Offshore Risk Assessment

An overview of
methods and tools

Vamanu, B.
Necci, A.
Tarantola S.
Krausmann, E.

2016
This publication is a Technical report by the Joint Research Centre (JRC), the European Commission’s science
and knowledge service. It aims to provide evidence-based scientific support to the European policymaking
process. The scientific output expressed does not imply a policy position of the European Commission. Neither
the European Commission nor any person acting on behalf of the Commission is responsible for the use that
might be made of this publication.

JRC Science Hub

https://ec.europa.eu/jrc

JRC104209

Ispra: European Commission, 2016

© European Union, 2016

The reuse of the document is authorised, provided the source is acknowledged and the original meaning or
message of the texts are not distorted. The European Commission shall not be held liable for any consequences
stemming from the reuse.

How to cite this report: Vamanu B., Necci A., Tarantola S., Krausmann E.; Offshore risk assessment - An
overview of methods and tools, European Commission, Ispra, 2016

All images © European Union 2016

Title Offshore risk assessment. An overview of methods and tools

Abstract
A solid familiarity with the basic principles of risk management and risk assessment, as well as with the most
widely used techniques, methods and tools, is a fundamental requirement on the Competent Authorities’ side in
the context of the requirements of the Offshore Safety Directive. This report introduces the topic, and offers an
illustration of one of the most important investigation techniques, the analysis of historical information.
Contents

Abstract ............................................................................................................... 3
1 Introduction ...................................................................................................... 4
2 Risk definitions .................................................................................................. 6
3 The Risk Assessment.......................................................................................... 7
3.1 General aspects ........................................................................................... 7
3.2 Types of risk assessment, selection of approach and level of detail .................... 8
3.3 The Risk Assessment Stages ....................................................................... 11
3.3.1 Establish the Context ......................................................................... 11
3.3.2 Hazard identification .......................................................................... 11
3.3.3 Frequency assessment ....................................................................... 12
3.3.4 Consequence assessment ................................................................... 13
3.3.5 Risk representation ............................................................................ 16
3.3.5.1 Risk matrix ................................................................................. 16
4 Risk assessment techniques .............................................................................. 19
4.1 The Hazard Identification Technique ............................................................. 19
4.2 Hazard review ........................................................................................... 19
4.3 The What-if Analysis .................................................................................. 20
4.4 The Checklist Analysis ................................................................................ 20
4.5 The Hazard and Operability (HAZOP) Analysis ............................................... 21
4.6 Failure Modes and Effects Analysis (FMEA) .................................................... 23
4.7 (Statistical) Analysis of Historical records ...................................................... 26
4.8 SWIFT ...................................................................................................... 28
4.9 Fault Tree analysis ..................................................................................... 30
4.10 Event Tree analysis .............................................................................. 32
4.11 CCFA – Common cause failure analysis ................................................... 34
4.12 Human Reliability Analysis .................................................................... 36
4.13 The Bow Tie Analysis ............................................................................ 37
5 Analysis of natural hazard impacts at offshore facilities ........................................ 40
5.1 The WOAD survey ...................................................................................... 40
5.2 Damage/failure mechanisms for natural-hazard impacts ................................. 44
5.2.1 Environmental actions and loads .......................................................... 44
5.2.2 Damage to fixed structures ................................................................. 47
5.2.3 Damage to floating structures ............................................................. 48
5.2.4 Storage and production facilities: FSU, FPSO and loading buoys .............. 49
5.2.5 Transport, towing and collision ............................................................ 50
5.2.6 Pipelines ........................................................................................... 50

