Ocean Engineering 104 (2015) 725737

Contents lists available at ScienceDirect

Ocean Engineering
journal homepage: www.elsevier.com/locate/oceaneng

Probabilistic re risk analysis and structural safety assessment

of FPSO topside module
Jin Yanlina, Beom-Seon Jang b,n
a
Department of Naval Architecture and Ocean Engineering, College of Engineering, Seoul National University, 1 Gwanak-ro, Gwanak-gu,
Seoul 151-744, Korea
b
Research Institute of Marine Systems Engineering, Dept. of Naval Architecture and Ocean Engineering, Seoul National University, Seoul, Korea

art ic l e i nf o a b s t r a c t

Article history: An offshore platform normally is exposed to ammable oil and gas in the course of its operation.
Received 12 July 2014 Uncontrolled hydrocarbon leaks or accumulated ammable gas clouds present very dire threats, due to
Accepted 5 April 2015 the probability of resultant re and explosion. Fire accident represents a major part of the total risk to
Available online 7 May 2015
offshore platforms. Nevertheless, existing procedures of re risk analysis (FRA) are still not comprehen-
Keywords: sive enough to systematically evaluate the risks to topside structure safety. As reported in this paper, a
QRA (Quantitative risk assessment) new FRA procedure is established to overcome the deciencies of existing ones.
FRA (Fire risk analysis) Prior to introducing the new FRA procedure, this paper reviews two types of existing FRA procedures
PFP (Passive re protection) and points out a common problem, namely the difcult application of design accidental loads (DALs) to
CFD
structural consequence analysis. In this regard, the new procedure includes an extended structural
Snapshot
consequence analysis rather than follow the conventional means of determining specic DALs. More-
over, the new procedure offers a new concept of cumulative failure frequency for assessment of topside
module structure safety. The role of cumulative failure frequency is to probabilistically identify failed
members of objective structures. The key advantages of the new FRA procedure are twofold: rst,
effective structural consequence analysis without the need for DALs, and second, probabilistic safety
assessment of topside structure subjected to a certain number of prescribed re-accident scenarios. The
cumulative failure frequency, in fact, becomes useful information for determination of risk mitigation
measures (e.g. passive re protection (PFP), deluge systems, etc.). This paper not only presents a detailed
description of the new FRA procedure but also demonstrates an example using a real FPSO separation
module.
& 2015 Elsevier Ltd. All rights reserved.

1. Introduction At the early stage of an offshore project, FRA concentrates on

Energy consumption has risen steadily over the past few
decades as economic and infrastructural development has pro-
ceeded. The ever-expanding energy requirement has forced the
extension of oil and gas exploitation to the deep seas. In these
harsh environments, offshore platforms and their crewmen face
considerable risk and danger. As two well-known accidents (Piper
Alpha, 6th June 1988; Deep Water Horizon, 20th April 2010) serve
to emphasize, accidents involving re and/or explosion, albeit very
rare, can be very devastating. Risk assessment is essential both to
the prevention of accidents and to the survival of platforms and
their crews in cases where prevention fails. FRA is a conventional
means of evaluating the re risk to offshore platforms.
n
Corresponding author. Tel.: 82 2 880 8380; fax: 82 2 888 9298.
E-mail address: seanjang@snu.ac.kr (B.-S. Jang).
possible consequences associated with potential re scenarios in
terms of re escalations and impairments. The representative
method is the ame size-based-approach (Krueger and Smith,
2003); it assesses the failure of a critical target or process module
by using a design ame size obtained from simplied re model-
ing and analysis. When an offshore project enters into the detailed
engineering stage, structural consequence analysis becomes vital,
as it provides data necessary for the determination of risk-control
measures such as passive re protection (PFP). However, the
ame-size-based approach in early stage, with its simplied re
modeling, is not adequate for detail structural consequence
analysis. Rather, an advanced FRA procedure that includes a more
accurate structural consequence analysis is required.
SCI (2009) published a procedure for probabilistic assessment
of re load and structural response. This procedure includes
application of CFD (e.g. Kameleon FireEx)-assisted 3D re simula-
tion to capture a realistic re accident, and also evaluates DALs by
adopting a conventional exceedance curve of heat dose. Though

http://dx.doi.org/10.1016/j.oceaneng.2015.04.019
0029-8018/& 2015 Elsevier Ltd. All rights reserved.
726 Y. Jin, B.-S. Jang / Ocean Engineering 104 (2015) 725737

the DALs are determined probabilistically, it is not straightforward
to use the DALs to carry out a complete structural consequence
analysis and probabilistic safety assessment. Paik et al. (2011) and
Paik and Czujko (2012) proposed another quantitative procedure,
EFEF JIP, that randomly generates re scenarios by input of several
random variables associated with individual probability density
functions. However, this procedure also follows the same excee-
dance curve-based-approach for the determination of DALs, which
results in the same difculties.
This paper proposes a new FRA procedure, which can eventually
enable a probabilistic safety assessment of topside structure subjected
to re damage. The procedure modies existing FRA procedures to
accommodate the needs of structural consequence analysis required
for a probabilistic safety assessment. It uses an index function to
quantify the failure of each structure member and presents a new
concept, cumulative failure frequency, for probabilistic evaluation of
their safety. The introduction of cumulative failure frequency enables
the new procedure to screen the critical structure member exposed to
high re-accident risk by identifying the structure member that has a
failure frequency exceeding a certain risk acceptance criterion i.e. 10  4
(NORSOK, 2001).
In addition to probabilistic structural safety analysis, the new
procedure includes an approximate method for the rational selection
of probable leak positions and the calculation of their probabilities. In
order to improve efciency problems raised by computing time, it also
proposes a virtual compressed leak prole into CFD re simulation to
quickly collect enough 3D thermal load data to be used for structural
consequence analysis. The remainder of this paper is organized as
follows. Section 2 delineates the general outlines of FRA and identies
the drawbacks of existing procedures. Section 3 introduces the newly
proposed FRA and structural safety analysis procedure. Finally, Section
4 provides an example to demonstrate how the procedure can be
applied to the safety evaluation of a test FPSO module structure.
2.1. Phase 1: re scenario identication
Phase 1, the input-preparation stage of FRA, comprises 2 steps:
re scenario identication, and frequency calculation. Hazard iden-
tication (HAZID), carried out prior to FRA, usually provides
important data (e.g. isolatable segments, main inventory, etc.) for
re scenario identication. In re scenario identication, several
variables are specied for dening a re scenario. Table 1 lists these
variables along with the general procedure for obtaining them.
Table 1
Variables for scenario identication.
Variables The way to determine the variables
Leak rate Calculate with the main inventory (by HAZID work)
condition (temperature, pressure, chemical composition)
and leak hole size.
Leak duration Calculate with total mass of the main inventory and leak
rate.
Leak direction N/A
Leak location N/A
Leak frequency Calculate with historical database.
Ignition probability Calculate with certain ignition probability model.
In this way, most of the variables can be calculated. However, leak
position and direction are quite difcult to determine, because both of
them have a strong inherent randomness, rendering impossible
prediction or consideration of all possible cases in FRA. At present,
there is still no standardized procedure for their probabilistic deter-
mination. Also, the most common methods used in the existing FRA
procedures are nothing more than some conservative probability
models or experts' deterministic judgment. In this study, a method
for determining leak position and direction, presented in Section 3.1
below, is further developed.

