP 752 [4] with regard to locating
portable buildings (building type B1). However, it does not give any overpressure-
lethality relationship for such buildings, for which API RP 753 [5] should be followed
rather than using the curve on the above graph.
8 ©OGP
Figure 2.4 Overpressure – Lethality Relationships from CIA Guidance [6]
Building Types
CIA1: Hardened structure building: special construction, no windows
CIA2: Typical office block: four storey, concrete frame and roof, brick block wall panels
CIA3: Typical domestic building: two-storey, brick, walls, timber floors
CIA4: ‘Portacabin’ type timber construction, single storey
Note that the presentations of the graphs in Figure 2.3 and Figure 2.4 follow those of the
original publications and no attempt has been made to convert either or both to a
common set of axes.
©OGP 9
2.3 Toxic gases

2.3.1 General
Various approaches are used to determine the consequences of toxic gases (not
including smoke, which is addressed separately in Section 2.4):
• IDLH
• ERPG
• Probit
• SLOT & SLOD DTLs
Of these, the IDLH (“Immediate Danger to Life or Health”) is the maximum concentration
from which escape is possible within 30 minutes without any escape-impairing
symptoms or irreversible health effects. Its use as the limiting value for the onset of
fatalities has several disadvantages, chief amongst them as regards QRA is significant
conservatism. IDLHs are more suitable for use as a workplace risk management tool
rather than in a major accident risk assessment. In most cases, exposure to the IDLH
concentration would be extremely unlikely (<< 1%) to result in fatalities.
ERPGs – Emergency Response Planning Guidelines – are precisely what their name
implies, i.e. they are used (in the USA) to plan emergency response to an incident,
knowing the likely ranges of health effects resulting from the incident and consequent
numbers of casualties.
Neither IDLH nor ERPG values are therefore recommended for major hazard QRAs,
however both are useful as indicators of the hazard effects of toxic materials.
The probit approach has been used for at least 30 years, with probit functions being
developed for a wide range of toxic materials. They have been used especially, but not
exclusively, in the Netherlands. They enable the lethality to be estimated for any
combination of concentration and duration of exposure, including time dependent
concentrations (resulting from time varying release rates). They can be used to provide
fine resolution in fatality estimates, especially for third party (offsite) risks onshore,
using the results of atmospheric dispersion models (see Consequence Modelling
datasheet). Probits recommended below are those published by recognised bodies
(TNO and the UK HSE) and used by regulators.
The SLOT and SLOD DTLs technique has been proposed and developed by the UK HSE
as an alternative to the probit approach.
The SLOT (Specified Level Of Toxicity) DTL (Dangerous Toxic Load) is usually defined
as the dose that results in highly susceptible people being killed and a substantial
portion of the exposed population requiring medical attention and severe distress to the
remainder exposed. As such it represents the dose that will result in the onset of fatality
for an exposed population (commonly referred to as LD1 or LD1-5).
The SLOD (Significant Likelihood of Death) DTL is defined as the dose to typically result
in 50% lethality (LD50) within an exposed population and is the value typically used for
group risk of death calculation onshore.
Both the SLOT and SLOD DTLs are calculated as:
DTL = cnt
where: c = concentration in ppm
10 ©OGP
t = exposure duration in minutes

Table 2.6 gives SLOT and SLOD values, and both HSE and TNO probits, for selected
toxic materials. See Section 5.0 for references to data sources for other materials.
Table 2.7 gives the resulting concentrations that give 1% and 50% lethality for 10
minutes and 30 minutes exposure. There is no clear pattern regarding whether the HSE
or TNO probits indicate higher or lower concentrations for a given lethality level.
• For studies of facilities falling under the UK regulatory regime, the HSE probits or
SLOT/SLOD values are recommended.
• In other regulatory regimes that have specified probits, the use of those probits is
recommended.
• For all other studies, the TNO probit is recommended.
2.3.2 Hydrogen Sulphide

Other than toxic products from combustion of hydrocarbons (see Section 2.4) the most
likely toxic gas present in oil and gas production hydrocarbon fluids is Hydrogen
Sulphide (H2S). The effects likely to be experienced by humans exposed to various
concentrations of H2S are described in Table 2.5.
Table 2.5 Effects of Exposure to Hydrogen Sulphide [1]
H 2S Effect
Concentration
20 – 30 ppm Conjunctivitis
50 ppm Objection to light after 4 hours exposure. Lacrimation
150 - 200 ppm Objection to light, irritation of mucous membranes, headache
200 - 400 ppm Slight symptoms of poisoning after several hours
250 - 600 ppm Pulmonary edema and bronchial pneumonia after prolonged exposure
500 - 1000 ppm Painful eye irritation, vomiting.
1000 ppm Immediate acute poisoning
1000 - 2000 ppm Lethal after 30 to 60 minutes
> 2000 ppm Rapidly lethal
©OGP 11
Table 2.6 SLOT & SLOD DTL Values and Probit Constants (concentration in ppm , duration in m inutes)
Material HSE SLOT & SLOD HSE Probit TNO Probit

SLOT SLOD “n” a b n a b n
8 1.09 ×
Ammonia 3.78 × 10 9 2 -43.24 2.32 2 -16.33 1 2
10
Carbon Monoxide 40125 57000 1 -67.68 6.64 1 -7.26 1 1
5 4.84 ×
Chlorine 1.08 × 10 5 2 -15.33 1.55 2 -4.89 0.5 2.75
10
Hydrogen 12 1.5 ×
2 × 10 13 4 -30.08 1.16 4 -10.87 1 1.9
Sulphide 10
6 7.45 ×
Sulphur Dioxide 4.66 × 10 7 2 -10.23 0.84 2 -16.89 1 2.4
10
Hydrogen Fluoride 12000 41000 1 -36.44 4.16 1 -8.70 1 1.5
96000 6.24 × 2
Nitrogen Dioxide 5 -11.61 1.24 2 -16.26 1 3.7
10
Table 2.7 Exam ple Concentrations (ppm ) to give 1% and 50% Lethality for 10 m inute and 30 m inute Exposures
M aterial 10 minutes, 1% lethality 30 minutes, 1% lethality 10 minutes, 50% 30 minutes, 50%

lethality lethality
HSE SLOT TNO Probit HSE SLOT TNO Probit HSE SLOD TNO Probit HSE SLOD TNO Probit
Ammonia 6148 4218 3550 2435 10149 13523 5859 7808
Carbon Monoxide 4013 2063 1338 688 5700 21203 1900 7068
Chlorine 104 105 60 71 220 573 127 384
Hydrogen 669 371 508 208 1107 1265 841 709
Sulphide
Sulphur Dioxide 683 1327 394 840 2729 3504 1576 2217
Hydrogen 1200 422 400 203 4100 1996 1367 960
Fluoride
Nitrogen Dioxide 9600 90 3200 67 62400 168 20800 125
12 ©OGP
2.4 Smoke
Smoke from hydrocarbon fires contains carbon monoxide, which is toxic, and carbon
dioxide, which contributes to the physiological effects of smoke in various ways.
Smoke is also deficient in oxygen, hence its inhalation will result in oxygen depletion.
Hence the direct effect of smoke needs to consider the combined effects of these
constituents: see Section 2.4.1.
Smoke also obscures vision and hence may prevent personnel from reaching the TR or
lifeboat embarkation points on an offshore installation, or muster location onshore: see
Section 2.4.2.
Once personnel are mustered in the TR offshore, they continue to be vulnerable through
smoke ingress to the TR; this is addressed separately in Section 2.5.
2.4.1 Smoke Inhalation

2.4.1.1 Effects of carbon monoxide exposure
Table 2.8 Effects of Carbon Monoxide Exposure [1]
CO Effects
concentration
1500 ppm Headache after 15 minutes, collapse after 30 minutes, death after 1 hour
2000 ppm Headache after 10 minutes, collapse after 20 minutes, death after 45
minutes
3000 ppm Maximum "safe" exposure for 5 minutes, danger of collapse in 10
minutes, danger of death in 15 to 45 minutes
6000 ppm Headache and dizziness in 1 to 2 minutes, danger of death in 10 to 15
minutes
12800 ppm Immediate effect, unconscious after 2 to 3 breaths, danger of death in 1
to 3 minutes
The toxicity of carbon monoxide is due to the formation of blood

carboxyhaemoglobin. This results in a reduction of the supply of oxygen to critical
body organs and is referred to as anaemic anoxia. The affinity of haemoglobin for
CO is extremely high (over 200 times higher than O2), so that the proportion of
haemoglobin in the form of carboxyhaemoglobin (COHb) increases steadily as CO is
inhaled. There is little doubt that CO is the most important toxic agent formed in
hydrocarbon fires because:
• It is always present in fires, often at high concentrations.
• It causes confusion and loss of consciousness, thus impairing or, preventing
escape.
The rate of change (per second) of the carboxyhaemoglobin level (COHb, %) is given by:
where CO is in %, BR is in m3/s and is the actual breathing rate (approximately 3 × 10-3

m3/s for an average individual). The cumulative effect of CO can be calculated by
integrating this expression.
©OGP 13
The actual breathing rate may exceed the nominal breathing rate because of the effects
of CO2 and is estimated as follows:
Table 2.9 shows the effects of COHb in blood. From this table it can be concluded that
COHb levels in the range 10-20% represent a range of values where there is a reduced
potential of ability to escape or carry out functions requiring dexterity or conscious
effort. Above 20% COHb impairment and death become more certain within a relatively
short period and recovery may not be possible. It is suggested that the upper limit for
survivability without significant impairment is 15% COHb with a cautious best estimate
of 10% COHb to be used where exposure is followed by intense physical activity such
as escape or evacuation under harsh conditions.
Table 2.9 Effects of COHb in Blood [1]
% COHb in Physiological and Subjective Symptoms

Blood
2.5-5 No symptoms
5-10 Visual light threshold slightly increased
10-20 Tightness across forehead and slight headache, dyspnoea on moderate
exertion, occasional headache, signs of abnormal vision
20-30 Definite headache, easily fatigued, Impaired judgment, possible dizziness
and dim vision, impaired manual dexterity
30-40 Severe headache with dizziness, nausea and vomiting
40-50 Headache, collapse, confusion, fainting on exertion
60-70 Unconsciousness, convulsions, respiratory failure and death
80 Rapidly fatal
80+ Immediately fatal
2.4.1.2 Effects of carbon dioxide exposure

Table 2.10 Effects of Carbon Dioxide Exposure [1]
CO 2 Responses
Concentration
45 000 ppm / 4.5% Reduced concentration capability for more than 8 hours exposure,
adaptation possible
55 000 ppm / 5.5% Breathing difficulty, headache and increased heart rate after 1 hour
65 000 ppm / 6.5% Dizziness, and confusion after 15 minutes exposure
70 000 ppm / 7.0% Anxiety caused by breathing difficulty, effects becoming severe after 6
minutes exposure
100 000 ppm / 10% Approaches threshold of unconsciousness in 30 minutes
120 000 ppm / 12% Threshold of unconsciousness reached in 5 minutes
150 000 ppm / 15% Exposure limit 1 minutes
200 000 ppm / 20% Unconsciousness occurs in less than 1 minute
14 ©OGP
While carbon dioxide is not considered to be particularly toxic, at levels normally

observed in fires, a moderate concentration does stimulate the rate of respiration.
This would be expected to cause accelerated uptake of any toxic and/or irritant
gasses present during an incident involving fire and fume as breathing rate
increases 50% for 20 000 ppm (2% v/v) carbon dioxide and doubles for 30 000 ppm
(3% v/v) carbon dioxide in air. At 50 000 ppm (5%v/v), breathing becomes laboured
and difficult for some individuals as it represents a significant level of oxygen
depletion.
The effect of CO2 can be expressed as the fraction, FCO2, of the incapacitating dose
by integrating the following expression:
where CO2 is the concentration of CO2(%) in air, which can be estimated using the
approach suggested in Section 2.5.1 of the Consequence Modelling datasheet..
Concentrations of less than 3% are considered to have no effect.
2.4.1.3 Effects of oxygen depletion

Table 2.11 Effects of Oxygen Depletion [1]
% Oxygen in Air Symptoms

21-20 Normal
18 Night vision begins to be impaired
17 Respiration volume increases, muscular coordination diminishes,
attention and thinking clearly requires more effort
12 to 15 Shortness of breath, headache, dizziness, quickened pulse, effort
fatigues quickly, muscular coordination for skilled movement lost
10 to 12 Nausea and vomiting, exertion impossible, paralysis of motion
6 to 8 Collapse and unconsciousness occurs
6 or below Death in 6 to 8 minutes
Oxygen constitutes approximately 21% v/v in clean air. Oxygen concentrations

below 15% by volume produce oxygen starvation (hypoxia) effects such as
increased breathing, faulty judgment and rapid onset of fatigue. Concentrations
below 10% cause rapid loss of judgment and comprehension followed by loss of
consciousness, leading to death within a few minutes. This is taken to be the
limiting oxygen concentration where escape needs only a few seconds. If escape is
not possible within few seconds, incapacitation and death is assumed to occur.
The effect of oxygen depletion can be expressed as the fraction, FO2, of the
incapacitating dose by integrating the following expression:
where O2 is the oxygen concentration (%) in air.
©OGP 15
2.4.1.4 Combined effects of carbon monoxide, carbon dioxide and oxygen depletion
The combined effect of these smoke constituents can be considered to give an
incapacitating dose, FTot, calculated as follows:
If FTot > 1.0, impairment is considered to result.
2.4.2 Smoke Obscuration

A visibility of 4-5 m is about the threshold of diminished performance, and this is the
smoke level that should be considered in smoke ventilation system design. It is
suggested that there should be a minimum of 3 m vision for escape from a primary
compartment and at least 10 m for an escape route.
Important factors to consider in a risk analysis with regard to obscuration of vision (and
time to escape) are:
• Exposure to smoke
• Arrangements of escape ways (layout, sign, illumination, railing, etc.)
• Training of personnel
• Familiarity with the installation
Where an escape way is well laid out and provided with high visibility marking or
illumination (including effective provision of torches / light-sticks), then the 3 m criterion
may be applied.
Alternatively, impairment of escape ways or of the TR can be considered to occur when
the particulate concentration exceeds that giving a visibility reduction of 1 dB/m. This
can be estimated using the approach suggested in Section 2.5.1 of the Consequence
Modelling datasheet.
2.5 Vulnerability inside a Temporary Refuge

Personnel inside a Temporary Refuge continue to be vulnerable to the consequences of
an incident that has caused them to muster there. They are vulnerable to:
• Smoke ingress to the TR
• Heat build-up in the TR
• Ingress to the TR of unignited hydrocarbon gas
• Delayed explosion or structural collapse resulting in the TR being breached or
otherwise ceasing to be habitable
2.5.1 Smoke ingress

Smoke ingress to the TR also results in heat build-up. CO2 build-up and oxygen
depletion are also enhanced through respiration. Hence application of a simple model
for gas build-up in the TR such as the CSTR model suggested in Section 2.5.1 of the
Consequence Modelling datasheet will under-estimate the effects of smoke ingress.
16 ©OGP
It can be assumed that the smoke plume totally engulfs the TR at a uniform
concentration. It is further assumed that any smoke that enters the TR will be rapidly
and evenly dispersed around the relevant interior space.
The CO and particulates concentrations, Conc, in the TR are evaluated as:
where: Concin is the concentration of CO/particulate inside the TR

Concout is the concentration of CO/particulates outside the TR
Vent Rate is the TR ventilation rate (air changes per second)
The CO2 concentration, Conc, in the TR is calculated as:
where: C is the concentration of CO2 in exhaled air, assumed to be 3%

N is the number of persons in the TR
BR is an average individual’s breathing rate (m3/s)
V is the TR volume (m3)
The O2 concentration in the TR is calculated as:
where P is the percentage of inhaled air that is converted from O2 to CO2, usually 3%.
The initial concentrations are all taken to be zero, except O2 which is taken to be 20.9%.
The internal temperature (neglecting any changes in humidity level) is calculated by
integrating the following function:
where Q1 is the heat conducted through the TR fabric (assumed zero)

Q2 is the heat generated by the TR occupants (350 W per person at normal
temperatures)
and Vρ C is the heat capacity of the TR air (volume × density × specific heat).
Impairment of the TR is then taken to occur if either:

• The particulate concentration exceeds that giving a visibility reduction of 1 dB/m, or,
• The total incapacitating dose of COHb, CO2, O2, and temperature effects exceeds 1.0.
The total dose FTot is calculated as:
©OGP 17
2.5.2 Heat build-up

Besides heat build-up through smoke ingress, the TR may also be heated by an
externally impinging fire. However, on many modern installations there is at least an
H60 rated firewall protecting the TR from fire. Hence, provided the integrity of the
firewall is not breached (e.g. by an explosion), the TR should not be impaired solely by
the effects of heat build-up due to external radiation within its expected endurance time.
2.5.3 Ingress of unignited hydrocarbon gas

As discussed in Section 2.5.1 of the Consequence Modelling datasheet, a gas
concentration inside the TR exceeding 60% of LFL can be assumed to cause TR
impairment.
2.5.4 Structural collapse

Structural collapse and/or breach of the TR is addressed in the Structural Vulnerability
datasheet.
2.6 Cold Water

The survival of people immersed in cold water (e.g. as a result of escape to water from
an offshore installation) depends on a range of variables:
• Environmental factors: temperature, sea state, visibility
• Clothing: survival suit, lifejacket
• Personal factors, e.g. body fat, fitness
An HSE offshore safety report [7], published in 1996 but still referenced by the HSE,
presents a comprehensive discussion of the subject and a recommended approach.

The criteria set out in Section 2.0 should be used where no equivalent criteria are
specified either by the regulatory authority or by the party commissioning the QRA.
They should generally be considered valid for most studies related to onshore and
offshore facilities.
Where the combustion products in smoke include other toxic materials besides CO,
their effects should be incorporated in the analysis, e.g. by using the probits for those
materials.
18 ©OGP
3.2 Uncertainties
Individuals’ vulnerabilities to all the potential causes of injury/fatality discussed in
Section 2.0 vary widely, depending on many factors such as:
• Personal factors: physical (e.g. fitness), psychological, training
• Clothing (applies to thermal radiation, exposure to fire, cold water immersion)
• Ability to escape (e.g. ease of egress, availability of escape routes/means)
• Availability and ongoing integrity of shelter (e.g. TR)
• Availability of means of breathing assistance (applies to toxic gases and smoke)
In addition, factors such as warning time, the reliability of HVAC shutdown systems and
TR fabric integrity will impact on the dose received. All of these factors should be
considered for their relevance and impact when using the criteria.

For all of the impact criteria except cold water, an HSE document [1] provides a good
general summary of vulnerabilities and physical effects of the hazards discussed in
Section 2.0. It draws on a range of other published studies referenced within it. This
document accordingly forms the basis of the recommended data.
Supplementary references are as follows:
• Fire API [3]
• Explosion API [4] (but see note below Figure 2.3), CIA [6]
• Toxic gases Dutch “Purple Book” [8], [12]
• Smoke SFPE [9]
• TR Purser [10]
• Cold Water HSE [7]

HSE SLOD and SLOT values for a wide range of materials additional to those presented
in Section 2.3 are given in [12]. The “Purple Book” [8] likewise gives probits for a wide
range of materials.
6.0 References
[1] HSE, 2008. Indicative Human Vulnerability to the Hazardous Agents Present Offshore for
Application in Risk Assessment of Major Accidents, HID Semi Permanent Circular no.
SPC/Tech/OSD/30, http://www.hse.gov.uk/foi/internalops/hid/spc/spctosd30.pdf.
[2] FEMA, 1989. Handbook of Chemical Hazard Analysis Procedures, Washington, D.C:
Federal Emergency Management Agency.
[3] American Petroleum Institute (API), 2007. Pressure-Relieving and Depressuring
Systems, ANSI/API STD 521, 5th ed., Washington, D.C: API.
[4] American Petroleum Institute (API), 2003. Management of Hazards Associated with
Location of Process Plant Buildings, 2nd. ed., API RP 752, Washington, D.C: API.
©OGP 19
[5] American Petroleum Institute (API), 2007. Management of Hazards Associated with
Location of Process Plant Portable Buildings, 1st. ed., API RP 753, Washington, D.C: API.
[6] Chemical Industries Association (CIA), 2003. Guidance for the location and design of
occupied buildings on chemical manufacturing sites, 2nd. ed., London: Chemical
Industires Association, ISBN 1 85897 114 4.
[7] HSE, 1996. Review of Probable Survival Times for Immersion in the North Sea, Offshore
Technology Report OTO 95 038,
http://www.hse.gov.uk/research/otopdf/1995/oto95038.pdf.
[8] VROM, 1999/2005. Guidelines for quantitative risk assessment, Publication Series on
Dangerous Substances, PGS 3 (formerly CPR18, “Purple Book”), Ministerie van
Volkshuis-vesting, Ruimtelijke Ordening en Milieubeheer,
http://www.vrom.nl/pagina.html?id=20725.
[9] SFPE, 2002. The SFPE Handbook of Fire Protection Engineering, 3rd. ed., ch. 2-6,
Quincy, MA: National Fire Protection Association.
[10] Purser, D, 1992. Toxic Effects of Fire Cases, Offshore Fire and Smoke Hazards,
Aberdeen.
[11] NFPA 2007. Standard on Flame-Resistant Garments for Protection of Industrial
Personnel against Flash Fire, NFPA 2112.
[12] HSE, 2008. Assessment of the Dangerous Toxic Load (DTL) for Specified Level of
Toxicity (SLOT) and Significant Likelihood of Death (SLOD),
http://www.hse.gov.uk/hid/haztox.htm.
20 ©OGP
Appendix I – Relationship between Lethality and Probit

The following table shows the percentage affected (lethality) for a given probit
value.
Lethality (%)
0 1 2 3 4 5 6 7 8 9
0 - 2.67 2.95 3.12 3.25 3.36 3.45 3.52 3.59 3.66
10 3.72 3.77 3.82 3.87 3.92 3.96 4.01 4.05 4.08 4.12
20 4.16 4.19 4.23 4.26 4.29 4.33 4.36 4.39 4.42 4.45
30 4.48 4.50 4.53 4.56 4.59 4.61 4.64 4.67 4.69 4.72
40 4.75 4.77 4.80 4.82 4.85 4.87 4.90 4.92 4.95 4.97
50 5.00 5.03 5.05 5.08 5.10 5.13 5.15 5.18 5.20 5.23
60 5.25 5.28 5.31 5.33 5.36 5.39 5.41 5.44 5.47 5.50
70 5.52 5.55 5.58 5.61 5.64 5.67 5.71 5.74 5.77 5.81
80 5.84 5.88 5.92 5.95 5.99 6.04 6.08 6.13 6.18 6.23
90 6.28 6.34 6.41 6.48 6.55 6.64 6.75 6.88 7.05 7.33
% 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9
99 7.33 7.37 7.41 7.46 7.51 7.58 7.65 7.75 7.88 8.09
Examples:
• 1% is equivalent to 2.67 probits.
• 99.9% is equivalent to 8.09 probits.
©OGP 21

March 2010
Vulnerability
of plant/structure
RADD – Vulnerability of plant/structure
contents
1.1 Application ...................................................................................................... 1
1.2 Definitions ....................................................................................................... 1
2.1 Fire ................................................................................................................... 2
2.1.1 Vulnerability of Plant/Structure under Fire Loading ............................................... 2
2.1.2 Derivation of Fire Loads ............................................................................................ 4
2.2 Explosions....................................................................................................... 7
2.2.1 Vulnerability of Plant/Structure to Explosions ........................................................ 7
2.2.2 Overpressure Loading ............................................................................................. 10
2.2.3 Drag Loading on Equipment ................................................................................... 11
2.2.4 Response of Plant/Structure ................................................................................... 12
2.3 Missiles .......................................................................................................... 14
3.2 Uncertainties ................................................................................................. 17
6.0 References .......................................................................... 19
6.2 References for other data sources examined ............................................ 19
©OGP
Abbreviations:
2D Two-dimensional
AIChE American Institute of Chemical Engineers
API American Petroleum Institution
BS British Standard
CCPS Center for Chemical Process Safety
CoP Code of Practice
DLM Direct Load Measurement
ESREL European Safety and Reliability
FPSO Floating Production, Storage and Offloading unit
ISO International Organization for Standardization
LPGA LP Gas Association
MDOF Multiple Degree of Freedom
SDOF Single Degree Of Freedom
UKOOA United Kingdom Offshore Operators Association (now Oil & Gas UK)
©OGP

1.1 Application
This datasheet provides information on vulnerability of plant/structure to the
consequences of major hazard events on onshore and offshore installations. The focus
is on primary structures (e.g. primary beams/columns, firewalls, control rooms etc.) and
major items of equipment such as pressure vessels where failure can lead to escalation
effects. Information is presented relating to the structural response failure criteria. The
following consequences are considered:
• Fire
• Explosion
• Missile
For the purposes of a QRA the information provided in this datasheet may be sufficient
and, where applicable, acceptable to the regulatory authority. However, where the risks
arising from structural failure are significant, more detailed analysis of the vulnerability
of plant/structure to heat, overpressure and impact loads may be required. This should
be carried out by specialists within those fields as it requires both a sound
understanding of the underlying physics and the use of complex numerical simulations.
Such assessments would, typically, require a multi-disciplinary approach involving
safety, process and structural engineering disciplines amongst others.
It should also be stressed the vulnerability of plant/structure can be significantly
reduced by employing the principles of inherent safety. For example, application of
good local and global layout methods can reduce not only the likelihood and the
severity of fires and explosions but also the likelihood of escalation of the event and the
overall consequences.
1.2 Definitions
• Em issivity A constant used to quantify the radiation emission characteristics
of a flame: it is the fraction of the maximum theoretical radiative
flux (that of a “perfect black body”) emitted by the flame.
• Convective Flux Refers to the transfer of heat from one point to another
within a fluid, gas or liquid, by the mixing of one portion of the fluid
with another.
• Im pulse The integral of a force or load over an interval of time.
• Radiative Flux Refers to the transfer of heat from one body to another by thermal
radiation.
• Rise Tim e The time taken for the explosion overpressure to increase from
zero to the peak overpressure.

• Section 2.1: Response to Fires
• Section 2.2: Response to Explosions
• Section 2.3: Impact of Missiles
©OGP 1
2.1 Fire
Section 2.1.1 gives typical data for vulnerability of plant/structure under fire loading.
Characteristic data for typical hydrocarbon fires are given in Section 2.1.2.
2.1.1 Vulnerability of Plant/Structure under Fire Loading

Table 2.1 gives typical times to failure of various items of plant/structure. Critical
temperatures for failure of various components and vessels are shown in Table 2.2.
Table 2.1 Tim e to Failure of Pipework, Vessels, Equipm ent and Structures
affected by Fire [1]
Fire Scenario (Note 1) Failure Tim e to Failure (Note 2)

Flame with heat flux of Excessive deformation of < 5 min
250 kW/m2 impinging onto pipe supports leading to
a pipe support with no fire loss of tightness and
protection. potential rupture.
Flame with heat flux of Hub connector or flange < 5 min

250 kW/m2 impinging onto (clamp or bolted), loss of
a connector or flange tightness.
(clamp or bolted) with no
fire protection.
Flame with heat flux of Valve, loss of tightness. < 10 min
250 kW/m2 impinging onto
a valve with no fire
protection.
Flame with heat flux of Safety valve, opens at a < 10 min
250 kW/m2 impinging onto pressure lower than the
a safety valve with no fire setting pressure.
protection.
Flame with heat flux of Bursting disc, opens at a < 10 min

250 kW/m2 impinging onto pressure lower than the
a bursting disc device with setting pressure or is
no fire protection. destroyed.
Flame with heat flux of Pressure vessel rupture < 40 min depending on the
250 kW/m2 impinging onto with the potential formation flame size with respect to
pressure vessel with no of projectiles. vessel size, vessel
fire protection. contents, wall thickness
and the size of pressure
relief/blowdown orifice.
Determine the time to
failure by multi-physics
analysis.
2 ©OGP
Fire Scenario (Note 1) Failure Tim e to Failure (Note 2)

Flame with heat flux of Pressure vessel rupture < 40 min depending on the
250 kW/m2 impinging onto with the potential formation size of the pipe and fire
a pipe attached to a of projectiles. intensity.
pressure vessel. The pipe
is unprotected and the
vessel is protected so that
heat is conducted by the
pipe into the pressure
vessel shell forming a hot
spot with loss of strength.
Flame with heat flux of Excessive deformation of < 5 min
250 kW/m2 impinging onto vessel supports leading to
a vessel support with no loss of tightness at nozzle
fire protection. flanges.
Flame with heat flux of Loss of load bearing < 15 min depending on the
250 kW/m2 impinging capacity of a structural member size
locally onto a structural member, which may lead to
member with no fire large deformation in some
protection. locations and loss of
tightness of pipework.
Flame with heat flux of Collapse of structure or its < 30 min depending on the
250 kW/m2 impinging part leading to loss of member sizes.
locally onto a joint of tightness of pipework and
structural members or large releases of hazardous
engulfing several joints. fluids.
Flame with heat flux of Collapse of atmospheric < 40 min depending on the
250 kW/m2 impinging onto storage tanks, road tankers, flame size with respect to
the storage or transport rail tank cars and marine tank size and the tank
tanks with no fire tankers leading to large contents, fill level, wall
protection. releases of hazardous thickness and the size of
fluids. any pressure relief device.
Determine the time to
failure by multi-physics
analysis.
Notes
1. The time to failure for heat fluxes other than 250 kW/m2 should ideally be determined by
transient calculations.
2. The times to failure given are upper limits, as per the original source reference. Judgment
should be used to select a suitable minimum or other absolute value if required.
©OGP 3
Table 2.2 Com m only used critical tem peratures [2]
Exposed Structure Tem perature

(°C)
Structural steel onshore 550-620
LPG tanks (France and Italy) 427
Structural steel offshore 400
LPG tanks (UK and Germany) 300
Structural aluminium offshore 200
Unexposed face of a division/boundary 180
Unexposed face of a division/boundary 140
Surface of safety related control panel 40
Note that these values are indicative only and, if the risks from structural failure due to
fire are significant, more detailed analysis may be required in order to determine the
thermal response of plant/structure. Generally for simple linear elements, all that is
required is the temperature distribution across the section at the mid point. This may be
computed using 2D thermal analysis. For more complex elements and whole structures,
typically the complete temperature history of all parts of the structure is required
although some simplification may be possible.
In particular, the material behaviour under elevated temperatures i.e. temperatures
above ambient, should be accounted for. The effects of elevated temperatures when the
structure is considered to be stress-free are threefold:
• reduction of modulus of elasticity and hence changes in stiffness
• reduction in yield strength of structural steel and
• thermal strains.
Data for the behaviour of various grades of steel under elevated temperatures is given
in [3].
2.1.2 Derivation of Fire Loads

The assessment of the vulnerability of plant/structure to fires requires that the following
be established:
a) The fire scenario or design fire
b) Heat flow characteristics from the fire to the plant/structure
c) The behaviour of material properties of the plant/structure at elevated temperatures
d) The properties of fire protection systems.
The actual fire scenarios and design fluxes must first be defined. Design fires are
usually characterised in terms of the following variables with respect to time [4]:
• heat release rate
• toxic-species production rate
• smoke production rate
• fire size (including flame length)
4 ©OGP
• duration.
Other variables such as temperature, emissivity and location may be required for
particular types of numerical analysis. Generally, the following should be considered in
the determination of fire loads:
a) whether the fire is a pool or jet fire and confined/unconfined
b) whether fire is ventilation or fuel controlled
c) whether flame is obstructed/unobstructed
d) composition of fire fuel (one-phase or two-phase)
e) gas to oil ratio in the burning fluid
f) temporal and spatial variation of heat flux within a flame.
[2] and [5] include details of a wide range of pool and jet fires that enable the radiative
and convective heat transfer to be calculated more accurately than in the past for a wide
range of fire scenarios. These are presented in Table 2.3 to Table 2.7 below for high
pressure gas jet fires, high pressure two-phase jet fires, pool fires on installation, pool
fires on sea and fire loading on pressure vessels respectively.
Table 2.3 Characteristic Data for High Pressure Gas Jet Fires [2]
Size (kg/s) 0.1 1 10 >30

Flame Length (m) 5 15 40 65
Radiative flux (kW/m2) 80 130 180 230
Convective flux 100 120 120 120
(kW/m2)
Total heat flux (kW/m2) 180 250 300 350
Flame emissivity 0.25 0.4 0.55 0.7
Table 2.4 Characteristic Data for High Pressure Two-Phase Jet Fires [2]
Fuel m ix of 30% gas, 70% liquid Flashing Liquid

by m ass fires (e.g.
propane/butane)
Size (kg/s) 0.1 1 10 >30 1
Flame Length (m) 5 13 35 60 not given in [2]
Radiative flux 100 180 230 280 160
(kW/m2)
Convective flux 100 120 120 120 70
(kW/m2)
Total heat flux 200 300 350 400 230
(kW/m2)
Flame emissivity 0.3 0.55 0.7 0.85 1
©OGP 5
Table 2.5 Characteristic Data for Pool Fires on Installations [2]
Methanol Pool Sm all Large

Hydrocarbon Hydrocarbon
Pool Pool
Typical Pool Diameter (m) 5 <5 >5
Flame Length (m) Equal to pool Twice pool Up to twice pool
diameter diameter diameter
Mass burning rate 0.03 Crude: 0.045 - Crude: 0.045 -
(kg/(m2s)) 0.06 Diesel: 0.055 0.06 Diesel: 0.055
Kerosene: 0.06 Kerosene: 0.06
Condensate: 0.09 Condensate: 0.10
C3/C4s: 0.09 C3/C4s: 0.12
Radiative flux (kW/m2) 35 125 230
Convective flux (kW/m2) 0 0 20
Total heat flux (kW/m2) 35 125 250
Flame emissivity 0.25 0.9 0.9
Table 2.6 Characteristic Data for Pool Fires on Sea [2]
Typical Pool Diameter > 10

Flame Length (m) Up to twice
diameter
Mass burning rate (kg/(m2s)) Crude: 0.045 - 0.06
Diesel: 0.055
Kerosene: 0.06
Condensate: 0.10
C3/C4s: 0.20
Radiative flux (kW/m2) 230
Convective flux (kW/m2) 20
Total heat flux (kW/m2) 250
Flame emissivity 0.9
Table 2.7 Characteristic Fire Loading for Pressure Vessels and Other
Equipm ent [5]
Jet Fire Pool Fire

0.1 kg/s < leak leak rate > 2 kg/s
rate < 2 kg/s
Local Peak Heat Load (kW/m2) 250 350 150
Global Average Heat Load 0 100 100
(kW/m2)
The global average heat load represents the average heat load that exposes a
significant part of the process segment or structure and provides the major part of the
heat input to the process segment thereby affecting the pressure in the segment.
6 ©OGP
The local heat load exposes a small area of the process segment or structure to the
peak heat flux. The local peak heat load, with the highest flux, determines the rupture
temperature of different equipment and piping within the process segment.
2.2 Explosions
The loading on plant/structure from an explosion arises from both overpressure loading
and drag loading. The input data required for the assessment of the vulnerability of
plant/structure include:
• Peak pressure
• Impulse
• Load duration
• Rise time (to peak pressure)
• Drag pressure
• Approximate impulse duration for dynamic drag
2.2.1 Vulnerability of Plant/Structure to Explosions

Survey of damage due to explosion overpressure has been carried by a number of
researchers, where Table 2.8 and Table 2.9 present the data from Clancey [6], which
looked at damage effects produced by a blast wave in general, and Stephens [7], which
focused on vulnerable refinery parts.
As for the fire damage cases reported in Table 2.1, the values given in Table 2.8 and
Table 2.9 are indicative only. The determination of the vulnerability of a plant/structure
should be determined based on an assessment of the criticality of the structure
followed by a proportionate modelling approach (i.e. one based on the criticality and
complexity).
©OGP 7
Table 2.8 Dam age Estim ates for Com m on Structures Based on
Overpressure [6]
Pressure Dam age