i
 5.3 Fatalities, serious injuries and pollution ........................................................ 51
5.4 Offshore Accidents triggered by natural events in Europe................................ 54
5.4.1 The Mediteranean .............................................................................. 54
5.4.1.1 Natural Hazards ........................................................................... 54
5.4.1.2 Accident Analysis ......................................................................... 56
5.4.2 The North Sea and West Europe .......................................................... 56
5.4.2.1 The natural hazards ..................................................................... 56
5.4.2.2 The Accident Analysis ................................................................... 57
5.5 Wrapping-up and future work ...................................................................... 58
6 Conclusions .................................................................................................... 59
References ......................................................................................................... 61
List of figures ...................................................................................................... 65
List of tables ....................................................................................................... 66
Annexes ............................................................................................................. 67
Annex 1. Offshore NATECH accidents in European waters ..................................... 67

ii
Abstract
One of the main requirements of the Offshore Safety Directive (Directive 2013/30/EU) is
for the Member States’ offshore regulatory bodies and the operators and owners to
reduce the risks of major accidents in offshore operations as low as reasonably
practicable1. While the duty in managing the risks stays with the industry (i.e. the
offshore operators and owners), Member States’ regulatory bodies (i.e. the Competent
Authorities) also bare a great responsibility, having to assess the work of the former and
to decide whether or not the measures taken are sufficient for providing an adequate
level of risk. Therefore, a solid familiarity with the basic principles of risk management
and risk assessment, as well as with the most widely used techniques, methods and
tools, is a fundamental requirement on the Competent Authorities side.
Without aiming at being a comprehensive textbook, this report is an introduction in the
risk assessment with focus driven on the offshore specific aspects. The work does not
address the risk assessment professionals, being mainly oriented towards an audience
that needs to have a sufficient knowledge of the core (methodological and analytical)
concepts governing the offshore risk assessment, for effectively performing the day-to-
day activities.
In this line, a thorough literature and bibliographic research on various resources
(including, yet not limited to: offshore safety related regulatory documents, industry
standards, guidance and best-practices; and standard reference materials in safety
studies) have been performed to provide a content that would confer the reader sufficient
information for a fair positioning in respect to the subject at hand.
Even though the governing rules in risk assessment are the same as in the ‘generic’ case,
the oil and gas offshore risk assessment presents some particularities, born from the
specificity of these activities. This report addresses both these aspects: through the
general approach in risk assessment, the reader is introduced in the particular realm of
offshore risk assessment. The information provided (e.g. methods, models, analytical
tools) has been selected as to provide most relevance in the offshore safety business.
This work has been performed within the context of the JRC Institutional Project SAFE-
OIL between Units C.3. and E.2.

1
the point (from) where the cost of further risk reduction would be grossly disproportionate to the benefits of
such reduction (OSD, Preamble (14))

3
1 Introduction

The offshore Oil & Gas Industry is very important to the EU economy. Sixteen 2 EU
Member States are involved in the Industry, and offshore exploration and production
activities are carried out in a five of the EU geographical areas3.
After the Deepwater Horizon accident in 2010, the need for legislation at the EU level on
safety in the offshore oil and gas sector became evident. For this purpose, in June 2013,
the European Parliament and the Council officially adopted Directive 2013/30/EU (or
Offshore Safety Directive, OSD) on “safety of offshore oil and gas operations and
amending Directive 2004/35/CE”.
The core objective of the OSD is ‘(to reduce) as far as possible the occurrence of major
accidents (…) and to limit their consequences’ (OSD, 2013) in the offshore oil and gas
operations. The solution adopted is providing a regulatory framework that, upon being
transposed in the National legislations, and, in conjunction with the industry safety
practices would be conducive to:
1. An unified approach to the safety of the offshore oil and gas operations throughout
the EU;
2. A minimum level of risks (to people, assets and environment) of these activities.
The OSD aims to reducing the risks of major accidents in the offshore operations as low
as reasonably practicable4. While the duty in reducing the risks stays with the operators
and owners, Member States’ regulatory bodies (the Competent Authorities) also bare a
great responsibility, having to assess the work of the operators and owners and to decide
whether or not the measures taken by the later are sufficient for providing an adequate
level of risks.
Naturally, within this context, a solid familiarity with the basic principles of risk
management and risk assessment, as well as with with the most widely used techniques,
methods and tools, is a fundamental requirement on the Competent Authorities side.
This is what this report addresses. Without having the objective of being a
comprehensive textbook, this report is an introduction in the risk assessment with focus
driven on the offshore specific aspects. The authors’ intention is to provide a content that
would confer the reader sufficient information for a fair positioning in respect to the
offshore risk assessment.
The report is mainly the result of a thorough literature and bibliographic research on
various offshore safety related regulatory documents in relevant countries (e.g. U.S, U.K,
Norway, Denmark, Australia) and from various industry standards, guidance and best-
practice documents (e.g. NORSOK, API, etc.). Other well-known reference documents
(e.g. TNO colored books5) have been reviewed when introducing the methods and
models for addressing particular analytical aspects in risk assessment (such as
frequency/probability and consequence assessment). Lastly, this report is also based on
the authors’ experience in the risk assessment problematique.
One remark should be made from the beginning: the OSD addresses the accident risks.
This observation is relevant since assessing the risks of a system during normal operation
and assessing the accident risks are two distinct topics in safety assessment, each with
different characteristics and requiring different analytical tools (especially for
consequence assessment, see for example the acute intoxication vs. long-term exposure