2.2. Phase 2: consequence analysis and determination of design

2. General outline of re risk analysis accidental load

FRA is dened as an investigative procedure by which the damages Phase 2 mainly focuses on risk evalulation by combining the
of potential re accident to an offshore platform and its facilities are frequency data that comes from phase 1 and the consequences of
determined. FRA results and ndings are utilized as general input to an identied re scenarios through re simulation or structural
overall quantitative risk assessment (QRA). FRA can be classied into analysis. As indicated in Fig. 1, the goal of risk evaluation in
3 phases, as illustrated in Fig. 1. existing FRA is to determine design loads. Conventionally, the
most popular tool for determining design loads is the exceedance
Existing FRA Procedure Proposed FRA Procedure curve, which is formed from the consequence value on the y axis
and the corresponding frequency value on the x axis.
Fire Scenario Identification Fire Scenario Identification Case I and Case II in Fig. 2 show sample exceedance curves for
Phase 1

ame length and heat dose, respectively. Case I is the FRA result for
Frequency Calculation Frequency Calculation use of the ame size-based-approach in front end engineering design
(FEED), and Case II is the FRA result according to the procedure
Fire Simulation Fire Simulation + Structure published by SCI (2009). When a design criterion, as indicated by the
Consequence Analysis red dashed line in the gure, is added to both curves, design loads
Risk Design Criterion such as 20 m ame length and 126 MJ/m2, respectively, can be
Evaluation obtained.
Phase 2

Risk Acceptance Risk

Criterion Evaluation In FRA studies, the purpose of structural consequence analysis is to
Exceedance Curve check how much damage the re inicts on the structure. The damage
Cumulative Failure Frequency can be estimated quantitatively by numerical heat transfer analysis or
Design Loads structural analysis. However, unfortunately, such structural conse-
(e.g. flame size, heat dose etc.) Identification of Failed Structure quence analysis is hard to be accomplished by the above-noted design
Members
loads such as ame length or heat dose since these quantities are only
Structural Consequence
non-spatial scalar values but not the 3D spatial data required for
Risk Acceptance
Phase 3

Analysis
Criterion
conducting heat transfer analysis or structural analysis.
Design Criterion Therefore, note that if the structural consequence analysis is to be
Risk Control Risk Control realized, true useful design loads i.e. a full 3D spatial heat ux data,
should be determined. As a previous study, SCI (2009) proposed an
Fig. 1. General procedure of FRA procedure. equivalent design scenario concept to overcome this problem. The
 Y. Jin, B.-S. Jang / Ocean Engineering 104 (2015) 725737 727

1.0E-03
Exceedance Curve: Heat dose

Exceedance Curve : Flame length Large of Case 1

1.0E-02
Large of Case 2
Medium of Case1

Frequency
Design Criterion
1.0E-04
Medium of Case 2
1.0E-03
Frequency

Design Scenario ? Small of Case 1

Design Criterion
Small of
Design Load
Design Flame Length Case 2
1.0E-04 1.0E-05
0 50 100 116 150 200

Heat dose received by structure (MJ/m2)

Fig. 3. Example of non-existent equivalent design scenario.

1.0E-05
0 10 20 30 40 50 60 70 80
method to assess the re damage on topside structure. Details
Flame length obtained from simplified fire modeling (m) about the new procedure are discussed in Section 3.

2.3. Phase 3: risk mitigation

1.0E-03
Exceedance Curve: Heat dose
Phase 3 mainly considers mitigation of structure failure according to
Large of Case 1 the result of the risk evaluation carried out in phase 2. Typically, there
Large of Case 2 are two types of effective protection for offshore topside structures:
PFP coating, and deluge systems. Compared to deluge systems, PFP
Frequency

Medium of Case1 coating, in most cases, is much more preferable; nevertheless, due
Design Criterion
1.0E-04
Medium of Case 2 to its considerable cost, it is necessary to optimize its application.
With respect to PFP optimization, cumulative failure freque-
ncy calculation, as enabled by the newly proposed procedure, is
Design Scenario Small of Case 1 expected to be very useful; since it is able to determine all of the
Small of failed elements having a failure frequency larger than the risk
Design Load Case 2 acceptance criterion i.e. 10  4 (NORSOK, 2001). More details about
1.0E-05
the cumulative failure frequency is discussed in Section 3.6.
0 50 100 126 150 200

Heat dose received by structure (MJ/m2)