Psig kPa
0.02 0.14 Annoying noise (137 dB if of low frequency 10-15 Hz)
0.03 0.21 Occasional breaking of large glass windows already under strain
0.04 0.28 Loud noise (143 dB), sonic boom, glass failure
0.1 0.69 Breakage of small windows under strain
0.15 1.03 Typical pressure for glass breakage
0.3 2.07 "Safe distance" (probability 0.95 of no serious damage1 below this
value); projectile limit; some damage to house ceilings; 10%
window glass broken
0.4 2.76 Limited minor structural damage
0.5-1.0 3.4-6.9 Large and small windows usually shattered; occasional damage
to window frames.
0.7 4.8 Minor damage to house structures
1.0 6.9 Partial demolition of houses, made uninhabitable
1.0-2.0 6.9-13.8 Corrugated asbestos shattered; corrugated steel or aluminium
panels, fastenings fail, followed by buckling; wood panels
(standard housing) fastenings fail, panels blown in
1.3 9.0 Steel frame of clad building slightly distorted
2 13.8 Partial collapse of walls and roofs of houses
2.0-3.0 13.8-20.7 Concrete or cinder block walls, not reinforced, shattered
2.3 15.8 Lower limit of serious structural damage
2.5 17.2 50% destruction of brickwork of houses
3 20.7 Heavy machines (3000 lb) in industrial building suffered little
damage; steel frame building distorted and pulled away from
foundations
3.0-4.0 20.7-27.6 Frameless, self-framing steel panel building demolished; rupture
of oil storage tanks
4 27.6 Cladding of light industrial buildings ruptured
5 34.5 Wooden utility poles snapped; tall hydraulic press (40,000 lb) in
building, slightly damaged
5.0-7.0 34.5-48.2 Nearly complete destruction of houses
7 48.2 Loaded, lighter weight (British) train wagons overturned
7.0-8.0 48.2-55.1 Brick panels, 8-12 inch thick, not reinforced, fail by shearing or
flexure
9 62 Loaded train boxcars completely demolished
10 68.9 Probable total destruction of buildings; heavy machine tools
(7,000 lb) moved and badly damaged, very heavy machine tools
(12,000 lb) survive
300 2068 Limit of crater lip
1
Understood to be to typical brick built buildings
8 ©OGP
Table 2.9 Dam age Estim ates Based on Overpressure for Process Equipm ent [7] (legend on next page)
Equipment Overpressure, psi

0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 5.5 6.0 6.5 7.0 7.5 8.0 8.5 9.0 9.5 10.0 12.0 14.0 16.0 18.0 20.0
Control house steel roof A C D N
Control house concrete A E P D N
roof
Cooling tower B F O
Tank: cone roof D K U
Instrument cubicle A LM T
Fixed heater G I T
Reactor: chemical A I P T
Filter H F V T
Regenerator I IP T
Tank: floating roof K U D
Reactor: cracking I I T
Pipe supports P SO
Utilities: gas meter Q
Utilities: electronic H I T
Electric motor H I V
Blower Q T
Fractionation column R T
Pressure vessel: PI T
horizontal
Utilities: gas regulator I MQ
Extraction column I V T
Steam turbine I M S V
Heat exchanger I T
Tank sphere I I T
Pressure vessel: vertical I T
Pump I V
©OGP 9
Legend to Table 2.9:

A. Windows and gauges broken L. Power lines are severed
B. Louvres fail at 0.2-0.5 psi M. Controls are damaged
C. Switchgear is damaged from roof collapse N. Block walls fail
D. Roof collapses O. Frame collapses
E. Instruments are damaged P. Frame deforms
F. Inner parts are damaged Q. Case is damaged
G. Brick cracks R. Frame cracks
H. Debris - missile damage occurs S. Piping breaks
I. Unit moves and pipes break T. Unit overturns or is destroyed
J. Bracing fails U. Unit uplifts (0.9 tilted)
K. Unit uplifts (half tilted) V. Unit moves on foundation
2.2.2 Overpressure Loading

DNV OS-A101 [8] provides some generic overpressure values for various offshore units
including drill rigs, FPSOs and production platforms as detailed in Table 2.10.
Table 2.10 Nom inal Design Blast Overpressures for Various Offshore Units
[8]
The characteristic representation of the overpressure load is via a triangular blast

profile and the response of the plant/structure to the explosion is primarily determined
by the ratio of the blast load duration, td, to the natural period of vibration of the
plant/structure, T as detailed in Table 2.11 [2].
In an impulsive response regime, the blast load is very short compared with the natural
period of the structural element. The duration of the load is such that the load has
10 ©OGP
finished acting before the element has had time to respond. Due to inertial resistance of
the structure, most of the deformation occurs after the blast load has passed. Impulse is
an important aspect of damage-causing ability of this type of blast and may become a
controlling factor in design situations where the blast wave is of relatively short
duration.
In the quasi-static regime, the duration of the blast load is much longer than the natural
period of the structural element. In this case, the blast loading magnitude may be
considered constant while the element reaches its maximum deformation. For quasi-
static loading, the blast will cause the structure to deform while the loading is still
applied.
In the dynamic regime, the load duration is similar to the time taken for the element to
respond significantly. There is amplification of response above that which would result
from static application of the blast load.
Table 2.11 Regim es of Dynam ic Response [2]
Im pulsive t d /T < Dynam ic 0.3 < t d /T < Quasi-static t d /T >

0.3 3.0 3.0
Peak Load Preserving the Preserve peak value - the response is sensitive
exact peak value is to increases or decreases in peak load for a
not critical smooth pressure pulse
Duration Preserving the Preserve load duration Not important if
exact load duration since in this range it is response is elastic
is not critical close to the natural but is critical when
period of the structure. response is plastic.
Even slight changes
may affect response.
Impulse Accurate Accurate representation Accurate
representation of of the impulse is representation of the
impulse is not important impulse is not
critical important
Rise Time Preserving rise Preserving rise time is important; ignoring it
time is not can significantly affect response
important
2.2.3 Drag Loading on Equipment

For the drag loading, the directional force on equipment is given by:
F d = 0.5 ρ A Cd |v| v
where F d is the drag force vector, ρ is the fluid density, A is the maximum cross
sectional area of the object in a plane normal to v, Cd is the drag coefficient and v is the
large scale fluid velocity ignoring spatial fluctuations in the vicinity of the object.
For small obstacle diameters, the drag coefficient can be estimated by using the values
given in Figure 2.1. For equipment with diameters greater than 2 m, it is recommended
to use the Direct Load Measurement (DLM) method in which the pressure difference
between upwind and downwind sides is computed (using Computational Fluid
Dynamics) and multiplied by the obstacle windage area for the X, Y and Z direction. A
description of this approach is given in [9].
©OGP 11
Figure 2.1 Drag Coefficients, C D , for Various Shapes [9]
2.2.4 Response of Plant/Structure

Essentially three methods of analysis are available to calculate the response of a
structure subjected to transient loads as illustrated in Figure 2.2. These methods are
termed:
• Approximate methods
• Single degree of freedom
• Multiple degree of freedom
12 ©OGP
Figure 2.2: Methods of Analysis
Approximate methods are limited to energy methods and static analysis methods. The
energy method (based on principle of equating work done by load to change in strain
energy in structure) are adequate for simple structural elements and load regimes but
for more complex structural elements and load configurations, these methods become
very laborious and time consuming. They are therefore not recommended for any but
the simplest cases. Static analysis methods have been used where quasi-static blast
loads act (i.e. dynamic amplification in response is minimal). As large conservatism can
occur, these methods are generally not recommended.
Single-degree-of-freedom (SDOF) methods are commonly used to model the response
of simple elements to dynamic loading. This method can only be used if the structural
system can be adequately idealised as a single-degree-of-freedom system (i.e. a real
system that is comparatively simple e.g. a single plate or beam). The SDOF model has
the ability to modify equations and parameters if a time-stepping procedure is employed
which enables a nonlinear system to be modelled. This method is most suited if the
primary requirement in determining the behaviour of a blast-loaded structure is its final
state (e.g. maximum displacement) rather than a detailed knowledge of its response
history.
Where a structure cannot be idealised as a SDOF system, a more rigorous approach is
required. This can be obtained by performing a multiple-degree-of-freedom (MDOF)
analysis using numerical techniques e.g. finite element analysis. Such analysis can be
carried out using commercially available software such as ANSYS, ABAQUS, NASTRAN,
DYNA-3D.
It should also be noted that the mechanical properties of materials are affected by the
dynamic loading induced by a blast load. In particular, those materials having definite
yield points and pronounced yielding zones show a marked variation in mechanical
properties with changes in loading rate. Yield strengths are generally higher under rapid
strain rates (as what happens under blast loads) than under slowly applied loads.
The strain rate dependency in steels is generally modelled using the Cowper-Symonds
relationship:
©OGP 13
where σd is the dynamic stress at a particular strain rate, σ is the static stress at a
particular strain rate, is the uniaxial plastic strain rate and D and q are constants
specific to the steel.
Typical values for D and q are as follows:
• Mild steel: D = 40 s-1, q = 5
• Stainless steel (grade 304); D = 100 s-1, q = 10
2.3 Missiles
There are two possible types of missiles/projectiles. Primary missiles result from the
rupture of pressurised equipment such as pressure vessels or failure of rotating
machinery (e.g. gas turbines and pumps). Secondary missiles arise from the passage of
a blast wave which imparts energy to objects in its path. These objects could be small
tools, loose debris and other structures disrupted by the explosion.
Various models for the calculation of the missile velocity and range of missiles are
given in [10] and [11]. However, the models provide no information on the distribution of
mass, velocity or range of fragments to be expected.
Baker et al. ([12],[13]) compiled data on the number and distribution of fragments for 25
accidental bursts as shown in Table 2.12. As the data on most of the events considered
were limited, it was necessary to group similar events into six groups in order to yield
an adequate base for useful statistical analysis. The range for the source energy was
calculated based on the assumption that the total internal energy E of the vessel
contents is translated into fragment kinetic energy.
Baker also performed statistical analysis on each of the groups to yield estimates of
fragment-range distributions and fragment mass distributions as illustrated in Figure
2.3. It should, however, be noted that a number of problems still exist with regard to the
determination of missile loading, namely [9]:
• Fraction of explosion energy which contributes to fragment generation is unclear
• Methods do not exist to predict even the order of magnitude of the number of
fragments produced. Effect of parameters such as material, wall thickness and initial
pressure are not known.
14 ©OGP
Table 2.12 Behaviour of fragm ents in som e vessel explosions [10]
Event Number Explosion Source Vessel Vessel Number of

Group of Material Energy (J) Shape Mass Fragments
Number Events
1 4 Propane, 1.49 to 5.95 × Rail tank 25542 to 14
anhydrous 105 car 83900
ammonia
2 9 LPG 3814 to 3921 Rail tank 25464 28
car
3 1 Air 5.2 × 1011 Cylinder 145842 35
pipe and
spheres
4 2 LPG, 550 Semitrailer 6343 to 31
propylene (cylinder) 7840
5 3 Argon 244 to 1133 × Sphere 48.3 to 187 14
1010
6 1 Propane 24.8 Cylinder 512 11
©OGP 15
Figure 2.3: Fragm ent range distribution from som e accidental events [10]:
(a) event groups 1 and 2, and (b) event groups 3-6 (see Table 2.12 for event
groups)
16 ©OGP

The data set out in Section 2.0 are based on a review of the latest guidance in the
literature. However, the limits of applicability of the data should be recognised
particularly with regard to the damage data.
The vulnerability of plant/structure should generally be assessed via a recognised
analytical framework and should not rely on solely on data provided in Table 2.5 and
Table 2.6 for example. The analytical framework would typically involve numerical
simulations and the depth of those simulations would depend on the complexity of the
problem and the critically of the plant/structure. It is highly recommended that expert
judgement is sought for those assessments.
3.2 Uncertainties
The main area of uncertainty relate to the numerical modelling of plant/structure under
dynamic loads such as blast loading. The complexity of the problem requires
simplifying assumptions regarding the:
• Structural model and boundary conditions
• Loading characteristics
• Geometric nonlinearity
• Material nonlinearity
Comprehensive data on material behaviour at elevated temperatures and under dynamic
loading are not available.

The principal source of the fire and explosion criteria presented in Section 2.0 is the
UKOOA/ HSE Fire and Explosion Guidance [2]; besides the references included in the
table captions and text of Section 2.0, additional information has been obtained from the
following references:
• Fire [11], [14]
• Explosion [14]
The data sources from which the critical temperatures given in Table 2.2 were obtained
are identified in Table 4.1; [2] gives the full references for these data sources.
©OGP 17
Table 4.1 Data sources for com m only used critical tem peratures given in
Table 2.2 [2]
Tem perature Use Source (see Criteria

(°C) [2] for full
reference)
550-620 Structural steel ASFP, 2002 Temperature at which fully
onshore (BS 5950) stressed carbon steel loses
its design margin of safety
427 LPG tanks ISO 23251:2006 Based on the pressure relief
(France and Italy) (2007) valve setting
400 Structural steel ISO 13702, Temperature at which the
offshore 1999 yield stress is reduced to the
minimum allowable strength
under operating loading
conditions
300 LPG tanks LPGA CoP 1, Integrity of LPG vessel is not
(UK and Germany) 1998 compromised at
temperatures up to 300°C for
90 minutes
200 Structural ISO 13702, Temperature at which the
aluminium 1999 yield stress is reduced to the
offshore minimum allowable strength
under operating loading
conditions
180 Unexposed face of ISO 834 BS 476 Maximum allowable
a temperature at only one point
division/boundary of the unexposed face in a
furnace test
140 Unexposed face of ISO 834 BS 476 Maximum allowable average
a temperature of the
division/boundary unexposed face in a furnace
test
40 Surface of safety ISO 13702 Maximum temperature at
related control which control system will
panel continue to function

The following references should be consulted if further information is required.
• Structural Dynamics: [15]
• Structural response to dynamic loading: [16][17]
• Offshore fire and blast loading: [18]
18 ©OGP
6.0 References
[1] Medonos S, 2003. Improvement of Rule Sets for Quantitative Risk Assessment in
Various Industrial Sectors, Safety and Reliability, Proc. ESREL 2003 Conf., Vol. 2,
A.A. Balkema Publishers, ISBN 5809 596 7.
[2] UKOOA/HSE, 2007. Fire and Explosion Guidance, Issue 1.
[3] Steel Construction Institute, 2001. Elevated temperature and high strain rate
properties of offshore steels, Offshore Technology Report OTO 2001 020, Sudbury,
Suffolk: HSE Books. http://www.hse.gov.uk/research/otopdf/2001/oto01020.pdf.
[4] Fire safety engineering. Structural response and fire spread beyond the enclosure of
origin, BS ISO/TR 13387-6:1999, ISBN 0 580 34037 6.
[5] NORSOK N-004 Design of Steel Structures, N-004, Rev.1, December 1998.
[6] Clancey V J, 1972. Diagnostic features of explosion damage, 6th Intl. Meeting on
Forensic Sciences, Edinburgh, Scotland.
[7] Stephens M M, 1970. Minimising damage to refineries from nuclear attack, natural or
other disasters, Office of Oil and Gas, US Department of the Interior.
[8] DNV, 2005. DNV OS-A101, Safety Principles and Arrangements, DNV Offshore
Standard.
[9] Natabelle Technology Ltd., 1999. Explosion Loading on Topsides Equipment, Part 1,
Treatment of Explosion Loads, Response Analysis and Design, Offshore Technology
Report OTO 1999 046, Sudbury, Suffolk: HSE Books.
http://www.hse.gov.uk/research/otopdf/1999/oto99046.pdf.
[10] CCPS, 1994. Guidelines for evaluating the characteristics of vapor cloud explosions,
flash fires and BLEVEs, New York: AIChE.
[11] Lees’ Loss Prevention in the Process Industries, Hazard Identification, Assessment and
Control, 3rd ed., Mannan S (Ed.), 2004.
[12] Baker W E, Kulesz J J, Ricker R E, Westine P S, Parr V B, Vargas L M, and Mosely
P K, 1978. Workbook for Estimating the Effects of Accidental Explosion in Propellant
Handling Systems. NASA Contractors Report 3023, Contract NAS3-20497. NASA
Lewis Research Center, Cleveland, Ohio.
[13] Baker W E, Cox P A, Westine P S, Kulesz J J, and Strehlow R A, 1983. Explosion
Hazards and Evaluation, Amsterdam: Elsevier Scientific Publishing Company.
[14] Steel Construction Institute, 2005. Protection of Piping Systems subject to Fires and
Explosions, Technical Note 8.
6.2 References for other data sources examined

[15] Biggs, J M, 1964. Introduction to Structural Dynamics, New York: McGraw-Hill
Companies.
[16] Steel Construction Institute, 2002. Simplified Methods for Analysis of Response to
Dynamic Loading, Technical Note 7.
[17] Steel Construction Institute, 2007. An Advanced SDOF Model for Steel Members
Subject to Explosion Loading: Material Rate Sensitivity, Technical Note 10.
[18] API, 2006. Recommended Practice for the Design of Offshore Facilities Against Fire
and Blast Loading, API Recommended Practice 2FB, 1st. ed.
©OGP 19

March 2010
Ship/
installation
collisions
RADD – Ship/installation collisions
contents
1.1 Scope ............................................................................................................... 1
1.2 Definitions ....................................................................................................... 1
1.2.1 Collisions .................................................................................................................... 1
1.2.2 Damage ....................................................................................................................... 2
2.1 Basics of ship collision risk modelling......................................................... 3
2.1.1 Collision Frequency ................................................................................................... 3
2.1.2 Collision consequences ............................................................................................ 4
2.2 Overview of historical ship/installation collision information.................... 7
2.3 Passing vessel collisions............................................................................... 9
2.3.1 Shipping traffic patterns and vessel behaviour ...................................................... 9
2.3.2 Best practice collision risk modelling for passing vessels ................................. 11
2.4 Field related vessel collisions ..................................................................... 12
2.4.1 Frequencies of field related vessel collisions ....................................................... 12
2.4.2 Consequences of vessel related field collisions................................................... 16
2.4.3 Collisions of mobile units........................................................................................ 17
2.5 Collision risk management .......................................................................... 18
3.2 Uncertainties ................................................................................................. 18
3.3 Example ......................................................................................................... 18
6.0 References .......................................................................... 20
©OGP
Abbreviations:
AIS Automatic Identification System
ARPA Automatic Radar Plotting Aid
BHN Bombay High North
DP Dynamic Positioning
DSV Diving Support Vessel
ERRV Emergency Response and Rescue Vessel
FPSO Floating Production, Storage and Offloading unit
FPU Floating Production Unit
H 2S Hydrogen sulphide
HC Hydrocarbon
HSE Health and Safety Executive
MSV Multipurpose Support Vessel
REWS Radar Early Warning System
ROV Remotely Operated Vehicle
TEMPSC Totally Enclosed Motor Propelled Survival Craft
TR Temporary Refuge
UK United Kingdom
©OGP

1.1 Scope
This datasheet provides data on ship/installation collision risks in relation to activities
within the offshore oil & gas Exploration and Production industry, for use in
Quantitative Risk Assessment (QRA). The risks related to icebergs are not considered.
Ship traffic may be divided into two groups:
• Passing vessels: Ship traffic which is not related to the installation being
considered, including merchant vessels, fishing vessels, naval vessels and also
offshore related traffic going to and from other installations than that being
considered.
• Field related: Offshore related traffic which is there to serve the installation being
considered, e.g. supply vessels, oil tankers, work vessels.
For passing vessels, collision risk is highly location dependent due to variation in ship
traffic from one location to another. The ship traffic volume and pattern at the specific
location should hence be considered with considerable care. This dependency on
location also means that use of historical data which are averaged over a large number
of different locations, is not possible. For passing vessels, the datasheet therefore
presents best current practice in modelling collisions of passing vessels with offshore
installations rather than recommended frequencies.
Field related offshore traffic refers to those vessels which are specifically visiting the
installation, and is therefore considered to be less dependent of the location of the
installation. The frequency of infield vessel impacts will depend on the durations that
vessels are alongside, the installation layout, environmental conditions, and
procedures, so care is required to ensure these factors are considered appropriately.
In addition, the datasheet presents an overview of historical data on ship collisions that
have occurred, with an emphasis on the circumstances and consequences of the
collisions.
1.2 Definitions
1.2.1 Collisions
Collisions can be divided into two groups:
• Powered collisions (vessel moving under power towards the installation)
• Drifting collisions (vessel drifting towards the installation)
Powered collisions include navigational/manoeuvring errors (human/technical failures),
watch keeping failure, and bad visibility/ineffective radar use. A drifting vessel is a
vessel that has lost its propulsion or steerage, or has experienced a progressive failure
of anchor lines or towline and is drifting only under the influence of environmental
forces.
Table 1.1 sets out the different types of vessels that may collide with an offshore
installation.
©OGP 1
Table 1.1 Categories of Colliding Vessels
Type Of Traffic Vessel Rem arks

Traffic Category Category
Passing Merchant Merchant ships: Commercial traffic passing the area
cargo, ferries
etc.
Naval traffic Surface vessels Both war ships and submarines
Submerged Submerged submarines
vessels
Fishing Fishing vessels Sub-categorised into vessels in
vessels transit and vessels operating in the
area
Pleasure Pleasure vessels Traffic passing the area
Offshore Standby boats Vessels going to and from other
traffic fields
Supply vessels Vessels going to and from other
fields
Offshore tankers Vessels going to and from other
fields
Tow Towing of drilling rigs, flotels, etc.
Field related Offshore Standby vessels Dedicated standby vessels
traffic Supply vessels Visiting supply vessels
Working vessels Special services/support such as
diving vessels, flotels, pipe lay
barges, intervention vessels and
crane barges
Offshore tankers Shuttle tankers visiting the field
Drilling rigs MODUs May collide with fixed installation
either on approach or as a result of
mooring failure
1.2.2 Damage
Sections 2.2 and 2.4.2 present data for the following damage levels as defined in WOAD
[1]:
• Total loss Total loss of the unit including constructive total loss from
an insurance point of view. However, the unit may be
repaired and put into operation again.
• Severe dam age Severe damage to one or more modules of the unit;
large/medium damage to loadbearing structures; major
damage to essential equipment.
• Significant dam age Significant/serious damage to module and local area of the
unit; minor damage to loadbearing structures; significant
damage to single essential equipment; damage to more
essential equipment.
• Minor dam age Minor damage to single essential equipment; damage to
more none-essential equipment; damage to non-loadbearing
structures.
2 ©OGP
• Insignificant dam age Insignificant or no damage; damage to part(s) or

essential equipment; damage to towline, thrusters,
generators and drives.
• Basics of ship collision risk modelling (Section 2.1)
• Overview of historical ship/installation collision information (Section 2.2)
• Passing vessel collisions (Section 2.3)
• Field related vessel collisions (Section 2.4)
• Collision risk reduction (Section 2.5)
2.1 Basics of ship collision risk modelling

The risk arising from collision of a ship with an offshore installation is considered in two
parts: collision frequency and collision consequences.
2.1.1 Collision Frequency

The collision frequency is calculated as:
Collision frequency = Frequency of ship being on collision course ×
Probability that collision is not avoided
For powered collisions, the frequency of a ship being on a collision course can be
estimated from knowledge of shipping traffic in the vicinity of the installation. This is
discussed, for passing vessels, in Section 2.3.2.1.
For drifting collisions, the frequency of a ship being on a collision course depends on
where the ship loses power or steerage, and the direction and strength of the current
and wind.
For a passing vessel, not suffering from propulsion or steerage problems, to collide
with an offshore installation, the following three conditions must occur:
1. The ship needs to be on a collision course with the installation;
2. The navigator/watchkeeper must be unaware of the collision course sufficiently long
for the ship to reach the installation (“watchkeeping failure”);
3. The installation/standby vessel crews must be either be unaware of the developing
situation or be unable to warn the vessel to “normalise” the situation.
Watchkeeping failure is discussed further in Section 2.3.2.1. Measures available to the
operator to prevent a collision can be divided into two categories:
• Standby vessel (or ERRV) intervention: Detection of the errant vessel by radar / AIS /
visual sighting; intervention in the form of VHF communication, or approaching the
vessel and attracting its attention using light and sound signals, such as
pyrotechnics.
• Installation intervention: This is normally limited to VHF communication, assuming
there is a means to detect the errant vessel on the installation, such as radar and/or
AIS.
Standby vessel intervention is normally more effective as the bridge crew consists of
dedicated watch-keepers with maritime training and experience.
©OGP 3
These scenarios can be addressed by using appropriate collision risk models. Care
should be taken that the model used is calibrated against historical data1.
2.1.2 Collision consequences

If a collision occurs, consequences can range from superficial damage to complete loss
of the installation. The damage to the installation depends on:
The Impact Energy, E (kJ), is related to these by E = 0.5
• Size of vessel (M, te)
kMV2
• Speed of vessel where k is the “hydrodynamic added mass constant: k = 1.1
(V, m/s) for end-on (powered) impact, k = 1.4 for broadside (drifting)
impact.
• Point of impact, e.g. legs, conductors, risers, bracings
• Whether angle of impact is head-on, glancing, or sideways-on (broadside)
• Partitioning of impact energy between installation and vessel
Fatalities on the installation as a result of a collision will depend first and foremost on
whether the impending collision has been detected, e.g. by radar or AIS, and whether a
precautionary alarm, evacuation or down-manning has then been carried out. If a vessel
under power is observed on a collision course, the time available for precautionary
evacuation/down-manning will be limited (e.g. typically 30 minutes if observed by radar
down to zero if visual observation only in conditions of poor or night visibility). A
decision may have to be made whether to carry out a precautionary evacuation/down-
manning, which would have to be by TEMPSC or escape direct to sea (see datasheet
Evacuation, Escape and Rescue), or for personnel to remain on the installation. Each of
these carries attendant risks. If a drifting vessel is observed on a collision course, the
time available for response is likely to be much longer and it may be possible to initiate
precautionary evacuation/down-manning by helicopter, or to manoeuvre the vessel /
barge clear of the installation by a security or field support vessel.
Figure 2.1 and Figure 2.2 give example flow charts to determine possible outcomes
given potential collisions by powered and drifting vessels respectively. These figures
are more typical of a fixed production installation than a MODU but illustrate issues that
may need to be considered when analysing ship collisions for any type of installation.
The appropriate flow chart for a specific analysis will depend on the means provided to
detect vessels on a collision course, their availability, and the procedures to decide on
mustering and precautionary evacuation/down-manning. Any or all of these may be
dependent on the weather conditions at the time (e.g. visibility may affect observation,
sea state affects the risks in evacuation by TEMPSC).
Note: Figure 2.1 and Figure 2.2 refer to the ‘TR’ (Temporary Refuge), defined as [14]: “[a] place
provided where personnel can take refuge for a predetermined period whilst investigations,
emergency response and evacuation preparations are undertaken”. Depending on the
jurisdiction, impending ship collision is not necessarily considered to require a TR; however, the
muster location in this scenario is conveniently identified with the TR.
1
Lack of such calibration is often a shortfall of simple models.
4 ©OGP
Figure 2.1 Exam ple Flow Chart for Powered Vessel on Collision Course
with Installation
Note: No specific time value is given to “Early” or “Late” observation of a vessel on a collision
course. “Early” can be considered to be sufficient to muster personnel, make a decision
whether or not to evacuate, and if to evacuate then for TEMPSCs to be sufficiently far away at the
time of collision. “Late” can be considered to give some time to muster at least some personnel
in the TR but insufficient for TEMPSC evacuation; on a bridge linked complex, some personnel
are considered in this example to have insufficient time to reach the TR and therefore to attempt
escape to sea.
©OGP 5
Figure 2.2 Exam ple Flow Chart for Drifting Vessel on Collision Course with
Installation
Note: No specific time value is given to “Early” or “Late” observation of a vessel on a collision
course. “Early” can be considered to be sufficient to initiate helicopter evacuation (considering
the time required to mobilise sufficient helicopters) if this is possible (e.g. sufficient visibility), or
else to muster personnel, and make a decision whether or not to evacuate. “Late” can be
considered to give some time to muster at least some personnel in the TR but insufficient for
TEMPSC evacuation; on a bridge linked complex, some personnel are considered in this
example to have insufficient time to reach the TR and therefore to attempt escape to sea. A
drifting vessel typically moves at 1 to 2 kn so, in this example, it is assumed that the drifting
vessel is observed sufficiently early for at least partial mustering to take place.
The likelihood of receiving an “Early” or “Late” warning will be dependent on the procedures in
place at the field and the detection system that is used. Information on the performance of some
detection systems is available in [13].
6 ©OGP
2.2 Overview of historical ship/installation collision information

WOAD [1] provides details of 465 collision incidents worldwide during 1970-2002, of
which 326 have occurred since 1980. As the collision frequency is strongly location
specific, it is not useful to use these records to estimate absolute collision frequencies.
However, other useful information can be derived.
57 of the 1980-2002 incidents in WOAD can be identified with passing vessels
unconnected with field activity. 189 of the remaining incidents in WOAD occurred
during drilling, production or workover, including 10 during shuttle tanker operations
(loading of liquids). Many of these involved supply vessels, standby vessels or crew
boats. Table 2.1 presents statistics for different levels of damage resulting from
collisions.
Table 2.1 Collisions with Offshore Installations (W orldwide)
Dam age* Passing Vessels Infield Vessels

Num ber Percent Num ber Percent
Total Loss 3 5% 1 0.5%
Severe 19 33% 16 8%
Significant 8 14% 55 29%
Minor 10 18% 65 34%
Insign./No 17 30% 52 28%
All 57 100% 189 100%
* See Section 1.2.2 for definitions of damage categories.
These records do not include the most serious ship-installation collision, that at
Bombay High North (BHN) on 27 July 2005, when an MSV (Multipurpose Support Vessel)
approaching the installation lost control, drifted and collided with the installation. This
resulted in serious oil leakage and a major fire, resulting in the loss, within two hours, of
both the BHN platform and a jackup rig working alongside. A total of 22 fatalities
resulted, on the installation, jackup and MSV; 362 personnel were rescued, some after
spending more than 12 hours in the water [15]. The collision occurred despite the MSV
being DP (Dynamic Positioning) equipped.
Other types of incident in the WOAD database include:
• Collision during towing or mobilizing/demobilizing of MODUs (involving vessels
associated with the activity such as tugs, supply vessels, and anchor handling
vessels).
• Collision during construction/repair (involving vessels involved with the activity
such as crane barges, pipeline barges and tugs).
• Moorings broken when MODU was idle/stacked.
In only one incident did fatalities occur, when a jackup punched through the seabed,
resulting in collapse of two legs; subsequently the jackup drifted into an adjacent unit.
In this incident, there were 2 fatalities and 43 personnel were successfully evacuated.
In 7 incidents, of which 3 were during loading, there was a release of oil from the struck
installation, a pipeline or a loading hose. In one incident, the colliding vessel was
damaged and oil leaked from its fuel and lube oil tanks. In a further 2 incidents, gas
including H2S was released.
©OGP 7
Worldwide passing vessel collision frequencies for the periods 1980-1989 and 1990-
2002 have been estimated separately as shown in Table 2.2. Both passing vessel and
infield vessel collisions have considerably reduced from the earlier to the later period,
by almost 60% for passing vessels and 50% for infield vessels.
Table 2.2 W orldwide Collision Data during 1980-1989 and 1990-2002
Vessel Type Collisions Exposure Collision Frequency

(installation-years) (per installation-year)
1980-1989 1990-2002 1980-1989 1990-2002 1980-1989 1990-2002
-4 -4
Passing 33 24 5.9 × 10 2.5 × 10
56243 97627 -3 -4
Infield 103 86 1.8 × 10 8.8 × 10
Note: figures for Infield vessels exclude loading buoy incidents, for which exposure data is not
available.
DNV has prepared research reports [3], [4] and associated incident databases for the UK
HSE covering accident statistics for offshore installations on the UKCS 1980-2005.
These include 432 events described as ‘Collision’, although not all of these resulted in
actual impact. Table 2.3 summarises the statistics for all recorded collision related
events, including near misses; Table 2.4 presents summary statistics for those events
that resulted in actual impact, however minor. Clearly visiting vessels dominate the
statistics even more completely than they do worldwide. However, as Table 2.5 shows,
only 5% of collision events are classified as ‘Accidents, as compared with 31% of
passing vessel events; most visiting vessel events involve minor scrapes.
The number of collision related events involving passing powered vessels appears to
have increased significantly from 1980-1989 to 1990-2005, possibly due to better
reporting of near misses; however, the frequency of actual collisions has fallen by 30%
to 40%, for both passing and visiting vessels. This may be attributable to improved
communication systems, electronic charting, and navigational techniques, systems and
procedures. Introduction of ARPA and DP systems may also have played a role.
Table 2.3 UKCS Collision Event Data during 1980-1989 and 1990-2005
Vessel Type Events Exposure Event Frequency

1980-1989 1990-2005 1980-1989 1990-2005 1980-1989 1990-2005
-3 -3
Passing 5 42 3.0 × 10 9.1 × 10
1685 4630 -2 -2
Visiting 140 245 8.3 × 10 5.3 × 10
Table 2.4 UKCS Collision Data during 1980-1989 and 1990-2005
Vessel Type Collisions Exposure Collision Frequency

1980-1989 1990-2005 1980-1989 1990-2005 1980-1989 1990-2005
-3 -3
Passing 5 10 3.0 × 10 2.2 × 10
1685 4630 -2 -2
Visiting 132 213 7.8 × 10 4.6 × 10
8 ©OGP
Table 2.5 UKCS Collision Event Categories 1990-2005
Event Passing Vessels Visiting Vessels

Category 1 Num ber Percent Num ber Percent
Accident 13 31% 11 4%
Incident 4 10% 54 22%
Near Miss 23 55% 77 31%
Unsignificant2 2 5% 103 42%
All 42 100% 245 100%
Notes
1. The event categories in this table are not equivalent to those used in Table
2.1.
2. This can be read as “Insignificant” (“Unsignificant is used for consistency
with the original data source: see Table 4.1).
Of the 31 passing vessel collision events listed for fixed installations, 14 (46%) involved
fishing vessels, and of these 3 involved fishing gear becoming entangled with subsea
wellhead equipment rather than vessel impact with the surface installation. 7 (23%) of
these 31 collision events are known to have involved either infield vessels visiting other
installations or shuttle tankers, i.e. 7 of the events are known to have involved field
related vessels.
Visiting vessel collisions are examined in more detail in Section 2.4.
2.3 Passing vessel collisions

2.3.1 Shipping traffic patterns and vessel behaviour
Each of the passing vessel traffic types listed in Table 1.1 behaves in one of several
distinct ways in relation to a installation. This must be considered both when reviewing
traffic data and when estimating collision frequency. Each type is discussed in the
following sub-sections, with an evaluation of relevant traffic patterns and vessel
behaviour in the vicinity of offshore installations.
2.3.1.1 Merchant Vessels

Merchant vessels are frequently found to represent the greatest installation collision
hazard, since:
• Merchant vessels are often large and may thus represent considerable impact
energy.
• Traffic may be very dense in some areas.
• Oil and gas operators have no prevailing influence.
In addition there is a problem with the uncertainties in the risk estimates, which are
higher than for many of the other vessel groups as merchant vessel operating
standards vary.
©OGP 9
2.3.1.2 Naval Traffic

Estimating risk associated with naval vessels is difficult because information about
movements and volume is restricted and hence difficult to obtain. Estimation very often
has to be based on surveys or subjective evaluation. Further, the naval traffic volume is
difficult to assess since possible routes and areas where naval vessels operate/exercise
can vary from year to year. The variation in traffic routes and density can also be
dependent on the political situation.
Naval traffic may be divided into two main categories, surface traffic (submarines
included) and submerged traffic.
2.3.1.2.1 Surface Traffic

As for merchant vessels, collisions are either due to drifting of the vessel or may occur
while the vessel is under power (errant vessels).
As regards collisions under power, it may be acceptable to disregard this scenario as
these vessels have a large crew compared to merchant vessels. They will always have
at least two persons on the bridge (large vessels such as frigates, destroyers and
aircraft carriers will have more personnel on the bridge). Normally the operations room
is also manned. Considering the number of personnel on watch it seems very unlikely,
compared to a merchant vessel, that a naval surface vessel should not know of or
detect the installation, and avoid it. In addition, naval vessels are more likely to operate
in groups, which also will reduce the collision probability. Submarines operating on the
surface are not considered to represent any higher threat to the installation than any
other surface vessel.
Overall, it is considered that the contribution to overall collision risk from such vessels
is in general likely to be very low.
2.3.1.2.2 Submerged Submarine Traffic

As for naval surface vessels, due to a reduced probability of drifting combined with a
relatively low number of vessels, the contribution from drifting submarines to the
overall collision risk is negligible.
Submerged submarines are in a special situation because they do not have a look-out.
Navigation is therefore completely dependent on electronic navigational aids and sonar.
In principle submarines are officially restricted from operating in the immediate vicinity
of offshore installation in times of peace. Nevertheless a 1988 incident when a
submarine collided with Norsk Hydro’s Oseberg B platform shows a deviation from this
principle. In connection with this accident, it was stated that it was often very difficult
for submarines to detect platforms, which do not emit much sound in the water.
Some data on submarine traffic have been collected [2]. At the time of publication
(1995), an appropriate number of submarines active in the entire North Sea, at all times,
seems to have been in the region of 15 to 25. It is not known if this has changed
appreciably since then.
2.3.1.3 Fishing Vessels