2
BG, HR, CY, DK, FR, DE, GR, IRE, IT, MT, NL, PL, PT, RO, ES, UK
3
The North Sea, the Mediterranean Sea, the Baltic Sea, the Black Sea, and the Atlantic Ocean
4
i.e. the point (from) where the cost of further risk reduction would be grossly disproportionate to the benefits
of such reduction (OSD, Preamble (14))
5
More at: https://www.tno.nl/en/focus-area/urbanisation/environment-sustainability/public-safety/the-
coloured-books-yellow-green-purple-red/

4
models). This observation is also important in the context of this document, as it allows
us to position ourselves in terms of the subjects covered next.
It is worth mentioning here the definition of major accident, as provided in the OSD. In
Article 2, Major Accidents are defined as:
a. an incident involving an explosion, fire, loss of well control, or release of oil, gas
or dangerous substances involving, or with a significant potential to cause,
fatalities or serious personal injury;
b. an incident leading to serious damage to the installation or connected
infrastructure involving, or with a significant potential to cause, fatalities or
serious personal injury;
c. any other incident leading to fatalities or serious injury to five or more persons
who are on the offshore installation where the source of danger occurs or who are
engaged in an offshore oil and gas operation in connection with the installation or
connected infrastructure; or
d. any major environmental incident resulting from incidents referred to in points
(a), (b) and (c).
e. for the purposes of determining whether an incident constitutes a major accident
under points (a), (b) or (d), an installation that is normally unattended shall be
considered attended.
From the above one may see that the OSD is focused on the technological, process and
(risk) management aspects of the offshore activities, the failure of which would
(potentially) result in a significant health and environmental impact. The declared
objective is providing an adequate level of safety for:
— People
— Asset
— Environment
At a closer look one may see that the overall objectives are not disjoined. Indeed, one
cannot sufficiently protect the asset (installation) without protecting the people on board
that installation; moreover, the safety of the people on an installation is directly
depending on the integrity of that particular installation. The same happens in respect to
the relationship between the asset and the environment, since the impairment of an
installation may result in a major impact on the environment.

The content of the report goes as follows: the main definitions in respect to risk adopted
in this document are given in Chapter 2.
The document continues with the overview of the generic risk assessment process, given
in Chapter 3. The key concepts are introduced together with each of the phases of the
risk assessment detailed.
Chapter 4 contains a collection of the risk assessment techniques identified as most
indicated in the offshore oil and gas safety guidance documents. The selection is based
on the information provided in various industry and regulatory document on this subject.
Topics such as the suitability of the techniques for addressing different issues or the
strong and weak points of the approach are addressed for each.
The report concludes with the Chapter 5, dedicated to the importance of the analysis of
previous accidents in drawing upon lessons learned and thus minimizing the risks in the
offshore industry. The chapter is an illustration of the aforementioned and consists on an
analysis performed on the WOAD 6 in respect to the natural and technological (Natech)
risks.