Fig. 2. Example of exceedance curve and design loads. (a) Case I and (b) Case II
3. Framework of proposed re risk analysis
(reproduce from FABIG Technical Note 11). (For interpretation of the references to
color in this gure, the reader is referred to the web version of this article.) Fig. 4 shows a schematization of the new FRA procedure
proposed in this paper. The procedure comprises 7 steps, each of
equivalent design scenario can be determined by heat dose excee- which is explained individually in the following sections.
dance curve such like the one shown in Case II of Fig. 2. For instance, in
Case II, it is found that one of the re scenarios used to form the Proposed FRA Procedure
exceedance curve namely, Medium of Case 2, matches coincidently
with the design criterion. Accordingly, the Medium of Case 2 can be
used as an equivalent design scenario for structural consequence Fire Scenario Identification
<Leak Location, Direction, Rate>
analysis with its full spatial 3D heat ux distribution. However, such an
approach is not yet applicable to all situations and a relative example
is presented in Fig. 3. If a design criterion value is placed between
Frequency Calculation Consequence Analysis
Medium Case 1 and Case 2, there is no equivalent scenario corre- <Part Count Method>
sponding to the design criterion and a proper virtual design scenario Fire Simulation
needs to be created by interpolating the Medium Case 1 and Case 2. <Snapshot >
However, the interpolation is not an easy work because the 3D heat Thermal Loads
ux distribution required for conducting the thermal structural Structural Analysis
analysis is to be created from a non-spatial quantity i.e. heat dose. <Thermal Elasto-Plastic
Additional details on this approach can be found at FABIG Technical Analysis>
Note 11 (SCI, 2009). Risk
In response to the above-noted difculties in existing proce- Evaluation Design Criterion
dures, in the present study, a new FRA procedure is established.
The new procedure focuses mainly on probabilistic evaluation of
topside structure failure itself rather than calculation of the Identification of Failed Structural
indirect DALs. As Fig. 1 shows, this is accomplished by performing Members
<Cumulative Failure Frequency>
structural consequence analysis separately for the whole identied
scenarios, and then calculating the cumulative failure frequency to Risk Acceptance Criterion
check out failed structure members. In addition, the new proce-
dure does not consider the unavoidable assumptions needed for Risk Mitigation
<Passive Fire Protection>
utilizing the DALs or equivalent design scenario made in existing
FRAs; therefore, it is both a more straightforward and accurate Fig. 4. General procedure of new proposed FRA.
728 Y. Jin, B.-S. Jang / Ocean Engineering 104 (2015) 725737
3.1. Fire scenario identication
Mostly in FRA studies, all potential re scenarios are identied
only by one leak position, which is commonly assumed as the
volumetric center of the identied isolatable segments. This kind
of approach usually makes the work of scenario identication
much simpler for analyzers. However, for a general size of FPSO
topside module, such an assumption is too rough for a compre-
hensive topside structural safety evaluation. Therefore, the new
FRA procedure includes a more specic consideration on determi-
nation of probable leak position. Normally, most of hydrocarbon
leakages originate from equipment components such as anges,
valves and pipe connections inside of topside modules; but given
that there are often a very signicant number of these compo-
nents, considering each of them individually could make for a
virtually innumerable number of re scenarios. To resolve this
Main Inventory
Flow line connected to the main inventory
Valve
Fig. 5. Comparison of leak position between existing FRAs and proposed FRA. (a) Leak location in existing FRA and (b) leak locations in proposed FRA.
problem, an approximate method is developed for the new
procedure.
Approximate method for selection of probable leak positions
1. Identify the process ow lines connected to the main inven-
tories identied in HAZID work.
2. Divide a process module into several blocks, the number which
corresponds to the size and equipment layout of the module.
3. In each block, count the number of leak components (i.e. ange,
valve, pipe connection, pipe, process equipment etc.) only along
the ow lines identied in step 1.
4. Determine the leak position in each block, namely the volu-
metric center of the block or the position of the leak compo-
nent that is closest to the volumetric center.
Normally, piping and instrumentation diagram (P&ID) and
process ow diagram (PFD) offer much important data for identi-
cation of the above-noted ow lines as well as process compo-
nents. Hence, the determination of probable leak positions cannot
be separated from these drawings. An example is provided in
Fig. 5. According the approximate method, the sample segment is
divided into four blocks, and in each block a probable leak
position, satisfying above-noted step 4 is selected.
Similar to the leak position, leak direction also is care-
fully decided in the new procedure. As already emphasized, leak
direction is almost impossible to predict due to its randomness.
Even though in some of existing FRA procedures, randomness
is reected by a simple probability model, and whether such
a model is reliable enough to depict such randomness remains
controversial since it has a high possibility of missing many critical
scenarios and underestimating of resultant risk level. At present,
conservative determination of leak direction in a deterministic
approach is much better than an unclear probability model; thus
the new procedure also adopts the former approach. The original
purpose of FRA is to evaluate re damage to topside structures
or associated facilities. The new procedure considers only the
critical leak direction at each leak position, which is directed
towards the most valuable part of the structure (i.e. which locally
bears the weight of heavy facilities), and which is dened in a
deterministic way. Although such an approach might lead to a
highly critical or conservative re scenario, it does denitely
guarantees the safety of topside structures at least from the point
of view of the vulnerable parts, since it takes all of them into
consideration.
Block 1 Block 2
Main Inventory
Block 3 Block 4
Leak location
Flange
3.2. Frequency calculation
For an FRA of an offshore platform, leak frequency data, usually
obtained from historical leak databases, is one of the most
important inputs. At present, the most widely utilized leakage
database is the Hydrocarbon Release Database (HCRD) recorded by
HSE (2005), which contains information on almost all of the
hydrocarbon leakage accidents occurring in the world. The leak
frequency in the example demonstrated in Section 4 also is
calculated using the HCRD. The method generally used to calculate
leak frequency is called part count (DNV GL, 2013), which counts
the number of pieces of equipment or components where hydro-
carbon leakage can possibly occur. The newly proposed procedure
calculates leak frequency by the following formula:
X
n
F leak f k UN k 1
ik
where Fleak: total leak frequency of an identied segment, fk: leak
frequency of kth kind of equipment, n: the number of equipment
types, Nk: number of kth kind of equipment in a segment,
fk, and Nk are obtained from an historical database and the part
count method, respectively.
3.3. Fire frequency calculation
The above-noted leak frequency Fleak represents only the total
leak frequency of an identied segment (or module). In order to