Fishing vessels are divided into two groups, depending on the operational pattern:
• Fishing vessels in transit from the coast to and from different fishing areas.
• Vessels may be fishing in an area. The vessels’ operation and behaviour during
fishing (primarily trawling) will be complex and varied, but usually at low speed and
with no preferred heading.
10 ©OGP
Fishing vessels vary in size from large factory/freezer ships to smaller vessels operating
near the coast. Typically, a large fishing vessel will have a displacement around
1000 tonnes. This implies that the collision energy will be less than 20 MJ. For a typical
North Sea installation neither drifting vessels nor vessels under power will normally be
able to threaten the installation’s integrity.
However, risers and other relevant equipment have considerably less impact resistance;
being typically much smaller than merchant vessels, it is also more likely that a fishing
vessel may pass between the legs of an installation and reach risers or conductors.
Collisions of both powered and drifting fishing vessels should therefore be considered,
taking this into account.
2.3.1.4 External Offshore Traffic

Passing offshore vessels and tankers as well as supply, standby and work vessels are
in many respects similar to passing merchant vessels, except that such vessel
operations tend to be more aware of the offshore installations and also may benefit from
operator influence (procedure, training competency, communication etc.).
Vessels or installations under tow pose particular problems which are considered
separately (Section 2.4.3).
2.3.2 Best practice collision risk modelling for passing vessels

2.3.2.1 Collision frequency estimation
As set out in Section 2.1.1, there are two parts to this:
1. Estimating the frequency of a ship being on a collision course
2. Estimating the probability that collision is not avoided
The first of these is strongly dependent on the installation’s location with respect to
shipping traffic, and also on the installation’s size (although, in a bridge linked complex,
for some approach directions one platform may be shielded by another).
Shipping databases are available to assist in this task such as ShipRoutes. Where
possible, other methods of logging vessel tracks in and around a field can be
implemented such as Automatic Identification Systems (AIS). This can be achieved
using systems such as AISTracker and will provide an enhanced understanding of the
behaviour of shipping around the field. This offers considerable benefit to collision risk
assessment work in relation to passing and infield vessel risk assessment. Details are
provided on ship type, size, speed, navigation status, etc.
Fishing vessel activity can be assessed by processing satellite tracking data on fishing
vessel movements: this has already been done, for example, for part of the North Sea
(Anatec – unpublished).
Based on the work undertaken within the HSE’s OTO 1999 052 study [9], the following
causes of ineffective watchkeeping were identified:
• Watch-keeper present on bridge but:
o Busy/preoccupied with other tasks
o Asleep
o Incapacitated due to sickness, accident or substance abuse
• Watch-keeper absent from the bridge
• Poor visibility combined with undetected radar fault.
Further discussion on each of these causation factors is provided in the OTO report [9].
©OGP 11
The probability of radar failure can be estimated from reliability data for the system
concerned (considering all parts: radar, processor, power supply, display).
One widely used model which takes account of these factors when assessing passing
ship collision is COLLRISK [12]. Based on analysis of collision data for the region of
interest (e.g., North Sea), as well as traffic data and installation operating experience,
the model has been back-tested to ensure it provides results in line with experience. As
well as the calibration factor, the main influences on the collision risk are traffic
volumes in proximity to the installation, ship characteristics (e.g. type, size and speed),
installation dimensions/orientation, and metocean data, in particular visibility. The
model can also take into account the benefits of various risk reducing measures.
2.3.2.2 Collision consequences

As shown in Table 2.1, collisions of passing vessels can result in damage ranging from
insignificant to total loss. Table 2.1 shows that almost 40% of such collisions resulted
in severe damage or total loss, although none of these resulted in fatalities to
installation personnel.
Initially, the damage breakdown in Table 2.1 could be used directly in a QRA together
with suitable assumptions about warning, mustering and precautionary evacuation
(using a flow chart such as the examples in Figure 2.1 and Figure 2.2). Although no
fatalities have occurred to date as a result of a passing vessel collision, the Bombay
High North incident summarised in Section 2.2 demonstrates that a major accident
involving fatalities is credible, especially if escalation to a hydrocarbon fire or explosion
occurs.
If this relatively simple approach indicates high ship collision risks, then more detailed
analysis may be required in order to demonstrate that the simple approach is
conservative. This could involve structural analysis of the effect of a vessel collision
with the installation2.
2.4 Field related vessel collisions

2.4.1 Frequencies of field related vessel collisions
Unlike passing vessel collisions, the dependency of field related vessel collisions on
geographical location is largely limited to metocean conditions and allowable weather
criteria; conversely, field related vessel collisions are strongly dependent on the field
activities (drilling or production) and on the associated support requirements (e.g.
provision of supplies, anchor handling, diving support).
Table 2.6 presents worldwide field related vessel collision statistics based on WOAD [1]
and corresponding exposure data3 [8]. This shows much lower collision frequencies for
fixed platforms compared with FPSOs and FPUs, and wide variation between the
collision frequencies for the different types of FPU. There are also variations between
different types of MODU but these are not so great.
2
Such a project was undertaken in 2008 for a variety of jacket types; it is intended to publish the
outcome of this work.
3
Note that exposure data is here measured by unit-years in service. It should be noted that
collision frequencies for a particular unit will be strongly dependent on the number of visits per
year and on the types of vessel visiting. Such data are not readily available. However, if the unit
being studied can be considered to have a ‘typical’ number of visits per year, then the
frequencies given in Table 2.6 can be used. If field related collision frequencies prove to be an
issue, then a more detailed analysis should be undertaken, using actual data combined with
collision risk modelling.
12 ©OGP
Figure 2.3 shows worldwide collision frequencies for production installations, Figure 2.4
collision frequencies for MODUs; both show error bars corresponding to 90%
confidence limits. From these figures it is concluded:
• The collision frequency for fixed production units is significantly different from
those for FPSOs and FPUs.
• TLPs appear to be subject to a significantly higher collision frequency than jackups
and semi-submersibles.
Table 2.6 Field Related Vessel Collision Statistics (W orldwide)
Unit Type Collisions Exposure Collision

(unit-years) Frequency
(per unit-year)
Production Units
Fixed 77 135122 5.7 × 10 -4
FPSO 4 445 9.0 × 10 -3
TLP 3 88 3.4 × 10 -2
Jackup 1 89 1.1 × 10-2
Semi-submersible 4 363 1.1 × 10-2
All FPU (not FPSOs) 8 540 1.5 × 10-2
Jackups + Semi-subs 5 452 1.1 × 10 -2
Loading Buoy 6 Not available -
Drilling Units (MODUs)
Jackup 41 10743 3.8 × 10-3
Semi-submersible 45 4837 9.3 × 10-3
Drill ship/barge/tender 14 2183 6.4 × 10-3
All MODUs 100 17763 5.6 × 10-3
Figure 2.3 Production Unit Vessel Collision Frequencies (W orldwide)
Error bars indicate 90% confidence limits.
©OGP 13
Figure 2.4 MODU Vessel Collision Frequencies (W orldwide)
Error bars indicate 90% confidence limits.
Table 2.7 shows the proportions of collisions by vessel type.
Table 2.7 Collisions by Vessel Type (W orldwide)
Vessel Type Production MODUs

Units
Supply Vessel 34% 60%
Standby Vessel 19% 11%
Working Vessel 34% 16%
Rig 7% 6%
Shuttle Tanker 3% 1%
Other 3% 5%
Unknown 0% 1%
Generally, collisions with any sort of offshore-related traffic can be more easily
controlled because many of these vessels are operated by the oil companies
themselves, and they can impose restrictions on vessel operations if it is deemed
necessary.
Figure 2.5 shows infield vessel collision frequencies by geographical region.
Comparing this with Table 2.2, it is clear that infield vessel collision frequencies vary
significantly from region to region, even considering only the regions with large
numbers of offshore installations and MODUs operating. Of these areas, the frequency
is highest by far in the North Sea (see also Table 2.9) and has only reduced by 19% over
the two time periods presented. On the UKCS the frequency is even higher relative to
the worldwide average. It is not clear from the data whether these high frequencies are
due to better reporting, especially of minor collisions, the more severe weather
conditions in the North Sea compared with other regions, or better control of infield
vessel movements in other regions. There has been no collision resulting in significant
or severe damage or total loss in the North Sea since 1994.
Table 2.8 gives a detailed breakdown of collisions between visiting vessels and
installations on the UKCS for 1990-2005. This shows considerably higher frequencies.
Table 2.10 shows the distribution of damage levels for the main regions: it shows a
much higher proportion of collisions in the North Sea resulting in insignificant or no
damage than any other region. Nevertheless, even excluding these, or counting those
14 ©OGP
resulting in significant or severe damage or total loss, the North Sea frequency is
significantly higher than any other region.
Table 2.8 UKCS Field Related Vessel Collision Statistics 1990-2005
Unit Type Collisions Exposure Collision

(unit-years) Frequency
(per unit-year)
Production Units
Fixed 90 3383 2.7 × 10 -2
FPSO & FSU 14 265 5.3 × 10 -2
Drilling Units (MODUs)
All MODUs 109 982 1.1 × 10 -1
Figure 2.5 Geographical Variation of Infield Vessel Collision Frequencies
Table 2.9 Geographical Variation of Infield Vessel Collision Frequencies

Com pared to W orldwide Average
Region Fraction of 1990-

2002 W orldwide
Average
Africa 0.36
Asia 0.17
Central & S. America 0.59
Europe: North Sea 9.55
Middle East 0.11
US: Gulf of Mexico 0.24
UKCS* 49.35
* Fraction is based on UKCS 1990-2005 frequency as given in Table 2.4.
©OGP 15
Table 2.10 Infield Vessel Collision Dam age Levels by Region: All
Installations
Geographical Damage Level (see Section 1.2.2 for definitions)

Area Total
Loss Severe Significant Minor Insignif./No
Africa 0% 0% 14% 86% 0%
Asia 0% 0% 44% 33% 22%
Central & S America 0% 17% 33% 33% 17%
Europe: N Sea 0% 5% 16% 31% 48%
Middle East 0% 20% 10% 60% 10%
US-GoM 2% 13% 48% 33% 4%
2.4.2 Consequences of vessel related field collisions

Worldwide average collision damage levels are tabulated for different vessel types and
overall as follows:
• Fixed installations: Table 2.11
• FPSOs: Table 2.12
• FPUs: Table 2.13
• MODUs: Table 2.14
Table 2.11 Collision Dam age Levels by Vessel Type: Fixed Installations
Vessel Type Damage Level (see Section 1.2.2 for definitions)

Total
Loss Severe Significant Minor Insignif./No
Supply 0% 11% 15% 52% 22%
Standby 0% 0% 20% 13% 67%
Barge/Tug 0% 30% 11% 48% 11%
Rig 0% 0% 0% 80% 20%
Shuttle Tanker 0% 0% 33% 33% 33%
Other n/a n/a n/a n/a n/a
Unknown n/a n/a n/a n/a n/a
ALL 0% 14% 14% 44% 27%
Table 2.12 Collision Dam age Levels by Vessel Type: FPSOs

Total Loss Severe Significant Minor Insignif./No
Supply 0% 0% 0% 0% 100%
Standby n/a n/a n/a n/a n/a
Barge/Tug n/a n/a n/a n/a n/a
Rig n/a n/a n/a n/a n/a
Shuttle Tanker n/a n/a n/a n/a n/a
Unknown 0% 0% 33% 33% 33%
ALL 0% 0% 25% 25% 50%
16 ©OGP
Table 2.13 Collision Dam age Levels by Vessel Type: FPUs

Supply 0% 0% 50% 50% 0%
Standby 0% 0% 0% 0% 100%
Barge/Tug 0% 33% 0% 33% 33%
Rig 0% 0% 0% 0% 100%
Shuttle Tanker n/a n/a n/a n/a n/a
Unknown n/a n/a n/a n/a n/a
ALL 0% 13% 13% 25% 50%
Table 2.14 Collision Dam age Levels by Vessel Type: MODUs

Supply 0% 5% 43% 33% 18%
Standby 0% 9% 18% 27% 45%
Barge/Tug 0% 0% 56% 25% 19%
Rig 17% 0% 50% 0% 33%
Shuttle Tanker 0% 0% 40% 20% 40%
Other 0% 0% 0% 0% 100%
Unknown 0% 0% 0% 0% 100%
ALL 1% 4% 42% 28% 25%
Note however that, for example, the Norwegian and the UK criteria for design against
vessel impacts have been derived from a probabilistic evaluation of supply vessel
impacts [6], [7]. These collisions are therefore to a large degree minimized by platform
design. Hence the distribution of damage levels to be expected from field related vessel
collisions in different geographical areas may vary from those tabulated above
according to the installation design criteria. They may also vary according to
operational procedures: for example, an arriving supply vessel may be required to stop
on arrival at the installation exclusion zone (500 m radius) and then proceed at low
speed to the installation. Hence, where more specific information is available on design
criteria and operational procedures, these should be taken into account if the risk levels
are sufficiently high to occasion concern. The trend towards the use of larger,
multipurpose vessels, which may exceed the size the installation was originally
designed for, should also be considered where appropriate.
2.4.3 Collisions of mobile units

9 separate incidents of collisions between installations have been identified in WOAD
[1]. Of these, 1 occurred during hurricane ‘Juan’ (27/10/1985) and 3 during hurricane
‘Andrew’ (27/08/1992). 3 further weather related incidents occurred. Of the remaining 2
incidents, one appears to have been an operational error; in the other case, the
description refers to a drifting rig but does not indicate the cause.
The HSE report [4] and database identifies 5 collision incidents during towing of mobile
units. One involved a collision during preparation for tow-out from the construction
yard; no details are given for the remaining 4 but, based on WOAD information, it is
©OGP 17
possible these involved the towing tugs contacting the unit rather than the unit itself
contacting another unit.
2.5 Collision risk management

Collision risk management is examined in the UK HSE OTO 1999 052 report [9], to which
reference should in the first place be made, in particular to Chapter 7. This commences
with the HSE’s general Safety Management System model as set out in HS(G)65 [10] and
shows how this can be applied specifically to managing ship collision risks. [9] then
presents specific measures for managing in-field and passing vessel collision risks. It
also includes as Appendix B an overview of ship collision detecting and alerting
(hardware) systems. This includes normal setups such as standby vessel with standard
marine radar or ARPA, and more sophisticated systems such as REWS (Radar Early
Warning System using installation-mounted scanners to increase detection range and
provide early warning of vessels on a possible collision course with the installation,
allowing an early decision and response such as precautionary partial or full
evacuation).Although still cited by the HSE [11], this report is already outdated in some
respects in that the general introduction of AIS post-date it. AIS enables tracking and
identification of vessels in the vicinity of an offshore installation with improved range
and accuracy over radar.
Models (e.g. COLLRISK [12]) allow the benefits of such measures to be taken into
account within the risk modelling.

As stressed in Section 2.3.2.1, the frequency of passing vessel collisions with offshore
installations is highly location specific and therefore it is not appropriate to present in
this datasheet any statistical passing vessel collision frequencies. The frequencies
required should be estimated as described in Section 2.3.2.1.
The data selected for presentation in Section 1.2.2 are those which can be considered
valid for use in QRA, at least to determine whether ship collision risks are significant. If
they are, then more detailed analysis of frequencies (for infield vessel collisions) and/or
of consequences may be required.
3.2 Uncertainties
As in all analyses of incident data, the completeness of incident reporting in particular
is open to question, especially as regards potential under-reporting of minor incidents.
However, for a QRA it is those collisions with the potential to result in fatalities,
significant damage or pollution that need to be considered, and reporting of such
incidents is more likely to be complete.
The exposure data (i.e. unit-years) can be considered reliable, although for MODUs they
do not appear to distinguish between units in operation offshore and units laid-up; also,
prior to 1983, geographical data are only available for some regions.
3.3 Example
The frequency of supply vessel collisions causing significant or severe damage or total
loss to a fixed installation in the North Sea is required for a QRA. It is assumed that the
supply vessel visit frequency is typical of such installations.
18 ©OGP
-4
• Worldwide average infield vessel collision frequency = 9.3 × 10 per year (Table 2.2, 1990-
2002)
• North Sea weighting = 9.55 (Table 2.9)
• Fraction of collisions due to supply vessels = 0.34 (Table 2.7, production units)
• Fraction of significant damage + severe damage + total loss = 0.26 (Table 2.11, supply
4
vessels )
Hence the overall frequency of significant supply vessel collisions with the installation
is estimated as:
(9.3 × 10-4) × 9.55 × 0.34 × 0.26 = 7.9 × 10-4
Further, installation specific analysis would be required to determine the consequences

(e.g. damage to conductors, escalation) of such a collision. If the overall risk were
considered high, then more detailed analysis taking into account existing collision risk
management (e.g. supply vessel approach procedures) could be carried out.

The analysis presented in Section 1.2.2 is derived from two sources:
• Worldwide: WOAD incident data [1] for the period 1980-2002 combined with DNV’s
analysis of offshore unit exposure [8] for the same period. The WOAD database has
been used for the detailed information available in it as regards damage levels and
geographical region.
• UKCS: HSE reports [3][4] and associated accident databases for the period 1980-
2005. The reports include exposure data as well as summaries of accident statistics.
The databases give the year, type of unit involved, operation mode and event
category (see below) as well as an event description.
Incidents involving collision recorded in the WOAD database include incidents that have
occurred during transfer of mobile units, to units that were idle, to units under
construction, or to units under repair in port or in a yard. These were eliminated from
consideration, as have units of other types, i.e. not involved in drilling or production.
However, accommodation units are included. The analysis in Section 1.2.2 is therefore
for fixed units offshore and for mobile units operating (drilling or production) offshore.
The UKCS databases distinguish between collision events involving passing vessels
(event code ‘CL’) and collision events involving visiting vessels (event code ‘CN’), The
accident descriptions have been reviewed to identify those that resulted in an actual
collision as well as the type of vessel involved (for passing vessel collisions). Event
categories do not specifically indicate damage levels; they are defined in Table 4.1.
4
The last of these could also have been selected from Table 2.10, taking the North Sea value.
Table 2.11 has been used as the data are specific to a fixed installation and to a supply vessel.
The value is also higher than would have been obtained from Table 2.10 (0.21), hence the result
will be more conservative and hence will accentuate any requirement for more detailed analysis
and/or improved collision risk management.
©OGP 19
Table 4.1 Event Categories in UKCS Database [3][4]
Category Description
A Accident Hazardous situation which have developed into an accidental situation. In
addition, for all situations/events causing fatalities and severe injuries
this code should be used
I Incident Hazardous situation not developed into an accidental situation. Low
degree of damage, but repairs/replacements are required. This code
should also be used for events causing minor injuries to personnel or
health injuries.
N Near-Miss Events that might have or could have developed into an accidental
situation. No damage and no repairs required
U Unsignificant Hazardous situation, but consequences very minor. No damage, no
repairs required. Small spills of crude oil and chemicals are also
included. To be included are also very minor personnel injuries, i.e. "lost
time incidents".

The analysis derived from the WOAD database [1] has used only some of the
information available in the database. Each incident record contains a description (of
varying quality) and (besides the information used in the analysis presented here) also
the following information that could be used for more detailed investigation:
• Accident date
• Unit name
• Human and equipment causes
• Geographical area, shelf and field block
• Numbers of crew and 3rd party fatalities and injuries
• Fluid spilt (if any)
• Repairs required
• Evacuation
The WOAD database also includes collisions that have occurred in situations other than
drilling and production offshore: units that were under transfer, idle, under construction
or under repair in a port or yard. It can therefore be used to obtain information about
collision incidents in these circumstances if required.
The UK HSE has published accident statistics for fixed and floating offshore units on
the UK Continental Shelf 1980-2005 ([3], [4] respectively). These include collisions but
do not give details in the reports; more detailed information is available in the
accompanying databases (available as Excel spreadsheets)
The Petroleum Safety Authority Norway publishes annual reports on risk levels in the
petroleum industry and an annual report including a Facts Section that includes some
information on accidents including collisions.
The US Minerals Management Service publishes numbers of incidents including
collisions by year and provides links to more detailed descriptions of each incident,
however it has not proved possible to obtain the corresponding annual exposure data.
6.0 References
[2] Dovre Safetec AS, 1995. SAFETOW Reference Manual – Risk Assessment of Towing
Operations, Draft Report No. ST-95-CR-015-00.
20 ©OGP
[3] DNV, 2007a. Accident statistics for fixed offshore units on the UK Continental Shelf 1980-
2005, HSE Research Report RR566, Sudbury, Suffolk: HSE Books.
[5] J. P. Kenny, 1988. Protection of Offshore Installations Against Impact, Report No. OTI 88
535, Sudbury, Suffolk: HSE Books.
[6] NPD, 1984. Regulation of Structured Design of Loadbearing Structures.
[7] Department of Energy, 1990. Offshore Installations, Guidance on Design, Construction
and Certification, 4th. ed.
[8] DNV, 2004. Exposure Data for Offshore Installations 1980-2002, Technical Note 22
(unpublished internal document).
[9] HSE, 2000. Effective Collision Risk Management for Offshore Installations, Offshore
Technology Report OTO 1992 052, Sudbury, Suffolk: HSE Books.
http://www.hse.gov.uk/research/otopdf/1999/oto99052.pdf
[10] HSE, 1997. Successful health and safety management, ISBN 0717612767, HS(G)65,
Sudbury, Suffolk: HSE Books.
[11] HSE, 2008. Collision risk management guidance on enforcement, HSE Semi
Permanent Circular SPC/ENFORCEMENT/24.
http://www.hse.gov.uk/foi/internalops/hid/spc/spcenf24.htm
[12] Anatec. COLLRISK. www.anatec.com/collrisk.htm
[13] Anatec, 2007. Assessment of the benefits to the offshore industry from new
technology and operating practices used in the shipping industry for managing
collision risk, HSE RR592.
[14] ISO, 2000. Petroleum and natural gas industries — Offshore production installations —
Requirements and guidelines for emergency response, International Organization for
Standardization, ISO 15544:2000.
[15] ONGC, 2006. Annual Report 2005-06, p33.
http://www.ongcindia.com/download/AnnualReports/annual_reports05-06.htm

Norway
Petroleum Safety Authority Norway.
Annual Report 2007 Facts Section http://www.ptil.no/getfile.php/PDF/FACTS%202008.pdf
Risk Levels in the Petroleum Industry, Trends 2007
http://www.ptil.no/getfile.php/PDF/Summary_rep_2008.pdf
Similar reports available for previous and subsequent years from the above.
USA
Minerals Management Service, OCS Related Incidents, Incident Statistics and
Summaries 1996-2010 http://www.mms.gov/incidents/IncidentStatisticsSummaries.htm
tabulates numbers of incidents including collisions by year and provides links to more
detailed descriptions of each incident.
©OGP 21

March 2010
Major
accidents
RADD – Major accidents
contents
1.1 Application ...................................................................................................... 1
1.2 Definitions ....................................................................................................... 1
2.1 Major offshore accidents ............................................................................... 2
2.1.1 Major offshore accidents resulting in significant fatalities.................................... 2
2.1.2 Major offshore accidents resulting in total loss or severe damage ...................... 9
2.1.3 Major offshore accidents resulting in significant pollution ................................. 17
2.2 Major onshore accidents.............................................................................. 22
2.2.1 Major onshore accidents resulting in significant fatalities .................................. 22
2.2.2 Major onshore accidents resulting in significant property damage ................... 26
3.2 Uncertainties ................................................................................................. 30
4.1 Major offshore accidents ............................................................................. 30
4.2 Major onshore accidents.............................................................................. 31
6.0 References .......................................................................... 31
©OGP
Abbreviations:
BBL Barrels
DECC Department of Energy and Climate Change
FPSO Floating Production, Storage and Offloading Unit
GoM Gulf of Mexico
ITOPF International Tanker Owners Pollution Federation Limited
LNG Liquefied Natural Gas
MMS (US) Minerals Management Services
OLF The Norwegian Oil Industry Association
SBM Synthetic Based Mud
SFT Statens forurensningstilsyn (Norwegian Pollution Control Authority)
US United States (of America)
WOAD World Offshore Accident Databank
©OGP

1.1 Application
This datasheet provides background historical information on major accidents in the
onshore and offshore oil and gas production and process industries, to serve as
background for QRA studies.
The focus of this datasheet is on presenting an overview the range of accident types
and their relative frequency of occurrence, rather than on absolute frequencies.
Attention is focused on major accidents, taken to be those that have resulted in
significant numbers of fatalities, asset damage and/or environmental pollution.
Frequencies have been estimated for several of the accident types most commonly
addressed in QRAs in other datasheets of this set.
1.2 Definitions
• M ajor Accident An accident1 resulting in at least one of:
• Multiple fatalities
• For Offshore units:
 Total Loss or Severe Damage (as defined below)
• For Onshore units:
 Approximately USD 100M property damage
• 1000 barrels of oil spilt
(Note: these definitions should not be treated as implying any
equivalence between the stated levels of fatalities, loss and
environ-mental damage.)
• Total Loss Total loss of the unit including constructive total loss from an
insurance point of view, however the unit may be repaired and put
into operation again (as per definition in WOAD [1]).
• Severe Dam age Severe damage to one of more modules of the unit; large
/medium damage to loadbearing structures; major damage to
essential equipment (as per definition in WOAD [1]).

• Major offshore accidents (Section 2.1)
o Major offshore accidents resulting in significant fatalities (Section 2.1.1)
o Major offshore accidents resulting in total loss or severe damage (Section 2.1.2)
o Major offshore accidents resulting in significant pollution (Section 2.1.3)
• Major onshore accidents (Section 2.2)
o Major onshore accidents resulting in significant fatalities (Section 2.2.1)
1
Road accidents are excluded from this database. They are addressed in the Land Transport
Risks datasheet.
©OGP 1
o Major onshore accidents resulting in significant property damage (Section 2.2.2)

Note that data on major onshore accidents resulting in significant pollution is not
readily available to a standard comparable with that available for offshore accidents;
hence no such data are presented.
2.1 Major offshore accidents

2.1.1 Major offshore accidents resulting in significant fatalities
The WOAD database [1] was searched for all accidents involving fatalities. The data
cover the period 1970 to 2007, in which there were a total of 553 accidents resulting in a
total of 2171 fatalities.
Table 2.1 lists all accidents resulting 10 or more fatalities along with the operating
mode, the main event that caused the accident, the extent of damage involved, and the
geographic area where the platform was operating.
Table 2.2 breaks down the numbers of fatal accidents and fatalities by the type of unit
involved.
Table 2.3 provides a breakdown of fatalities by 5-year periods; the numbers of fatal
accidents and fatalities are graphed in Figure 2.1.
Table 2.4 provides a breakdown of fatalities by geographical area.
2 ©OGP
Table 2.1 Top Offshore Incidents Listed in Decreasing Order of Fatalities Involved: W orldwide, 1970 – 2007 (m ainly [1])
2
Accident Date Installation/ Type of Unit Operation Mode Damage Event Sequence No. of No. of Geographical
1 3
(dd/mm/yyyy) Field Fatalities Injuries Area
06/07/1988 Piper Alpha Jacket Production Total loss Release → Explosion → Fire 167 60 Europe North Sea
27/03/1980 Alexander L Semi- Accommodation Total loss Breakage or fatigue → List → 123 NA Europe North Sea
Kielland submersible Capsizing, overturn, toppling
03/11/1989 Seacrest Drill ship Exploration drilling Severe Breakage or fatigue → 91 0 Asia South
damage Capsizing, overturn, toppling
15/02/1982 Ocean Ranger Semi- Exploration drilling Total loss Breakage or fatigue → 84 0 America North East
submersible Leakage into hull → List →
Capsizing, overturn, toppling
25/10/1983 Glomar Java Drill ship Drilling, unknown Total loss Breakage or fatigue → 81 0 Asia East
Sea phase Leakage into hull → List →
→ Loss of buoyancy or sinking
25/11/1979 Bohai II Jackup Transfer, wet Total loss Breakage or fatigue → 72 0 Asia East
Leakage into hull → List →
06/11/1986 Brent field Helicopter- Other Total loss Breakage or fatigue → 45 2 Europe North Sea
Offshore duty Helicopter accident → Loss of
buoyancy or sinking
16/08/1984 Enchova Jacket Development Significant Blowout → Fire → Explosion 42 19 America South East
Central Drilling damage
11/08/2003 Neelam field Helicopter- Other Total loss Helicopter accident → 27 0 Asia South
Offshore duty Loss of buoyancy or sinking
15/10/1995 DLB 269 Barge (not Transfer, wet Severe Leakage into hull → List → 26 0 Gulf of Mexico, excl.
drilling) damage Capsizing, overturn, toppling US
→
Loss of buoyancy or sinking
02/10/1997 Caspian Sea Helicopter- Other Total loss Helicopter accident → 23 1 Caspian/Black Sea
©OGP 3
2
1 3
15/08/1991 McDermott Lay barge Construct. work Total loss Leakage into hull → 22 NA Asia South
Lay Barge 29 unit Capsizing, overturn, toppling
→
4 4
23/10/2007 Usumacinta Jackup Drilling Severe Collision → Release → Fire 22 NA Gulf of Mexico, excl.
damage US
02/10/1980 Ron Jackup Exploration drilling Minor Blowout 19 19 Middle East
Tappmeyer damage
09/10/1974 Gemini Jackup Drilling, unknown Severe Breakage or fatigue → 18 0 Middle East
phase damage Capsizing, overturn, toppling
→
26/06/1978 Statfjord field Helicopter- Other Total loss Helicopter accident → 18 0 Europe North Sea
08/12/1977 South Marsh, Helicopter- Other Total loss Collision → Helicopter 17 1 US Gulf of Mexico
128A Offshore duty accident → Loss of buoyancy
or sinking
5 5
Jacket Production Minor Collision (helicopter) 17 1 US Gulf of Mexico
damage
13/10/1971 Western Drill barge Exploration drilling Severe Blowout → Explosion → Fire 16 0 America South West
Offshore 2 damage
03/06/1978 Zakum field Helicopter- Other Total loss Helicopter accident → 15 0 Middle East
17/11/1982 NA Helicopter- Other Total loss Collision (helicopter) 15 0 Asia East
Offshore duty
21/12/1987 Eugene Island, Helicopter- Other Total loss Collision → Fire 15 0 US Gulf of Mexico
190 Offshore duty
2
Jackup Stacked Minor Helicopter accident 15 0 US Gulf of Mexico
damage
20/03/1980 off Macae, Helicopter- Other Total loss Breakage or fatigue → 14 0 America South East
Brazil Offshore duty Helicopter accident →
17/10/1985 Trintoc Atlas Mobile unit Construct. work Severe Release → Explosion 14 0 Centr.Amer.East,
(not drilling) unit damage not GoM
4 ©OGP
2
1 3
15/04/1976 Ocean Jackup Mobilizing Total loss Towline failure/rupture → 13 0 US Gulf of Mexico
Express Capsizing, overturn, toppling
13/08/1981 Leman field Helicopter- Other Total loss Helicopter accident 13 0 Europe North Sea
Offshore duty
30/04/1982 Gulf of Helicopter- Other Total loss Helicopter accident → 13 0 Asia South
Thailand Offshore duty Loss of buoyancy or sinking
20/03/1983 B.O.S. 355 Barge (not Construct. work Severe Explosion → Fire 13 32 Africa West
drilling) unit damage
25/11/1990 Adriatic Helicopter- Other Total loss Breakage or fatigue → 13 0 Europe
Offshore duty Helicopter accident South,Mediterr.
18/11/1998 Campeche S. Helicopter- Other Total loss Collision → 13 0 Gulf of Mexico, excl.
field Offshore duty Loss of buoyancy or sinking US
23/11/1977 nr. Varhaug Helicopter- Other Total loss Breakage or fatigue → 12 0 Europe North Sea
field Offshore duty Helicopter accident
08/09/1997 en route Norn Helicopter- Other Total loss Helicopter accident → 12 0 Europe North Sea
field Offshore duty Loss of buoyancy or sinking
02/10/1999 off Dharan, Helicopter- Other Severe Helicopter accident → 12 8 Middle East
Saudi Arabia Offshore duty damage Loss of buoyancy or sinking
27/07/2005 Bombay High Jacket Production Severe Collision → Release → Fire 12 0 Asia South
North damage
29/05/1972 SS, 201 Helicopter- Other Total loss Helicopter accident 11 NA US Gulf of Mexico
Offshore duty
04/06/1980 Opobo, Helicopter- Other Total loss Helicopter accident → 11 0 Africa West
Nigeria Offshore duty Loss of buoyancy or sinking
20/05/1985 Tonkawa Drill barge Transfer, wet Severe List → 11 0 US Gulf of Mexico
damage Capsizing, overturn, toppling
→
Loss of buoyancy or sinking →
Release
03/10/1989 High Island Pipeline Production Significant Collision → Release → 11 4 US Gulf of Mexico
Pipeline damage Explosion → Fire
14/03/1992 Cormorant Helicopter- Other Total loss Helicopter accident → 11 1 Europe North Sea
field Offshore duty Loss of buoyancy or sinking
©OGP 5
2
1 3
6
25/03/1993 Lake NA NA Significant Explosion & Fire 11 NA America South East
Maracaibo damage
15/03/2001 Petrobras P-36 Semi- Production Total loss Explosion → Fire → 11 0 America South East
submersible Capsizing, overturn, toppling
→
Loss of buoyancy or sinking →
Release
16/07/2002 Leman field Helicopter- Other Total loss Helicopter accident → 11 0 Europe North Sea
24/03/2004 NA Helicopter- Other Total loss Helicopter accident → 11 0 US Gulf of Mexico
27/05/1982 nr. Natuna Helicopter- Other Total loss Helicopter accident → 10 0 Asia South
Island Offshore duty Loss of buoyancy or sinking
04/11/1985 Concem Barge (not Construct. work Total loss Capsizing, overturn, toppling 10 0 Europe North Sea
drilling) unit
31/07/1989 Avco 5 Barge (not Transfer, wet Total loss Capsizing, overturn, toppling 10 0 US Gulf of Mexico
drilling)
05/05/1989 Bohai Harbour Helicopter- Other Total loss Breakage or fatigue → 10 0 Asia East
Offshore duty Helicopter accident
06/12/1990 nr. Matak Helicopter- Other Total loss Explosion → 10 2 Asia South
Offshore duty Helicopter accident →
18/01/1995 Ubit Jacket Repair work/ Severe Explosion & Fire 10 23 Africa West
under repair damage
Notes
1: Installation given for installation accidents; field or location given for helicopter accidents
2: Event sequence given as in WOAD [1] except ‘Other’ replaced by ‘Helicopter accident’ where applicable
3: Fatalities and Injuries includes crew members and contract workers
4: Source: [12]
5: Fatalities and Injuries were only in helicopter
6: Source: [8]
NA = Not Available
6 ©OGP
Table 2.2 Breakdown of Incidents and Fatalities by Type of Unit:

W orldwide, 1970 – 2007 [1]
Type Of Unit No. % of No. of % of Total % of

of Total Fatal Total No. No. of Total
1 2 2
units Units Incidents of Fatal Fatalities No. of
Incidents Fatalities
Artificial Island 2 0.1 0 0.0 0 0.0
Barge (not drilling) 62 1.7 9 1.6 44 2.0
Concrete structure 31 0.9 8 1.4 19 0.9
Drill barge 141 3.9 15 2.7 70 3.2
Drill ship 110 3.0 47 8.5 236 10.9
Drilling tender 16 0.4 3 0.5 14 0.6
Flare 10 0.3 0 0.0 0 0.0
FPSO/FSU 22 0.6 4 0.7 8 0.4
Helicopter-Offshore 260 7.2 113 20.4 646 29.8
duty
Jacket 1278 35.2 202 36.5 509 23.4
Jackup 720 19.8 66 11.9 233 10.7
Lay barge 22 0.6 4 0.7 29 1.3
Loading buoy 30 0.8 0 0.0 0 0.0
Mobile unit (not 18 0.5 6 1.1 21 1.0
drilling)
Other 8 0.2 1 0.2 1 0.0
Other/Unkn. fixed 7 0.2 1 0.2 2 0.1
structure
Pipeline 236 6.5 5 0.9 19 0.9
Platform rig 1 0.0 0 0.0 0 0.0
Semi-submersible 326 9.0 47 8.5 292 13.5
Ship, not drilling or 26 0.7 12 2.2 17 0.8
production
Submersible 42 1.2 3 0.5 3 0.1
Subsea installation 22 0.6 0 0.0 0 0.0
Tension leg 13 0.4 2 0.4 2 0.1
platform
Well support 229 6.3 5 0.9 6 0.3
structure
Totals 3632 100.0 553 100.0 2171 100.0
Notes
1. Since WOAD is an incident database only (i.e., it does not provide unit operating years), the
numbers in this row represent the frequency of the unit in the incident database.
2. To avoid double counting of fatal accidents and fatalities, the number given is for the
installation/ vessel/aircraft which suffered fatalities (e.g. helicopter hits offshore
platform/installation/vessel, crew/passenger(s) in helicopter killed give number of fatalities
and fatal accident is recorded on the helicopter)
©OGP 7
Table 2.3 Breakdown of Fatalities by Year Period: W orldwide, 1970 – 2007

[1]
Year Period No. of Fatal % of Total No. No. of % of Total No.