6
World Offshore Accident Database

5
2 Risk definitions
Despite an already prestigious history of more than 50 years, there is still a certain level
of confusion in respect to the terminology used in risk assessment. The use of different
terminology when referring to the same process is conclusive in effect to a sense of
confusion, reluctance and, to the extreme, distrust within the industry and regulatory
practitioners.
For preventing such shortcomings, a set of key terms together with the respective
definitions is provided next. The following list would also facilitate the further reading by
providing a unified terminology throughout the rest of this document.
Hazards or Threats
The hazards or threats are the conditions which exist which may potentially lead to an
undesirable event (ABS, 2000).
Controls
The controls are the measures taken to prevent hazards from causing the undesirable
event. The controls can be physical (e.g. safety shutdowns, redundant controls,
conservative design, etc.) or procedural (i.e. written operating procedures, best-
practices, etc.). The controls can address both technical factors and the human factors
(e.g. selection procedure, trainings, supervision, etc.)
Event
The event is an occurrence that has as associated outcome. The number of the potential
outcomes of a specific event can vary and depends upon the event characteristics, its
severity, the conditions in which it occurs and other other add-on events.
Risk
The risk is defined as the product of the frequency with which an event is anticipated to
occur and the consequence of the event’s outcome.
With the definition of risk, two more terms have been introduced, as follows.
Frequency
The frequency of a potential undesirable event is expressed as events per unit time
(usually per year). Usually, the frequency of an event is computed from historical data.
In cases when data is not available, or it is irrelevant from a statistical point of view
(situation that occurs mainly when addressing high consequence low frequency risks),
the frequency is determined using risk assessment models.
When missing the unit time, frequency turns into (frequentist) probability. The
frequentist probability is the interpretation of probability as ‘the long run frequency of
occurrence of an event as estimated by the historical observation’ (DHS, 2010).
Consequence
The Consequence can be expressed as the number of people affected (injured or killed),
property damaged, amount of spill, area affected, outage time, mission delay, dollars
lost, etc. Regardless of the measure chosen, the consequences are expressed in ‘per
event’. Using this expression in the risk equation one gets the risk expressed in
“consequences/year”, which is the most typical quantitative risk measure.

6
3 The Risk Assessment

3.1 General aspects

Risk assessment is the fundamental component of the risk management process. When
looking at the definition of risk management (i.e., according to DHS, ‘(the) process of
identifying, analysing, assessing, and communicating risk and accepting, avoiding,
transferring or controlling it to an acceptable level considering associated costs and
benefits of any actions taken’ (DHS, 2010) one may notice that the foundation for a
sound decision making is given by identifying, analysing, assessing and communicating
the risks. And these are, in fact, the pillars of the risk assessment.

Figure 1. Risk assessment in the risk management context

A more formal definition of risk assessment is provided by ABS and it goes like: ‘(r)isk
assessment is the process of gathering data and synthesizing information to develop an
understanding of the risk of a particular enterprise.’ (ABS, 2000) Moving further on this
definition, the same document sets up the main objective of the risk assessment process,
which is providing the answers to the following questions:
1. What can go wrong?
2. How likely is it?
3. What are the impacts?
Naturally, to be able to cope with these challenges, one needs some well established
procedures on the one hand, and a set of (analytical) tools that, when properly used,
would provide (with enough confidence) the answers to the questions at hand.
Over the last half century risk assessment has been intensively used in industry and
finance. Historically, risk assessment originates in the nuclear sector [Rasmussen, 1975].
The concepts addressed there were soon embraced by other sectors and, as a natural
consequence, has been adapted to match the specific needs of that particular enterprise.