obtain the re frequency of an identied re-accident scenario,
 Y. Jin, B.-S. Jang / Ocean Engineering 104 (2015) 725737
additional conditions need to be considered, generally by certain
probability models. According to the proposed procedure, re
frequency can be calculated by the following formulas:
F f ire F leak U P position UP ign UP ESD ; for failed ESD and EDP
F f ire F leak U P position UP ign U1  P ESD ; for successful ESD and EDP
where P represents three types of probability model. Pposition
indicates the probabilities of hydrocarbon leakage at each leak
position determined by applying the approximate method pre-
sented in Section 3.1. It is relatively straightforward to see that
according to the theoretical denition of probability, Pposition is
actually equal to the ratio of Fleak to Fblock, as shown in the
following formula:
F block
P position
F leak
Hence, the terms Fleak  Pposition in formula (2) can be replaced by
Fblock, which indicates that when the leak frequency is calculated
by the approximate method, the divided block itself has already
considered the leak position probability. In summary, nal re
frequency of a specic re scenario can be calculated by following
formulae.
F f ire_f ;i F block;i UP ign UP ESD ; for failed ESD and EDP
F f ire_s;i F block;i U P ign U 1  P ESD ; for successful ESD and EDP
where Fblock,i: leak frequency of ith divided block, Fre_f,i: re
frequency of scenario i for failed ESD and EDP, Fre_s,i: re frequency
of scenario i for successful ESD and EDP, Pign: ignition probability
i: ith scenario number, PESD: failure probability of emergency
shutdown (ESD) and emergency depressurization (EDP).
Also, Pign, which denotes the ignition probability, is obtained by
Cox et al., (1990) model represented in the following formula:
P ign 0:0158 U R0:6415
where R: leak rate.
3.4. Fire simulation
In this study, each identied re scenario is simulated using the
Kameleaon FireEx (KFX) program (KFX, 2010). When a re accident
occurs, the surrounding gas mixture (i.e. CO2, H2O, soot, etc.) partici-
pates in the radiation heat transfer. At moderate temperatures, the
mixture heats itself by absorbing radiation emitted from the ames;
conversely, at high temperatures, it emits radiation to the surround-
ings to obtain a thermal balance. The radiation emission and absorp-
tion of a mixture gas usually are dependent on gas temperature,
pressure, the chemical composition, the uidity of the mixture gas,
together with the radiation process itself. KFX is one of the most
advanced re simulation tools for offshore hydrocarbon re accidents.
It is available for both calculation of turbulent combustion ow using
the Eddy Dissipation Concept developed by Magnussen and Hjertager
(1976), Magnussen (2005) and radiation heat ux using the Discrete
Transfer Model developed by Shah (1979). A comprehensive KFX
application to the safety issues of the oil and gas industry has been
reported by Magnussen et al. (2000).
When a re accident occurs, the actual leak rate of hydrocarbon
ejected from the process equipment diminishes as time passes,
because under normal conditions, it is gradually stopped by the ESD
or EDP system installed on the FPSO. Such a phenomenon, known
as a transient or dynamic re accident (Svio and Asmund, 2010),
must be considered in FRA studies. However, CFD-based transient
re simulation often requires a lot of time; thus if all identied
scenarios are simulated within the full time scale, the FRA studies
become very inefcient.
729
In order to reduce the time required for transient re simulation,
the new procedure utilizes a snapshot method. Literally, a snapshot is a
certain physical moment of a transient re accident; each snapshot
represents a different leak rate condition. Fig. 6 shows the procedure of
2
the snapshot method in detail. Three cases of leakage are considered
for the equipment, and 8 snapshots are specied in constructing a
virtual compressed leak prole. As the dashed lines show, the specied
snapshots should have a proper leak rate distribution so that they can
be repeatedly used (i.e. shade box) for the 3 cases of leakage. When a
transient re simulation is carried out with a virtual compressed leak
prole, the required time can be signicantly reduced.
For example, if the 3 cases of leakage in Fig. 6 are individually
simulated for the full time scale, the re simulation must cover 420 s,
1000 s and 1500 s, respectively, and 2920 s in total; but when the
3 cases are simulated together with the virtual compressed prole the
3 simulation needs to cover only 90 s. Note, however, that if the
snapshot method is to be used correctly, the time interval between
each snapshot must be carefully considered, because it inuences both
the simulation accuracy and the time required. In this paper, many
cases with different time intervals are examined and it is found that a
time interval longer than about 15 s can provide the nearly the same
heat ux distribution as the actual transient leak prole. Even if the
minimum value can differ depending on the geometric complexity of
4 the simulation model or the leak rate proles, the time interval of 15
20 s seems to be sufcient for a general use. Details of the case study
results are not fully described, but for illustrating purpose the case of
15 s for a re scenario is laid in the Appendix.
When a transient re simulation is completed, a series of instanta-
neous 3D heat ux distribution datasets are produced, which are used
later as structural consequence analysis inputs. However, since the
simulation is carried out under a virtual compressed leak prole, the
series data cannot be directly applied to structural consequence
analysis. The following section provides a detailed explanation of the
correct use of these data.
5
3.5. Structural consequence analysis
In the new procedure, thermal elasto-plastic analysis is applied
to evaluate topside module structure safety under re-accident
conditions. The analysis has two parts, heat transfer analysis and
non-linear structural analysis, both of which are carried out using
the FAHTS (FAHTS, 2011) and USFOS (USFOS, 2012) package
program. FAHTS is a KFX/USFOS interface program tailored for
transference of thermal load to structural analysis. Studies on the
integrated analysis of re-exposed structures using KFXFATHS
USFOS have been reported by Trond and Tore (2005) and by Jan
Reier et al. (2011). The validity of the use of FAHTSUSFOS for
nonlinear structural consequence analysis, moreover, has been
veried by Paik et al, 2013.
In heat transfer analysis, FAHTS can calculate temperature distribu-
tions using re simulation results. However, since re simulation is
carried out under a virtual compressed leak prole, the time scale of
the results must be recovered before use. For example, in Fig. 6, the
time interval between snapshots 1 and 2 is specied as 30 s in the
virtual compressed leak prole; but in the heat transfer analysis, it is
recovered as 105 s and 405 s, namely the actual time intervals for large
and medium leakages, respectively. All time scales should be recov-
ered in the same manner when snapshots are applied to heat transfer
analysis.
For topside module structure failure evaluation, a further, non-
linear structural analysis is carried out using USFOS. Structural analysis
must pay attention to the material-property degradation of steel.
Material properties such as Young's modulus and yield strength
usually decrease signicantly at high temperatures. In USFOS, there
is a function to automatically modify material properties according to
730 Y. Jin, B.-S. Jang / Ocean Engineering 104 (2015) 725737