Incidents of Fatal Fatalities of Fatalities
Incidents
1970-1975 94 17.0 188 8.7
1976-1980 107 19.3 320 14.7
1981-1985 112 20.3 639 29.4
1986-1990 83 15.0 568 26.2
1991-1995 39 7.1 114 5.3
1996-2000 40 7.2 134 6.2
2000-2005 55 9.9 158 7.3
2006-2007 23 4.2 50 2.3
Total 553 100.0 2171 100.0
Figure 2.1 Breakdown of Num ber of Fatalities and Num ber of Incidents by
Year Period: W orldwide, 1970 – 2007
Note
1. This chart shows, for each period, the percentage of total incidents/fatalities in 1970-2007
that occurred during that period. (As the numbers of installations have varied during this
time, they cannot be used to estimate per-installation incident frequencies or fatality rates.)
2. The period 2006-2007 represents only 2 years’ data whereas the previous periods are 5 years.
8 ©OGP
Table 2.4 Breakdown of Fatalities by Geographical Area: W orldwide, 1970 –

2007 [1]
Geographica No. of Fatal % of Total No. No. of % of Total No.

l Area incidents of Fatal Fatalities of Fatalities
Incidents
US GoM 344 62.2 611 28.1
Europe N.S. 88 15.9 574 26.4
Asia + 41 7.4 443 20.4
Australia
Other 80 14.5 543 25.0
Totals 553 100.0 2171 100.0
2.1.2 Major offshore accidents resulting in total loss or severe damage

Table 2.5 to Table 2.7 give the numbers of major accidents resulting in total loss by unit
type, worldwide for the period 1970 to 2007, taken from WOAD [1], broken down further
as follows:
• By Operation Mode: Table 2.5
• By Main Event: Table 2.6
• By Geographical Area: Table 2.7
Table 2.8 to Table 2.10 give the numbers of major accidents resulting in severe damage
by unit type, worldwide for the period 1970 to 2007, taken from WOAD [1], broken down
further as follows:
• By Operation Mode: Table 2.8
• By Main Event: Table 2.9
• By Geographical Area: Table 2.10
©OGP 9
Table 2.5 Num ber of Total Losses by Type of Unit and Operation Mode: W orldwide, 1970 – 2007 [1]
Type of Unit Operation mode (see below for key to codes)

AB AC CP C DM DR ID LO MO OT PR RE SC SE ST TE TR UC W Tota
W O l
Artificial Island 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1
Barge (not drilling) 0 0 0 4 0 0 0 0 0 0 0 0 0 1 0 0 3 0 1 9
Concrete structure 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1
Drill barge 0 0 2 0 0 9 0 0 1 0 0 0 0 0 0 0 1 0 2 15
Drill ship 0 0 0 0 0 3 0 0 0 0 0 0 0 0 0 0 1 0 0 4
Drilling tender 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1
Flare 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
FPSO/FSU 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
Helicopter-Offshore duty 0 0 0 0 0 0 0 0 0 145 0 0 0 0 0 0 0 0 0 145
Jacket 1 0 0 0 0 10 1 0 0 0 15 0 1 0 0 0 0 2 3 33
Jackup 0 0 0 3 0 30 1 0 9 1 1 0 1 3 1 0 27 0 4 81
Lay barge 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 2
Loading buoy 0 0 0 0 0 0 0 3 0 0 0 0 0 0 0 0 0 0 0 3
Mobile unit (not drilling) 0 0 0 2 0 0 0 0 0 0 0 0 0 0 1 0 3 0 0 6
Other fixed structure 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
Pipeline 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 0 0 2
Semi-submersible 0 1 1 0 0 4 0 0 0 0 1 0 0 0 0 0 2 1 0 10
Ship, not drilling or
production
Submersible 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 1 0 0 2
Subsea installation 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
Well support structure 0 0 0 0 0 0 0 0 0 0 3 0 0 0 0 0 0 0 0 3
Total 1 1 3 10 57 2 3 10 146 21 1 2 4 2 41 4 10 318
10 ©OGP
Code Operation Mode Code Operation Mode Code Operation Mode Code Operation Mode Code Operation Mode
AB Abandonment of DM Demobilizing MO Mobilizing SC Scrapped TR Transfer
production
AC Accommodation DR Drilling OT Other SE Service UC Under construction
CP Completion ID Idle PR Production ST Stacked WO Well workover
CW Construction work LO Loading of liquids RE Repair work/under TE Testing
repair
Table 2.6 Num ber of Total Losses by Type of Unit and Main Event: W orldwide, 1970 – 2007 [1]
Type of Unit Main event (see below for key to codes)

AN BL CA CL CN CR EX FA FI FO GR HE LE LI LG MA OT PO ST TO WP Total
Artificial Island 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1
Barge (not drilling) 0 0 5 0 0 0 0 0 1 1 2 0 0 0 0 0 0 0 0 0 0 9
Concrete structure 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1
Drill barge 0 0 4 0 0 0 0 0 8 2 1 0 0 0 0 0 0 0 0 0 0 15
Drill ship 0 0 4 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 4
Drilling tender 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 1
Flare
FPSO/FSU
Helicopter-Offshore duty 0 0 0 11 13 0 0 0 2 119 0 0 0 0 0 0 0 0 0 0 0 145
Jacket 0 1 6 5 0 0 0 0 16 1 0 0 0 1 1 0 0 0 2 0 0 33
Jackup 0 0 47 1 1 0 0 1 10 8 3 0 2 3 0 0 0 0 5 0 0 81
Lay barge 0 0 1 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 2
Loading buoy 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 3 0 0 3
Mobile unit (not drilling) 0 0 1 1 0 0 0 0 0 2 2 0 0 0 0 0 0 0 0 0 0 6
Other fixed structure
Pipeline 0 0 0 0 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 2
Semi-submersible 0 0 4 0 0 0 0 0 3 2 1 0 0 0 0 0 0 0 0 0 0 10
production
Submersible 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 2
Subsea installation
Well support structure 0 1 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 3
Total 0 2 73 18 14 0 0 1 40 140 10 0 3 4 1 0 0 0 12 0 0 318
©OGP 11
Code Main Event Code Main Event Code Main Event Code Main Event Code Main Event
AN Anchor/mooring failure CR Crane accident GR Grounding MA Machinery/propulsion failure WP Well problem, no blowout
BL Blowout EX Explosion HE Helicopter accident OT Other
CA Capsizing, overturn, toppling FA Falling load / Dropped object LE Leakage into hull PO Out of position, adrift
CL Collision, not offshore units FI Fire LG Release of fluid or gas ST Breakage or fatigue
CN Collision, offshore units FO Loss of buoyancy or sinking LI List, uncontrolled inclination TO Towline failure/rupture
12 ©OGP
Table 2.7 Num ber of Total Losses by Type of Unit and Geographical Area: W orldwide, 1970 – 2007 [1]
Type of unit Geographical Area

Europe
US GoM N.S. Asia Australia Other Total
Artificial Island 0 0 0 0 1 1
Barge (not drilling) 4 1 1 2 1 9
Concrete structure 0 1 0 0 0 1
Drill barge 7 0 1 0 7 15
Drill ship 0 0 3 0 1 4
Drilling tender 0 0 0 0 1 1
Flare
FPSO/FSU
Helicopter-Offshore duty 52 28 29 4 32 145
Jacket 17 1 9 0 6 33
Jackup 36 4 18 1 22 81
Lay barge 0 0 1 0 1 2
Loading buoy 0 3 0 0 0 3
Mobile unit (not drilling) 4 1 0 0 1 6
Other fixed structure
Pipeline 0 2 0 0 0 2
Semi-submersible 0 4 0 0 6 10
production
Submersible 2 0 0 0 0 2
Subsea installation
Well support structure 3 0 0 0 0 3
Total 125 45 62 7 79 318
©OGP 13
Table 2.8 Num ber of Accidents with Severe Dam age by Type of Unit and Operation Mode: W orldwide, 1970 – 2007 [1]
Type of Unit Operation mode (see below for key to codes)

AB AC CP C DM DR ID LO MO OT PR RE SC SE ST TE TR UC W Tota
W O l
Artificial Island 0 0 0 4 0 0 0 0 0 0 0 1 0 0 0 0 6 0 0 11
Barge (not drilling) 0 0 0 0 0 0 0 0 0 0 2 0 0 0 0 0 0 1 0 3
Concrete structure 0 0 1 0 0 15 0 0 0 0 0 0 0 0 1 0 4 1 1 23
Drill barge 0 0 0 0 0 7 0 0 0 0 0 0 0 0 0 0 2 0 0 9
Drill ship 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 2
Drilling tender
Flare
FPSO/FSU 0 0 0 0 0 0 0 0 0 55 0 0 0 0 0 0 0 0 0 55
Helicopter-Offshore duty 0 2 3 0 0 17 0 0 0 0 149 1 1 0 0 0 1 10 5 189
Jacket 0 1 0 6 4 44 3 0 23 3 1 1 0 2 1 1 32 1 4 127
Jackup 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1
Lay barge 0 0 0 0 0 0 0 3 0 0 0 0 0 0 0 0 0 0 0 3
Loading buoy 0 0 0 3 0 0 0 0 0 0 0 0 0 0 0 0 2 0 0 5
Mobile unit (not drilling) 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 1
Other fixed structure 0 0 0 0 0 0 0 0 0 0 148 0 0 0 0 0 0 4 0 152
Pipeline 0 1 0 0 0 15 1 0 1 0 2 1 0 0 1 1 3 3 1 30
Semi-submersible 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1
Ship, not drilling or 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 1 0 3
production
Submersible 0 0 0 0 0 1 0 0 0 0 2 0 0 0 0 0 0 1 0 4
Subsea installation 0 0 0 0 0 1 0 0 0 0 83 0 0 0 0 0 0 0 0 84
Well support structure 0 4 4 13 4 105 4 3 25 58 388 4 1 2 3 2 50 22 11 703
Total
14 ©OGP
Code Operation Mode Code Operation Mode Code Operation Mode Code Operation Mode Code Operation Mode
AB Abandonment of DM Demobilizing MO Mobilizing SC Scrapped TR Transfer
production
AC Accommodation DR Drilling OT Other SE Service UC Under construction
CP Completion ID Idle PR Production ST Stacked WO Well workover
CW Construction work LO Loading of liquids RE Repair work/under TE Testing
repair
Table 2.9 Num ber of Accidents with Severe Dam age by Type of Unit and Main Event: W orldwide, 1970 – 2007 [1]
Type of Unit Main event (see below for key to codes)

AN BL CA CL CN CR EX FA FI FO GR HE LE LI LG MA OT PO ST TO WP Total
Artificial Island
Barge (not drilling) 0 0 3 0 0 0 0 0 1 4 3 0 0 0 0 0 0 0 0 0 0 11
Concrete structure 0 0 0 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 1 0 0 3
Drill barge 0 0 5 0 0 0 0 0 11 4 1 0 0 0 0 0 0 0 2 0 0 23
Drill ship 0 1 1 2 0 0 0 2 0 0 1 0 0 0 0 0 0 0 2 0 0 9
Drilling tender 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 2
Flare
FPSO/FSU
Helicopter-Offshore duty 0 0 0 3 10 0 0 2 0 1 0 0 0 0 0 0 39 0 0 0 0 55
Jacket 0 1 79 18 6 0 5 3 44 9 0 0 0 2 3 0 0 0 19 0 0 189
Jackup 0 3 29 3 3 0 2 1 14 11 8 0 3 11 0 0 0 2 36 1 0 127
Lay barge 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1
Loading buoy 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 0 0 3
Mobile unit (not drilling) 0 0 1 0 1 0 1 0 0 1 0 0 0 0 0 0 0 0 1 0 0 5
Other fixed structure 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1
Pipeline 0 0 0 7 0 0 2 0 4 0 0 0 0 0 117 0 0 0 21 1 0 152
Semi-submersible 0 0 0 1 4 0 4 5 1 6 0 2 0 0 0 1 0 5 1 0 30
0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 1
production
Submersible 0 0 0 0 0 0 0 0 2 0 1 0 0 0 0 0 0 0 0 0 0 3
Subsea installation 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 2 0 0 4
Well support structure 0 1 69 8 0 0 0 1 1 1 0 0 0 1 1 0 0 0 1 0 0 84
Total 0 6 189 42 24 0 10 13 86 33 21 0 5 14 122 0 40 2 93 3 0 703
©OGP 15
Code Main Event Code Main Event Code Main Event Code Main Event Code Main Event
AN Anchor/mooring failure CR Crane accident GR Grounding MA Machinery/propulsion failure WP Well problem, no blowout
BL Blowout EX Explosion HE Helicopter accident OT Other
CA Capsizing, overturn, toppling FA Falling load / Dropped object LE Leakage into hull PO Out of position, adrift
CL Collision, not offshore units FI Fire LG Release of fluid or gas ST Breakage or fatigue
CN Collision, offshore units FO Loss of buoyancy or sinking LI List, uncontrolled inclination TO Towline failure/rupture
Table 2.10 Number of Accidents with Severe Damage by Type of Unit and Geographical Area: Worldwide, 1970 – 2007 [1]
Type of unit Geographical Area

Asia +
US GoM Europe N.S. Australia Other Total
Barge (not drilling) 1 0 3 7 11
Concrete structure 1 2 0 0 3
Drill barge 13 0 4 6 23
Drill ship 0 1 5 3 9
Drilling tender 1 0 1 0 2
Helicopter-Offshore duty 32 12 6 5 55
Jacket 151 7 19 12 189
Jackup 60 5 39 23 127
Lay barge 0 0 0 1 1
Loading buoy 0 2 0 1 3
Mobile unit (not drilling) 2 0 0 3 5
Other fixed structure 0 0 0 1 1
Pipeline 133 9 6 4 152
Semi-submersible 10 14 3 3 30
production 0 0 1 0 1
Submersible 3 0 0 0 3
Tension leg platform 4 0 0 0 4
Well support structure 82 1 0 1 84
Total 493 53 87 70 703
16 ©OGP
2.1.3 Major offshore accidents resulting in significant pollution

2.1.3.1 Spills from offshore E&P installations
Table 2.11 gives the numbers of blowouts resulting in pollution worldwide and for
selected geographical areas, taken from SINTEF’s blowout database [6]. Categorisation
of spill size is from this database. Table 2.12 gives the fractions of all blowouts that
result in pollution, overall and by spill size category.
Table 2.11 Blowouts Resulting in Pollution, by Geographical Area, 1970 –

2007 [6]
Location Total No. Blowouts with Pollution

of
Large Medium Small Unknown Total
Blowouts
UK 30 0 0 0 0 0
Norway 34 1 0 1 1 3
D/DK/NL 2 0 0 0 0 0
North Sea* 66 1 0 1 1 3
US GoM 273 5 9 40 9 63
Worldwide 498 22 11 56 39 128
* Includes UK West of Shetland
Table 2.12 Fractions of Blowouts with Pollution, by Geographical Area,

1970 – 2007 [6]
Location Fraction Fraction of Blowouts with

of Defined Spill Size
Blowouts Large Medium Small
w.
Pollution
UK 0 - - -
Norway 0.088 0.50 0.00 0.50
D/DK/NL 0 - - -
NS/WoS 0.045 0.50 0.00 0.50
US GoM 0.23 0.09 0.17 0.74
Worldwide 0.26 0.25 0.12 0.63
Table 2.13 gives details of large spills (defined here as > 1000 BBL) in the US Gulf of
Mexico during 1970 – 2007, excluding those resulting from Hurricane Rita on 24/09/2005,
which are given separately in Table 2.14 and Figure 2.2 shows the corresponding
proportions of incidents and spill volumes by material spilt.
©OGP 17
Table 2.13 Large Spills (> 1000 BBL) from Platform s in the US Gulf of
Mexico, 1970 – 2007 [2]
Date Spill Size Material Operation

(BBL)
1
01/12/1970 53,000 Oil Completion/Workover
1
10/02/1970 30,000 Oil Production
17/04/1974 19,833 Oil Pipeline
07/02/1988 15,576 Oil Pipeline/Marine Vessel
24/01/1990 14,423 Condensate Pipeline
29/09/1998 8,212 Oil Pipeline
11/12/1981 5,100 Oil Pipeline/Marine Vessel
2 2
24/09/2005 5,066 Condensate + Production + Drilling
Diesel
12/05/1973 5,000 Oil Pipeline
06/05/1990 4,569 Oil Pipeline
16/11/1994 4,533 Condensate Pipeline
18/12/1976 4,000 Oil Pipeline
11/09/1974 3,500 Oil Pipeline
23/07/1999 3,200 Oil Pipeline
2
01/03/2002 3,000 SBM Drilling
21/01/2000 2,240 Oil Pipeline
31/08/1992 2,000 Oil Pipeline
23/11/1979 1,500 Diesel Drilling/Marine Vessel
3
19/01/2000 1,440 SBM Drilling
3
21/05/2003 1,421 SBM Drilling
26/01/1998 1,211 Condensate Pipeline/Marine Vessel
3
21/10/2007 1,061 SBM Drilling
3
11/04/2004 1,034 SBM Drilling
Totals
Number Spill Size Material Average Spill Size
(BBL) (BBL)
16 174,621 Oil 10,914
1 1,500 Diesel 1,500
3 20,167 Condensate 6,722
5 7,956 SBM 1,591
25 204,244 All 8,170
1
Blowout incident
2
Hurricane Rita: total spill of 5,066 (BBL) comprised 3 spills as listed in Table 2.14
3
SBM = Synthetic Based Mud
Table 2.14 Detail of Spills Resulting from Hurricane Rita [2]
Date Spill Size Material Operation

(BBL)
24/09/2005 2,000 Condensate Production
24/09/2005 1,572 Diesel Drilling
24/09/2005 1,494 Diesel Drilling
Total 5,066
18 ©OGP
Figure 2.2 Proportions of Incidents and Spill Volum es by Material Spilt
Table 2.15 and Figure 2.3 present data on all spills offshore UK and Norway by year.
©OGP 19
Table 2.15 Spills by Year Offshore UK (1991 – 2007) [3] and Norway (1996 –
2007) [4]
Year United Kingdom Norway

Number of Spill Size Number of Spill Size
Spills (BBL) Spills (BBL)
1991 N/A 1,407 N/A N/A
1992 N/A 1,649 N/A N/A
1993 N/A 1,642 N/A N/A
1994 N/A 1,275 N/A N/A
1995 N/A 616 N/A N/A
1996 N/A 931 9 227
1997 26 6,348 10 680
1998 14 1,004 15 1,158
1999 21 880 12 1,076
2000 18 3,841 5 214
2001 17 689 7 314
2002 18 704 9 686
2003 10 828 11 5,518
2004 13 550 10 483
2005 10 551 6 2,372
2006 4 195 7 768
2007 10 459 12 28,238*
* This includes a large oil spill from the Statfjord field caused by the rupture of a
loading hose on the Offshore Loading System. An estimated 27,500 barrels of oil was
pumped into the sea amounting to 99% of the total oil spilled in 2007. This is the
second-largest spill in Norwegian petroleum history.
20 ©OGP
Figure 2.3 Spills by Year in UK (1991 – 2007) [3]and Norway (1996 – 2007)
[4]
2.1.3.2 Tanker spills

Table 2.16 presents data on major tanker spills worldwide since 1970, comprising those
of the ITOPF [5] “top 20” tanker spills during this period (only the Torrey Canyon incident
of 1969 is thereby omitted from the ITOPF “top 20”) and other significant tanker spill
incidents.
©OGP 21
Table 2.16 Major Tanker Spills W orldwide 1970 – 2007 ([5] and others)
Date Tanker Spill Location Spill Size (te)

19/07/1979 Atlantic Empress Off Tobago, West Indies 287,000*
28/05/1991 ABT Summer 700 nautical miles off Angola 260,000
06/08/1983 Castillo de Bellver Off Saldanha Bay, South Africa 252,000
16/03/1978 Amoco Cadiz Brittany, France 223,000
11/04/1991 Haven Genoa, Italy 144,000
10/11/1998 Odyssey 700 nautical miles off Nova Scotia, Canada 132,000
19/12/1972 Sea Star Gulf of Oman 115,000
07/12/1971 Texaco Denmark Belgium, North Sea 107,140
23/02/1980 Irenes Serenade Navarino Bay, Greece 100,000
12/05/1976 Urquiola La Coruna, Spain 100,000
23/02/1977 Hawaiian Patriot 300 nautical miles off Honolulu 95,000
15/11/1979 Independenta Bosphorus, Turkey 95,000
29/01/1975 Jakob Maersk Leixoes, Portugal 88,000
05/01/1993 Braer Shetland Islands, UK 85,000
19/12/1989 Khark 5 120 nautical miles off Atlantic coast of 80,000
Morocco
03/12/1992 Aegean Sea La Coruna, Spain 74,000
15/02/1996 Sea Empress Milford Haven, UK 72,000
17/04/1992 Katina P Off Maputo, Mozambique 72,000
06/12/1985 Nova Off Kharg Island, Gulf of Iran 70,000
13/11/2002 Prestige Off Galicia, Spain 63,000
13/05/1975 Epic Colocotronis USA, Caribbean Sea 61220
24/03/1999 Exxon Valdez Prince William Sound, Alaska, USA 37,000
11/12/1999 Erika Bay of Biscay, off Brittany Coast 20,000
* This comprised 2 separate spills of approximately 145,000 te on 19/07/1979 and 141,000 te on
02/08/1979 following repairs.
2.2 Major onshore accidents

2.2.1 Major onshore accidents resulting in significant fatalities
The MHIDAS database [13] was searched for all accidents involving fatalities. The data
searched cover the period from 1970 onwards 2 , in which period a total of 13,502
accidents involving dangerous substances resulting in a total of 21,785 fatalities are
recorded.
Table 2.17 lists all accidents resulting 10 or more fatalities along with the material(s)
involved, the source of the event, and event descriptors.
2
Accidents up to the end of 2005 are covered by the database made available to DNV: see
Section 4.2.
22 ©OGP
Table 2.17 Top Onshore Incidents Listed in Decreasing Order of Fatalities Involved: Worldwide, 1970 – 2005 (mainly [13])
Accident Location Material name Source Event (Note 1) No. of No. of Country Notes
Date Fatalities Injuries
(dd/mm/yyyy)
3/12/1984 Bhopal, Madhya Pradesh Methyl Isocyanate Process: Pressurised Continuous Release; >2000 >170,000 India 1
Fireball
2/11/1994 Dronka Aircraft Fuel Storage: Atmospheric Continuous Release; Fire >580 Egypt 3
19/11/1984 San Juan Ixhuatepec, Mexico LPG Storage: Pressurised BLEVE >500 2500 Mexico
City Storage
23/12/2003 Gao Qiao, Chongqing Natural Gas, Hydrogen Gas Well Blowout; Continuous 243 4000-9000 China
Sulphide (Sour Gas) Release
19/12/1982 Tacoa Fuel Oil Transfer: Atmospheric Explosion; >153 500 Venezuela
Storage Instantaneous Release
14/9/1997 Visakhapatnam, Andhra Pradesh LPG, Kerosene, Transfer: Pipework Explosion; Fire 56 20 India
Petroleum Products,
Crude Oil
24/1/1970 Semarang, Java Kerosene Storage: Pipework Fire; Tank Fire 50 Indonesia 4
6/1/1998 Xingping, Shaanxi Nitrogen Process: Pipework Explosion 50 100 China
8/1/1979 Bantry Bay, Cork Crude Oil Transfer: Ship Explosion; Fireball 50 Eire 5
24/3/1992 Dakar Ammonia Process Explosion; Fire 41 403 Senegal 6
10/2/1973 Staten Island, New York Natural Gas Storage: Atmospheric Confined Explosion; Fire 40 2 Usa
30/3/1972 Duque De Caxias, Rio De LPG Storage: Pressurised BLEVE; Fire 39 51 Brazil
Janeiro
17/8/1999 Korfez, Gulf Of Izmit Crude Oil, Naphtha Process Fire; Continuous Release 37 Turkey
9/11/1988 Bombay Toluene, Benzene, Storage: Atmospheric Fire; Explosion 35 16 India
Naphtha
26/6/1971 Czechowice Oil Storage: Atmospheric Explosion; Fire 33 Poland
6/11/1990 Maharastra, Bombay LPG Process: Pipework Continuous Release; <31 >30 India
Unconfined Explosion
21/9/2001 Toulouse Ammonium Nitrate, Storage: Atmospheric Explosion 30 2500 France
Ammonia, Chlorine
1/6/1974 Flixborough, Lincolnshire Cyclohexane Process: Pipework Continuous Release; 28 89 UK
22/10/1988 Shanghai LPG Process Unconfined Explosion; 25 17 China
Fire
20/10/1995 Colombo Diesel, Kerosene, Crude Storage: Atmospheric Explosion; Fire <25 Sri Lanka 7
Oil
19/1/2004 Skikda LNG Process: Heat Fire 23 74 Algeria
Exchangers
23/10/1989 Pasadena, Texas Isobutane Process: Reactor Unconfined Explosion; 23 125 USA
©OGP 23
(dd/mm/yyyy)
Fire
??//1972 Weirton, West Virginia Propane Process Confined Explosion 21 20 USA 8
9/12/1977 Cartagena Ammonia Process: Reactor Explosion; Release 21 30 Colombia
26/6/1996 Nr Tianjin Chemicals (unspecified) Process Explosion 19 20 China
23/3/1979 Beira, Sofala Oil Storage: Atmospheric Tank Fire; Fire 19 Mozambique 9
13/7/1979 Taipei Resin Storage Dense Phase Explosion; 18 59 Taiwan 10
Fire
13/7/1973 Potchefstroom, Natal Ammonia Transfer: Pressurised Instantaneous Release; 18 65 South Africa
Storage Dense Gas Cloud
5/7/1990 Channelview, Texas Hydrocarbons Waste: Atmospheric Explosion; Fireball 17 5 USA
Storage
1/11/1986 Devnya, Vinyl Chloride Process: Pipework Explosion; Fire 17 19 Bulgaria
??/7/1984 Chicago, Illinois Propane, Process: Process Instantaneous Release; 17 17 USA
Monoethanolamine Vessels Explosion
23/5/1984 Abbeystead, Lancashire Methane Process Explosion 16 28 UK 11
13/8/1989 Qingdao, Oil Storage Explosion; Tank Fire 16 86 China
5/8/1993 Qingshuihe, Guangdong Sulphur, Warehouse Explosion; Fire >15 >160 China 12
Organophosphorus,
Ammonium Nitrate, LPG
23/3/2005 Texas City, Texas Octanes Process: Process Explosion; Fire 15 >100 USA
Vessels
23/7/1984 Romeoville, Illinois Propane Process: Reactor Unconfined Explosion; 15 USA
BLEVE
13/10/1974 , Crude Oil Transfer: Ship Explosion; Fire 15 4 Sumatra 13
??/6/1974 Zaluzi, Ethylene Process Explosion 14 79 Czechoslovakia
25/8/1977 Cairo, Butane Process Release 14 6 Egypt 14
7/11/1975 Beek, Propylene Process: Pipework Dense Gas Cloud; 14 107 Netherlands
1/9/1992 Eleusis, Crude Oil Process: Pipework Explosion; Fire 14 >30 Greece
2/6/1979 Sajobabony, Chemicals (unspecified) Process Explosion; Fire 13 6 Hungary
4/10/1989 Yochon, Cholla Namdo Chemicals Process Explosion; Fire 13 19 South Korea 15
18/3/1990 Tehran, Gas Storage Explosion; Fire 13 >1 Iran 16
8/7/2002 Shenxian, Shandong Province Ammonia Process: Pipework Continuous Release 13 11 China
??//1976 Chalmette, Louisiana Ethyl Benzene Process: Process Explosion; Fire 13 USA
Vessels
5/7/1973 Kingman, Arizona Butane Transfer: Rail Tanker Continuous Release; 13 95 USA 17
BLEVE
7/4/1974 Fort Miffin, Pennsylvania Crude Oil Transfer: Ship Fire; Explosion 13 8 USA 18
24 ©OGP
(dd/mm/yyyy)
30/1/1989 Secunda, Transvaal Oil Process: Pipework Explosion; Fire 12 8 South Africa
25/3/1993 Maracaibo, Natural Gas Process Explosion; Fire 11 >1 Venezuela
26/5/1992 Haryana, Ammonia Process: Pipework Release 11 9 India
7/9/1992 Haryana, Ammonia Process: Pipework Explosion >11 9 India
??/3/1984 , Lagos Kerosene Process Explosion 10 Nigeria
??/2/1979 Risa, Petrol Process Confined Explosion; Fire 10 Germany
22/6/1981 Rocklin, California Gasoline Storage: Atmospheric Release 10 USA
Notes
1. Events are presented as given in MHIDAS.
2. Fatalities/injuries estimated from various sources.
3. Military depot tanks struck by lightning and flaming fuel spread through flooded town.
4. Tank fire caused by theft from pipeline after torch ignited leak from pipeline.
5. Explosion on vessel during unloading.
6. Ammonia tank in peanut plant.
7. Bomb attack.
8. Coking works.
9. Guerilla attack.
10. Resin factory.
11. Water pumping station.
12. Warehouse fire spread to LPG tank.
13. Explosion on ship during loading.
14. Butane bottling factory
15. Unclear from description if plastics goods factory or acrylonitrile plant.
16. Underground gas storage facility.
17. Rail tanker BLEVE during unloading.
18. Explosion on ship - not clear from description if vessel was loading/unloading at time of incident.
©OGP 25
2.2.2 Major onshore accidents resulting in significant property damage

Table 2.18 presents data on major onshore accidents in the hydrocarbon-chemical
industry during 1970 to 2001 resulting in significant property damage as measured by
the cost, taken from [6] (the most recent compilation of data). The loss amounts include
property damage, debris removal and cleanup costs while the costs of business
interruption, extra expense, employee injuries and fatalities, and liability claims are
excluded.
These data do not include the Texas City disaster of 23/03/2005. The cost of this has
been reported [9] as USD 305M; however, the basis of this sum may not be comparable
to the values presented in Table 2.18, which are strictly property damage losses.
26 ©OGP
Table 2.18 Top Property Dam age Losses in the Hydrocarbon-Chem ical Industry, 1970 – 2001 [7],[8]
6 6
Date Name of Unit Type of Unit Operating Main Event Cost (10 Cost (10 Area
Mode USD USD 2002)
Actual)
23/10/1989 High Density Polyethylene Reactor Petrochem Operating Explosion 675 869 USA
21/09/2001 Ammonium Nitrate Storage Petrochem Storage Explosion 750 750 Europe
Warehouse
25/06/2000 Condensate Line Refinery Transfer Explosion 412 433 Middle East
05/05/1988 Fluid Catalytic Cracking Unit Refinery Operating Explosion 255 336 USA
09/11/1992 Fluid Catalytic Cracking Unit Refinery Operating Explosion 260 318 Europe
25/12/1997 Air Separation Unit Gas Processing Operating Explosion 275 294 Asia
14/11/1987 Butane Oxidation Reactor Petrochem Startup Explosion 215 288 USA
23/07/1984 Monoethanolamine Absorber Refinery Operating Explosion 191 275 USA
Column
16/10/1992 Hydrodesulphurization Unit Refinery Startup Explosion 161 196 Asia
01/06/1974 Cyclohexane Oxidation Reactor Petrochem Operating Explosion 62 182 Europe
03/04/1977 Refrigerated Propane Storage Gas Processing Storage Fire 76 179 Middle East
25/09/1998 Gas Processing Plant Gas Processing Operating Explosion 160 171 Australia
26/07/1996 Cryogenic Unit Gas Processing Operating Explosion 136 148 Central
America
13/12/1994 Ammonium Nitrate Unit Petrochem Operating Explosion 120 141 USA
01/09/1979 Ethanol Storage Tank/DWT Tanker Refinery Transfer Explosion 68 138 USA
09/04/2001 Visbreaker Unit Refinery Maintenance Fire 130 134 Central
America
01/05/1991 Nitroparaffin Unit Petrochem Operating Explosion 105 129 USA
23/04/2001 Coker Unit Refinery Operating Fire 120 124 USA
30/05/1978 Alkylation Tank Farm Refinery Storage Fire 55 120 USA
27/05/1994 Synthetic Rubber Reactor Petrochem Operating Explosion 100 118 USA
15/04/1978 Gas Transmission Pipeline Gas Processing Transfer Explosion 54 117 Middle East
05/12/1970 Hydrocracking Unit Refinery Operating Explosion 27 114 USA
©OGP 27
6 6
Date Name of Unit Type of Unit Operating Main Event Cost (10 Cost (10 Area
Mode USD USD 2002)
Actual)
11/03/1991 Vinyl Chloride Plant Petrochem Operating Explosion 91 112 Central
America
10/04/1989 Hydrocracker Unit Refinery Shutdown Fire 87 112 USA
21/10/1980 Polypropylene Reactor Petrochem Maintenance Explosion 60 111 USA
16/05/2001 Polyacrylates Plant Petrochem Operating Fire 109 109 Europe
15/08/1984 Fluid Bed Coking Unit Refinery Operating Fire 76 109 Canada
22/06/1997 Olefins Unit Petrochem Operating Explosion 100 108 USA
22/03/1987 Hydrocracking Unit Refinery Startup Explosion 79 107 Europe
07/03/1989 Aldehyde Column Petrochem Operating Explosion 77 99 Europe
12/03/1991 Ethylene Oxide Unit Petrochem Operating Explosion 80 98 USA
08/10/1992 Hydrogen Processing Unit Refinery Operating Explosion 73 96 USA
19/05/1985 Ethylene Plant Petrochem Operating Fire 65 93 Europe
28 ©OGP
Table 2.19 presents a summary of the top 100 onshore incidents during 1972 – 2001 (i.e.
over the 30 years preceding publication) [8]; Figure 2.4 presents this information
graphically.
Table 2.19 Sum m ary of Top 100 Major Onshore Incidents, 1972 – 2001 [8]
Industry Total Loss Percent of No. (and %)

6
(10 USD Total USD of Incidents
2002)
Refining 4,958 47 49
Petrochemical 4,072 38.5 33
Gas Processing 1,170 11 10
Terminals/Distribution 363 3.5 8
Total 10,563 100 100
Figure 2.4 Breakdown of Top 100 Major Onshore Incidents by Type of Unit,
1972 – 2001 [8]
©OGP 29

The information presented in Section 2.0 is taken from data sources believed to be the
most comprehensive available. Nevertheless, it cannot be taken to be complete for all
worldwide locations, for the reasons set out in Section 4.0. It is intended to give an
overview of the types of accident that have occurred and the types of unit involved, and
to provide limited indications of relative likelihoods for different types of unit, operation
mode, main event, variation over time, and geographical area. However, it should not be
used by itself to estimate absolute frequencies as the corresponding exposure data are
not given. Rather, as stated in Section 1.1, the information presented is background
historical information on major accidents in the onshore and offshore oil and gas
production and process industries, to serve as background information for QRA
studies.
3.2 Uncertainties
Regarding the completeness of the information with respect to major offshore
accidents, see Section 4.1.
For offshore tanker spills, various data sources have been cross-checked with the
primary source, ITOPF statistics [5]: spill quantities do not always match and, in these
cases, the ITOPF data have been taken as definitive.