7
This document will cover the procedures and tools identified as the most adopted (by the
industry), accepted and recommended (by the regulatory bodies) in the particular field of
offshore oil and gas operations.
The process of risk assessment comprises four main stages:
— establish the context (see the observation below)
— hazard identification - HAZID (also referred to as risks identification);
— risk analysis which, covers:
● Frequency assessment – the analysis of the (potential) initiating events and the
frequency of occurence;
● Consequence assessment – the analysis of the (potential) consequences;
— establishing the level of risk (risk picture (NORSOK Z-013, 2010))
— Risk evaluation
It should be mentioned that, in some sources, the first phase in the list above (i.e.
establish the context) might fall outside the process of risk assessment. The NORSOK
Standard Z-013 (2010) for instance is one case in which this phase is an integral part of
the risk assessment. The HSE or ABS approaches (see e.g. HSE (2006), ABS (2000)) is
the opposite example. Due to its utmost importance in the outcome of the risk
assessment, we have chosen to include this stage in the risk assessment process.

3.2 Types of risk assessment, selection of approach and level of

detail
Risk assessment can be applied in approaches described as Qualitative, Semi-
Quantitative and Quantitative. The complexity and resource requirements dramatically
increase from the qualitative to the quantitative assessment. It is also valid that, within
the same approach, the level of detail of the analysis may vary, depending on the drivers
of the assessment. The task of deciding which is the right approach stays with the project
manager and depends on many factors; among these, the most important drivers are
(Det Norske Veritas, 2002):
— the lifecycle stage of the facility, due to:
● greater or lesser flexibility in terms of design changes;
● availability of historical data;
● level of knowledge in respect to the design and operational details.
Naturally, fewer the information, the coarser models adopted.
— the major hazard potential – the greater the potential impact, the greater the need
for thorough assessment.
— the risk decision context – more novelty will push to a more thorough risk
assessment.
The basic aim is risk reduction and the key test is one of reasonable practicability.
The different stages of the lifecycle offer different opportunities for risk assessment, and
hence the approach may be different in each. It is a general agreement within the
offshore risk practitioners and regulators in terms of complexity of the assessment in
different stages in the lifespan of a project, that could be summarized like in Table 1
(adapted from Det Norske Veritas, (2002)):

8
Table 1. Risk assessment characteristics throughout the lifespan of a project

Life cycle phase Characteristics of risk assessment

Feasibility study — relatively simple;

and concept
— broad in scope;
selection
— address the complete lifecycle

Concept / front-end — based on historic data;

design
— make use of reference designs;
— make use of lessons learned;

Detailed design — specific scope;

— the most complex and thorough assessment;
— used to:
● check wheter the safety levels are acceptable;
● evaluate additional safety measures;
● advise on major procedural safeguards

Operation — based on practical experience;

— part of the ongoing risk management of the installation;
— small amendments to detailed design risk assessment
findings.

Abandonment — review of the specific assessment performed during the design

phase;
— focus on the environmental aspects of the abandonment;
— thorough assessment on the issues identified as critical /
sensitive(i)
(i) for mature, standard concepts, the use of qualitative methods is, in most of the cases, sufficient; for novel
approaches, however, the thorough quantitative assessment on major risks reduction measures is
essential.
Source: Det Norske Veritas, (2002) (excerpt)

The level of information required for a proper assessment also varies widely depending
on the process/system analysed, the potential impact of the hazard, and the prior know-
how and best-practices used when addressing a particular risk. Sometimes a screening
process is sufficient to provide a sound risk evaluation; other times, the level of detail
(granularity) required by the analysis increases dramatically in order to have meaningful
results as valuable input for the risk evaluation phase.
The same statement is also valid in terms of the methods used for the assessment: while
the use qualitative methods are sufficient to address the frequency and consequences of
some hazards, the more detailed, in-depth quantitative methods are required when
addressing the ‘high risks’ hazards. Moreover, the selection of the quantitative or
qualitative methods also depends on the current phase in the assessment. While the
qualitative methods are recommended in the early phases (such as hazard identification,
identification of initial events, identification of the possible effects) the quantitative
methods are better suited as the analysis requirements grow of in terms of complexity
and granularity (Figure 2).