Actual Leak Profile Snapshot Virtual Compressed Leak Profile

12kg/s 9kg/s
10 10 6kg/s
5kg/s
3kg/s

Leak Rate (kg/s)

Leak Rate(kg/s)

Large Medium Smal l

1 1
1kg/s
0.5kg/s

0.1kg/s
0.1 0.1
0 500 1000 1500 2000 0 15 30 45 60 75 90

Recover
Time(s) Time (s)

Compress
Calculate 3D Heat flux Distribution

Small Medium Large

Operating Condition 45s 90s 150s 250s 450s
5kg/s 3kg/s 1kg/s 0.1kg/s

45s 200s 450s 700s 1000s

1kg/s 0.5kg/s 0.1kg/s

45s 500s 1500s

Equipment Time (s)

Fig. 6. Example of the snapshot method.

Reduction Factor
1.200
Temperature > 450C
0C
1.000

0.800

0.600

0.400

0.200

0.000
0 200 400 600 800 1000 1200

Yield Strength Proportional limit Young's modulus

Failed Element
Fig. 7. Temperature-dependent material properties (EN 1993-1-2, 2005).

the results of heat transfer analysis, and the degree of degradation is

determined according to Euro code 3 shown in Fig. 7.

3.6. Cumulative failure frequency

Plastic Utilization 1
Calculation of the cumulative failure frequency of the topside
module structure is the most important operation of the new FRA
procedure. First though the failed element must be identied in each
re scenario. Failed elements can be identied either by using the
results of heat transfer analysis or non-linear structural analysis with
2 types of failure criteria (SCI, 2009). For example, Fig. 8(a) shows
failed elements identied by means of heat transfer analysis with the
temperature criterion, and Fig. 8(b) shows their identication by
means of non-linear structural analysis with the plastic utilization
criterion. In USFOS, plastic utilization is dened as the ratio of the
plastic area to the entire beam cross-section area; accordingly, a plastic Failed Element
utilization value of 1 indicates that a beam element likely has failed. In
many cases elements may still continue to contribute to the load-
carrying after having reached a plastic utilization of 1.0, by changing Fig. 8. Identication of failed element. (a) Heat transfer analysis and (b) non-linear
the behavior from bending to membrane action. Nevertheless, the structure analysis.
 Y. Jin, B.-S. Jang / Ocean Engineering 104 (2015) 725737
membrane effect is ignored and the value of criterion is still chosen as
1.0 conservatively for the sake of safety.
In the new procedure, the cumulative failure frequency of a
module structure is calculated by the following formula:
X
n X
n
F f ailure;j F f ire_f ;i UI f ;i F f ire_s;i UI s;i
i1 i1
where Ffailure,j: cumulative failure frequency for jth element, If,i:
index of jth element in ith scenario for failed ESD and EDP, Is,i:
index of jth element in ith scenario for successful ESD and EDP, I:
index function: I 1 for failed, I 0 for safe, n: the number of re
scenario.
The failure frequency of an individual element in a given
scenario is dened as the re frequency multiplied by an index
function. In the newly proposed procedure, index function I is used
to dene the consequence (i.e. failure or safety) for an individual
element in each scenario. If an element has failed, I is equal to 1,
and if it is safe, I is 0. Finally, cumulative failure frequency can be
achieved by summing all failure frequencies over the total number
of identied scenarios.
3.7. Summary
For design and risk mitigation of offshore structures, it is
important to understand structure response behavior under re
loads. However, the existing FRAs procedures do not adequately
provide for an overall structural consequence analysis; even though
they can be used to calculate DALs, as reviewed in Section 2.2, these
alleged design loads are nothing more than nominal design loads.
Therefore, the proposed FRA procedure applies a new concept of
cumulative failure frequency to the probabilistic assessment of
offshore topside structure safety. By utilizing the cumulative failure
frequency, it is possible to integrate all of the results of structural
consequence analysis and probabilistically identify the structure
elements that are likely to fail in res. Thus, to the extent that the
new procedure offers this kind of comprehensive offshore structure
risk evaluation, it represents an advance on the existing methods.
Top deck
Upper deck
Fig. 9. Test model used in example.
The Section 4 provides an illustrative, more detailed example of the
new FRA procedure.
4. Example of proposed re risk analysis
4.1. Basic information of test module
Fig. 9 shows a sample test module comprising 3 decks. Each
deck supports heavy process equipment, which means that it is
likely to fail in the course of a re accident. Under the assumption
that the HAZID work has already been completed, it is determined
731
that the main hazardous inventories in the test module are the
two oil and gas separators and, based on this, it is also assumed
that 3 kinds of time-dependent leakage (DNV GL, 2013) have been
calculated according to operation conditions of the identied main
inventories. The 3 calculated leakages are presented in Fig. 6.
6
4.2. Frequency calculation
In the above example, the several leak locations are determined
using the approximate method introduced in Section 3.1. Since the
process ow lines connected to the separators spatially pass
through the test module, almost all of the test module space is
taken into consideration. Fig. 10 provides a detailed layout of the
subdivided blocks and identied leak positions.
Leak frequency is calculated using the part count method; the
historical input data applied for that calculation is obtained from
OGP (2010), which summarizes the input leak frequency data
according to the methodology proposed by DNV (Andreas (2011)).
The results of the leak frequency calculations are listed in Tables 24.
Moreover, the probability of ignition and ESD and EDP activation are
added to calculate the nal re frequencies for the identied
scenarios.
As Tables 24 show, part counting considers 5 types of equip-
ment of different diameters; for each type of equipment, 3 kinds of
leakage, large, medium and small, are factored. Detailed calcula-
tion is carried out using formula (1) presented in Section 3.1.
However, since the test module used in this example is not yet
fully designed, an extra modication factor is introduced for
consideration of the future equipment. In fact, the test module is
a FEED stage model and the sum of leak frequency probably can be
underestimated since the number of pipes, valves and other
equipment would be smaller than those of nal as-built design.
This means that leak frequency Fleak calculated by formula (1)
should be magnied to compensate the incomplete design of the
test module. The magnication factors should be estimated care-
fully by considering the level of design process at the moment
when the FRA is conducted. However, in this study, those factors
238tons 238tons
26.3tons
8tons 26.3tons
Process deck
are just assumed as 1.5 simply according to other similar com-
pleted modules.
4.3. Fire simulation and structural consequence analysis
The total number of scenarios considered in this example is 33,
but when using the virtual compressed leak prole introduced in
this paper, that number can be reduced to 11. Fig. 11 shows all of
the present simulation cases. As noted in Section 3, at each leak
position, only a critical leak direction is considered, which is
determined by the equipment layout. The number of leak
732 Y. Jin, B.-S. Jang / Ocean Engineering 104 (2015) 725737