4.1 Major offshore accidents
The Worldwide Offshore Accident Databank (WOAD) project was launched in 1983 and at
present [1] includes accident data from 1970 to 2007 inclusive. The database is
maintained by DNV, which collects data on major offshore accidents from public
sources worldwide. Although the database attempts to cover worldwide accidents,
there are areas of the world for which limited information is available, e.g. countries with
a fully state-owned offshore industry. For such areas only accidents to units owned by
private, foreign operators is normally known.
Whereas WOAD provides good data on fatalities and damage levels, it has only limited
data on pollution incidents, hence other, national, sources have been used to obtain the
pollution incident data presented in Section 2.1.3 for the US Gulf of Mexico [2], offshore
United Kingdom [3] and offshore Norway [3] (with supplementary data from [10]).
SINTEF’s blowout database [6] indicates whether pollution occurred and, where
information was available, categories the pollution as “Small”, “Medium”, “Large”,
“Unknown”, and “None”; however, it does not define these categories quantitatively.
For the purposes of determining the fraction of blowouts resulting in pollution (Table
2.12), it has been assumed that some pollution resulted where the category is
“Unknown”.
Tanker accident data has been taken principally from ITOPF [5] with additional data from
[11].
30 ©OGP
4.2 Major onshore accidents

The accident data presented in Table 2.17 are taken almost entirely from MHIDAS [13],
one of the most authoritative databases of accidents in the onshore energy and process
industries. Compilation of MHIDAS commenced in the 1980s, however information on
selected accidents before that time were included as available.
Two editions of Marsh’s (formerly Marsh & Maclennan) regular publications of major
onshore property damage incidents have been used, from 1995 [7] and 2003 [8]. These
provide property damage values, both actual and on a common USD basis (1993 USD in
[7]; 2002 USD in [8]; the 1993 values have been updated to 2002), as well as brief
accident descriptions.

The sources referenced in Section 4.0 may be consulted for additional information,
especially:
WOAD [1] for offshore accidents in general, and in particular for accidents causing
fewer than 10 fatalities (cf. Section 2.1.1, Table 2.1).
MMS [2] for offshore pollution accidents and other offshore accidents
OLF [4] for discharges and emissions offshore Norway
ITOPF [5] for tanker spills
SINTEF [6] for comprehensive data on blowouts (requires licence to download and
access)
MHIDAS [13] for further information on major onshore incidents up to the end of 2005.
Marsh [7] for further information on major onshore property damage incidents
JLT [9] for insurance costs of losses in upstream, downstream and power generation
and also losses from hurricanes Katrina, Rita and Wilma in 2005
MHIDAS is now maintained by AEA Technology, who should be contacted for further
information (http://www.aeat.co.uk/cms/locations-office/).TNO’s FACTS database
contains information on more than 23,000 (industrial) accidents involving hazardous
materials that have happened all over the world during the past 90 years. It is available
online (http://www.factsonline.nl/) but requires a licence to obtain detailed information
such as numbers of fatalities and injuries.
6.0 References
[2] MMS, 2009. MMS Incident Statistics and Summaries, US Department of the Interior,
Minerals Management Service.
http://www.mms.gov/incidents/IncidentStatisticsSummaries.htm
[3] DECC, 2009. Pollution Prevention and Oil Spills, Department of Energy and Climate
Change.
https://www.og.berr.gov.uk/information/bb_updates/chapters/Table_chart3_1.htm
[4] OLF, 2008. 2007 environmental report, The Norwegian Oil Industry Association
(OLFboyl), 2008.
©OGP 31
http://www.olf.no/getfile.php/Dokumenter/Publikasjoner/Milj%C3%B8rapporter/0808
05%20OLF%20Enviromental%20report%202007.pdf
[5] ITOPF, 2009. Statistics, International Tanker Owners Pollution Federation Limited.
http://www.itopf.com/information%2Dservices/data%2Dand%2Dstatistics/statistics/
[6] SINTEF, 2008. Offshore Blowout Database, version 4.0.
http://www.exprosoft.com/blowout/ (requires licence to download and access)
[7] Marsh & McLennan Protection Consultants, 1995. Large Property Damage Losses in
the Hydrocarbon - Chemical Industries, A Thirty-year Review (16th ed.), ed. Mahoney D.
[8] Marsh Property Risk Consulting, 2003. The 100 Largest Losses 1972-2001. Large
Property Damage Losses in the Hydrocarbon-Chemical Industries, 20th ed., ed. Coco,
JC.
http://www.marshriskconsulting.com/ma/maStore/cgi-
bin/ma_onlinestorecatalog.exe?VM_CGI_EVENT=ProductDetailEv&VM_CGI_OBJE
CT=storebuilder_displayed_page&Category_ID=371&Subcategory_ID=228136&Nav
Root=306&Product_ID=234871
[9] JLT Risk Solutions, 2006. Energy Insurance Newsletter, January.
http://www.jltusa.net/files/EnergyNL0601.pdf
[10] SFT, 2009. Utslipp av olje og kjemikalier på norsk kontinentalsokkel 1996, Statens
forurensningstilsyn. http://www.sft.no/publikasjoner/vann/1470/ta1470.pdf
[11] Etkin, DS, 1999. Historical overview of oil spills from all sources (1960-1998), Intl.
Oil Spill Conf., Seattle, WA, American Petroleum Institute, 1097-1102, API
publication 4686.
[12] http://home.versatel.nl/the_sims/rig/index.htm (accessed 18/03/2009).
[13] Health and Safety Executive, 2006. MHIDAS Database - Major Hazard Incident Data
Service.
32 ©OGP

March 2010
Construction
risk for
offshore units
RADD – Construction risk for offshore units
Contents
1.1 Scope ............................................................................................................... 1
1.2 Definitions ....................................................................................................... 1
2.1 Worldwide Construction Failure Risks ......................................................... 3
2.2 North Sea Construction Failure Frequencies............................................... 3
2.3 Fatal Accident Rate (FAR) data ..................................................................... 3
3.2 Contributors to Severe/Significant or Total Loss Incidents ....................... 4
3.3 Uncertainties ................................................................................................... 4
4.1 Construction Incident frequency................................................................... 5
4.1.1 Historical Frequencies of Incidents.......................................................................... 5
4.1.2 WOAD Accident Reports ........................................................................................... 6
4.2 FAR data ........................................................................................................ 12
4.2.1 OGP FAR Data .......................................................................................................... 12
4.2.2 Comparison with other industries .......................................................................... 13
4.2.3 Construction FAR breakdown by Region .............................................................. 13
4.2.4 Norwegian Construction Data................................................................................. 13
6.0 References .......................................................................... 14
©OGP 1
Abbreviations:
DPS Dynamic Positioning System
FPSO Floating Production, Storage and Offloading
GoM Gulf of Mexico
HSE (UK) Health & Safety Executive
MOPU Mobile Offshore Production Unit
NPD Norwegian Petroleum Directorate
NS North Sea
OGP International Association of Oil and Gas Producers
OSHA Occupational Safety & Health Administration
PSA Petroleum Services Authority (Norway)
UK United Kingdom
US United States
WOAD Worldwide Offshore Accident Databank
WW Worldwide
2 ©OGP
1.1 Scope
This datasheet presents estimates of fabrication, construction and installation risks in
respect of asset damage/loss and personnel safety. The data are mainly applicable to
offshore installations although reference is made to onshore construction fatal accident
rates.
The datasheet has not been designed to assist with the quantification of general project
management uncertainties for the purpose of estimating the likelihood of project
schedule and cost overruns. This is considered to be a separate subject.
Measured in terms of the life-cycle of a project, the fabrication, construction and
installation phases have a short duration and can be characterised as:
• labour intensive,
• involving a large number of one-off tasks,
• requiring temporary work arrangements and working environments,
• exposing components/structures to non-design loading condition.
In terms of the last of these, structures can be designed to withstand extreme loadings
when fixed in-situ, such as an offshore installation being designed for a one-hundred
year return wave (a storm having an annual probability of occurrence of 10-2). However,
their tolerance can be considerably lower during the temporary phases. In addition,
ancillary systems such as semi-submersible crane vessels can be in a condition which
makes them vulnerable to adverse weather for the period of an operation.
In regard to the QRA of an onshore facility there may be no need to treat the three
phases as distinct. All hazardous operations could take place at the one site and the
phases could overlap in the project schedule.
The risks arising from the use of Temporary Living quarters and in particular the
potentially high risk associated with vehicle activity are not included in the construction
risks outlined. The Land Transport Accident Statistics datasheet provides an indication of
potential vehicle risk which may need to be evaluated when considering the total risks
associated with a construction project.
1.2 Definitions
• Construction (as defined by OGP [4])
Construction comprises all construction and fabrication activities, and also
disassembly, removal and disposal (decommissioning) at the end of the facility life.
Factory construction of process plant, yard construction of structures, offshore
installation, hook-up and commissioning, and removal of redundant process
facilities are all examples which are included under construction activities.
With this definition, construction may involve the assembly of relatively large
sections of an installation. Examples would include:
- lifting of modules onto a module support frame (MSF),
- mechanical outfitting of a concrete gravity based structure (GBS).
©OGP 1
Fabrication activities need not take place in the same location as the construction
activities. Therefore, construction could involve the transport of substantial
sections of the installation between sites. The hazards and risks associated with
these activities may need to be considered and analysed within the framework of a
“total” risk analysis.
• Fabrication (taken as a subset of Construction above)
Activities performed in producing significant sub-components, packages, or
modules which will be combined during the construction phase.
• Installation (taken as a subset of Construction above)
Activities performed to transfer the structure to, and position it at, the designated
site.
This definition is tailored to offshore developments, where one or more structures
are transported and assembled at the site. An onshore facility may have no
equivalent activities.
For an offshore jacket platform this phase can include the lifting or load-out of the
jacket and deck, onto transport barges. Some structures, such as concrete gravity
based structures, can be towed without the assistance of a transport barge.
This data sheet can be used in risk assessments oriented to either quantifying risks to
personnel or to quantifying risks to asset integrity.
The following damage categorisation as extracted from the Worldwide Offshore
Accident Databank (WOAD, [1]) is used, as applied to all accident types:
• Total Loss: Total loss of the unit including constructive total loss from an
insurance point of view, however the unit may be repaired and put into operation
again.
• Severe Dam age: Severe damage to one of more modules of the unit: large
/medium damage to load bearing structures: major damage to essential equipment.
• Significant Dam age : Significant/serious damage to module and local area of the
unit: minor damage to the load bearing structures: significant damage to single
essential equipment: damage to more essential essential equipment.
• Minor Dam age: Minor damage to single essential equipment: damage to more non
essential equipment: damage to non load bearing structures.
• Insignificant Dam age: Insignificant or no damage: damage to part of essential
equipment, damage to towline, thrusters, generators and drives.
2 ©OGP
2.1 Worldwide Construction Failure Risks

Table 2.1 outlines the Construction damage risks worldwide, where ‘Construction’ is
defined as set out in Section 1.2.
Table 2.1 Construction Dam age Risks: W orldwide

-3
Risk of all types of damage 6.5 × 10 per unit constructed
-3
Risk of Severe/Significant damage 3.1 × 10 per unit constructed
-4
Risk of Total Loss 3.6 × 10 per unit constructed
2.2 North Sea Construction Failure Frequencies

Table 2.2 outlines the Construction damage risks in the North Sea, where ‘Construction’
is defined as set out in Section 1.2.
Table 2.2 Construction Dam age Risks: North Sea

-2
Risk of all types of damage 6.9 × 10 per unit constructed
-2
Risk of Severe/Significant damage 3.6 × 10 per unit constructed
-3
Risk of Total Loss 2.0 × 10 per unit constructed
The North Sea damage risks are around 10 times higher than the Worldwide data
(Section 3.1 explains this).
2.3 Fatal Accident Rate (FAR) data

The best available FAR data for fabrication, construction and installation activities are
those extracted from OGP’s Safety Performance Indicator reports for 2006 and 2007
([4],[6]). Based on specific construction activity safety data collected in these years, the
following FARs have been calculated:
• 2006: 2.63
• 2007: 2.33
The data have not been split to yield any onshore/offshore specific FAR or
Company/contractor FAR as applied to many other breakdowns within [4]. The limited 2
year data collection/ analysis period does not allow for 3 or 5 year rolling bases which
offer a stronger (less uncertain) measure of the FAR. Note the reader should be aware of
the variation in OGP member company reporting from year to year as this can give rise
to some uncertainty on the overall values.
©OGP 3

The risk values given in Sections 2.1 and 2.2 are applicable to the offshore oil and gas
industry worldwide and specifically in the North Sea.
However, it is recommended that failure risk data to be used on particular studies are
localised to the country where the unit will be deployed as there are variations and
trends on the risks calculated, as can be seen comparing the worldwide and NS data
(Table 2.1 and Table 2.2). The worldwide data are dominated by the fixed installations in
US GoM. These are historically smaller and simpler than North Sea installations and this
is likely to be reflected in the risks. Therefore the Worldwide data is considered
appropriate to represent the construction risk for simple installations in shallow water.
For large integrated installations in deeper water (including those in deeper water in the
GoM) the North Sea data are representative of the risks as there is much more material
and overall construction activity involved.
The risks reflect incidents that have arisen mainly in the ‘under construction’ phase
within WOAD, and do not address the reverse construction / decommissioning risks.
Note there is a small category of events listed under “scrapping” category within
WOAD, most of which relate to idle units having problems, rather than true
decommissioning/ deconstruction activity. Conservatively, as there has been no serious
deconstruction events noted to date despite such activities occurring, construction
phase risks could be applied to deconstruction activities which are becoming more
common.
3.2 Contributors to Severe/Significant or Total Loss Incidents

The failure risk data presented in section 2.1 and 2.2 relate to the frequency of overall
system failures rather than component failures. Failure data at system level are most
useful for a “first pass” QRA, with the function of gauging the overall risk level and
estimating the relative contribution of specific activities. By review of the actual incident
reports detailed in Table 4.3 to Table 4.6 inclusive, the following hazard types are
prevalent:
• Dropped objects
• Mooring failures
• Dynamic positioning failures
• Floating unit collisions with installations
• Ballasting failures
• Weather window forecasting failures.
A detailed causal analysis of failures when under construction has not been attempted
although the raw incident reports will allow users to interpret causes if desired.
3.3 Uncertainties
In some cases the exposure data available makes no distinction between unit categories
e.g. for Monohull units there is no distinction between FPSO and FSU. The same
situation occurs for WOAD exposure data for fixed units. [2] provides a summary of
exposure data used to calculate worldwide structural failure accident frequencies.
4 ©OGP
Hence, by making no distinction in the exposure data the calculated frequency may be
overestimated or underestimated for FSPO, FSU and Fixed units within WOAD.
4.1 Construction Incident frequency

The principal source of the data presented in Section 2.1 is the data from WOAD for the
period 1980-2005 [1] and the HSE [7],[8] for 1980-2005. Databases available worldwide
were thoroughly reviewed and interrogated appropriately in producing these sources. It
is therefore believed that they are reasonably complete in recording accidents and
incidents worldwide and on the NS for offshore units.
These statistics are based on the numbers of incidents evident within WOAD software
v5.1 and the exposure data (number of unit years) [2],[7],[8]. Accident data used cover
the time period from 1980 to 2005 as this is the basis of the exposure data.
4.1.1 Historical Frequencies of Incidents

This section gives a historical picture of all incidents, including their severity during the
fabrication, construction and installation phases of offshore projects. The review is
limited to offshore incidents due to the accessibility of relevant accident/incident
records.
Incidents from WOAD, satisfying following criteria were used for the analysis:
• installation type - concrete, jacket, FPSO/FSU, and TLP
• operation mode - under construction
Examinations of the records found the majority did not occur in the phases as defined
by this data sheet. In WOAD, “construction” can cover temporary work on the platform
at any point in its lifecycle. Therefore it was necessary to review each entry to find
relevant incidents. It was also found not to be possible to differentiate with confidence
between the fabrication or construction phases of a project.
Overall estimates of incident/accident frequencies for all phases are given in Table 4.1
along with the assumptions underlying the estimates. The relevant entries from WOAD
are listed in Table 4.2 to Table 4.5 in Section 4.1.2.
Table 4.2 details a breakdown on the severity of each of the events on a worldwide and
North Sea Basis, used to determine the frequency of severe/significant and total failure
frequencies outlined in Table 2.1 and Table 2.2.
©OGP 5
Table 4.1 Sum m ary of W OAD search [4]
Estimated Estimated risk of

Fixed Number of reported
population (units incident/unit
units incidents (in WOAD)
constructed) (1,2) constructed
WW NS WW NS WW NS
Concrete 13 13 n/a 41 n/a 0.32
Jacket 36 17 8201 425 0.004 0.04
FPSO/ FSU 2 2 77 21 0.026 0.095
TLP 3 2 13 3 0.23 0.67
TOTAL 54 34 8291 490 0.0065 0.069
Note 1
Assumption of total fixed installation World wide:
For the period 1970 – 1995, total number of fixed installations 6515 (100% Jacket)
For the period 1996 – 2005, total number of fixed installations 1686 (100% Jacket)
There are few concrete installations outside the North Sea (Hibernia, Sakhalin (Lun-A, PA-B,
Molipak), at least 3 off Australia), none of which feature in the WOAD search, and as they are less
than 1% of the overall population they are excluded as negligible.
Note 2
Assumption of total fixed installation in North Sea:
For the period 1970 – 1995, total number of fixed installations 360 (10% concrete and 90% Jacket)
For the period 1996 – 2005, total number of fixed installations 106 (5% concrete and 95% Jacket)
Table 4.2 Incident Severity
Fixed Incident Severity

installations No. of Insignifica
Significa Total
Event nt/ no Minor Severe
nt Loss
s damage
Concrete WW 13 6 1 1 4 1
Concrete NS 13 6 1 1 4 1
Jacket WW 36 9 6 10 9 2
Jacket NS 17 3 2 5 7 0
FPSO/ FSU WW 2 2 0 0 0 0
FPSO/FSU NS 2 2 0 0 0 0
TLP WW 3 0 1 1 1 0
TLP NS 2 0 1 0 1 0
4.1.2 WOAD Accident Reports

Table 4.3 to Table 4.6 detail the construction incident descriptions for the 4 fixed
installation categories within WOAD [1] for the period up to February 2009.
6 ©OGP
Table 4.3 Concrete Facility Under Construction Incidents [1]
Accident Unit Name Description

Date
15-May-96 BRENT,211/29,C The new derrick of the platform drilling rig for the Brent C platform was being transported from Bergen in Norway to the UK on
Heerema's derrick barge "DB 102" when the derrick struck a bridge causing damage to the upper section of the derrick. The
platform rig was returned to Consafe's Burntisland yard for repairs. An investigation into the accident was initiated. The incident
was not expected to delay the re-development of the Brent field. A similar accident occurred in August (see accident in Table 4.4
dated 04-Aug-96 to unit in CAPTAIN field).
12-Aug-95 TROLL,31/6 Smoke developed in a firewater pump located in the seawater shaft. No persons were in the shaft at that moment. No further
information available.
15-Apr-95 TROLL,31/6,A During installation of scaffolding below the deck, a worker fell overboard and 20 m down into the sea and was quickly recovered.
The worker was in shock and taken to hospital.
09-Aug-92 SLEIPNER,15/9,A2 A fire occurred in a 440 V emergency switchboard. The fire will not hamper the completion of the platform. The replacements and
repair work should be completed mid September.
14-May-92 SLEIPNER,15/9,A2 The Aker Verdal yard experienced a construction accident during assembly of the platform jacket. The accident occurred during
roll-up and lifting of the upper part of the "row 2" jacket frame (weight 700 tons). One of the two lift slings parted and the frame
leaned slowly over and stopped at a 45 deg. Angle without hitting "row 1". No injuries or damage.
23-Aug-91 SLEIPNER,15/9,A1 Water intrusion into one of the drillshafts caused the sinking of the 600,000 tons concrete base of Sleipner 'a' platform. 22 workers
onboard were evacuated when the water flooding started. 15 mins later the base sank in water 200 m deep. The base was crushed
against the sea bottom and destroyed. Investigations have revealed that the concrete base in some places were underdesigned
and hence not able to support the exposed loads.
Three separate mistakes led to the sinking:
1: design forces in cracked areas were underestimated; 2: reinforcing steel in those areas was incorrectly designed; 3: some joints
were not separately designed. The accident may delay startup of the Sleipner field and it would take approx. 12-15 months to build
a new gravity base structure.
Insurance claims worth 2.3 billion NOK arising from the loss of the platform were settled in October 1993. This sum covers a new
base structure, outfitting lost with the original, the cost of temporarily storing the topsides and additional hook-up work. The
amount will be covered by insurance companies Vesta (Norway) and Lloyd's of London.
08-Nov-85 GULLFAKS,34/10,A Steel shock absorbers between the 41.000 ton deck and the legs failed and the deck started tilting. The deck was evacuated. The
deck was raised 0.02 m during a 10 hour successful jackup operation Nov.11 and the shock absorbers were replaced by steel
plates so that weight was evenly distributed on the four legs. Work was then resumed.
04-Nov-85 GULLFAKS,34/10,B The barge 'concem' was offloading cement into the platform Gullfaks C during slipforming when barge capsized and sank (ref
accident id. No 8601100). The barge's 10m high construction tower struck platform and containers on barge's deck clipped side of
platform base and caused damage to riser supports. Additional damage resulted from power failure which affected slipforming
equipment on platform.
27-Aug-84 FRIGG,25/1,TCP2 A gas leak occurred due to a failure of the bolts of the upper isolating valve of the standpipe for LSH on glycol contactor CV2C.
Standpipe and isolating valves were removed and nozzles blinded. Cause seems to be that bolts were overstressed due to
misaligned supporting and inaccurate tightening of bolts.
25-Feb-78 STATFJORD,33/9A,A During installation of platform four workers were doing welding and grinding at the 49.5 m level of the utility shaft. A liquid surface
was 2 m below the workers. Protective coating was added to the water from time to time. Diesel was trapped on top of the surface.
Probably due to breakage of acetylene hose a sudden fire ignited the diesel and heavy smoke and fire developed. Air hose to
grinding tool was probably melted and escaping air fed the fire. Escape stair tube behaved as a chimney with high flame intensity.
2 men tried to escape by elevator, but this stopped probably due to optical endstop switches activated by heavy smoke. One man
was found in the control room, an other at the 49.5 m deck. The only man wearing a breathing apparatus was found at 55.5 m deck
with only the last 5 min emergency air left. The smoke divers were forced back at the 61.5 m level due to the strong heat. Water
from hoses and deluge system cooled down heat and the fire was under control after about 2 hours.
06-Oct-76 NINIAN The concrete batching plants barges "no. 3" and "no. 4" and generator barge "h.d. barge no. 3" ranged against fendering of the
NORTH,3/3,CENTRAL partly constructed platform. The platform suffered damage to temporary installed anti-scouring fenderings and water ingress. No
further info available.
©OGP 7
22-Mar-76 FRIGG,10/1,CPD1 The fire blaze broke out at the base of the towers of the structures about 40 ft from the water level. The fire was extinguished after
one hour. About 10 square metres of concrete was damaged into a thickness of one inch.
15-Mar-99 TROLL,31/2,C The incident occurred during pressure testing of the of the Troll C platform structure before connection of deck and hull. Main
parts of the hull (including pipe shafts in columns) is filled with water and in order to ensure watertight penetrations for electric-,
instrument-, power- and hydraulic cables and pipes "Brattberger connections" are used. The day after the test immersion started,
leaks occurred between pipe shaft and pump room in column g 20 and between pipe shaft and stairwell in column g 10. The
ballasting operation was stopped immediately and the pump room and the stairwell was de-ballasted, flushed with fresh water and
dried out with hot air. Both leaks were caused by leaking "Brattberger connections". The Brattberger connection in the pump room
(mct rgsr) was designed for a hydrostatic pressure of 4 bar and started leaking at a water depth of 31.4 m. The supplier (Nortelco)
found the cause to be wrong packing of the connection. The Brattberger connection in the stairwell (mct rgpm 100) was design for
a hydrostatic pressure of 1.8 bar and started leaking at a waterdepth between 13.2 and 18.2 m. The cause of the leak was that the
maximum hydrostatic pressure the connection was designed for had been reached. - it was concluded that an unsuitable
connection was installed since this connection will not be capable of handling an unforeseen immersing. Corrective actions taken:
all Brattberger connections installed below el. 15.0 m were checked by supplier. All Brattberger connections between pipe shaft
and pump room (rgsr) were opened and re-packed. 8 Brattberger connections of type RGPO 100 towards pipe shaft in columns
g10 and g20 were replaced with Brattberger connections of type RGPM 100 which are designed for a hydrostatic pressure of
15 bar. All other Brattberger connections of type RGPO was reinforced by use of flat bar welded to both sides of the bulkhead. All
work was controlled, checked out and approved by Nortelco AS. When the test immersion was restarted, small leaks from 3
Brattberger connections were discovered. The pipe shafts was de-ballasted and the connections re-packed under control and
approval of Nortelco. More information available in archive.
Table 4.4 Steel Jacket Under Construction Incidents [1]

Date
15-Mar-00 VERMILION,267 While derrick barge 'Southern Hercules' was attempting to load the 390-ton vermilion 267 platform deck onto a materials barge in
the bayou black channel at the ocean marine facility in Gibson la., the load dropped. The derrick barge's jib broke away from the
boom during the lifting operation. The derrick barge suffered minor damage to hull and boom. It was not revealed any damage to
deck and no delays to first production was expected. The cause of failure was to be investigated. The accident is also recorded on
the derrick barge, see accident id. No. 0004060.
03-Dec-98 PETRONIUS The platform was under construction when a 72 million usd worth 3800-ton south deck module dropped to the seabottom at 2230
hrs as it was being installed onto the deepwater compliant tower platform. The module was being lifted by derrick barge "db 50"
when a lifting line parted. The module struck a transport barge being alongside as well as the "db50" before falling to the seafloor
in 1754 ft waters. The deck, the second of two modules that were to be pieced together into one unit, held the crew quarters,
waterflood facilities and production equipment. It was decided that the module would not be retrieved since it did not pose any
threat to the environment or to navigation. In may 1999, the go-ahead for building a new module was given.
17-Jul-98 MAIN PASS,65/B The Nabors offshore drilling platform rig "t-269" was being installed on the 100-ft platform when the rig partially collapsed over the
platform (with approx. 70 people onboard) and several sections of the rig fell overboard. However, the largest part of the rig
remained intact. The platform was in the final stage of construction when the accident occurred. The rig and heavy drilling set-up
were being constructed on top of the platform. When the work was finished there would have been a towering derrick typical of
those that drill older fields. Crews were unloading components to the "sub-structure" (supporting the derrick) from a barge to
large rails on the platform. Pumping equipment, tanks, electrical components and generator were in place when the accident
occurred. The rig split in two sections of which one fell overboard and onto a neighbouring barge. Three workers were killed and
12 persons were injured. Fishing vessels in the area pulled floating workers from the waters and the injured persons were taken to
hospital by helicopters and by boats. Two of the dead workers were crushed by the collapse of steel rigging and walkways as the
drilling portion of the rig fell.
17-Nov-77 HEATHER,2/5,A In wind NNE 45 knots and 40 feet waves, a 24" pipe, 50ft long, 8 tons, sealed in both ends and floating, broke loose.
8 ©OGP
28-Dec-92 BRUCE,9/8A,PUQ Two persons were working on the scaffolding underneath the platform, some 70 ft above the sea, when the scaffolding suddenly
collapsed. The incident occurred when they pulled equipment on to the scaffolding. One person fell straight into the icy sea, while
the other was trapped by his legs and struggled to free them before he let himself into the sea. Fortunately, none of them suffered
injuries apart from shock. Despite not wearing life jackets, both managed to swim to the platform legs within two mins and climb
up the ladders before "zodiac" rescue boats were launched and reached the spot.
04-Aug-96 CAPTAIN,13/22A,WPP A During towout of the platform (transport on barge) from the Clydebank yard of UIE Scotland, it collided with the Erskine road
bridge (aadt=18000) in the river Clyde, causing damage to the platform's drilling rig and closing of all traffic on the bridge such that
engineers assessed the extent of damage. It will probably remain closed to end-august and for heavy vehicles to the end of '96.
Reports indicate that the accident may have been caused by a miscalculation of clearances, which failed to take account of the
height of the barge being used. Platform repairs were carried out offshore. There may be raised claims by road transport firms to
compensate for extra costs due to the closing of the bridge. This was the second such accident within short time, see accident in
Table 4.3 dated 15-May-96 to BRENT C.
10-Sep-94 FRÏY,25/5 During cutting of riser pipe, a sheen of oil in the pipe ignited causing a fire. A fire blanket was used to put out the fire. The oil was
left in the pipe after flushing during construction.
21-Jan-94 GUNESHLI FIELD PLATFORM The platform capsized and sank during bad weather. The recently installed drilling platform was designed to withstand winds up to
42 m/s. No injuries and no oil was spilled. No decision has been made yet on whether the platform will be salvaged. The platform
took over 7 years to build and will cost tens of millions of dollars to replace. No further information available.
27-Oct-93 GRAND ISLE,102 During installation the platform jacket toppled. Certain problems with the jacket's mud mats and inclement weather were
encountered during the installation. The jacket is being surveyed for damage. It is expected that the jacket will be salvaged and
reinstalled after being repaired at the fabrication yard of "gulf island fabrication" in Houma.
15-Nov-92 BRUCE,9/8A,D During offshore commissioning it was discovered that someone seriously had tampered with electrical cables and pipework in
platform's drilling modules. The defects were corrected and the platform's hookup schedule was not affected. The platform is
under construction at the Eiffel yard in Marseilles. The Bruce field is scheduled to commence commercial production in spring
1993.
15-Oct-92 GOODWYN A During installation of the platform, the pile foundations (20 off, 130 m long), which should secure the platform to the sea floor, were
damaged. After sinking through a soft layer of sand, the piles were supposed to pierce into a thin layer of rock before sinking
further into bedrock. However, the piles did not pierce neatly through and were bent and buckled approximately 86 m below the
sea bed. A programme aimed at repairing the piles was started immediately so that the topsides installation, hook-up and
commissioning could proceed. Initial production is set to October 1994, one year later than expected.
25-Aug-92 BRUCE,9/8A,PUQ A fire occurred on the south-east leg of the platform at 0856 hrs. The fire is believed to have caused by a gas burner pre-heater.
Helicopters were scrambled and the platform was downmanned from 34 to 16. M tug/supply vessel "Maersk Rover" (standby
vessel for the "beryl a" platform), was put on readiness to assist in fire-fighting if required. Rescue operations terminated at 0930
hrs. The fire was reported put out at 0920 hrs.
13-Jan-92 BRUCE,9/8A,D An explosion occurred to the drilling platform under construction at the Eiffel yard at St Louis du Rhone near Fos (Marseille). The
explosion occurred in one of the mud tanks. It is speculated that inflammable gas built up in the tank during the weekend and was
ignited when normal construction activities restarted Monday morning. The walls of the module and the scaffolding were hit by the
blast. Bp states that the accident will not affect the schedule for the project.
15-Aug-90 OSEBERG 2,30/6,C During piling of the platform, brace no. 7015 was dented. The damage does not affect platform integrity in the period until
installation of modules in spring 1991. Corrective actions have been taken.
06-Mar-88 OSEBERG,30/9,B West German submarine U27 collided with the Oseberg B platform. Personnel were evacuated to the hotel platform
"Polyconfidence" which is linked to the platform with a gangway. A later survey found that a crossmember with diameter of 1.2 m
had been dented to a depth of about 20 cm. The repair costs will probably reach several million dollars. The submarine was
navigating approx. 20 m below the surface. The platform was marked on the map, but no signals from the sonar were received. The
submarine sustained damage to bow, bridge and navigation equipment. No injuries.
17-May-87 LOGGS GGS,ACCOMODATION One of the newest offshore platforms may have to be cut from the seabed by explosive charges. During piling work severe
vibrations caused damage to the jacket. The pile-driving equipment broke down. A substitute pile-driver proved to be too powerful
for the piles needed.
14-Jul-86 CHEVRON JACKET The platform installed by Brown&Root tipped over while the structure was being set. The incident was believed to be caused by a
UNKNOWN hole left in the seafloor where the drilling rig had been. The jacket was uprighted and there was no damage.
©OGP 9
26-Jun-86 HARRIET,B The deck structure of Harriet B tilted approx. 20 deg. On barge Intermac 256. Towed to shallow water for safety. The barge's deck
received some holes. Salvage required a giant derrick barge and salve cost estimated to 1mill usd. Value of monopod cargo of 350
tonnes is 4mill usd.
07-Jun-86 ZELDA/E Diving/work barge "Satyra Tirta" had accidental contact with the platform. No damage to the platform is reported, but the vessel
got its port side shell plating torn open in way of fuel tank and store room associated distortion to internal crop etc. Later
inspection showed flooding of winchroom and wetting of electrical cables.
04-Dec-85 PNT ARGUELLO Jacket contacted lock in panama canal during voyage from Morgan City to Port Hueneme loaded on barge "450-10". One gantry
316,HERMOSA crane needs to be renewed, two turbo generator casings reconditioned and partly renewed, 2 sets of electric conduits and one air
winch clutch renewed. Repairs deferred.
09-Jun-82 NORTH RANKIN,A Damage to valve removal track during launching.
01-Apr-82 MAGNUS,211/12,PRODUCTION Installation of the 40000 tonne structure halted because several steel piles fell off the structure altering the balance of the
structure. The piles were needed to secure it to the seabed. The piles were discovered 100 yards clear of the platform target
location. The oil platform was finally sited on the Magnus field Apr 4.
25-Feb-82 TYRA,5504/6.2,TE-E Damage to jacket due to storm during tow out.
15-Jul-81 VALHALL,2/8A,PCP During installation of the jacket in July 1981, a pile hammer was accidently dropped on the east side of the jacket. An investigation
survey by use of ROV showed no damage to jacket structure. During an annual underwater insp. In June 85,a puncture in the
subject diagonal was revealed during close visual inspection. The repair offshore is scheduled to start mid September 85.
16-Aug-80 PLATFORM SA Accident occurred when deck was lifted from barge to place it onto the jacket. There were two unsuccessful attempts, and in each
attempt the ropes gave way resulting in damage to the barge in the first and to the deck in the second. Repairs will be handled
locally.
17-Apr-80 PLATFORM SA Jacket fell into sea while being fitted onto leg of rig. See also accident 11-Jan-1980.
11-Jan-80 PLATFORM SA The jacket of the "platform SA" sank while it was launched at Bombay high oilfield. Mishap probably due to a leakage in the
compressor system at the time of the mechanical launching. Jacket was salvaged with the help of cranes and divers and was then
installed at the site.
01-Jun-77 HEATHER,2/5,A Suffered damage during piling operation when a steel pile was accidentally dropped, striking one of the "bottle" legs and
fracturing pile sleeves. Production delayed probably six months (to February 1978).
18-Nov-76 NINIAN SOUTH,3/8A External corrosion was discovered on an import riser pipe. One of three flowlines has to be replaced.
29-Aug-75 AUK,30/16,A Visibility below 50 yards. Collision with supply vessel. Production delayed for 3 weeks.
12-Mar-75 UNKNOWN,TRINIDAD JACKET Jacket on barge '299'. Delivery to Amoco Trinidad Oil Co.. During launching, the jacket slipped off the barge and subsequently
floated in an angular position. Platform was to be launched in sheltered water due to prolonging storm. It was under way to be
installed when interrupted by storm.
25-Oct-74 FRIGG,10/1,DP1 Location: the elf/total group at the 'Frigg' gas field. The buoyancy tanks failed as the platform was tilted from a horizontal to a
vertical position about 3 km from the installation site. A new 20 mill usd platform is under construction. Field production delayed
about one year. Platform was refloated July 7 1975. Will be used for other purposes.
06-Jun-74 SAMAAN Barge 'MM 151' transporting platform overturned and sank. No attempts to recover jacket.
05-Feb-73 EKOFISK,2/4,A Half the deck section dropped into the water. The wire broke while lifting the deck section from the building site to the pontoon for
transport to Ekofisk. Repaired March 22, expected cost: several million NOK.
09-Oct-70 AGOSTINO Ready for use when found inclined. Submerged part of support columns reinforced by further internal piles.
04-May-04 South Pars platform, SPP1 A man was killed while working on the installation of the jacket for one of the gas platforms for the South Pars field off Iran. The
accident happened when the piles were being loaded from a barge to the Stanislav Yudin crane ship. Both Statoil and seaway
heavy lifting have appointed internal commissions of inquiry to find the cause of the accident. Statoil is operator for the
development of the offshore part of phases six, seven and eight. The deceased was contracted for construction and installation of
the jackets for the gas platforms. No more information available.
10 ©OGP
Table 4.5 FPSO/FSU Under Construction Incidents [1]

Date
27-Dec-98 JOTUN,25/7,FPSO Jotun B was undergoing hook up/commissioning activities when the incident occurred. No production or drilling activities was
performed. A hydraulic oil leak in the east fire pump was detected and thought to be a maintenance issue initially but pulling of
the pump was found to be required. 300 - 400 l of oil was lost within the pump caisson. All hot work in connection with the hook-
up was suspended. The repair period was estimated to 2-3 days. No more information available
30-Jan-99 JOTUN,25/7,FPSO The incident occurred in platform hook-up and commissioning phase. Two smoke detectors in room 108, 1st floor, living
quarters detected gas. All personnel were mustered. Site inspection showed that smoke was still present in the room and the
initial investigation showed that the feeder within a switchboard had short circuited resulting in damage to the bars and
surrounding insulation supports. No injuries to personnel. No more information available.
Table 4.6 TLP Under Construction Incidents [1]

Date
04-May-95 HEIDRUN,6507/7,TLP During towout of tension leg no. 2 to the Heidrun field, the clamps for the pontoons broke and the leg sank in 240 m waters at
position N 64.37.5 and E 08.03.7. The leg has been located and is lying flat on the seabed. The operator plans to salvage the leg.
No further information available.
23-Jun-89 GREEN CANYON,184 Four of the structure's tendons sank while enroute to installation site. Cause is being investigated, but rests of the tropical storm
allison may have accelerated the sinking. Installation was carried out without the four tendons. Production would not begin until
the four missing ones were installed. Estimated startup of production was second week in November.
01-Nov-82 HUTTON,211/28,TLP Cracks in steelwork for the Hutton field prod. Platf. Built at Nigg bay on the Cromarty Firth. The cracks are so widespread that
large sections may have to be scrapped. However, Conoco might be able to repair cracked sections.
©OGP 11
4.2 FAR data
4.2.1 OGP FAR Data

As at the date of preparation of this datasheet, [6] is the source for the recommended
FAR data, replacing all other FAR data provided in the original E&P Forum datasheet.
However, users of these data are advised to consult the most up-to-date annual OGP
Safety performance indicators reports as they become available. Though limited in
recording period, this is considered to offer a modern, stronger insight into
construction FAR than many other sources.
Other data sources have been reviewed to identify alternative or more extensive FAR
analysis. The UK HSE publishes annual statistic reports (Offshore Injury, Ill Health, and
Incident Statistics) and it is noted that the Maintenance/Construction category in these
offers the closest match to the Construction category as defined in this datasheet.
For 2007/2008, the Maintenance/Construction category contributed 72 incidents, or
37.5% of all the incidents and also had the most major injuries (13 incidents, or 29.5%).
In 2006/2007 [10] the equivalent values were 2 fatal incidents (2 fatalities) (100% of total),
15 major (39% of total) and 60 severe (38% of total).
The HSE data does not present a FAR breakdown for the Maintenance/Construction
category. In overall terms a single FAR value per annum, or on a rolling basis is not
provided. The HSE data combines fatal and major injury data in presenting 3-year rolling
results.
The OGP data [4],[6] have been analysed in more detail to determine if further
breakdown of the reported Construction FAR is feasible. The OGP report presents a
breakdown of the overall annual FAR, with further breakdown for onshore/offshore and
contractor/ company personnel. Though not accurate, some estimate of onshore and
offshore Construction FAR could be determined from the reported data.
• From 2006 data ([4]) the overall FAR was 3.92, with 4.64 applicable onshore and 1.58
offshore.
• From 2007 data ([6]) the overall FAR was 3, with 3.0 applicable onshore and 2.9
offshore.
Offshore FAR contributions increased in 2007, with the capsize of the Bourbon Dolphin
which claimed 8 lives.
The 2-year average onshore overall FAR allocation is 3.82 ((4.64+3.0)/2) and the offshore
overall FAR is 2.24 ((1.54+2.9)/2). Continued collection of OGP data will enable better 3-
and 5-year rolling average estimates to be made in the future.
The overall average Construction FAR for 2006 was 2.63 ([4], p63) and that for 2007 was
2.33 ([6], p62)
If the overall average FAR ratios are applied to the Construction FAR, the following
approximate average Onshore and Offshore Construction FAR are determined.
• Average construction FAR (2 year average) = (2.63+2.33)/2) = 2.48
• Average overall FAR (2 year average) (= (3.92+3.0)/2) = 3.46
• Onshore average construction FAR = 3.82/3.46 × 2.48 = 2.74
• Offshore average construction FAR = 2.24/3.46 × 2.48 = 1.60
The onshore and offshore average construction FAR values are considered
approximate; analysis of the actual detail of the OGP electronic database will yield more
accurate values.
12 ©OGP
The finding that the onshore construction FAR is higher than the offshore construction
FAR overturns the previous E&P Forum datasheet which postulated that the offshore
FAR was higher.
4.2.2 Comparison with other industries

Comparing overall FARs with other industries as detailed in the original E&P Forum
datasheet is no longer seen as offering significant value and has not been included. The
OGP now has a wealth of data where it is possible to analyse data by geography,
operation/activity type and incident severity along with trending. This is of much greater
value than comparison with other industries.
4.2.3 Construction FAR breakdown by Region

It is conceivable that the OGP database enables this, although no attempts have been
made to postulate this using mathematical manipulation of the reported data.
4.2.4 Norwegian Construction Data

The average frequency of fatalities for the period 2001 up to and including the first half
of 2008 on the UK Continental Shelf is 2.9 per 100 million manhours against 1.2 on the
Norwegian Continental Shelf [11] (Page 30). However the report does not lend itself to
any interpretation of the contributions stemming from construction activity and
reference to the old data presented in the E&P Forum Construction datasheet is now
considered to be significantly out of date (very high values) and should be avoided.