9
 Figure 2. Quantitative vs qualitative methods selection

The choice of the proper methods and tools suitable for the situation at hand is the key
element for a meaningful risk analysis (ABS, 2000). For emphasizing the importance of
this aspect, some sources consider that the selection of the methods, together with the
definition of the models, represents itself a risk to be addressed when dealing with the
assessment of complex and ‘high risks’ systems (Coca et. al, 2014).

Figure 3. Possible screening process for determining the appropriate assessment level

Source: HSE (2006)

The choice of the qualitative over the quantitative methods, of the level of complexity of
the models and the granularity of the assessment is, in the end, driven by the need of
valuable information for a solid decision making. The basic philosophy could be
summarized as follows: only increase the complexity of the assessment if the current

10
results are not sufficient or are not adequate for deciding. This is a screening process
that can be summarized as (HSE, 2006):
— start with the qualitative approach;
— if the current level of detail cannot offer any of the following:
● the required understanding of risks;
● discrimination between the risks of different events or
● assistance in deciding whether more needs to be done
— increase the detail and/or complexity of the analysis (Figure 3).
It is worth mentioning at this point that many of the methods and analytical tools are
shared between different phases of the assessment. One example is the fault tree
analysis, which can be employed in both frequency and consequence assessment. When,
further in this document, we will review the analysis methods we will also mention the
applicability of a specific method in the different risk assessment phases.
Each of the assessment phases presented before has its own requirements and
particularities. We will review next some of the key aspects that are shared among the
reference industry and regulatory documents on the subject (e.g. ABS (2000), Det
Norske Veritas (2002), NORSOK Z-013 (2010)), in respect to the objectives, content and
processes employed in each.

3.3 The Risk Assessment Stages

3.3.1 Establish the Context

The main objective in this phase is to establish the basic parameters of the risk
assessment process and to set the scope and the acceptance criteria for the rest of the
process. This phase should encompass the following:
- the definition of the main objectives of the current risk assessment;
- definition of the analysed system and system boundaries;
- the definition of the scope of the assessment;
- identification and definition of the methods, models and tools employed in the
assessment; and
- definition of the risk acceptance criteria to be used.
Setting up the context ensures that the subsequent process will be suitable with respect
to its intended objectives and purpose, properly tailored to the system of interest, and at
a sufficient level of detail that would produce effective and meaningful results for the
decision-making process (NORSOK Z-013, 2010).

3.3.2 Hazard identification

Hazard identification is the thorough examination of the process to identify the hazards,
the sources of hazard and to perform a preliminary prioritization in terms of severity. The
outcomes of this phase are (Det Norske Veritas, 2002):
1. a list of hazards for the subsequent evaluations using other risk assessment
techniques (failure selection);
2. the qualitative evaluation of the significance of the hazards and the measures for
reducing the risks from them (hazard assessment).
This phase is critical in the context of the risk management since an overlooked hazard
(hence, risk) cannot be further assessed and controlled.
Hazard identification is a structured process itself. As a generic practice, the following
phases should be addressed:

11
 1. a broad review of all the possible hazards and sources of accident;
2. the rough identification of the possible consequences (outcomes) of each of the
hazards;
3. a rough classification into critical / non-critical hazards;
4. identification of the control measures addressing the specific hazards (e.g.
inherent safer design, possible design improvements, etc.)
5. prioritization of hazards in respect to criticality; identify which of the hazards
require further evaluation; establish the level of detail and the type (e.g.
qualitative or quantitative) of the assessment.
Most of the methods employed in hazard identification are qualitative. The methods
involve expert judgement, brainstorming and a solid knowledge of the infrastructure
and/or processes addressed. To be noted the ‘linguistic’ confusion that may be created
when referring to the qualitative term. A qualitative technique may include the use of
numerical data in the determination of the results.
The HAZID must be a creative process, so as to encourage the identification of all
possible hazards (Det Norske Veritas, 2012); moreover, it should make use (where
available) of accident experience and lessons learned.
There are many techniques that can be employed during the hazard identification phase.
Several of them, standing out as being recommended by the offshore industry and/or
regulatory guidance documents make the subject of Chapter 4. These are:
- Safety Review
- The Hazard Identification technique – HAZID
- The Hazard Review
- Preliminary Hazard Analysis
- What-if Analysis
- Checklist Analysis
- Hazard and Operability Analysis – HAZOP
- Failure Modes and Effects Analysis – FMEA
- Fault Tree Analysis - FTA
- Event Tree Analysis - ETA
It is worth mentioning that the applicability of the methods depends on the subject of the
assessment (installation, process, hardware, software, etc.). Moreover, from the
perspective of completeness, it should be ensured that the most important undesired
consequences have been considered in the identification of the hazards. Completeness
depends on the selection of identification techniques and how well the hazards are
known.
For existing technologies, hazard identification heavily relies on previous experience and
studies and, in this case, a simple identification technique may suffice to recognize the
hazards. For new technologies, however, a more thorough analysis should be employed
(such as HAZOP) to confer sufficient confidence that all the hazards have been identified.

3.3.3 Frequency assessment

The objective of frequency assessment is to characterize the hazards (identified in the
previous phase of OSRA) in terms of likelihood of occurrence.
ISO 31010 states that:
— many abnormal events7 may have a range of outcomes with different associated
probability; moreover,

7
risk event in the ISO 31010 terminology.

12
— (in risk assessment) ‘…the probability relevant to the selected consequences is used
and not the probability of the event as a whole.’
Building on that, we may augment the objective of frequency assessment as follows: the
role of this analysis is to provide an estimation of the likelihood of an initial abnormal
(hazardous) event, the possible outcome(s), and the frequency of its outcome(s).
The degree of detail of the analysis depends on the type of risk assessment: in case of a
quantitative assessment, a high-level of detail and the use of data from statistics is
required; less details are required for qualitative assessments (IPIECA/IOGP, 2013).
The analysis methods employed during this phase can be classified as inductive and
deductive. A deductive technique answers to the question how did the system get here,
while inductive technique responds to the question what happens to the system if…?
The inductive techniques postulate on an initial fault or condition and assert the possible
effects of the this on system’s state or operation.
The deductive techniques postulate that the system is already in a failure state (i.e.,
LOC has occurred) and the effort is driven towards finding out the possible causes and
(human) behaviours that might have contributed to the current state of the system.
Among the most frequent methods used in this phase are:
— Historical failures and accidents frequency data;
— Fault Tree Analysis (FTA);
— Event Tree Analysis (ETA);
— Human reliability analysis;
— Common cause failure analysis
The selection of the level of detail and tools for frequency assessment strongly depends
on the lifecycle phase of the offshore project. During project planning, the qualitative
assessment is sufficient, due to the high level of uncertainties and limited data at this
stage. During the project execution, the quantitative assessment is required; moreover,
more reliable information is available, thus facilitating this type of analysis. The
qualitative approach is taken during the operational and decommissioning phases, this
time because the thorough results of the assessment are available from the project
execution phase.
For offshore facilities, the same remarks are valid. Moreover, depending on the novelty of
the installation (technologies, layout, design), the qualitative assessment ponder
increases for existing technologies, while the quantitative assessment stays with the new
ones.
From the above we may state that in the offshore case, frequency assessment is
performed in a qualitative or semi-qualitative form in most of the cases. For most
situations, it is recommended the assessment to be grounded on the historical frequency
of events and available statistical data relevant (Oil & Gas UK, 2012).

3.3.4 Consequence assessment

In OSRA, consequence assessment mainly addresses the evaluation (qualitative or
quantitative) of the level of impact on people, assets and environment of a loss of
containment event. The process heavily relies on modelling for describing the release
phenomena and the credible physical outcomes of a loss of containment event.
Loss of containment may happen in different ways and with different outcomes. This
depends on various factors such as the type of the release, the location, the weather, the
release medium, the physical and chemical properties of the released substance, the
release form of the substance, etc. Figure 4 depicts the physical and consequence
phenomena in a generic case of a hazardous substance loss of containment release.