Process Deck Upper Deck

Block1

Block1 Block2 Block3

Block2

Block4

Block3

Block5 Block6

Top Deck
Block1

Leak location
Equipment
Pipeline, flange, valve congested
area of main flow line
Block2

Block division line

Fig. 10. Block divisions and Identied leak positions.

Table 2
Leak frequency calculation: process deck.

Type Diameter OGP Data Quantity Modication factor Large Medium Small

Large [65 mm] Medium [46 mm] Small [6 mm]

Flange 30 1.48E  05 2.95E  05 2.54E  04 6 1.5 1.33E 04 2.66E  04 2.28E  03

24 1.33E 05 2.50E  05 2.12E  04 6 1.5 1.20E  04 2.25E  04 1.91E  03
20 1.22E  05 2.23E  05 1.84E  04 23 1.5 4.21E  04 7.69E  04 6.35E 03
Actuated valve 20 2.97E 05 5.53E  05 4.37E  04 0 1.5 0.00E 00 0.00E 00 0.00E 00
24 2.90E  05 5.40E  05 4.30E  04 1.5 1.5 6.53E  05 1.22E  04 9.68E  04
Manual valve 20 1.65E  05 2.80E  05 1.54E  04 2 1.5 4.95E  05 8.40E  05 4.62E  04
Pipe [mm] 30 7.30E  06 6.50E  06 5.10E  05 13,305 1.5 1.46E  04 1.30E  04 1.02E  03
24 7.30E  06 6.50E  06 5.10E  05 51,715 1.5 5.66E  04 5.04E  04 3.96E  03
20 7.30E  06 6.50E  06 5.10E  05 90,475 1.5 9.91E  04 8.82E  04 6.92E  03
Vessel 30 2.80E  04 3.50E  04 1.52E  03 2 1.0 5.60E  04 7.00E  04 3.04E  03
Total 3.05E  03 3.68E  03 2.69E  02

Table 3
Leak frequency calculation: upper deck.

Type Diameter OGP Data Quantity Modication factor Large Medium Small

Large [65 mm] Medium [46 mm] Small [6 mm]

Flange 30 1.48E  05 2.95E  05 2.54E  04 0 2.0 0.00E 00 0.00E 00 0.00E 00

24 1.33E 05 2.50E  05 2.12E  04 0 2.0 0.00E 00 0.00E 00 0.00E 00
20 1.22E  05 2.23E  05 1.84E  04 7 2.0 1.71E  04 3.12E  04 2.58E  03
Actuated valve 20 2.97E 05 5.53E  05 4.37E  04 0.5 2.0 2.97E 05 5.53E  05 4.37E  04
10 3.17E  05 6.20E  05 4.83E  04 0 2.0 0.00E 00 0.00E 00 0.00E 00
Manual valve 20 1.65E  05 2.80E  05 1.54E  04 2 2.0 6.60E  05 1.12E  04 6.16E  04
Pipe [mm] 30 7.30E  06 6.50E  06 5.10E  05 0 2.0 0.00E 00 0.00E 00 0.00E 00
24 7.30E  06 6.50E  06 5.10E  05 0 2.0 0.00E 00 0.00E 00 0.00E 00
20 7.30E  06 6.50E  06 5.10E  05 58,170 2.0 8.49E  04 7.56E  04 5.93E  03
Vessel 30 2.80E  04 3.50E  04 1.52E  03 0 1.0 0.00E 00 0.00E 00 0.00E 00
Total 1.12E  03 1.24E 03 9.56E  03
 Y. Jin, B.-S. Jang / Ocean Engineering 104 (2015) 725737 733

Table 4
Leak frequency calculation: top deck.

Type Diameter OGP Data Quantity Modication factor Large Medium Small

Large [65 mm] Medium [46 mm] Small [6 mm]

Flange 30 6.00E  06 2.95E  05 7.35E 05 0 2.0 0.00E 00 0.00E 00 0.00E 00

24 5.10E  06 2.50E  05 6.20E  05 0 2.0 0.00E 00 0.00E 00 0.00E 00
20 4.43E  06 2.23E  05 5.47E  05 12 2.0 1.06E  04 5.35E 04 1.31E  03
Actuated valve 20 2.97E  05 5.53E  05 4.37E  04 0 2.0 0.00E 00 0.00E 00 0.00E 00
10 3.17E  05 6.20E  05 4.83E  04 0 2.0 0.00E 00 0.00E 00 0.00E 00
Manual valve 20 1.65E  05 2.80E  05 1.54E  04 6 2.0 1.98E  04 3.36E  04 1.85E  03
Pipe [mm] 30 7.30E  06 6.50E  06 5.10E  05 22,000 2.0 3.21E  04 2.86E  04 2.24E 03
24 7.30E  06 6.50E  06 5.10E  05 0 2.0 0.00E 00 0.00E 00 0.00E 00
20 7.30E  06 6.50E  06 1.50E  05 10,000 2.0 1.46E  04 1.30E  04 3.00E  04
Vessel 30 2.80E  04 3.50E  04 1.52E  03 2 1.0 5.60E  04 7.00E  04 3.04E  03
Total 1.33E 03 1.99E  03 8.74E  03

