By Brendan Fitzgerald
First Published on December 2006
Abstract
Timely and appropriate safety engineering input to the design of any offshore facility is now crucial in order to ensure that the facility meets regulatory requirements. The safety case process is the driver behind this, but to imagine that this is just a documentary exercise akin to the International Safety Management Code in the Marine industry is very wide of the mark. The paper addresses the potential conflict between apparently competing regulatory and industry standards which are brought together in the FPSO. Some examples from practical experience of many FPSO projects are given, with suggestions to resolve these conflicts.
1. The FPSO – an unhappy marriage?
The FPSO is a marriage of two industries, two cultures and two regulatory regimes. The maritime industry is internationally regulated by the International Maritime Organisation (IMO). The offshore oil and gas production industry is subject to national regulations of some variety.
For both industries, the regulations have been forged by accident and disaster. In the maritime industry, the sinking of the Titanic in 1912 gave rise to the development of the Safety Of Life At Sea (SOLAS) regulations. Other accidents gave rise to the further development of these regulations. A relevant example to this discussion is the requirement for inert gas systems in tankers following a succession of cargo tank explosions, usually during tank cleaning operations.
The offshore oil and gas production industry has seen several high profile disasters. Several led directly to either significant changes in regulations or the development of new regulations. These included:
- Alexander Kjelland, which shaped the Norwegian offshore regulations;
- Piper Alpha, which led to the introduction of the Safety Case for offshore facilities in various countries; and
- Ocean Ranger, which led to changes in regulation for mobile offshore drilling units.
So each of the two industries have, unsurprisingly, developed regulations based on their history. That of the maritime industry is long and honourable – consider the regulations for steam systems, based on over 150 years of experience – with a culture based on command and a prescriptive regulatory style. The history of the offshore oil and gas industry is relatively short and intense – little more than forty years in most parts of the world. The culture of the offshore oil and gas industry is based on management and consultation, with many parts of the world and many companies embracing goal setting regulations.
In the FPSO, the two industries come together – are married – and many of these aspects can become competing forces.
1.1. Acknowledgement & Respect – Essential for the FPSO
Like any marriage, successful partnership needs communication and a willingness to compromise and see the other’s point of view. For an FPSO development project to be a success, this idiosyncrasy of the FPSO must be recognised and actively addressed. Those from one industry are bound to be uncomfortable if asked to operate in the sphere of the other industry. They may even be suspicious of it, feel that they and their way of doing things are under attack and become defensive. To overcome this, the FPSO project must have, from the beginning, a culture of mutual respect for the other’s industry – for its approach, its ethos, its basis.
Many parts of an FPSO are dominated by one culture or the other – so for these areas of design and operation, the solution is straightforward. But the interface areas, where the two cultures meet, are the areas where problems can arise. Often these problems occur due to apparently competing regulatory or design rule demands. Inevitably, many of these problems can arise from a safety engineering view point.
The Safety Case regulatory regime offers a particular challenge, because it demands that the whole facility is addressed. So, for an FPSO, this appears to challenge the very heart of the maritime regulations and rules under which the basic ship is built.
Or does it? To consider the areas where safety engineering problems can arise in an FPSO, we must first consider this question. This is addressed in the following section.
2. The Safety Case Process
For many, the Safety Case represents simply a documentation exercise that sits outside the design and development process. However, that is to misunderstand both the intent of the Safety Case and the process that it involves. Hence, two key questions arise:
- Why is the Safety Case a process?
- Is it not just a document?
To understand the answer to this, we need to understand the objectives of the Safety Case, its demands and its benefits. We can then understand the influence that this process has on FPSO design and operation.