Country-specific accidents and incidents data bases may be interrogated depending on
the area that the installation will be deployed. As a starting point WOAD is a reliable
source of information that can be interrogated in a variety of ways. There are more
sources of data including, but not limited to, the HSE in the United Kingdom, the
Occupational Safety & Health Administration (OSHA) in the United States of America,
and the Petroleum Services Authority (Norway) and the increasingly valuable annual
OGP reports which do illustrate a breakdown along regional lines on some of their
construction statistics, e.g. Lost Time Injury Frequency but not on their FAR values.
©OGP 13
6.0 References
[1] DNV, 2009. Worldwide Offshore Accident Databank (WOAD), v5.2. Search: February
2009.
[2] DNV, 2004. Exposure Data for Offshore Installations 1980-2002, Technical Note 22,
DNV internal documentation.
[3] UK Health & Safety Executive, 1996. The Offshore Installations and Wells (Design &
Construction, etc) Regulations, 1996.
[4] OGP, 2007. Safety performance indicators - 2006 data, OGP report no. 391.
[5] Trbojevic V.M., Bellamy L.J., Brabazon P.G., Gudmestad T., Rettedal W.K., 1994.
Methodology for the analysis of risks during the construction and installation
phases of an offshore platform, J Loss Prev. Process Ind., 1994 Vol 7(No 4).
[6] OGP, 2008. Safety performance indicators - 2007 data, OGP report no. 409. noting
erratum for FAR corrected in OGP Report 419
[7] DNV, 2007a. Accident statistics for fixed offshore units on the UK Continental Shelf
(http://www.hse.gov.uk/research/rrhtm/rr566.htm)
(http://www.hse.gov.uk/research/rrhtm/rr567.htm)
[9] HSE, 2008. Offshore Injury, Ill Health, and Incident Statistics 2007/2008, HID Statistics
Report HSR 2008 - 1, Sudbury, Suffolk: HSE Books.
(http://www.hse.gov.uk/offshore/statistics/hsr0708.pdf)
[10] HSE, 2007. Offshore Injury, Ill Health, and Incident Statistics, 2006/2007, HID Statistics
Report HSR 2007 - 1, Sudbury, Suffolk: HSE Books.
(http://www.hse.gov.uk/offshore/statistics/hsr0607.pdf)
[11] Petroleum Safety Authority Norway, 2009. Trends in Risk Level in the Petroleum
Industry – Summary Report Norwegian Continental Shelf 2008.
http://www.ptil.no/getfile.php/PDF/RNNP%20sam%20eng%2008.%20til%20nettet.pd
f
14 ©OGP

March 2010
Evacuation,
escape &
rescue
RADD – Evacuation, escape & rescue
Contents
1.1 Scope ............................................................................................................... 1
1.2 Definitions ....................................................................................................... 1
2.0 Summary of Recommended Methods and Data ....................... 2
2.1 Recommended Methods ................................................................................ 2
2.1.1 Application.................................................................................................................. 2
2.1.2 Generic Stages of EER .............................................................................................. 3
2.1.3 Evacuation Decision and its influence on EER Analysis ....................................... 6
2.1.4 Helicopter Evacuation................................................................................................ 7
2.1.5 TEMPSC Evacuation .................................................................................................. 7
2.1.6 Times and Failures Modes of Lifeboat Evacuation................................................. 7
2.1.7 Activity Undertaken to Improve TEMPSC Evacuation ............................................ 8
2.1.8 Bridge-Link Evacuation ............................................................................................. 9
2.1.9 Escape to Sea ............................................................................................................. 9
2.1.10 Rescue and Recovery ................................................................................................ 9
2.2 Recommended Data ..................................................................................... 10
2.2.1 Availability of Escape Routes to Muster Areas ..................................................... 10
2.2.2 Lifeboat Embarkation............................................................................................... 11
2.2.3 Lifeboat Evacuation ................................................................................................. 11
2.2.4 Frequency of Installation Evacuation..................................................................... 12
2.2.5 Probability of Evacuation Success......................................................................... 12
2.2.6 Escape by Sea Entry ................................................................................................ 13
2.2.7 Operability of Evacuation and Escape Methods under Various Accident
Circumstances.......................................................................................................... 13
2.2.8 Survival Times in Water........................................................................................... 15
3.0 Guidance on Use of Data ..................................................... 15
3.1 Availability of Escape Routes to Muster Areas.......................................... 15
3.2 Lifeboat Embarkation ................................................................................... 15
3.3 Lifeboat Evacuation...................................................................................... 16
3.4 Frequency of Installation Evacuation ......................................................... 16
3.5 Probability of Evacuation Success ............................................................. 16
3.6 Escape by Sea Entry..................................................................................... 16
3.7 Operability of Evacuation and Escape Method under Various Accident
Circumstances .............................................................................................. 16
3.8 Survival Times in Water ............................................................................... 16
3.9 Development of Offshore EER Arrangements ........................................... 17
3.9.1 Post PFEER Activity in the UK in Relation to Evacuation, Escape and Rescue 17
4.0 Review of Data Sources ....................................................... 19
5.0 Recommended Data Sources for Further Information ........... 19
6.0 References .......................................................................... 20
©OGP
Abbreviations:
ARRC Autonomous Rescue and Recovery Craft
DC Daughter Craft
DoE (UK) Department of Energy (no longer exists as such)
EPIRB Emergency Position Indicating Radio Beacon
EER Evacuation, Escape and Rescue
ERP Emergency Response Plan
ERRV Emergency Response and Rescue Vessel
ERRVA Emergency Response and Rescue Vessel Association
FRC Fast Rescue Craft
GEMEVAC Trade Name for Gondola System for Hibernia
H 2S Hydrogen Sulphide
NPD Norway Petroleum Directorate
OIM Offshore Installation Manager
OSC On-Scene Commander
PFEER Prevention of Fire and Explosion, and Emergency Response
PLB Personal Locator Beacon
POB People on Board
SAR Search And Rescue
SBV Standby Vessel
TEMPSC Totally Enclosed Motor Propelled Survival Craft
©OGP

1.1 Scope
This data sheet provides Quantitative Risk Assessment (QRA) data and guidance for
Evacuation, Escape and Rescue (EER) from offshore installations as this has the
potential to be more significant in personnel risk terms compared to onshore
installations.
Total evacuations of installations are rare events and each has very different
circumstances. Thus, data relating to real EER events are sparse and QRA tends to rely
on detailed analysis of escalation scenarios and EER activities within each scenario.
This datasheet contains a number of example data rule sets and general guidance for
EER analysis.
Assuming personnel have survived the initial events, personnel EER from onshore
facilities tends to be less complex and of inherently lower risk. Qualitative analysis,
geared towards provision of suitable escape routes and appropriate rescue and medical
contingency planning, will normally be adequate. On some onshore facilities the
provisions of temporary shelters are required for sheltering from certain toxic gas
releases e.g. H2S. In addition some emergency procedures are required for remote
onshore facilities such as being overdue in desert, cold climate and jungle
environments.
The data presented is for North Sea and the user should seek local legislation for
guidance.
It is noted that maintenance activities on Totally Enclosed Motor Propelled Survival
Craft (TEMPSC) in particular have been a source of risk. QRAs do not typically
distinguish this risk as part of EER analysis but take account of maintenance risk within
the general occupational risk category. Specific guidance on TEMPSC maintenance risk
is provided by the UK HSE in its SADIE (Safety Alert Database Information Exchange).
1.2 Definitions
The following definitions are based on those within the UK Prevention of Fire and
Explosion, and Emergency Response (PFEER) Regulations 1995 [1] .
Evacuation
Evacuation means the leaving of an installation and its vicinity, in an emergency, in a
systematic manner and without directly entering the sea. Successful evacuation will
result in persons being transferred to a place of safety, by which is meant a safe
onshore location, or a safe offshore location or marine vessel with suitable facilities.
Evacuation means may include helicopters, lifeboats and bridge-links.
Escape
Escape means the process of leaving the installation in an emergency when the
evacuation system has failed; it may involve entering the sea directly and is the ‘last
resort’ method of getting personnel off the installation.
©OGP 1
Means of escape cover items which assist with descent to the sea, such as life-rafts,
chute systems, ladders and individually controlled descent devices; and items in which
personnel can float on reaching the sea such as throw-over liferafts.
Rescue
In the PFEER regulations, this is normally addressed as ‘Recovery and Rescue’.
Recovery and rescue is the process of recovering of persons following their evacuation
or escape from the installation, and rescuing of persons near the installation and taking
such persons to a place of safety.
Place of safety means an onshore or safe offshore location or vessel where medical
treatment and other facilities for the care of survivors are available.
The recovery and rescue arrangements are:
• Facilities and services external to the installation, such as vessels, public sector and
commercially provided search and rescue facilities; and
• Facilities on the installation such as installation-based fast rescue craft.
2.0 Summary of Recommended Methods and Data

2.1 Recommended Methods
2.1.1 Application
All EER activities expose personnel to an element of risk. However, three broad classes
of EER can be distinguished:
• Routine Practice. These might be organized numerous times per year at an
installation to rehearse the procedures and use of the EER equipment. The timing
and conditions of such activities can to a large extent be controlled so that
personnel are not put at unnecessary risk. The risks stemming from routine practice
are not typically documented as part of a QRA. The risks are however appreciated
and the offshore and marine industries have undertaken activity to control these
risks, for the offshore industry the work done by the UK Step Change in Safety group
in relation to its guidance on the Loading of Lifeboats during drills [11] provides
effective guidance on risk control.
• Precautionary. For example, these might occur in the event of a drilling kick, an un-
ignited gas leak, a drifting ship nearby, a minor structural failure or threatening
platform movements in rough seas. Such an activity is not usually done under great
pressure, and there have historically been few fatalities in such events.
• Emergency. For example, these might occur in the event of an ignited blowout, leak
from process equipment, a collision or a structural collapse. Such activities are
usually performed with urgency. These are historically more likely to result in
fatalities.
In developing predictions about the frequency of EER activities, for a given installation,
influences will include, for instance, local environmental factors, the nature and extent
of processing facilities, and the intrinsic hazards of the process.
A multitude of variables can influence the outcome success of offshore EER activities.
In particular, the weather is an important factor. Should an emergency evacuation be
necessary during severe storm conditions, the risks of the EER activities are greater.
2 ©OGP
As each installation has its own unique characteristics, it is necessary to model the EER
operation to give some basis for EER effectiveness. This can be done by using
computer models, manual calculation methods, or a combination of these.
2.1.2 Generic Stages of EER

Table 2.1 presents the stages of EER as a possible set of descriptions for use in EER
analysis. Figure 2.1 provides a basic flowchart for the key stages of offshore
emergency response as defined by the HSE in its guide for offshore EER HAZOP [8].
The situation may require evacuation, escape or a mix of both.
The stages of an EER are complex and need to be considered with care during a risk
assessment. The stages shown in Table 2.1 should be tailored for the particular
installation and its potential major accident scenarios.
Table 2.1 provides failure modes for evacuation but does not suggest the effects of
failure. It should be recognised that the various types of failure carry different levels of
risk for participants. An example is given in Section 2.2.5.
Figure 2.1 Basic EER Stages
©OGP 3
Table 2.1 Generic Stages of EER
Stage + Typical Specific Descriptions Possible Problems

Generic
Description
Alarm Detection system warns of an • Detection fails.
Appreciation of unsafe condition. Control room • Delay (any cause).
an incident. operator decides that there is an • Operator error.
emergency and starts emergency • Public Address System fails.
procedure. Using the public • Public Address System not heard.
address system, personnel are
told that there is an emergency.
Access Personnel become aware that they • Personnel do not hear alarms and
Movement from should leave their work area. They do not notice the hazard
immediate area move out of the immediate area. condition.
of the hazardous • Hazard condition incapacitates
condition. personnel before they can leave
the area.
• Escape routes blocked due to
hazard or other causes.
• Personnel ignore procedures and
do not escape.
• Escape routes not understood by
personnel.
Muster Personnel assemble in a • Environment within muster area
Personnel designated muster /refuge area. not tolerable due to accident
assemble in a effects i.e. smoke, heat.
place of refuge. • Problems in maintaining order
within muster/ refuge area
Egress Personnel move to the helideck or • Egress routes affected by the
Personnel move to TEMPSC boarding areas to hazard
from a muster/ await controlled embarkation • Helicopters unavailable
refuge area to a • Lack of control
point of • Personal survival equipment (e.g.
embarkation smoke hoods) unavailable
Evacuation Personnel leave the installation • Means unavailable (wholly or
using the primary and preferred partly)
means, helicopter, or using the • Uncontrolled situation resulting
primary mainstay means, in early departure, leaving others
TEMPSC. Some Operators • Means affected by hazard
consider crane system use • Means adversely affected by
allowing personnel to be lowered weather/ conditions
to attendant vessels as an • Insufficient capacity.
effective evacuation means. Use of • Failure during transfer/launch
Gondola type systems (GEMEVAC process.
Hibernia) • No vehicle at place where
personnel have gathered.
• Failure in the organisation or in
the judgment of leaders.
• Lifeboat or other vehicle
damaged by fire/explosion.
• Means of transfer damaged by
fire or explosion.
• Personnel injured by explosion
while awaiting order to evacuate.
4 ©OGP
Stage + Typical Specific Descriptions Possible Problems

Generic
Description
Escape Personnel leave the installation by • Access to controlled descent
controlled descent provisions, prov-isions hampered
ladders, stairs, chutes, personal • Hazard effects
descenders, davit launched • Debris in the water
liferafts, or uncontrollably by • Descent devices do not work
jumping
Rescue Personnel in the water or in • Adverse weather/ visibility
liferafts await external parties (air • Inadequate external support
and marine) to provide rescue. • Unavailable, inappropriate or
Those in the water are the first damaged personal survival
priority, next liferaft then TEMPSC equipment (lifejacket, survival
occupants. suit, etc)
• Personnel injury
• Those in water affected by cold,
heat or other effects of an
incident.
• Possible shark attack in tropical
waters.
Recovery to a Helicopter shuttles evacuees to • Adverse weather
Place of base/ship/nearby platform. • Lack of control on TEMPSC
Safety Lifeboat transfers evacuees to disembarkation
Personnel make helicopter then on to a place of • Accident during pick-up.
further transfer safety. Lifeboat transfers • Rescue vehicle suffers accident.
to arrive at shore evacuees to ship. Lifeboat • Ineffective support facilities on
or a place of reaches shore or another platform. recovery vessel
safety before Pick-up from liferaft and transfer
return to shore. to a place of safety. Those
immersed rescued from water and
transferred to a place of safety.
Those immersed arrive at, and are
then recovered to, a place of
safety.
©OGP 5
2.1.3 Evacuation Decision and its influence on EER Analysis

The decision on whether or not to evacuate the installation is made by a designated On-
Scene Commander (OSC), typically the Offshore Installation Manager (OIM). The
Emergency Response Teams would advise the OIM of the severity of the incident. In
most cases, the OIM would stand-by and wait for the response teams to control the
incident, and then return the installation to normal operations. Depending on the
severity of the event, the installation layout, the weather conditions, and the response
teams' capabilities, the OIM may choose to evacuate the installation.
The choices are:
• Remain on the installation until the incident is over. This may be adopted for small
incidents (e.g. false alarms, minor oil leaks etc), but these are not usually modelled
in a QRA. It may also be adopted for major incidents of short-duration (e.g. large
isolated process releases) where it is considered that staff in a muster/refuge area
are safer to remain onboard
• Evacuate non-essential personnel only. Incidents where a fire-party or other
essential crew can be left on the installation are considered to be precautionary
evacuations, and are often not modeled a QRA, since accident experience indicates
a very low level of fatality risk.
• Evacuate all personnel. This emergency evacuation is the only case typically
analysed in offshore QRA and is outlined in the evacuation model within Figure 2.2
that can be utilised as a basis for EER analysis.
Figure 2.2 EER Analysis Decision Model
6 ©OGP
2.1.4 Helicopter Evacuation

Use of helicopter to evacuate is only possible in situations where both helicopter(s) and
helideck are available. Some potential major accident scenarios would make it very
dangerous to utilise helicopter transportation. Heat, smoke and flames from fires tend to
propagate upwards and can impair a helideck facility. Helicopter evacuation is often
more available for performing precautionary evacuations.
Any evaluation of helicopter options must include an assessment of:
• The time scale of the supposed incident.
• The possible timing of the incident in relation to the availability of helicopters and
crew (i.e. day or night).
• The defined evacuation plan i.e. to shore, ships or other installations.
• The possible problems in the access, mustering and loading process.
2.1.5 TEMPSC Evacuation

In the event that evacuation by helicopter is not possible, generally, evacuation will be
attempted by TEMPSC.
The critical features affecting the risks of evacuation by TEMPSC are:
• Availability of TEMPSC suitable for launch, given the event necessitating evacuation.
• The choice of which TEMPSC to use, if there is spare capacity.
• Time required to load and launch the TEMPSC compared to the time for the event to
escalate.
• The risk of an unsuccessful launch in the prevailing weather conditions.
• The risk of an accident during recovery of personnel to a place of safety (ERRV).
2.1.6 Times and Failures Modes of Lifeboat Evacuation

Table 2.2 presents a more detailed analysis of evacuation failure modes, which is drawn
from [2]. This provides a framework for discussion and analysis.
For analysis of existing installations, analysts should be able to use measured times
from trials and exercises in place of the typical times shown in the table.
The design of a TEMPSC to withstand physical effects due to an incident can also affect
the success of an evacuation.
©OGP 7
Table 2.2 Typical Tim es and Failure Modes for Evacuation of a North Sea
Installation by 40-person TEMPSC
Action Possible Problems

(with Indicative Duration)
Muster Effects of incident. Escape ways blocked or unusable.
Go to stations Alarm ignored or not observed by personnel. Problems of
Head Count command.
Order to abandon
(5 to 15 mins)
Prepare to launch Muster area exposed to heat or smoke. Craft damaged by
effects of incident. Engine defect. Gear stuck. Sea cocks
jammed. Craft damaged.
Embark Personnel injured. Premature descent. Access blocked.
(4 to 10 mins) Other delays.
Start to lower Release/cable/brakes jammed, craft hooked up on gear and
Descend under control to near various other mechanical defects. Craft hits structure due to
sea level wind. Premature release of craft from falls. Wires too short.
Final descent to sea Release fails. Craft damaged by effects of the incident (heat,
Release fire, blast, fire on sea).
(1 min)
Move away from installation Steer into structure. Blown back into structure. Tides
carries craft into structure. Mechanical failures. No pickup
means.
Stay intact while awaiting Craft not located. Craft sinks or capsizes before recovery.
pickup Injured person die before recovery. Excessive delay in
pickup leads to death or injury of personnel.
Personnel recovered Mistakes during recovery. Failure of mechanism.
successfully
Recovery unit reaches shore Helicopter or ship suffers failure.
2.1.7 Activity Undertaken to Improve TEMPSC Evacuation

The offshore oil and gas industry has seen efforts to improve the design, hardware and
management of EER issues. Such improvements will achieve a reduction in risk for
personnel. For example, TEMPSC design and operations improvement studies have
covered:
• Assessment of Onload and Offload release mechanisms, to reduce the chance of
premature erroneous release.
• Improved Clearance / Offset of TEMPSC from installations
• TEMPSC mounted at right angles to the structure or at its corners so as to allow a
straight course away from the structure, also creating reduced wind and marine
loads which would tend to bring the craft closer to the installation
• Improved vessel maneuverability, some adopting use of bow thrusters.
• Better visibility for TEMPSC Coxswain
• Better maintenance of TEMPSC launch mechanisms.
• More consideration given to the practicalities of recovering personnel from TEMPSC.
• Improved impact resistance of TEMPSC
• Development of Freefall TEMPSC
8 ©OGP
• Development of the Preferred Orientation and Direction (PrOD) system to translate

craft orientation in descent to an optimal heading and then translate descent
potential energy into forward thrust.
Currently additional effort is being applied to the safety of Freefall TEMPSC in relation to
issues associated with increased average offshore worker mass and its effect on craft
load distribution, canopy strength etc. Increased mass effects are also being addressed
for conventional davit fall TEMPSC.
2.1.8 Bridge-Link Evacuation

This essentially relates to an evacuation from an adjacent installation e.g. a drilling
platform which is connected to the central platform by a bridge within a large
production complex. If personnel are able to reach the central platform where
evacuation normally takes place, the potential evacuation means where warranted are
either by helicopter or TEMPSC as discussed above.
2.1.9 Escape to Sea

Events that lead to the need for evacuation of the installation may also impair the means
of evacuation or access to them. In such a case, personnel will have to leave the
installation using escape means e.g. liferafts.
The critical features of escape to the sea are:
• Availability of means of escape to the sea, such as ladders, scrambling nets, ropes
and personal escape equipment. These may be impaired by the event requiring the
evacuation.
• The reliability of the available means of escape, which is typically expressed in
terms of the fatality rate among people using it.
2.1.10 Rescue and Recovery

The purpose of the rescue and recovery arrangements is to ensure prompt recovery to a
place of safety of personnel evacuating by TEMPSC, or entering the water during
escape or because of a man overboard (MOB) incident, (Note MOB not typically
assessed in QRA). This is normally achieved through arrangements with ‘local’ search
and rescue (SAR) helicopters and standby vessels/ Emergency Response and Rescue
Vessels (ERRV) as specified by the installation’s Emergency Response Plan (ERP).
The critical features affecting the risks of rescue and recovery are:
• Location of the SAR helicopter.
• Response / launch times for the SAR helicopter and SBV/ERRV.
• Speed of the SAR helicopter and SBV/ERRV.
• Capacity of the SAR helicopter and SBV/ERRV.
• The time taken to rescue people from the sea, compared to their survival time in the
prevailing conditions. This depends on the availability of suitable rescue craft, their
reliability and performance in the rescue task, the environmental conditions
affecting survival times and rescue performance, and the clothing and survival
equipment used by the people in the water.
©OGP 9
• The potential for accidents involving rescue vessels and helicopters.
2.2 Recommended Data

The following sub-sections discuss the data and rule sets utilised in the EER analysis.
There is little or no further update on the EER data used by the industry, hence the data
and rule sets presented in the report are mainly adopted from OGP member database
1996, unless otherwise stated. The industry focus has been on making practical
improvements in hardware rather than enhancing the nature and basis of EER analysis.
Such practical improvements have been highlighted for TEMPSC evacuation in Section
2.1.7 and for other general EER activity in Section 3.9.
The rule sets describe the adopted principles in the EER analysis and may be further
developed in conjunction with the installation specific EER arrangements. The rule set
will ensure consistent approach and provide a guideline on industry best practice for
EER analysis.
Note that much of the data set out in the following sub-sections has been provided by
OGP members, in which case it should be taken as indicating the type of data required
at each stage and values typically used, rather than definitive recommended values.
2.2.1 Availability of Escape Routes to Muster Areas

Table 2.3 provides sample rule sets that may be developed to assess the availability of
escape routes to muster areas exposed to heat radiation and smoke effects.
Table 2.3 Sam ple Rule Sets for Criteria of Im passability of Escape Routes
due to Heat Radiation and Sm oke
If the underside structure of a route formed by cladding and plate, is still intact, the escape
route is impassible if heat radiation level at the underside of the escape route exceeds 37.5
2
kW/m .
A route, separated from heat effects to the side by a clad wall but having a grated floor, is
2
impassable if the heat radiation level on other side of the clad wall is more than 12.5 kW/m .
2
Less than 5 kW/m will cause pain in 15 to 20 seconds and injury after 30 seconds’ exposure
[12].
2
Greater than 6 kW/m will cause pain within approximately 10 seconds; rapid escape only is
possible [12].
An unprotected route is impassable if the smoke concentration is higher than 2.3%.
In addition, many companies adopt smoke obscuration criteria such that routes
are deemed to be blocked if the visibility is less than 10 m. It is noted also that
many companies provide escape packs with smoke hoods, although little credit
is adopted for using smoke hoods for the access (immediate escape) stage as
they are located typically in accommodation areas for limited use in aiding
helicopter or TEMPSC boarding.
10 ©OGP
2.2.2 Lifeboat Embarkation

Table 2.4 provides sample rule sets that may be developed to assess the inoperability of
lifeboat embarkation areas due to heat radiation and explosion effects.
Table 2.4 Sam ple Rule Sets for Criteria of Inoperability of Lifeboat
Em barkation Areas due to Heat Radiation and Explosion Effects
Any jet fire impact (with or without water sprays operating).

Any pool fire impact (without water sprays operating).
Any explosion impact with an overpressure higher than 0.2 bar [12].
Permanent damage to the supporting structure.
2
A heat radiation level of more than 12.5 kW/m to the underside or outside of the embarkation
area.
2.2.3 Lifeboat Evacuation

Table 2.5 shows the probabilities of success for TEMPSC evacuation based on
computer model predictions.
Table 2.5 Probabilities of Success 1 for TEMPSC Evacuation (Com puter

Model Predictions)
2
Wind (Beaufort Force ) (m/s) Davit-Launched Free-Fall
[2],[6] [OGP Member]
Calm (0-3) (0 - 5 m/s) 0.8 0.95
Moderate (4-6) (5 - 14 m/s) 0.6 0.9
Gale (7-9) (14 - 24 m/s) 0.1 0.75
Storm (>9) (> 24 m/s) 0.05 0.4
Notes:
1. “Success”, in this context, is achieved when no fatalities occur during the TEMPSC
evacuation event. Thus 100% of the personnel on board the TEMPSC will be safely
transported away from the installation and potentially to shore. As a rule of thumb it is
commonly assumed in QRA that 50% of the occupants of a failed TEMPSC will become
evacuation phase fatalities and the remaining 50% are immersed with the potential to suffer
rescue and recovery phase risk.
2. Beaufort refers to the Beaufort Wind Scale, an internationally recognized system of
describing observed effects of winds of different velocities. Winds are grouped into speed
categories from 1 to 12 and area referred to as Force 1, Force 2, etc.
The Computer Model was the Escape model as documented within [6] developed by
Technica, now part of DNV and is available within the NEPTUNE Software toolkit,
upgraded as ESCAPE III to cater for mobile unit motion dynamics.
It is noted that the probability of successful TEMPSC evacuation is strongly influenced
by the facility layout. As a result of the research conducted in developing the ESCAPE
model and by the associated D.En Guidance, installation designers and facility
operators created greater clearance distances between TEMPSC and structures that
could be impacted on descent and in offset sea level clearances to minimize the
potential to be swept back towards the facility once released. By remounting new and
existing TEMPSC from a parallel/side on mount to a perpendicular/end-on mount this
reduced the wind loading on descent which could cause platform collisions and offered
©OGP 11
the ability to drive more quickly away (without a need to turn) when seaborne reducing
the swept back collision potential.
In addition, OREDA-92 [7] includes some recorded failure incident and failure rate data
for davit launched TEMPSC.
2.2.4 Frequency of Installation Evacuation

Table 2.6 shows the frequency of partial/total evacuation for the Northern North Sea.
Table 2.6 Frequency of Partial/Total Evacuation (Northern North Sea)

-3
Survival Craft Evacuation 3.0 × 10 per installation year [2]
-3
Helicopter Evacuation 7.5 × 10 per installation year [2]
Over a 25 year installation life, this implies a 7.5% probability that there will be a TEMPSC
evacuation and 19% probability of an evacuation by helicopter.
2.2.5 Probability of Evacuation Success

The actual success rates at each stage of the process of EER for a defined group of
personnel can be translated into an overall success rate. Stages of EER and associated
probabilities of personnel acting as described may be defined as follows:
• identifying alarm = P1
• making local escape (access stage) = P2
• reaching muster/refuge place = P3
• effecting evacuation or escape (from muster/refuge away from installation) = P4
• reaching place of safety = P5
As an example, consider escape of 5 people working in a process area in which there is

a rapidly developing fire. It is assumed that evacuation is by TEMPSC. Weather
conditions may be any of those observed at this location. There is a good back-up
organization to recover personnel after they have transferred to TEMPSC. (Source: OGP
member).
• P1 = 0.95 (Visual and thorough alarm system)
• P2 = 0.80 (Fire effects may overcome personnel)
• P3 = 0.98 (Good escape routes unlikely to be blocked)
• P4 = 0.85 (to include allowance for possibility of becoming trapped at the
muster/refuge place. Also includes derivation for TEMPSC launching weighted for
different weather conditions)
• P5 = 0.90 (Emergency organization for the installation retrieves personnel. Success
is good except in poor weather)
Overall Success = (P1 × P2 × P3 × P4 × P5) = (0.95 × 0.80 × 0.98 × 0.85 × 0.90) = 0.57 for
the 5 people in the area where the incident takes place. Note that the chance can be
improved to 0.74 (P1 × P2 × P3) if people can stay on the installation.
12 ©OGP
2.2.6 Escape by Sea Entry

Table 2.7 provides a sample rule set for the probability of immediate fatality due to
jumping to the sea from a North Sea deck (a lower deck where staff could be expected
to routinely work).
Table 2.7 Sam ple Rule Set for Im m ediate Fatality Probability due to
Jum ping to Sea from a North Sea Lower Deck
Fatality Probability 0.1

Source: Sample extract from a typical Rule Set document of an OGP member.
Note: Does not allow for use of tertiary devices, such as rope ladders etc., or for distance to sea.
Table 2.8 provides sample rule set that may be developed to assess the probability of
fatality upon entering the sea to escape in the North Sea.
Table 2.8 Sam ple Rule Set for Fatality Probability Upon Entering the Sea to
Escape (North Sea Data)
Stand-by vessel status Probability

of fatality
No stand-by vessel present
Averaged over all weather conditions 0.8
Stand-by vessel(s) present.
Calm Weather (Wind 0 to 5 m/s)
No or Low Fire Effects at Sea Level 0.06
High Fire Effects at Sea Level 0.15
Moderate Weather (Wind 5 to 12 m/s) 0.22
Severe Weather (Wind >12 m/s) 0.92
Source: Sample extract from a typical Rule Set document of an OGP member.
Notes:
• Probabilities cover full scope of evacuation: entering sea; remaining at sea surface; rescue.
• Personnel making a sea entry expected to be wearing survival suit and life-jacket.
• Data do not differentiate sea temperature effects on personnel survival rate. In reality,
personnel survival time immersed in sea, depends on local sea temperatures and generic
human endurance times.
2.2.7 Operability of Evacuation and Escape Methods under Various Accident

Circumstances
Table 2.9 shows the operability ratings of evacuation and escape methods under
various accident circumstances.
Table 2.10 shows the historical success rates for a number of evacuation and escape
methods.
©OGP 13
Table 2.9 Operability Ratings of Evacuation / Escape Methods Under

Various Accident Circum stances: Hazards, Evacuation Tim e, W eather
Types of Hazard Evacuation Time Weather

Evacuation/Escape Radiant Gas/H 2 < 15 < 60 < 180 Calm Mod Severe
means Heat S/ mins mins mins
Smoke
Preferred Helicopter 2 2 2/2 8/2 9/9 9 9 5
Evacuation Bridge 5 5 9/9 9/9 9/9 9 9 7
Direct Marine 5 5 2/2 9/5 9/9 9 8 3
TEMPSC Protected
9 9 9/7 9/9 N/A 9 6 1
Evacuation Access
Unprotected
3 3 7/7 9/9 N/A 9 6 1
Access
Liferaft,
Escape to
Ropes, Jump 2 2 8/8 N/A N/A 3 2 0
Sea means
etc.
Source: OGP member.
Notes
Ratings: Lowest = 0, Highest = 9. These ratings are based on how operable the various methods
of evacuation / escape are expected to be under different accident circumstances of hazard,
evacuation time and weather. A N/A mark indicates that alternative methods of evacuation /
escape would be used in these circumstances. Two marks are given for the evacuation times
based on the separate cases of total People on Board (PoB) = 20 and total PoB = 200 respectively
(i.e. 8 / 2 refers to 8 for a 20 man installation, 2 for a 200 man installation).
Table 2.10 Evacuation and Escape Success Rates
Types of Evacuation/Escape Historical