Process Deck Upper Deck Top Deck

Case 1 Case 4 Case 7 Case 10

Case 2 Case 5 Case 8 Case 11

Case 3 Case 6 Case 9

Leak location
Leak direction

Fig. 11. All of the cases considered in example.

positions, meanwhile, is determined by the equipment layout on Scenario i Sub-case

each deck. Fig. 12 presents a decomposition of the cases presented i: 1~33
Successful Activation of ESD &
in Fig. 11; each case contains 3 re scenarios, namely large,
EDP
medium, and small. In addition, each scenario is separated into Large
2 sub-cases, successful ESD and EDP and failed ESD and EDP.
Failure of ESD & EDP
Fig. 13 indicates the detailed sequence of re simulation and
structural consequence analysis. The scenario represented is a large Successful Activation of ESD &
re of case 4, and all of the identied scenarios follow the same EDP
Case n
sequence. n: 1~11
Medium
Failure of ESD & EDP
4.4. Cumulative failure frequency
Successful Activation of ESD &
In this example, heat transfer analysis and non-linear structural EDP
Small
analysis are separately used to calculate the cumulative failure
frequency of the test model, and their results are compared. As Failure of ESD & EDP

emphasized in Section 3.6, the failed structure element must be

identied with index function I before calculating the cumulative Fig. 12. Decomposition of cases considered in example.
734
Case4 :large, no ESD & EDP activation
Heat flux, Gas
Temperature
KFX Fire Simulation
Fig. 13. Sequence of re simulation and structural consequence analysis.
4.00E-04
3.50E-04
Cumulative failure frequency
3.00E-04
2.50E-04
2.00E-04
1.50E-04
1.00E-04
5.00E-05
0.00E+00
0 50
Fig. 14. Plot of cumulative failure frequency vs. element no.
failure frequency. However, in this example, the total number of re
scenarios considered is signicant, and accordingly, manual work of
checking the failed elements and calculating the cumulative frequency
becomes quite onerous. For efcient calculation of cumulative failure
frequency, a general computer code was developed. The code has
3 functions: checking for failed elements, calculating the cumulative
failure frequency, and graphically posting the result. Fig. 14 shows the
results for cumulative failure frequency as calculated by the code, and
Fig. 15 graphically maps them to the structure model. Moreover, when
a risk acceptance criterion such as 10  4 (NORSOK Z-013) is applied to
the determination of the cumulative failure frequency, the failed
element exceeding that criterion can be identied easily. Fig. 16 shows
the nal failed-element results as screened by the risk criterion and
the optimized PFP application area can be determined according to
these elements.
4.5. Summary
On the basis of a comparison of the two calculated cumulative
failure frequencies presented in Fig. 15, the following conclusions
can be drawn.
4.5.1. For the failed elements of the top deck
They were both identied as failed elements through
heat transfer analysis and structural analysis, because they were
concurrently subjected to high temperature and equipment
weight.
Y. Jin, B.-S. Jang / Ocean Engineering 104 (2015) 725737
Temperature
Distribution
FAHTS Heat Transfer Analysis USFOS Non-linear Structure
Analysis
Cumulative Failure Frequency of Example Topside Structure
Non-linear structure analysis
Heat transfer analysis
100 150 200 250 300 350 400
Element No.
4.5.2. For the failed elements of the upper deck
They were identied as failed elements through heat transfer
analysis, because they had temperatures higher than 450 1C.
However, they were deemed safe through structural analysis,
because the equipment supported by them is much lighter than
that on the top deck.
If an element's temperature is calculated as 600 1C, then the
element must have been regarded as failed according to the
temperature criterion; however, it may survive too as long as
there is no external load exerting on it. In heat transfer analysis,
the failure of element is only considered by the temperature
criterion, while in structural analysis; both temperature and
external load are considered together. Therefore, heat transfer
analysis and structural analysis may yield different results of
cumulative failure frequency.
All in all, it is concluded that structure elements that do not
locally bear heavy equipment loads sometimes are resistant to
failure even though they are directly exposed to high temperature.
This indicates that structural analysis is necessary for more
accurate evaluation of topside structure safety.
5. Conclusions
With the existing FRA procedures, correct and proper evaluation of
structure safety under re-accident scenarios is difcult to achieve,
simply because design loads calculated are difcult to apply to
structural consequence analysis. Indeed, in the existing FRA
 Y. Jin, B.-S. Jang / Ocean Engineering 104 (2015) 725737 735

2.800-004 2.800-004

1.980-004 1.980-004

1.400-004 1.400-004

9.930-005 9.930-005

7.030-005 7.030-005

4.980-005 4.980-005

3.520-005 3.520-005

2.500-005 2.500-005

7.000-006 7.000-006

3.000-006 3.000-006

0.000 0.000

Fig. 15. Cumulative failure frequencies calculated in example.

2.800-004 2.800-004

1.000-004 1.000-004

0.000 0.000

Fig. 16. Identied failed elements in the example.