2.1. The Objective of a Safety Case
The Safety Case is a clever move by the Regulator away from prescriptive rules and requirements. By their nature, prescriptive requirements will always be out of date, always trying to catch up with industry as it moves on. But with the Safety Case, the Regulator puts the onus on the Operator to demonstrate that they are operating safely. So instead of the Regulator having to throw a wide net and hope he has caught all of the likely hazards and accident events on an industry-wide basis, the Operator must show that they have identified all of the hazards that occur in their operations and then proceed to demonstrate that they are managing them effectively. The Safety Case then, in its simplest terms, is a demonstration of adequacy – i.e. the Operator makes the case that their equipment and all aspects of their operations are effective in achieving an adequate level of safety for its personnel (and any others they may affect).
The objective of a Safety Case is therefore:
- To demonstrate the adequacy of the hardware and management systems of a facility to provide a safe operating environment.
2.2. The Demonstration of Adequacy
To make this demonstration, the safety case needs to describe:
- The facility and its operations;
- The criteria by which adequacy is measured;
- The hazards that occur in relation to the facility and its operations;
- The risks that arise from these hazards; and
- The means by which these hazards and risks are controlled (hardware and management).
This demonstration makes the case for safety when it shows that the risks to the personnel affected by the facility are reduced to as low as reasonably practicable.
Hence, the demonstration involves a process. This process is as follows:
- Determine the criteria by which adequacy will be measured;
- Identify the hazards;
- Assess the risks;
- Identify possible means of risk improvement; and
- Carry out cost benefit analysis and implement the qualifying risk improvement measures.
But this process of itself has deeper implications. Adequate integrity of the facility is fundamental to the demonstration of control of the hazards. Hence, the demonstration must include:
- A description of the standards to which the facility has been designed and built;
- A description of the design process, including the quality control, verification, etc., that has been carried out;
- A description of the competency of the personnel involved in the design and construction; and
- Justification for key decisions in design option selection.
This demonstration then also involves a process, that of creating an audit trail for the design to track the progress and manner of execution of the design and construction, etc., of the facility
The Safety Case process thus goes to the heart of a development project. From the earliest decisions in feasibility, consideration needs to be given to risk and safety implications, otherwise the demonstration that risks are as low as reasonably practicable and the demonstration of adequacy cannot be made together.
The benefits that come from this demand include a greater understanding of the means of managing not just the hazards and risks but the facility itself.
There have been many instances of companies who did not appreciate that they were managing certain hazards. Examples of this have been most marked in relation to onshore facilities in various industries. The application of the safety case process led to a systematic identification of hazards, with results that, at times, were a surprise to the management. It has been known for a plant manager to run from a HAZOP to shut down the plant!
Internationally, perhaps the best example of a company not being aware of a hazard that they were managing was at Bhopal – a forgotten process vessel with an intermediate product that nobody addressed.
In the offshore industry, examples are less stark, due to the relatively simple processes – but they do exist!
3. Class Rules and Industry Standards
As discussed above, the Safety Case requires a demonstration of adequacy. The maritime industry requires that Class Rules are followed, whilst the offshore oil and gas industry requires that industry standards, such as those from the American Petroleum Institute (API) are followed. Is adherence to these alone a demonstration of adequacy? In short:
- Are Class Rules and industry standards good enough to demonstrate adequacy?
- If so, where on the FPSO?
- If not, why not?
Some may suggest that meeting class rules and industry standards, such as API, etc., should be sufficient to meet safety case requirements. Applying class rules and other industry standards do provide a sound basis for design. It is also true that, for an FPSO, classification meets many, if not all, of the requirements for demonstration of integrity of the facility. Additional verification activities may be required, however, in order to demonstrate adequate management of hazards. This would occur where hazard management requirements dictate a design standard above that required by class. For example, the Australian Regulations (Ref. 5) has a requirement for validation that deliberately leaves the scope to be agreed with the regulator at the beginning of the safety case process. This is clearly in the expectation that simply meeting class requirements and industry standards may not be sufficient.
Hence, “meet the standard – that is all that is required” is clearly not sufficient alone to demonstrate that all hazards are identified, adequately managed and risks are reduced to ALARP.
3.1. Where Might Class be Sufficient?
Where on an FPSO can Class Rules be taken to provide adequate demonstration that the risks are reduced to ALARP? Generally, in areas where the marine systems remain unchanged.