Success Rates
1
Preferred Helicopter Low
Evacuation Bridge High
2
Direct Marine N/A
TEMPSC Protected Access N/A
Evacuation Unprotected Access
Low
Escape to Liferafts, Ropes,

Low
Sea means Jumping etc.
Source: OGP member.
Notes
Ranking Categories: High / Medium / Low
1. Helicopters have not generally been available in time for emergency evacuations.
2. No data, as these are more recent developments and are not widely deployed offshore as
yet e.g. Hibernia GEMEVAC.
14 ©OGP
2.2.8 Survival Times in Water

Table 2.11 shows the survival time in water adopted in the North Sea. These values do
not account for times for injured staff where injured survival times in summer are 85%
of those not injured and in winter 60%.
Table 2.11 Survival Tim es (m inutes) in W ater [9]
Sea State: Calm Moderate Rough

Category Summer Winter Summer Winter Summer Winter
Lifejacket and Survival Suit 180 120 165 60 120 100
Lifejacket / No Survival Suit 75 45 30 30 15 15
Insulated Immersion Suit
180 180 180 180 180 180
with Buoyancy
Lifejacket / leaking survival
150 75 60 30 30 15
suit
Lifejacket/ leaking survival
suit with thermal immersion 150 180 60 80 180 60
garment during winter
No Lifejacket/No Survival
20 10 15 10 10 5
Suit
Survival times can be extended for warmer water environments with the following rough
guidance, depending on a variety of factors such as body type, clothing etc:
• 70° to 80°F (21° to 27°C): 3 hours to indefinitely
• 60° to 70°F (16° to 21°C): 2 to 40 hours
• 50° to 60°F (10° to 16°C): 1 to 6 hours
In warmer water factors other than hypothermia may become more important.
3.0 Guidance on Use of Data

The following sub-sections provide guidance on use of data presented in Section 2.2.1
to 2.2.7.
3.1 Availability of Escape Routes to Muster Areas

The criteria shown in Table 2.3 are samples of rule sets that can be used to evaluate the
number of fatalities to personnel trapped in a fire area over an extended period due to
effects from a fire of long duration. The criteria may be considered conservative when
escape is possible within a few minutes after the start of a fire. Rule sets should be
developed specific to the circumstances.
The Vulnerability of Humans datasheet provides data complementary to that given in
Section 2.2.
3.2 Lifeboat Embarkation

Similar to the above, the rule set for inoperability of TEMPSC embarkation areas should
be developed specific to the installation circumstances.
©OGP 15
3.3 Lifeboat Evacuation

The various references in Table 2.5 give a range of predictions for the success rate of
TEMPSC evacuation. These data figures are not precise, but give an indication that
launching of TEMPSC does not guarantee safe evacuation.
The outlines of the various ways in which the TEMPSC evacuation process can fail are
as indicated in Table 2.1 and Table 2.2.
TEMPSC evacuation success data are generally predictions based on North Sea
experience of davit launched TEMPSC. Installations in other areas may use craft which
are not davit launched TEMPSC. This could affect the success rate for evacuation.
3.4 Frequency of Installation Evacuation

Table 2.6 shows the predicted frequency of having to evacuate an installation is derived
from generic information. Some installations may never have an evacuation, others may
have several over their lifetime.
Helicopter evacuation might not be achievable until some hours after the initiating
event. Fire, smoke and gas presence can prevent the use of helicopter. For such cases,
TEMPSC and bridge transfer (for bridge linked platforms) provide further alternative
means of evacuation.
3.5 Probability of Evacuation Success

The probabilities presented are based on typical OGP member database. Any
probabilities used should be scrutinised and developed specific to the installation
evacuation arrangement and facilities.
3.6 Escape by Sea Entry

There are insufficient data on the use of liferafts to give reliable figures for the
probability of fatality when these devices are available. The probabilities presented in
Table 2.7 and 2.8 are sample extract from typical rule sets document of OGP member
database. Similar to the above, probabilities used should be scrutinised and developed
specific to the installation escape arrangement and facilities.
3.7 Operability of Evacuation and Escape Method under Various Accident

Circumstances
Tables 2.9 and 2.10 are provided to aid estimates of EER systems effectiveness under
different accident circumstances. The data is qualitative estimate of the applicability and
success rates for different types of EER equipment.
3.8 Survival Times in Water

The survival times are taken from HSE Offshore Technology Report OTO 95 038 [9].
Survival times may be multiplied by 0.6667 to give a factor of safety as suggested in
guidance PBN 97/20 of HSE for demonstration of good prospect.
16 ©OGP
All of these references date from the late 1980s/early 1990s. There has been little
subsequent development in this area, as explained by the following brief account.
Prior to the PFEER (Offshore Installations (Prevention Of Fire and Explosion, and
Emergency Response)) Regulations 1995 in the UK, a significant degree of EER analysis
was performed associated with the Piper Alpha Disaster report by Lord Cullen which
required EER Analysis as a “forthwith” study in advance of the Safety Case Regulations
which were enacted in 1993 (Updated in 2005 [10]). Much of the new numerical analysis
work was performed at this time building on the earlier DEn ESCAPE work involving
Technica.
The PFEER Regulations set out more firm requirements on emergency response issues,
principal among which was the requirement to demonstrate a good prospect of rescue
and recovery. The Regulations enabled the possibility of Standby Vessel sharing. A lot
of industry application was then devoted to demonstrating “good prospect”, particularly
in cases of SBV sharing. Post PFEER many SBV sharing studies were performed using
analysis methods developed before PFEER. Industry activity then drifted away from
numerical risk methods and focused more on the practicalities of effective rescue and
recovery. Section 2.3 gives a more detailed account of activity observed post PFEER in
the UK.
3.9 Development of Offshore EER Arrangements

Whatever offshore evacuation technique is used, two areas have been developed to
improve the success of EER, principally stemming from Lord Cullen’s report on the
Piper Alpha Disaster. Firstly there is the development of concept, specification and
performance of Temporary Refuges. Secondly, there is increased allowance for human
factors, comprising command, control, human behaviour and ergonomics in the design
of equipment, procedures etc with significant efforts given to training emergency
command teams in simulated exercises. Much work has been done in these areas and
there is continuous focus from operators and regulators.
A number of innovative EER systems are in various stages of development. Several
systems have been adopted by operators as risk reduction measures and best available
means for EER. Examples of these innovative systems can generally be grouped into
the following categories:
• TEMPSC assist systems
• Individual Escape Devices
• Multiple Personnel Escape Devices
Levels of operational testing and experience for each particular system vary. Due to
these systems’ relatively limited usage within the industry, there are little or no data
currently available.
3.9.1 Post PFEER Activity in the UK in Relation to Evacuation, Escape and

Rescue
It became obvious that a good prospect of rescue and recovery required the ability to
deploy resources quickly enough to recover people before survival times were
exhausted. Therefore effort was applied from two sides to this survival challenge:
• To improve survival times in water, and
©OGP 17
• To deploy new and different resources to get to people in the water more quickly.
3.9.1.1 Improving Survival Times

It became obvious that survival time was linked to the type of survival suits being worn.
Zips and worn seals compromised suits and caused ingress of water, which reduced
survival times, so new suits were developed and additional training provided to reduce
such problems.
The problems of incompatibility between various survival suits and lifejacket
combinations became more obvious and efforts were applied to demonstrate effective
combinations, with many companies performing mannequin water tests at sea.
The survival time was additionally tackled with the widespread adoption of thermal
immersion garment liners worn within survival suits in defined weather/sea conditions
to enhance the “good prospect”.
More recently, led by several companies from the mid 1990s, there has been the
adoption of rebreather technology to enhance personnel’s ability to survive helicopter
ditching scenarios. This addresses the human response to cold water immersion, which
induces breathing and water ingress if submerged. The rebreather allows breathing to
take place drawing in previously expelled breath to facilitate submerged escape from
the aircraft.
3.9.1.2 Reducing Recovery Times

As an aid to faster recovery of personnel from the water, the use of personnel locator
beacons (PLB), previously limited to TEMPSC, Helicopter and Liferafts, was adopted by
many companies whose associated support response fast rescue craft had provisions
to track the PLB signal. When using PLBs, it important to ensure that when activated
these devices do not interfere with helicopter EPIRB signals.
On the deployment of resources side, advances began with better systems of
recovering personnel from the sea. Lessons learned on earlier emergency situations
prompted:
• The development of devices such as the Jason’s Cradle, Dacon Scoop
• The development of Caley davits for FRC quick recovery in rough weather with an
inbuilt heave compensation device
• Lower freeboard, and better illuminated and defined SBV rescue zones.
A SBV code of practice was developed to harmonise the specification of SBVs, outlining
different classes of vessel essentially related to the POB on the installations they are
attending. This was then developed more recently as the Emergency Response Rescue
Vessel (ERRV) code.
The specifications of equipment and manning requirements were developed to ensure
effective resources could be available to rescue, recover, attend survivors and crew the
vessels effectively.
With respect to SBV, the industry began to increase the number, capacity, reliability,
endurance and speed of fast rescue craft. From the mid 1990s, fast rescue craft began
to develop towards the “daughter craft” (DC) principle. These craft were larger, had
canopies and could operate somewhat independently of the SBV for defined periods.
18 ©OGP
This enabled more distant deployments and enabled closer support for example for
helicopter operations between local facilities, greater support under shared SBV
circumstances e.g. over the side work close in support. DC have greater weather
limitations than FRC as their weight makes rough weather recovery a problem, limiting
their deployment to moderate seas.
Also from the late 1990s, BP and various partners began to advance the Jigsaw concept
that would provide good prospects of rescue and recovery by a more focused
deployment of higher specification SBV and offshore based Search and Rescue (SAR)
helicopter provisions (essentially equipped with forward looking Infrared systems, for
the location of those immersed, and winch recovery provisions). The Jigsaw vessels are
equipped with Autonomous Rescue and Recovery Craft (ARRC). These are essentially
vessels that can be deployed using dual davits, which have a Rigid Inflatable Boat basis
but with large cabs over 2 decks allowing comfortable autonomous operations and
effective recovery capabilities.
3.9.1.3 Non UK Developments

Away from the UKCS and the North Sea, newer work has been applied in the field of
Emergency Response towards colder and ice oilfield environments. The Terra Nova
development demonstrated the need to keep TEMPSCs in warmed garage facilities to
ensure quick, effective use. The Sakhalin developments have demonstrated the need for
new thinking in relation to evacuating onto full or partial sea ice cover. More recently the
Kashagan development in the northern Caspian Sea, icebound in winter, has required
creative solutions for emergency response arrangements, also influenced by significant
potential for high concentration H2S situations.
4.0 Review of Data Sources

The principal source of the data presented in Section 2.2 is the data published by OGP.
References [4], [4] and [6] include a useful overview of offshore EER, including fatality
assessment, as well as evacuation modeling (helicopters, lifeboats, bridge, sea entry).
OREDA-92 [7] includes some recorded failure incident and failure rate data for
conventional davit launched life boats.
The Vulnerability of Humans datasheet provides data complementary to that discussed in
Section 2.2.
Most of the data presented are generally based on the North Sea experience.
Installations in other areas operating in different environmental conditions and
operating standards may be subjected to area specific data.
5.0 Recommended Data Sources for Further Information

There are limited data available for use in EER analysis, however, a number of
organisations provide guidance on EER best practice through their websites, within the
UK this includes the Oil and Gas UK (formerly known as UKOOA), the Health and Safety
Executive (HSE) UK, Emergency Response and Rescue Vessel Association (ERRVA)
UK, and The Step Change in Safety group. For Norway the Norwegian Petroleum
Services Authority (PSA) (formerly the NPD) provides guidelines. For other offshore
sectors local authorities can be referred to such Transport Canada, Mineral
©OGP 19
Management Services (US), Occupational Safety and Health Administration (US), US

Coast Guard, and in general the International Maritime Organisation (IMO).
6.0 References
[1] HSE, 1995. Prevention of Fire and Explosion, and Emergency Response on Offshore
Installations. Not yet available electronically in full; link to summary information:
(http://www.hsebooks.com/Books/product/product.asp?catalog%5Fname=HSEBoo
ks&category%5Fname=&product%5Fid=2788)
[2] Sykes, K, 1986. Summary of conclusions drawn from reports produced by, or made
available to, the Emergency Evacuation of Offshore Installations Steering Group,
MaTSU.
[3] Technica, 1988. Escape II - Risk Assessment of Emergency Evacuation from Offshore
Installations, OTH 88 8285, London: HMSO, ISBN 0 11 412920 7.
[4] Robertson, D, 1987. Escape III - The Evaluation of Survival Craft Availability in
Platform Evacuation, Intl. Offshore Safety Conference, London.
[5] Department of Energy, 1988. Comparative Safety Evaluation of Arrangements for
Accommodating Personnel Offshore, Section 9 + Appendix 7.
[6] Technica, 1983. Risk Assessment of Emergency Evacuation from Offshore Installation,
Report F 158, prepared for DoE.
[7] DNV Technica, 1993. OREDA-92, Offshore Reliability Data Handbook, 2nd ed.,
ISBN 82 515 0188 1.
[8] HSE, 1995. A Methodology for Hazard Identification on EER Assessments, RM
Consultants Ltd, OTH 95 466.
http://www.hse.gov.uk/research/othhtm/400-499/oth466.htm
[9] HSE, 1995. Review of Probable Survival Times for Immersion in the North Sea,
OTO 95 038. http://www.hse.gov.uk/research/otopdf/1995/oto95038.pdf
[10] The Offshore Installations (Safety Case) Regulations 2005, SI2005/3117, Norwich: The
Stationery Office, ISBN 0 11 073610 9.
http://www.opsi.gov.uk/si/si2005/20053117.htm
[11] (UK) Step Change in Safety, 2003. Loading of Lifeboats during Drills - Guidance.
http://stepchangeinsafety.net/ResourceFiles/Lifeboat%20Loading%20Guidance%20
Final%20Copy.pdf
[12] International Association of Oil & Gas Producers, 2009. Vulnerability of Humans,
DNV Report no. 32335833/14, rev 2.
20 ©OGP
Report No. 434 – 20.1

March 2010
Guide to
finding and
using reliability
data for QRA
RADD – Guide to finding and using reliability data for QRA
contents
1.0 Scope and Application.............................................................. 3
1.1 Scope.................................................................................................................... 3
1.2 Application ........................................................................................................... 3
1.3 Definitions ............................................................................................................ 3
2.0 Summary of Recommended Data ............................................... 4
2.1 Copyright.............................................................................................................. 4
2.2 Sources of Reliability Data ................................................................................. 4
3.0 Guidance on use of data ........................................................... 6
3.1 Introduction.......................................................................................................... 6
3.2 Failure Rate Calculation...................................................................................... 7
3.2.1 Background ................................................................................................................... 7
3.2.2 Failure Rate Calculation #1 – Few Failures, Constant Failure Rate Assumed ........ 8
3.2.3 Failure Rate Calculation #2 – Point Estimate ............................................................. 9
3.2.4 Failure Rate Calculation #3 – Many Failures with Probability Plotting .................. 10
3.2.5 Treatment of Common Cause Failures ..................................................................... 13
3.2.6 Failure Rate Calculation using the OREDA Estimator............................................. 13
3.3 Calculation of “on demand” Failure Probability............................................. 14
3.4 Guidance Specific to the OREDA Handbook .................................................. 14
3.4.1 Selecting Appropriate Data ........................................................................................ 14
4.0 Review of data sources ........................................................... 16
4.1 OREDA Database and Handbook(s) ................................................................ 16
4.1.1 OREDA Data Presentation.......................................................................................... 18
4.2 MIL-HDBK-217F ................................................................................................. 19
4.3 FIDES .................................................................................................................. 19
4.4 EPRD-97 and NPRD-95...................................................................................... 19
4.5 PDS Data Handbook.......................................................................................... 20
4.6 FARADIP III......................................................................................................... 20
4.7 IEEE 493-1997 .................................................................................................... 20
4.8 Sintef Reports, SubseaMaster and WellMaster .............................................. 20
5.0 Recommended data sources for further information ................ 21
6.0 References .............................................................................. 21
©OGP
Abbreviations:
BIT Built-in Test
MTTF Mean Time To Failure
MTTR Mean Time To Repair
ND Nominal Diameter
SCSSV Surface Controlled Subsurface Safety Valve
©OGP

1.1 Scope
The reliabilities of fire and gas detection, ESD and blowdown, blowout prevention and
fire protection systems are key inputs to Quantitative Risk Assessment (QRA) of
exploration and production facilities. This datasheet provides guidance on obtaining,
selecting and using reliability data for these systems and for their component parts,
for use in QRA.
1.2 Application
This datasheet contains specimen data taken from previous OGP datasheets; this
specimen data are presented in Error! Reference source not found. to Error!
Reference source not found.. In addition, the recommended data sources that are
identified in section 2.0 should be consulted to ensure that all data are the most up to
date and relevant for any particular analysis. Guidance on using and processing data
is given in Section 3.0.
The data presented are applicable to activities in support of operations within
exploration for and production of hydrocarbons.
1.3 Definitions
For the purposes of this document, the following terms and definitions apply.
• Failure The inability of an equipment unit or system to perform
a specified function.
• Critical failure Failure of an equipment unit that causes an immediate
cessation of the ability to perform a required function.
• Non-critical failure Failure of an equipment unit that does not cause a
cessation of the ability to perform a required function.
• Dangerous failure A failure that has the potential to prevent a safety
system from achieving its safety function(s) when there
is a true demand. A single dangerous failure may not be
sufficient to prevent a redundant safety system from
performing its safety function (e.g. two coincident
dangerous failures may be needed to prevent operation
of a 2-out-of-3 voting system).
• Non-dangerous failure A failure of a safety system that is not dangerous.
• Safe failure A failure that has the potential to unnecessarily trigger
a safety function.
• Revealed failure A failure that is evident or that is detected by the
system itself as soon as it occurs. Failures detected by
the built-in diagnostic tests (BIT) of a logic solver are
also considered as revealed failures.
• Hidden failure A failure that is not revealed to operation or
maintenance personnel and that needs a specific action
(e.g. periodic test) in order to be identified.
• Com m on cause failure Failure of different items resulting from the same direct
cause, occurring within a relatively short time, where
these failures are not consequences of another. See
also Common mode failure.
©OGP 3
• Com m on m ode failure A subset of Common cause failure whereby two or
more components fail in the same manner.
• Demand Activation of a system’s function (may include
functional, operational and test activation).
• Failure m ode Effect by which a failure is observed on the failed item.
• Failure on dem and Failure that occurs immediately when an item is
instructed to perform its intended function (e.g. stand-
by emergency equipment).
• Reliability Probability of an item performing a required function
under stated conditions for a specified time interval.
• Observation period Interval of time between the start date and end date of
reliability data collection.
• Failure rate Limit, if this exists, of the ratio of the conditional
probability that the instant of time, T, of a failure of an
item falls within a given time interval, (t + + Δt) and the
length of this interval, Δt, when Δt tends to zero, given
that the item is in an up state at the beginning of the
time interval.
Note:
1. In this definition, t may also denote the time to
failure or the time to first failure.
2. A practical interpretation of failure rate is the
number of failures relative to the corresponding
operational time. In some cases, time can be
replaced by units of use. In most cases, the
reciprocal of MTTF can be used as the predictor for
the failure rate, i.e. the average number of failures
per unit of time in the long run if the units are
replaced by an identical unit at failure.
• M ean Tim e to Failure (MTTF) Expectation of the time to failure.
• M ean Tim e Between Failures (MTBF) Expectation of the time between failures.

2.1 Copyright
The data that are presented in the sources discussed in Section 2.2 are protected by
copyright and cannot be reproduced without specific written permission from the
copyright holders. Where guideline values are given (Error! Reference source not
found. to Error! Reference source not found.), these are taken from sources
that are either in the public domain or from pre-existing OGP datasheets. It is strongly
advised that in all analyses the best available data are taken from the relevant source
as listed in section 4.0.
2.2 Sources of Reliability Data
The recommended sources of reliability data are presented in Table 2.1.
4 ©OGP
Table 2.1 Data Sources
Data Source Equipment Available From

OREDA Handbooks [1] Process Equipment (Offshore) Det Norske Veritas
Note: new issue N-1322 Høvik
scheduled for release in Norway
2009
MIL-HDBK-217F – Electronic components US Military Handbook
Reliability Prediction of
Electronic Equipment
[10]
EPRD-97 – Electronic Electronic components Reliability Analysis Center
Parts Reliability Data 201 Mill Street
(RAC) [12] Rome, NY 13440
USA
NPRD-95 – Non Mechanical and electro- Reliability Analysis Center
Electronic Parts mechanical components 201 Mill Street
Reliability Data [11] Rome, NY 13440
USA
PDS Data Handbook [13] Sensors, detectors, valves & Sydvest
control logic Sluppenvegen 12E
N-7037 Trondheim
Norway
FARADIP III [14] Electronic, electrical, [email protected]
mechanical, pneumatic
equipment
IEEE 493-1997 [15] Electrical power generation and ISBN1-55937-066-1
distribution
STF18 A83002, Surface Controlled Subsurface Exprosoft
Reliability of Surface Safety Valves N-7465 Trondheim
Controlled Subsurface www.exprosoft.com
Safety Valves
STF75 A89054, Subsea Subsea Blowout Preventers Exprosoft
BOP Systems, Reliability N-7465 Trondheim
and Testing. Phase V www.exprosoft.com
STF75 A92026, Surface Blowout Preventers Exprosoft
Reliability of Surface N-7465 Trondheim
Blowout Preventers www.exprosoft.com
(BOPs)
STF38 A99426, Subsea Blowout Preventers – Exprosoft
Reliability of Subsea deepwater subsea N-7465 Trondheim
BOP Systems for www.exprosoft.com
Deepwater Application,
Phase II DW
SubseaMaster & Components in oil wells (BOPs Exprosoft
WellMaster and SCSSVs) N-7465 Trondheim
[9] and [8] www.exprosoft.com
EIREDA Database Valves, sensors and control EUORSTAT, Paris
European Industry logic (nuclear power station
Reliability Data data)
Handbook,
Electrical Power Plants
©OGP 5

3.1 Introduction
The science of reliability prediction is based upon the principals of statistical analysis.
Reliability is defined as “the probability that equipment will perform a specified
function under stated conditions for a given period of time” which defines a
probabilistic approach rather than a deterministic one. This probability can be
calculated or stated to reside within certain statistical confidence limits.
Fundamental to such a calculation is the ability to source basic reliability data. Ideally
such data should be:
• Current
• Auditable
• Specific (applicable to equipment/component type)
• Extensive (large sample with many recorded failures)
• Applicable to environment
• Be suitable for life trending
Unfortunately, real world data sources rarely meet these ideals and it is therefore
necessary to accept compromises. When performing QRA, it is important that the
limitations of the data source are understood, and where necessary alternatives
sought.
For QRA, the reliability parameters to be taken from the database would be the failure
rate (or the mean time to failure) and/or the probability of failure on demand; see
Section 3.3 for details of probability of failure on demand calculation.
Where information is extracted from the OREDA or another industry standard
database it is not (in general) necessary to perform any further statistical analysis of
the failure patterns. The approach described in Section 2.3.3 applies where basic
information relating to times to failure is available for analysis, for example from
maintenance records or breakdown reports. In these circumstances, it is necessary to
judge the quality of the data and to then apply the appropriate analytical technique.
The techniques for data analysis presented herein are divided into two classifications,
those that are based simply on the sample statistics and those that are based on
inferences from the associated statistical distributions. The characteristics of
distributions are much harder to derive (especially from field breakdown reports
rather than laboratory test data), but have the potential to provide more information.
Note that it is not the intention to provide a comprehensive theoretical background to
data analysis in this document, but instead to provide some practical techniques that
may be used to prepare reliability data. Three techniques are outlined, namely:
• Prediction of failure rate within defined confidence limits applied where only
sparse failure data are available – refer to Section 3.2.2
• Calculation of point estimate of failure rate applied where adequate data are
available – refer to Section 3.2.3
• Use of probability plotting to derive information relating to the underlying
statistical distribution – refer to Section 3.2.4
6 ©OGP
3.2 Failure Rate Calculation

3.2.1 Background
The observed failure rate for a component is defined as the ratio of the total number of
failures to the total cumulative observation or operational time. For items displaying a
constant failure rate, if λ is the failure rate of the N items then:
λ = k/T
where k is the total number of failures and T is the total observation time across the N
items.
For the case where components are replaced after failure (as applies to industry field
databases) then the total cumulative observation time may be defined as N × field
operational lifetime.
Strictly, this calculation provides a point estimate of the failure rate and if the exercise
were repeated with another set of identical equipment and conditions it may yield
results that are not identical to the first. Any number of such measurements may be
made providing a number of “point estimates” for the failure rate, with the true value
of the failure rate only being provided after all components have failed (for a non
replacement test). In practice therefore, it is necessary to make a prediction about the
total population of items based on the failure patterns of a sample. This process of
statistical inference can be performed using the properties of a X2 (chi squared)
distribution. This allows us to bound the population failure rate within confidence
limits (typically 90% or 60% may be used).
It is also necessary to make some assumptions about the pattern of failures across
time, considering the shape of the commonly depicted ‘bathtub curve’ (Figure 3.1).
This curve typifies the expected component failure rate across time and is divided into
three distinct area, namely
• Early life, characterized by a decreasing failure rate
• Useful life (constant failure rate)
• Wear out (increasing failure rate)
©OGP 7
Figure 3.1 The Bathtub Curve
In order to perform analysis of failure patterns outside of the constant failure rate
period a level of detailed information is required that is typically not available from the
recorded data (e.g. actual age of equipment of failure, homogeneous samples).
Therefore an assumption is made that all failures recorded are experienced during the
useful life phase, and the pattern of these failures may be described by a random,
exponential distribution. This can, at least to a certain extent, be justified on the
following grounds:
• Early life failures resulting from commissioning problems may not be recorded as
equipment failures
• Early life failures resulting from manufacturing defects can be largely eliminated
by testing prior to installation
• Wear out failures largely eliminated by preventative maintenance and planned
renewals. Note that this assumption may be less valid for wear out of subsea
equipment where no planned maintenance will be performed.
The preceding discussion allows us to analyze the data from each source, and in most
cases to calculate a mean value, confidence intervals about the mean value and the
associated variance.
3.2.2 Failure Rate Calculation #1 – Few Failures, Constant Failure Rate Assumed
Where total number of failures is small (say < 5), or zero, a point estimate of failure
rate is inappropriate, therefore a technique of statistical inference and confidence
limits should be applied. This can be addressed via a Chi Squared (X2) test using the
following methodology:
1. Measure T (total observed time) and k (number of failures)
2. Select a confidence interval
3. α = 1 – confidence interval
8 ©OGP
4. n = 2k for failure truncated test

or
n = 2(k+1) for time truncated test
5. Look up value for X2 corresponding to n and α (use standard mathematical tables)
6. Failure Rate Confidence Limit at X2/2T
7. For double sided limits use procedure twice to look up value for X2 at:
n = 2k and (1 – α/2) (lower limit)
n = 2k(2k+2) and α/2 (upper limit)
Note that X2/2T is a conservative estimate i.e. the true value has probability of α of
being higher than the estimate (based on a single sided upper confidence limit). Using
the upper bound of the failure rate is a conservative approach and hence it can be
used instead of the maximum likelihood estimate when the sample is considered to be
small.
Example : Equipm ent m aintenance records show that 5 devices each with a
recorded running time of 1000 hours have no recorded failures. Calculate the
failure rate at 60% confidence (single sided upper limit).
1. T = 5 × 1000 = 5000 hours
2&3. α = (1 – 0.6) = 0.4 for 60% confidence limit
4. n = 2 × (k+1) = 2 (time truncated since no failures have occurred)
5. From tables, X2 = 1.83 (60% confidence limit).
6. Upper bound of failure rate (60% confidence) = X2/2T = 1.83/10000 = 1.83 x 10-4
fails/hour
Note: the decision to use statistical interpretation or point estimate is based on the
number of recorded failures. For items with a very high failure rate a significant
number of failures could equate to a small amount of experience years, but typically a
large amount of experience years are also required for a point estimate.
3.2.3 Failure Rate Calculation #2 – Point Estimate

Where adequate data are available, a point estimate of the failure rate can be made
simply by taking the ratio of the total number of failures to the total cumulative
observed time. If λ is the failure rate of the N items then
λ = k/T
where k is the total number of failures and T is the total cumulative observed time.
©OGP 9
3.2.4 Failure Rate Calculation #3 – Many Failures with Probability Plotting
Where sufficient good quality data are available, probability plotting techniques may
be used to derive information relating to the underlying statistical distribution.
Graphical plotting techniques may be implemented manually or by computer and
involve analysis of the cumulative distribution of the data. A commonly used
distribution for failure data is the Weibull Distribution. This distribution originally
postulated in 1951 by Swedish mechanical engineer Waloddi Weibull. It is particularly
suited to reliability life data plotting because of its flexibility, having no specific shape
but instead being described by shaping parameters. It is a three parameter
distribution, but often only two are used – the characteristic life (α) and shape factor
(β). There are special cases associated with values of the shape factor:
• β = 1 corresponds to exponential distribution
• β < 1 represents burn in (decreasing failure rate)
• β > 1 represents wear out (increasing failure rate)
NB In line with convention, β is used here to represent the shape factor of the Weibull
distribution. This is not the same β used to describe the dependent failure fraction of
common cause failures (see Section 3.2.5).
By using a graphical plotting technique, the data can be quickly analysed without
detailed knowledge of statistical mathematics. A simple procedure for this is as
follows:
• Determine test sample size and times to failure
• List times to failure in ascending order
• Establish median rankings from published tables (or calculate/estimate from
formulae)
• Plot times and corresponding ranks on Weibull plot paper. This is essentially log-
log graph paper but with scales for reading β and α
• Draw best fit straight line and read off α at 63.3% intercept
• Draw a parallel line through intercept on y axis and read off β
Note that median ranking is the most frequently used method for probability plotting,
especially if the data are known not to be normally distributed. Median ranking tables
are available from statistics text books, or they may be estimated by the following
equation:
Ranking = (i - 0.3) / (N + 0.4)
where i is the failure order number and N is the total number of failures.
The process is best illustrated by means of a simple example:
10 ©OGP
Step 1. Rank Data using Median Rank Tables
Failure Time Median Failure Time Median Failure Time Median

Number to Rank Number to Rank Number to Rank
Failure Failure Failure
1 10 0.02 11 2000 0.35 21 77000 0.68
2 38 0.06 12 5000 0.38 22 10200 0.71
3 80 0.09 13 8300 0.42 23 119000 0.75
4 140 0.12 14 1200 0.45 24 134000 0.78
5 215 0.15 15 16300 0.48 25 146000 0.81
6 310 0.19 16 21500 0.52 26 159000 0.85
7 460 0.22 17 27500 0.55 27 172000 0.88
8 670 0.25 18 36000 0.58 28 187000 0.91
9 1050 0.29 19 48200 0.62 29 204000 0.94
10 1900 0.32 20 74000 0.65 30 230000 0.98
Step 2. Plot Tim es to Failure and Median Ranked Probabilities on W eibull

Paper
Step 3. Plot Line and Read Values of characteristic life (α) and shape
factor (β)
It is generally acceptable to fit a straight line plot by eye through the data points. The
value of shape factor is read by drawing a line perpendicular to the plotted line
through the plot origin. The value of β can then be read from the intercept of this line
and the β scale. The value for the characteristic life may read from the intercept of the
plotted line with the “estimator line”. The position of the estimator is determined by
the intercept of the perpendicular line with the α scale.
©OGP 11
In the above plot all three stages of the bathtub curve are displayed, the values are
approximately:
Characteristic life (α) 87 hours 320 hours 1000hours

Shape factor (β) 0.7 1.0 3.4
3.2.4.1 Probability Plotting – Complex Scenarios

If a straight line is not obtained in the Weibull plot, there could be one or more
underlying reasons, including:
• Data having been censored
• More than one failure mechanism (mixed Weibull effects)
• Errors in sampling
• There is a threshold parameter (i.e. a three parameter Weibull distribution applies)
• Distribution not Weibull
3.2.4.2 Dealing with Censored Data

At the end of a reliability trial or when processing field data there may be a number of
items that have not failed. This is referred to as a censored data sample. Those items
that have survived are referred to as “suspended”. To calculate the median ranks in
this situation the following procedure should be followed:
• Determine test sample size and times to failure
• List times to failure in ascending order
• Place suspended test items at the appropriate points in list
• For each failed item calculate the mean order number iti
where
and n is the sample size

• Establish median rankings from published tables (or calculate/estimate from
formulae)
• Plot times and corresponding ranks on Weibull plot paper.
3.2.4.3 Mixed Distributions

If the data do not fit to a straight line, especially where an obvious change of slope is
seen it may be that more than one mode of failure is being displayed by the sample. If
this is the case, the data pertaining to each failure mode must be segregated and
analysed separately.
3.2.4.4 Failure Free Period

Should the data still yield a curve rather than a straight line, it is possible that a failure
free life period is being exhibited i.e. a three value rather than a two value Weibull
distribution is applicable.
12 ©OGP
The third Weibull parameter (location parameter), γ, locates the distribution along the
abscissa. Changing the value of γ has the effect of "sliding" the distribution and its
associated function either to the right (if γ > 0) or to the left (if γ < 0). The parameter γ
may assume all values and provides an estimate of the earliest time a failure may be
observed. A negative γ may indicate that failures have occurred prior to the beginning
of the test or prior to actual use. The life period 0 to +γ is the failure free operating
period of such units
To cater for this, an attempt can be made to predict the failure free period. This may be
based on engineering judgement and knowledge of the items under consideration or
may simply the time until the first failure occurs. The data are then replotted from this
time and if a straight line results the failure free period is as estimated and the
remaining parameters may be estimated from the plot. If another curve is produced
the process is repeated.
3.2.5 Treatment of Common Cause Failures
A Common Cause Failure (CCF) is the result of an event that, because of
dependencies, causes a coincidence of failure states in two or more separate
channels of a redundant system, leading to the defined system failing to perform its
intended function. CCFs can degrade the performance of any redundant system and
are of particular concern when analysing protective functions. A number of
mathematical techniques exist for the treatment of CCF’s, one of the simplest and
most practical is the Beta factor approach. In essence this assumes that λ, the total
failure rate for each redundant unit in the system, is composed of independent and
dependent failure contributions as follows:
λ = λc + λi
where λi is the failure rate for independent failures
λc the failure rate for dependent failures
The parameter beta (β) can then be defined as:
β = λ c/ λ
NB β is also commonly used to represent the shape factor of the Weibull distribution, this is
not the same as β used to describe the dependent failure fraction of common cause failures.
Thus beta is the relative contribution of dependent failures to total failures for the
item. The lack of available data relating to dependent failures of sufficient quality
necessitates the use of an estimation technique for beta, guided by a number of
parameter shaping factors (the subjective assessment of defensive mechanisms).
Such a quantification method, known as the partial beta factor model may be applied
for detailed assessment. A full description of the technique, including weighting
factors is presented in [20].
For a simpler approach a representative value of β may be assumed between 0.01
(highly diverse components or systems) and 0.1 (similar components or systems).
3.2.6 Failure Rate Calculation using the OREDA Estimator

The OREDA handbook recognises that the data it presents are not taken from a
homogeneous sample. To merge these non homogenous data into a single multi
sample estimate with an average failure rate (point estimate of total number of failure
divided by aggregated time in service) is likely therefore to result in an unrealistically
short confidence interval. An approach referred to as the “OREDA-estimator” is
applied to derive a mean failure rate with associated upper and lower 90% confidence
bounds. A description of the theoretical basis for the OREDA-estimator is given in [2].
©OGP 13
The handbook also gives point estimates of failure rate; the numerical difference
between this and the OREDA estimator gives an indication of the degree of diversity in
failure rates between parts of the overall population.
OREDA recommends that the OREDA estimator be used when data are taken from this
source.
3.3 Calculation of “on demand” Failure Probability