procedures, the interface between the design loads and structural
consequence analysis becomes a serious problem. In order to resolve
this problem, a new FRA procedure is proposed in this paper. The
most salient point to be emphasized about this new procedure is the
application of the new concept of cumulative failure frequency to the
safety evaluation of topside structures. As compared with the tradi-
tional exceedance curve, the cumulative failure frequency allows for
probabilistic evaluation of topside module structure failure, and also is
very useful for determining the minimum PFP application area. These
advantages have been illustrated by the example presented in this
paper. However, there are still many uncertainties or subjective
decisions, such as determination of leak direction, entailed in the
new procedure; hence further studies focusing on reliable probabilistic
re scenario identication procedures will be conducted.
Acknowledgment
This work was supported by 10041090, QRA based Design
Verication Technology for Highly Hazard Accidents of Offshore
Installations and the Technology Innovation Program, 10042556,
Core Technology Development for Deepwater O&G Production
System FEED Engineering & Floating Systems funded by the
Ministry of Trade, Industry & Energy (MI, Korea). The authors
appreciate Prof. Jrgen Amdahl for his support in access to USFOS
Appendix
This Appendix presents the case study results mentioned in
Section 3.4 to demonstrate the validity of snapshot method
proposed in this research. Fire simulations for Case 5 in Fig. 11
are performed for the following leak proles and Figs. A.1A.3
show the comparison of heat ux contours on planes normal to x,
y and z axis, respectively.
 Case I: actual large leak rate prole starting from leak rate of
12 kg/s shown in Fig. 6(a)
 Case II: compressed leak prole with time interval of 15 s
between each snapshot shown in Fig. 6(b)
Figs. A.1A.3(a) show heat ux distribution captured at the
moment when the leak rate arrives at 6 kg/s during the transient
simulation with actual large leak rate prole (Case I). It requires a
simulation for about 150 s. Similarly, the instantaneous heat ux
results for the compressed leak prole proposed in this paper at
6 kg/s are depicted in Figs. A.1A.3(b).
736 Y. Jin, B.-S. Jang / Ocean Engineering 104 (2015) 725737

Fig. A.1. Comparison of projected heat ux contour on yz-plane at 6 kg/s for Case 5. (a) Case I and (b) Case II..

Fig. A.2. Comparison of projected heat ux contour on xz-plane at 6 kg/s for Case 5. (a) Case I and (b) Case II..

Fig. A.3. Comparison of projected heat ux contour on xy-plane at 6 kg/s for Case 5. (a) Case I and (b) Case III..
 Y. Jin, B.-S. Jang / Ocean Engineering 104 (2015) 725737
The heat ux results of Case II are quite similar to Case II. This
illustrates the compressed leak prole with time interval of 15 s is
reasonable, and it almost does not affect the accuracy of re
simulation while reducing the simulation time drastically.
Nevertheless, due to grid effect, sometimes the accuracy of
proposed snapshot method deteriorates when the leak rate is
relatively small, like 1 kg/s etc. However, in such cases, the
consequent res hardly cause any considerable damage to struc-
ture; therefore, the low accuracy of proposed snapshot at small
leak rate can be ignored.
References
Andreas, Falck, 2011. Leak frequency modeling for offshore QRA based on the
hydrocarbon released database. FABIG (57), 918.
Cox, A.W., Lees, F.P., Ang, M.L. Classication of Hazardous Locations, 1990, Institute
of Chemical Engineers (IChemE, UK), ISBN: 0 85295 258 9.
DNV GL, 2013. Failure frequency guidance: process equipment leak frequency data
for use in QRA, NO-1322 Hwik, Norway.
EN 1993-1-2, 2005. Eurocode 3 Design of steel structures Part 12: General rules
structural re design.
FAHTS, 2011. User's manual for FAHTS, USFOS A/S, Norway.
HSE, 2005. Offshore Hydrocarbon Releases Statistics and Analysis, UK.
Jan Reier, Huse, Danielsen, Ulf, Dalheim, Joar, 2011. Integrated analysis of re
exposed structures introducing probabilistic analysis into re modeling and
structure analysis. Soc. Pet. Eng. (SPE) (document no. 140380).
Jeom Kee Paik, Jerzy Czujko, Jeong Hwan Kim., Sung In Park., Shaqul Islam., Dong
Hun Lee., 2013. A new procedure for the nonlinear structure response analysis
of offshore installations in res. In: Proceedings of the SNAME Annual Meeting,
Bellevue, WA, USA.
737
Paik, Jeom Kee, Czujko, Jerzy, 2012. Engineering and design disciplines associated
with management of hydrocarbon explosion and re risks in offshore oil and
gas facilities. Trans. SNAME 120, 139, Providence, RI, USA.
Paik, Jeom Kee, Jerzy Czujko, Bong Ju, Kim, Jung Kwan, Seo, Han Seong, Ryu, Yeon
Chul Ha, Janiszewski, Piotr, Musial, Beata, 2011. Quantitative assessment of
hydrocarbon explosion and re risks in offshore installations. Mar. Struct. 24,
7396.
KFX, 2010. User's manual for Kameleon FireEx (2010). Computational Industry
Technologies A/S, Stavanger, Norway.
Krueger, Joel, Smith, Duncan, 2003. A practical approach to re hazard analysis for
offshore structures. Journal of Hazardous Materials, 107122.
Magnussen B.F., B. Hjertager, 1976. On mathematical modeling of turbulent
combustion with special emphasis on soot formation and combustion. In:
Proceedings of the Sixteenth Symposium (International) on Combustion, Cam-
bridge, USA.
Magnussen, B.F., Evanger, T., Vembe, B.E., Lilleheie, N.I., Grimsmo, B., Velde, B.,
Holen, J., Linke, G., Genillon, P., Tonda, H., Elf., Blotto P., 2000. Kameleon FireEx
in safety applications. Soc. Pet. Eng. (SPE), 61451.
Magnussen B.F., 2005. The eddy dissipation concept a bridge between science and
technology. In: Proceedings of the ECCOMAS Thematic Conference on Compu-
tational Combustion, Lisbon.
NORSOK, 2001. Risk and Emergency Preparedness Analysis. NORSOK Standard Z-
013, Oslo, Norway.
Shah, N.G., 1979. Ph.D. Thesis. The Computation of Radiation Heat Transfer.
University of London, Faculty of Engineering, London, UK.
OGP, 2010. Process Release Frequencies, Risk Assessment Data Directory, Report
no. 4341.
Svio Vianna, Asmund Huser, 2010. Fire CFD Modelling Applied to Offshore Design,
Det Norske Veritas, FIRESEAT 2010, Norway.
Steel Construction Institute (SCI), 2009. Probabilistic Assessment of Fire loads and
Structure Response, FABIG Technical Note 11.
Trond, Evanger, Tore, Holmas, 2005. Kameleon Fireex an advanced computational
system for calculation of re structure interaction. FABIG (41), 1620.
USFOS, (2012). User's manual for USFOS, USFOS A/S, Norway.