Areas on an FPSO where this may apply include the following:
- Machinery space / engine room – heavily controlled by class – using ALARP arguments to change away from class is unlikely to be simple and is not advised!
- Pump room – however, on a new build, consideration of deep well pumps would have to be made on an ALARP basis. For a conversion, the cost of change would be unlikely to be justified by the risk benefit.
- Accommodation partition fire ratings – class should be regarded as a minimum. In some locations, such as for the front wall, a detailed design justification would be required for the fire rating applied.
Areas on an FPSO where Class Rules are unlikely to be sufficient include:
- Accommodation HVAC – particularly for FPSOs in tropical waters;
- Hazardous area classification;
- Management of health hazards, such as exposure to cargo during marine maintenance activities;
- Cargo tank vent arrangements and location; and
- Cargo tank access arrangements – particularly if in-water inspections are required.
4. Implications of the Safety Case Process for FPSO Design
The marriage of cultures and industries that occurs in the FPSO presents a significant challenge. For any development project to be successful, this culture clash must be addressed. A key point, which is perhaps the hardest for some to accept, is that an FPSO is an offshore production facility and is not a ship! This is more complicated if the FPSO is disconnectable:
- When producing, it is a fixed production facility;
- But, when disconnected it reverts to being a ship.
This means two regulatory regimes continue to apply for a disconnectable FPSO and the point at which disconnection or reconnection occurs brings specific legal as well as management implications.
Yet, if the facility is permanently moored, the owner may still wish to keep the FPSO in class for use elsewhere after the field is depleted. Even as a fixed production facility, when offloading, an FPSO serves as a terminal and so falls under the ISGOTT guidelines (Ref. 1).
Hence, the marriage persists and must be addressed if all requirements are to be identified and met. Implementing the safety case process early in the development planning will ensure that the demands for an audit trail and risk input to early decision-making are made.
Starting to prepare a safety case at 70% design completion is not a good recipe – but is one more than a few projects have employed – with major cost implications for the project!
The fundamental requirement for demonstration of adequacy and justification of design decision-making, together with the requirement to demonstrate ALARP, mean that there are few “givens”. Accepted design practices may well prove to be sufficient, but the case must be made to demonstrate that, in the context of an FPSO – an offshore production facility – they are indeed adequate.
5. Acknowledgments
Thanks are given to my colleagues at Vanguard Solutions for their assistance in preparing this paper.
6. Glossary of terms
| ALARP | As Low As Reasonably Practicable |
| API | American Petroleum Institute |
| FEED | Front End Engineering Design |
| FPSO | Floating, Production, Storage and Off-loading (Facility) |
| HAZID | Hazard Identification |
| HAZOP | Hazard and Operability Study |
| HSE | Health, Safety and Environment |
| HVAC | Heating, Ventilation and Air Conditioning |
| IMO | International Maritime Organisation |
| IRPA | Individual Risk Per Annum |
| ISO | International Organisation for Standardisation |
| ISGOTT | International Safety Guide for Oil Tankers & Terminals |
| NOPSA | National Offshore Petroleum Safety Authority (of Australia) |
| OCIMF | Oil Companies International Marine Forum |
| SOLAS | Safety of Life at Sea |
7. References
- International Safety Guide for Oil Tankers and Terminals – 5th edition 2006, OCIMF.
- OCS Report MMS 2002-016, “Incidents associated with oil and gas operations – Outer Continental Shelf 2000”, US Department of the Interior, Minerals Management Service, Engineering & Operations Division.
- An Information Paper on Pump Room Safety, OCIMF, September 1995.
- P34 Accident Report – Original Translation
- Petroleum (Submerged Lands) (Management of Safety on Offshore Facilities) Regulations, Statutory Rules 1996 No 298, Commonwealth of Australia.
Article by: Brendan Fitzgerald, Director & General Manager, Vanguard Solutions Pty Ltd.
Photo Credit: P34 FPSO Incident