The on-demand failure probability may be listed in the failure data source, e.g. OREDA
or occasionally FARADIP. Section 3.4.1.1 illustrates how this is extracted from
OREDA. It is usually more appropriate, however, to calculate a specific probability of
failure on demand for a given protective function. Typically such failures are
unrevealed and must be detected by means of manual or automatic proof testing.
For a protective system having failure rate λ and proof test interval T, the probability
of failure on demand or unavailability due to unrevealed failures is presented in Table
3.1.
Table 3.1 Unrevealed Failure Probability
Number of Number of Units Required to

Units Operate
1 2 3
1 λT/2
2 λ2T2/3
3 λ3T3/4 λ 2T 2
4 λ4T4/5 λ 3T 3 2λ2T2
3.4 Guidance Specific to the OREDA Handbook

3.4.1 Selecting Appropriate Data
The item selected from database must be appropriate in terms of fit to the system
under analysis and in terms of data quality. Specifically, the following should be
considered:
Technology: does the data correctly represent the equipment being assessed? It
may be necessary for the analyst to provide or seek expert judgement. e.g. can data
for a diesel engine be used for a spark ignited engine?
Environm ent: will the environmental conditions influence the failure rate? OREDA
data are gathered offshore North Sea. This introduces specific failure mechanisms
(saline environment, humidity, temperature), if transferring the data to another
environment additional failure modes and mechanisms may be involved.
Operational Mode: Equipment operated frequently in a standby mode (emergency
generators, firewater pumps) will exhibit different failure modes and frequency
compared to equipment operating continuously.
Num ber of Recorded Failures: Equipment with few recorded failures will have a
large uncertainty associated with their failure rate.
Population/Installations: It is desirable for data to be selected for equipment with
a large population across a wide number of installations. This avoids data
representing localised effects or dominated by one design or manufacturer.
14 ©OGP
Tim e in Service: It is desirable for data to be selected for equipment with a long
time in service (calendar time). The operational time may be considerably less for
equipment that is normally on standby (e.g. firewater pumps).
3.4.1.1 Number of Demands

Where stated, this value can be used to derive an on-demand failure probability (but
note also that an on-demand failure probability is occasionally stated in the comment
field). For example, one selected data item (taxonomy code 1.3.2) has 7 recorded
critical failures for the mode “fails to start on demand”. The number of demands is
given as 860, and hence the on-demand critical failure probability can be calculated as
7/860 = 0.008.
3.4.1.2 Repair Time

Repair times are stated in terms of active repair hours and repair manhours (min,
mean and max). In general the “active repair hours” will be of most interest but this
field is sometimes blank. In these instances and estimate can be made at 50% of the
repair manhours. Note that the active repair time does not include time for fault
realisation, spare parts or crew mobilisation or the impact of any applied maintenance
strategy or delays.
©OGP 15

4.1 OREDA Database and Handbook(s)
Originally initiated by the Norwegian Petroleum Directorate in 1981 to collect reliability
data for safety equipment, OREDA is a project organization sponsored by eight oil
companies with worldwide operations. OREDA's main purpose is to collect and
exchange reliability data among the participating companies and to act as a forum for
co-ordination and management of reliability data collection within the oil and gas
industry. OREDA has established a comprehensive databank of reliability and
maintenance data for exploration and production equipment from a wide variety of
geographic areas, installations, equipment types and operating conditions. Offshore
subsea and topside equipment are primarily covered, but onshore equipment may
also be included. The data are stored in a database, and specialized software has been
developed to collect, retrieve and analyze the information. A more recent addition to
the OREDA database is information pertaining to subsea equipment including control
systems, flowlines, manifolds, production risers, templates, wellheads and Xmas trees
amongst others. NOTE: access to the electronic database is restricted to
participants in the OREDA program .
A revised edition of this Handbook was released in October 2002 containing OREDA
Phase IV (1993-96) and Phase V (1997-00) data. Reliability data collected and
processed in the OREDA project has been published in generic form in three
Reliability Data Handbooks; 1984 (1st edition), 1992 (2nd edition) and in 1997 (3rd
edition). These handbooks contain reliability data on offshore equipment compiled in
a form that can easily be used for various safety, reliability and maintenance analyses.
The project phases are reported in various handbooks as follows:
• Phase I (1983 to 1985) published in OREDA 84 handbook
• Phase II (1987 to 1990) published in OREDA 92 handbook. This handbook also
contains the data collected during phase I
• Phase III (1990 to 1992) published in OREDA 97 handbook
• Phase IV (1993 to 1996) and Phase V (1997 to 2000) published in OREDA 2002
handbook
Note that the OREDA handbooks do not catalogue the data recorded in the electronic
database; instead they present the results of filters defined by the OREDA committee
that are believed to be representative of users’ needs.
OREDA-2002, -97 and -92 data equipment groups and the equipment items covered
are listed in Table 4.1.
16 ©OGP
Table 4.1 OREDA-2002, -97 and -92 Data Categories
Data Group Equipment Items In OREDA- Data Equipment Items

(OREDA-2002 Group
and -97) (OREDA-
200
97
92)
2
Machinery Compressors   Process Vessels
Gas turbines   Systems Valves
Pumps   Pumps
Combustion engines  Heat exchangers
Compressors
Gas turbines
Pig launchers and
receivers
Electric Generators   Electrical Power generation
Equipment Motors  Systems Power conditioning,
Protection and circuit
breakers
Mechanical Heat exchangers  
Equipment Vessels  
Heaters and boilers 
Control and Control logic units  Safety Gas and fire detection
Safety Fire and gas detectors   Systems systems
Equipment Process sensors   Process alarm sensors
Valves   Fire fighting systems
ESD systems
Pressure relieving
systems
General alarm and
communication systems
Evacuation systems
Subsea Common components 
Equipment Control systems  
Manifolds 
Flowlines 
Isolation systems 
Risers 
Running tools 
Wellhead and Xmas  
trees
Utility Slop and drainage
Systems systems
Ventilation and heating
systems
Hydraulic supply systems
Pneumatic supply
systems
Control instrumentation
Crane Diesel hydraulic
Systems Diesel friction
Drilling Drawworks
equipment Hoisting equipment
Diverter systems
Drilling risers
BOP systems
Mud systems
Rotary tables
Pipe handling systems
©OGP 17
4.1.1 OREDA Data Presentation
The OREDA handbook [1] presents the following data recorded for each equipment
taxonomy class recorded.
Boundaries
Each equipment item class has an inventory description provided at the start of the
respective chapter. This should be examined carefully to identify equipment items for
the system under consideration that lie outside the defined OREDA boundary. These
must then be considered as separate items. An example of this would be a
compressor or electrical generator where the prime mover is listed as a separate item.
Taxonom y code
The taxonomy code gives an identification of the equipment item selected from the
database. It is good practice to record this code and to include it within calculations
as a reference for any data extracted.
Population
Total number of items under surveillance.
Aggregated tim e in service (calendar tim e)
This is the total recorded observation time for the population.
Aggregated tim e in service (operational tim e)
Total recorded observation time for the population when it is required to fulfil its
functional role. Note that this may be an estimated value.
Num ber of dem ands
Total number of recorded demand cycles for the population. Note that this may be an
estimated value.
Failure Mode
This column presents the recorded modes of failure for the equipment item, divided
into severity classes critical, degraded, incipient and unknown. In general, only the
critical severity class failures need be considered i.e. those that cause an immediate
and complete loss of an items function. Where an equipment item performs more than
one function (e.g. process and protective) it may be necessary to review each failure
mode and identify the requirement to progress it into the risk calculation, either as an
aggregated failure rate value for the equipment item or as individual failure events. i.e.
critical failures may include dangerous, non-dangerous and safe failures. These
failures may be critical to production but not to the equipment’s protective function.
Num ber of Failures
This is the total number of failures aggregated across all modes. In general, the higher
the number of failures, the greater the confidence in the calculated failure rate.
Failure Rate
All failure rates in the OREDA handbook are presented in terms of failures per million
hours. The following data are presented for each mode, calculated both in terms of
calendar and operational time:
• M ean: estimated average failure rate, calculated using the “OREDA” estimator –
see Section 3.2.6 for details
• Lower, Upper: 90% confidence bounds for the failure rate
• SD: Standard deviation
18 ©OGP
• n/T: Point estimate of the failure rate i.e. total number of failures divided by the
total time in service
For most calculations it is recommended that the mean value (i.e. based on the
OREDA estimator) is used. Note that the difference in value between the point
estimate and mean failure rate relates to the degree of diversity in the population.
4.2 MIL-HDBK-217F
The MIL-HDBK-217 handbook contains failure rate models for the various part types
used in electronic systems, such as integrated circuits, transistors, diodes, resistors,
capacitors, relays, switches, and connectors.
The handbook details two methods for reliability prediction, namely parts count and
parts stress calculation. Parts count prediction is recommended during the design
phase of a project. It is simpler than parts stress and requires less detailed
information. To calculate a system failure rate the following method is used:
For each component part of a system, a baseline failure rate value is selected from
tables based on the type of the part and the operating environment. This value is then
modified by multiplying by a quality factor, again selected from a table (e.g. military or
commercial specification). For microelectronics, a learning factor may also be applied.
The overall system failure rate is then derived by summation of the parts failure rates;
hence the title “parts count”. In general, parts count analysis will provide an adequate
estimate of a system’s failure rate for use in QRA.
Parts stress analysis involves derivation of more multiplying factors that in turn
require detailed analysis of the system.
4.3 FIDES
This is reliability standard created by FIDES Group - a consortium of leading French
international defence companies: AIRBUS, Eurocopter, Giat, MBDA and THALES. The
FIDES methodology is based on the physics of failures and is supported by the
analysis of test data, field returns and existing modelling. The FIDES Guide is a global
methodology for reliability engineering in electronics. It has two parts, namely a
reliability prediction guide and a reliability process control and audit guide.
Its key features are:
• Provides models for electrical, electronic, electromechanical components and
some subassemblies.
• Considers all technological and physical factors that play an identified role in a
product's reliability.
• Considers the mission profile.
• Considers the electrical, mechanical and thermal overstresses.
• Failures linked to the development, production, field operation and maintenance
processes.
4.4 EPRD-97 and NPRD-95

The databases EPRD-97 (Electronic Parts Reliability) NPRD-95 (Non Electronic Parts
Reliability) were developed by the United States Department of Defense Reliability
Information Analysis Center (RIAC). The EPRD-97 database contains failure rate data
on electronic components, namely capacitors, diodes, integrated circuits,
optoelectronic devices, resistors, thyristors, transformers and transistors. The NPRD-
©OGP 19
95 database contains failure rate data on a wide variety of electrical,
electromechanical and mechanical components. Both databases contain data
obtained by long-term monitoring of the components in the field. The collection of the
data was from the early 1970s through 1994 (for NPRD-95) and through 1996 (for
EPRD-97). The purposes of the both databases are to provide failure rate data on
commercial quality components, provide failure rates on state-of-the-art components
to complement MIL-HDBK-217F by providing data on component types not addressed
therein.
4.5 PDS Data Handbook

The PDS Data Handbook provides reliability data estimates for components of control
and safety systems. Data for field devices (sensors, valves) and control logic
(electronics) are presented, including data for subsea equipment. The data are based
on various sources, including OREDA and expert judgement. Some values for β
factors for analysis of common cause failures are also presented.
4.6 FARADIP III

FARADIP (Failure RAte Data In Perspective) is an electronic database that presents
data concatenated from over 40 published data sources. It provides failure rate data
ranges for a nested hierarchy of items covering electrical, electronic, mechanical,
pneumatic, instrumentation and protective devices. Failure mode percentages are
also provided.
4.7 IEEE 493-1997

The objective of this book is to present the fundamentals of reliability analysis applied
to the planning and design of industrial and commercial electric power distribution
systems. The intended audience for this material is primarily plant electrical
engineers. It includes a summary of equipment reliability data under the following
headings:
• Mechanical and electrical equipment reliability and availability data collection
conducted between 1990 and 1993
• Equipment reliability surveys (1976–1989)
• Equipment reliability surveys conducted prior to 1976
4.8 Sintef Reports, SubseaMaster and WellMaster

ExproSoft is a spin-off of the Norwegian Research Institute SINTEF, and has acquired
all commercial rights to reliability databases previously operated by this institute.
These products have since been refined and extended, creating integrated reliability
database and analysis tools for the upstream sector.
A study (JIP) on reliability of well completion equipment (“Wellmaster Phase III”) was
completed by SINTEF in November 1999. This has resulted in a database of well
completion equipment, with a total of 8000 well-years of completion experience
represented.
A subsea equipment reliability database project was completed by ExproSoft in late
2000 (Phase I). This project, led to the development of the SubseaMaster database and
software version 1.0. Phase II of SubseaMaster was launched as a joint industry
project in May 2001. and was completed in April 2003.
ExproSoft sell copies of the Sintef reports referred to in this datasheet.
20 ©OGP

The text book Functional Safety – a Straightforward Guide to IEC61508 [16] presents
background theory and a number of worked examples including fault trees and
analysis of common cause failures.
Layer of Protection Analysis – Simplified Process Risk Assessment [17] also presents
worked examples together with some specimen reliability data.
Background reliability theory can be found in Practical Reliability Engineering [18] and
Reliability, Maintainability and Risk [2]. The latter also contains some reliability data from
FARADIP [14]
Reliability Technology [19] contains (older) reliability data from the nuclear industry.
6.0 References
1. OREDA Participants, OREDA 2002 Handbook ISBN 82-14-02705-5.

2. Dr David J Smith, Reliability, Maintainability and Risk Sixth edition, ISBN 0-7506-5168-
7, 2001.
3. SINTEF, Reliability of Surface Controlled Subsurface Safety Valves, 21/2/1983, STF18
A83002.
4. Holand, P.: Subsea BOP Systems, Reliability and Testing. Phase V. STF75 A89054
ISBN 82-595-8585-5, 1989).
5. Holand, P.: Reliability of Surface Blowout Preventers (BOPs) STF75 A92026 (ISBN 82-
595-7173-0), 1992.
6. SINTEF; Reliability of Surface Controlled Subsurface Safety Valves, Phase IV - Main
Report 1991 STF75 A91038.
7. Holand, P.: Reliability of Subsea BOP Systems for Deepwater Application, Phase II
DW.(Unrestricted version). STF38 A99426 (ISBN 82-14-01661-4), 1999.
8. Exprosoft, Klæbuveien 125, Lerkendal Stadion, Trondheim, Wellmaster Database,
ongoing.
9. Exprosoft, Klæbuveien 125, Lerkendal Stadion, Trondheim, Subseamaster
Database, ongoing.
10. US DoD, Reliability Prediction of Electronic Equipment, MIL-HDBK-217F, Notice 2 1995.
11. Non-Electronic Part Reliability Data 1995 (NPRD-95), Reliability Analysis Center, PO
Box 4700, Rome, NY.
12. Electronic Part Reliability Data 1997 (NPRD-97), Reliability Analysis Center, PO Box
4700, Rome, NY.
13. Reliability Data for Safety Instrumented Systems - PDS Data Handbook, 2006 Edition,
Sydvest, Trondheim, Norway.
14. FARADIP (FAilure RAte Data In Perspective), Maintenance 2000 Limited,
Broadhaugh Building, Suite 110, Camphill Road, Dundee DD5 2ND 1987 onwards.
15. Institute of Electrical and Electronics Engineers IEEE 493-1997, Recommended
Practice for the Design of Reliable Industrial and Commercial Power Systems (“Gold
Book”).
16. Smith & Simpson, Functional Safety, ISBN 0-7506-5270-5, 2001.
17. Center for Chemical Process Safety, Layer of Protection Analysis, ISBN 0-8169-0811-
7, 2001.
18. O’Conner, P, Practical Reliability Engineering, ISBN 0-471-95767-4, 1996.
19. Green & Bourne, Reliability Technology, ISBN 0 471 32480-9, 1981.
20. Brand, VP, UPM3.1: A pragmatic approach to dependent failures assessment for
standard systems, ISBN 085 356, 1996.
©OGP 21
Report No. 434 – A1

March 2010
Appendix 1
RADD – Appendix 1
Appendix I Data Presented in 1996 Datasheet: ESD and Blowdown

Systems
This Appendix presents data previously given in the OGP (then E&P Forum) QRA
datasheet ESD and Blowdown Systems. The current data is copyright, as stated in
Section 2.1; the data previously presented is given in Table I.1 and Table I.2 for
reference but should be regarded as illustrative and checked against one of the
current sources listed in Table 2.1.
Table I.1 Illustrative Data for a Riser ESD Valves System
Item Description Failure rate (per

year)
Pilot Valve All Failures 0.018
Pilot Valve Fail energised 0.012
Pilot Valve Fail de-energised 0.006
PO Check Valve Fail energised fixed 0.012
PO Check Valve Fail de-energised fixed 0.012
PO Check Valve Fail de-energised dynamic 0.006
PO Check Valve Blocked or pilot signal lost 0.00804
PO Check Valve Internal leakage 0.0107
Check Valve Hydraulic; All failures 0.0268
ESD SOV All failures 0.0115
ESD SOV Fail energised 0.0077
ESD SOV Fail de-energised 0.0038
ESD SOV Reset pin failure 1.15E-4
ESDV Fail to close position 0.0219
ESDV Fail to re-open 0.00817
Valve Needle, Hydraulic 0.0119
Actuator Hydraulic, fail to close not given
Actuator Hydraulic, fail to open 0.0278
Actuator Hydraulic, all failures + incipient 0.00692
Ball Valve Fail to close 0.1458
Ball Valve All failures 0.00578
Valve Hydraulic manually activated 0.05589
Limit Switch Failure, closed circuit 0.0211
Switch Level; all failures inc. incipient 0.0021
Switch Press; all failures inc. incipient 0.0841
Pilot Line Failure 0.1139
Regulator Spring induced failure 0.0001
Accumulator Hydraulic Leaking 0.0230
Accumulator Hydraulic no operation/piston 0.0912
Accumulator fail 0.0120
Annunciator Minor leakage 0.0026
Air Supply Microprocessor based; fail to 0.0860
Air Supply alarm 0.6220
Pump Instrument air supply failure 0.0296
Filter 3 × 50% Compressor system 0.0147
Filter Hydraulic 0.0105
Filter Air 0.0263
Fluid 0.03416
Gauge Blocked, (Pre filter low 0.1752
Pipework concentration level) 8.76E-5
Pressure: Faulty indication
Instrument Connection Leakage
©OGP 1
RADD – Appendix 1
Appendix II Data Presented in 1996 Datasheet: Active Fire Protection

Systems
datasheet Active Fire Protection Systems. The current data is copyright, as stated in
Section 2.1Error! Reference source not found.; the data previously presented is
given in Table II.1 to Table II.9 for reference but should be regarded as illustrative and
checked against one of the current sources listed in Table 2.1.
Table II.1 Typical failure rates for fire protection system s

6
Equipment Type Failures (per 10 Failures (per
hrs) demand)
Firewater system 9.7 0.01
Water supply - diesel 0.025
engine driven pumpset
Water supply - electric 0.004
motor driven pumpset
Deluge system 0.015
Sprinkler system 0.005
Foam mixing system 0.01
Foam supply system 0.02
Halon system 87.0 0.02
CO2 system 8.0 0.02
Table II.2 Failure rates for pum ps (source 1, oil and gas industry)
Pump type Failures Failures Failures

6 6
per per 10 hrs per 10 hrs
demand operating calendar
Electric motor 0.0033 4719 56
(offshore)
(process industry) 0.043
Diesel engine (offshore) 0.023 25808 185
(process industry) 0.019
Table II.3 Failure rates for pum ps
Pump type Failure mode Failures Failures per

6
per 10 calendar demand
hrs
Positive All 22 0.094
displacement While running 1.9 0.019
Fail to start 1.9
Centrifugal All 99 0.033
2 ©OGP
RADD – Appendix 1
Table II.4 Failure rates for firewater distribution valves
Type Failures per Failures

6
demand per 10 operating
hrs
Air/hydraulic 0.0003 10
Motorised 0.001 10
Solenoid 0.001 10
Pressure regulating 50
Pressure relief 2.3
Table II.5 Failure rates for firewater distribution m ains

6
Equipment Leaks per 10 hrs
type Medium Serious Large
Fire main 0.04/m
Joint (>2 in ND) 0.014 0.0015
Joint (<2 in ND) 0.0015
Valve (>2 in 0.009 0.001
ND)
Valve (<2 in 0.001
ND)
Pipe (>2 in ND) 0.0015/100 m 0.0002/100 m
Table II.6 Failure rates for sprinklers

6
Equipment Failure per Failures per 10
type demand hrs
System 0.005
Control valve 0.001 10
Automatic head 0.001
Table II.7 Failure rates for deluge sets

6
Equipment Failure per Failures per 10
type demand hrs
System 0.015
Butterfly valve 0.001 10
Swing type 0.001 10
valve
Pneumatic 0.0099 21
valve
©OGP 3
RADD – Appendix 1
Table II.8 Failure rates for foam supply system s

6
Equipment type Failure per Failure per 10 hrs
demand
Foam compound supply
Centrifugal electric pump 0.007 200
Pelton wheel motor 0.007 200
Supply system 0.02
Foam compound proportioning negligible
In-line proportioner 0.005 negligible
Nozzle eductor 0.005 negligible
Metered proportioner 0.005 negligible
Pressure proportioning tank 0.005 negligible
Around-the-pump proportioner 0.005 negligible
Foam generation
Low expansion foam maker 0.005 negligible
High back-pressure foam maker 0.005 negligible
Table II.9 Failure rates for gaseous system s

6
Equipment type Failure per Failure per 10 hrs
demand
Halon System 0.0004* 87
0.02*
Discharge nozzle 0.27
CO2 System 8
* 2 values quoted from different sources
4 ©OGP
RADD – Appendix 1
Appendix III Data Presented in 1996 Datasheet: Fire and Gas

Detection
datasheet Fire and Gas Detection. The current data is copyright, as stated in Section
2.1; the data previously presented is given in Table III.1 for reference but should be
regarded as illustrative and checked against one of the current sources listed in Table
2.1.
Table III.1 Typical failure rates for fire and gas detection system s
6
Component λ crit Cove- Failure rate per 10 TIF (Test
6
per 10 rage hrs Independent
hrs c λdet λSO λFTO Failures)
-4
Gas detector, 5.5 50% 3.0 1.0 1.5 3 × 10 - 0.1
conventional
catalytic
-4
Gas detector, 4.0 70% 2.9 0.1 1.0 3 × 10 to 0.1
conventional IR
-4
Gas detector, beam 7 70% 5 1 1 3 × 10 to 0.1
-3
Smoke detector 4.0 40% 1.5 2.0 0.5 10 to 0.05
Heat detector 2.5 40% 1.0 1.0 0.5 0.05 to 0.5
-4
Flame detector 7.0 40% 2.5 3.0 1.5 3 × 10 to 0.5
-5
ESD push button 1.0 20% 0.2 0.6 0.2 10
-5 -4
FGD node (single 80.0 90% 72.0 6.0 2.0 5 × 10 to 5 × 10
PLC system)
-5
Field bus coupler 0.2 90% 0.18 0.02 0.001 10
-5
Field bus CPU/ 0.2 90% 0.18 0.02 0.001 10
Communications
unit
λcrit = Total critical failure rate of the component. Rate of failures that will cause either
trip or unavailability of safety function (unless detected and prevented from
causing such failure).
λdet = Rate of critical failure which will be detected by automatic self-test or by control
room monitoring. The effect of these failures on the Spurious Trip Rate (STR)
depends on the operational philosophy of the system.
c = det / crit = Coverage of the automatic self-test + control room operator.
λSO = Rate of Spurious Operation (SO) failures, undetectable by automatic self-test.
The rate of Spurious Operation (SO) failures of a component contributes to the
STR of the system (independent of operation philosophy).
λFTO = Rate of failures causing Fail-To-Operate (FTO) failures, undetectable by
automatic self-test. The FTO failures contribute to the Critical Safety
Unavailability (CSU) of the component/system.
TIF = Test Independent Failures. The probability that a component which has just
been functionally tested will fail on demand (applies for FTO failures only). The
TIF probability is the probability that a component which has just been tested
will fail on demand. This will include failures caused by for example improper
location or inadequate design (software error or inadequate detection principle).
An imperfect functional testing procedure will also contribute. Finally, the
©OGP 5
RADD – Appendix 1
possibility that the maintenance crew perform an erroneous functional test or

fail to return the component to a working state (which is usually not detected
before the next test) also contributes to the TIF probability.
6 ©OGP
RADD – Appendix 1
Appendix IV Data Presented in 1996 Datasheet: Blowout Prevention

Equipment
datasheet Blowout Prevention Equipment. The current data is copyright, as stated in
Section 2.1; the data previously presented is given in Table IV.1 to Table IV.5 for
reference but should be regarded as illustrative and checked against one of the
current sources listed in Table 2.1.
Table IV.1 Subsea BOP item specific average downtim e
BOP item No of Total Average downtime (hrs)

failures down-time per BOP-day per rig-day
(hrs)
Flexible joints 0 - - -
Annular preventers 8 534.5 0.203 0.177
Ram preventers 4 146.5 0.056 0.048
Hydraulic connectors 6 111.5 0.042 0.037
Failsafe valves 2 67.0 0.025 0.022
Choke and kill lines 19 627.0 0.238 0.207
Hydraulic control system 28 521.5 0.198 0.173
Acoustic control system 7 134.0 0.051 0.044
Total 74 2142.0 0.813 0.708
Notes:
1. BOP-days are all days from the time the BOP is first landed on the wellhead, until it is
pulled the last time.
2. Rig-days is the time from when the rig arrives on location and drops the anchors, until the
last anchor is pulled prior to leaving the location.
©OGP 7
RADD – Appendix 1
Table IV.2 Subsea BOP item specific failure rate with 90% confidence
lim its
6
BOP item Failure mode Failure rate per 10 hours
Lower Estimate Upper
limit limit
Flexible 0.0 0.0 36.4
joints
Annular Failed to open fully 23.6 54.1 94.8
preventers Hydraulic leakage 0.5 9.0 27.0
Unknown 0.5 9.0 27.0
Total 35.9 72.1 118.5
Ram type Internal leakage (seal failures) 1.4 7.9 18.7
preventers Internal leakage (seal and blade failure) 0.2 4.0 11.8
External leakage (door seal) 0.0 0.0 9.1
Failed to fully open 0.2 4.0 11.8
Total 5.4 15.8 30.6
Hydraulic External leakage 10.8 31.6 61.3
connectors Failed to unlock 0.4 7.9 23.7
Hydraulic failure in locking device 0.4 7.9 23.7
(minor)
Total 20.7 47.4 83.1
Failsafe Internal leakage 0.1 2.6 7.9
valves External leakage 0.0 0.0 6.1
Unknown leakage 0.1 2.6 7.9
Total 0.9 5.3 12.5
Choke and Leakage to environment 85.6 134.4 192.1
kill lines Plugged line (ice) 0.4 7.9 23.7
Unknown 0.4 7.9 23.7
Total riser related failures 54.7 94.8 143.9
Total flexible jumper hose failures 20.7 47.4 83.1
Total BOP flexible hose failures 0.4 7.9 23.7
Total choke kill line system 98.3 150.2 211.0
Hydraulic Spurious activation of BOP function 0.8 15.8 47.4
control Loss of all functions one pod 41.3 94.8 166.2
system
Loss of several functions one pod 5.6 31.6 75.0
Loss of one function both pods 5.6 31.6 75.0
Loss of one function one pod 85.8 158.1 248.2
Loss of one topside panel 0.8 15.8 47.4
Loss of one function topside panel 0.8 15.8 47.4
Topside minor failures 5.6 31.6 75.0
Other 0.8 15.8 47.4
Unknown 5.6 31.6 75.0
Total 314.6 442.6 588.6
8 ©OGP
RADD – Appendix 1
6
BOP item Failure mode Failure rate per 10 hours
limit limit
Acoustic Failed to operate BOP 5.6 31.6 75.0
control Spurious operation one BOP function 0.8 15.8 47.4
system
One subsea transponder failed to 0.8 15.8 47.4
function
Portable unit failed 0.8 15.8 47.4
Function failure LMRP function 0.8 15.8 47.4
Transducer arm failed 0.8 15.8 47.4
Total 51.9 110.6 187.2
Total subsea BOP system 955.4 1169.7 1402.5
Table IV.3 Detection of subsea BOP failures
BOP Item Activity when failure detected

Total BOP Run- Installation Regular
on rig ning test tests/
BOP drilling
Flexible joints 0 - - - -
Annular preventers 8 0 0 1 7
Ram preventers 4 1 0 3 0
Hydraulic connectors 6 3 0 1 2
Failsafe valves 2 1 0 1 0
Choke and kill lines 19 1 5 1 12
Hydraulic. Control system 28 4 3 9 12
Acoustic control system 7 0 1 5 1
Total 74 10 9 21 34
©OGP 9
RADD – Appendix 1
Table IV.4 Overview of surface BOP item specific num ber of failures and
down tim es
BOP item Pressure Days Number of failures Total Averag

class in Install- Oper- Total down e
servic ation ation time down
e (hrs) time
per
day
(hrs)
Annular Low pressure 473 1 5 6 6 0.013
preventers High 1891 6 9 15 50.5 0.027
pressure
Total 2364 7 14 21 56.5 0.024
Shear/blind Low pressure 473 1 0 1 0.5 0.001
rams High 1891 1 7 8 62.5 0.033
pressure
Total 2364 2 7 9 63 0.027
Pipe rams Low pressure 401 0 0 0 - 0.000
High 3782 2 1 3 10 0.003
pressure
Total 4183 2 1 3 10 0.002
Control system Low pressure 473 7 1 8 13 0.027
High 1891 7 12 19 66.5 0.035
pressure
Total 2364 14 13 27 79.5 0.034
BOP to high Low pressure 473 2 0 2 16.5 0.035
pressure High 1891 5 0 5 32.5 0.017
riser connection pressure
Total 2364 7 0 7 49 0.021
Riser conns. Low pressure 473 1 0 1 1 0.002
and High 1891 6 1 7 10.5 0.006
wellhead pressure
connections
Total 2364 7 1 8 11.5 0.005
Failsafe valves Total 5994 5 3 8 20 0.003
BOP stack Low pressure 473 2 0 2 5 0.011
clamps High 1891 0 0 0 - 0.000
pressure
Total 2364 2 0 2 5 0.002
Choke/kill lines Low pressure 473 1 0 1 3.5 0.007
High 1891 1 0 1 0 0.000
pressure
Total 2364 2 0 2 3.5 0.001
Total BOP Low pressure 473 17 6 23 49 0.104
system High 1891 31 33 64 249 0.132
pressure
Total 2364 48 39 87 298 0.126
10 ©OGP
RADD – Appendix 1
Table IV.5 Surface BOP item specific failure m odes and frequencies with
90% confidence lim its (all failures included)
BOP Item Failure mode Failure rate per 10 6 hours

limit limit
Annular Failed to fully open 149.18 246.76 364.29
preventers Leakage in closed position 46.06 105.75 185.30
Hydraulic leakage adapter ring 0.90 17.63 52.80
(degraded)
Shear/blind External leakage 0.90 17.63 52.80
rams Leakage in closed position 46.06 105.75 185.30
Premature partly closure shear ram 0.90 17.63 52.80
Unknown 0.90 17.63 52.80
Pipe rams Leakage in closed position 3.54 19.92 47.25
Hydraulic Failed to operate BOP 34.72 88.13 161.34
control Failed to operate one BOP function 70.16 141.00 231.74
systems
Failed to operate BOP from remote 0.90 17.63 52.80
panels
Spurious activation of BOP functions 0.90 17.63 52.80
Failed to operate rams from remote 0.90 17.63 52.80
panels
Failed to operate rams from remote 0.90 17.63 52.80
panels
Hydraulic leakage 34.72 88.13 161.34
Unknown 14.41 52.88 110.97
Incipient 6.26 35.25 83.61
BOP to high External leakage 57.91 123.38 208.73
pressure
riser
connections
Riser & External leakage 70.16 141.00 231.74
wellhead
connections
Failsafe External leakage 0.36 6.95 20.82
valves External hydraulic leakage 0.36 6.95 20.82
Failed to operate valve 0.36 6.95 20.82
Leakage in closed position 5.68 20.85 43.76
Unknown 0.36 6.95 20.82
BOP stack External leakage 6.26 35.25 83.61
clamps
Choke/kill External leakage 6.26 35.25 83.61
lines
Total BOP 1273.39 1533.42 1813.47
system
©OGP 11
RADD – Appendix 1
Table IV.6 Overall failure categories for SCSSVs (production and

injection wells)
Valve type Years in No. of failures per category Failure rate per
service 106 hours
Total SCSSV Other Unknow Total SCSSV
n
Wireline Retrievable 1189.7 124 39 54 31 11.9 3.7
Flapper
Wireline Retrievable Ball 508.9 84 36 42 6 18.7 8.1
All Wireline Retrievables 1698.6 208 75 96 37 13.9 5.1
Tubing Retrievable Flapper 1088.2 54 26 22 6 5.7 2.7
Tubing Retrievable Ball 52.7 5 4 1 0 10.9 8.6
All Tubing Retrievables 1140.9 59 30 23 6 5.9 3.0
Total, all valves 2839.5 267 105 119 43 10.8 4.2
Note: When SCSSV is stated, the valve itself failed mechanically. “Other” may typically be
control line failure or scale in the well.
12 ©OGP

OGP Risk Assessment Data Directory, Report No. 434, Compiled, 2010

Uploaded by

Copyright:

Available Formats

OGP Risk Assessment Data Directory, Report No. 434, Compiled, 2010

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

OGP Risk Assessment Data Directory, Report No. 434, Compiled, 2010

Uploaded by

Copyright:

Available Formats

What is the overall aim of the OGP?

What is the overall aim of the OGP?

What types of incidents are typically analyzed in E&P risk assessments?

What types of incidents are typically analyzed in E&P risk assessments?

Risk Assessment Data Directory

Report No. 434

Consistent high quality database and guidelines

Internationally recognised source of industry information

Risk Assessment Data Directory

Directory update process

Directory scope and content

The basic content of each datasheet is as follows:

Report No. 434 – 1

1.0 Scope and Definitions

Table 1.1 Other Equipm ent Types Covered

Equipment Type See Equipment Type See

1.2 Release types

2.0 Summary of Recommended Data

Equipment Type: (1) Steel process pipes

Equipment Type: (2) Flanges

Equipment Type: (3) Manual valves

Equipment Type: (4) Actuated valves

Equipment Type: (5) Instrument connections

Instrument connection release frequencies (per instrument year; sizes 10 to 50

HOLE DIA ALL FULL LIMITED ZERO

Equipment Type: (6) Process (pressure) vessels

Pressure vessel release frequencies (per vessel year; connections 50 to 150 mm

HOLE DIA ALL FULL LIMITED ZERO

Pressure vessel release frequencies (per vessel year; connections >150 mm

HOLE DIA ALL FULL LIMITED ZERO

Equipment Type: (7) Pumps: Centrifugal

Centrifugal pump release frequencies (per pump year; inlets 50 to 150 mm

HOLE DIA ALL FULL LIMITED ZERO

HOLE DIA ALL FULL LIMITED ZERO

Equipment Type: (8) Pumps: Reciprocating

Reciprocating pump release frequencies (per pump year; inlets 50 to 150 mm

HOLE DIA ALL FULL LIMITED ZERO

Reciprocating pump release frequencies (per pump year; inlets >150 mm

HOLE DIA ALL FULL LIMITED ZERO

Equipment Type: (9) Compressors: Centrifugal

Centrifugal compressor release frequencies (per compressor year;

HOLE DIA ALL FULL LIMITED ZERO

Centrifugal compressor release frequencies (per compressor year; inlets >150

HOLE DIA ALL FULL LIMITED ZERO

Equipment Type: (10) Compressors: Reciprocating

Reciprocating compressor release frequencies (per compressor year;

HOLE DIA ALL FULL LIMITED ZERO

Reciprocating compressor release frequencies (per compressor year;

HOLE DIA ALL FULL LIMITED ZERO

HOLE DIA ALL FULL LIMITED ZERO

HOLE DIA ALL FULL LIMITED ZERO

HOLE DIA ALL FULL LIMITED ZERO

HOLE DIA ALL FULL LIMITED ZERO

Equipment Type: (13) Heat exchangers: Plate

HOLE DIA ALL FULL LIMITED ZERO

HOLE DIA ALL FULL LIMITED ZERO

Equipment Type: (14) Heat exchangers: Air-cooled

HOLE DIA ALL FULL LIMITED ZERO

HOLE DIA ALL FULL LIMITED ZERO

Equipment Type: (15) Filters