13
The main subjects of interest in this phase are:
— release of gas in atmosphere, which can lead to fires, explosion (due to the formation
of explosive vapour cloud) or concentrations exceeding different threshold values
(e.g. IDLH, TLV, STEL); the effects of such releases are acute toxicity, thermal effects
and explosion (blast and fragment);
— release of oil which can lead to fires (pool formation) or spreading and/or pollution of
the environment.
From the above, we may draw upon the main categories of analytical models employed
in this phase. These are:
- Source term models;
- Atmospheric dispersion models
- Blast and thermal radiation models
- Aquatic transport models
- Effect models
- Mitigation models
Since the phenomenology and the physics of the release is the same, many of these are
generic models (can be applied for a given task, irrespective of the industry-specific
characteristics). The selection of this models must, however, be carefully performed to
ensure the applicability for the analysed scenario.

Figure 4. Consequence Phenomena and their relationship

Source: IOGP (2010)

The models should address the possible outcomes and the effects of a loss of
containment initial event. In particular, the following consequences must be considered:

14
 1. Release / discharge – the way the pollutant gets into the environment and the
physical characteristics of the release (e.g. rate of release, duration, physical
form, etc.)
Used to create the source term for the other type of the models (see e.g. TNO
Yellow Book (van den Bosch, 2005))
2. Dispersion in air – huge literature and solid history; all models address solving the
advection-dispersion equation.
- complexity may vary from the ‘simplest’ (e.g. Gaussian plume) models to
computational fluid dynamics (CFD)
- in the offshore safety, the CFD models play a key role, being used to obtain
numerical solutions for ventilation, dispersion and explosion problems (OGP,
2010). Due to the specificities of the offshore operations the Gaussian models
may not be appropriate for being applied.
- selection of the models depends on factors such as:
o type of release (continuous vs. instantaneous)
o duration of release
o quantity of the released pollutant which, in turn, determines the scale of
the potential effects
o physical characteristics of the pollutant (e.g. buoyancy)
o the availability of input data (especially for the CFD models)
- the relevant outcomes are:
o the concentration of pollutant in air as function of distance
o the area affected
3. Dispersion in water – more complex analytically
- computational fluid dynamics
- release point (depth)
- release location (e.g. estuaries)
- the characteristics of the marine environment (e.g. currents)
- the tidal regime
4. Fire and thermal radiation
These models should be used to evaluate the impact of the different type of fires
on humans/infrastructure; the following type of fires are addressed: pool, BLEVE,
jet, flare, flash. As valuable reference, please consult the TNO Yellow and Green
Books (van den Bosch (1992), van den Bosch (2005))

- the main outcome of the computation is the heat load as function of distance;
- in turn, using probit functions, the effects on humans (lethality percentage) can
be calculated; the probit coefficients are provided in literature for lethality due to
1st, 2nd and 3rd degree (see the TNO Yellow Book (van den Bosch, 2005)).
5. Explosion
- two main classes: (1) vapor cloud explosion and (2) overpressure and projectiles
effects.
6. Smoke and gas ingress;
7. Toxicity - the concentration in air is subsequently used in determining the health
effects in terms of toxicity. The process involves computing the chemical dose
which, using probit functions can estimate the lethality percentage of the exposed
individuals.
The activities employed in the consequence assessment phase may summarized as:
1. Characterize the material or energy associated with the hazard being analysed;
2. Estimate (using models and correlations) the transport of the material and/or the
propagation of the energy in the environment to the target of interest (people,
structure, etc.);

15
 3. Identify the effects of the propagation of energy or material on the target of
interest;
4. Quantifying the health, safety, environmental, or economic impacts (depending on
the target of interest).
The main results from the consequence assessment step are:
- an estimation of the statistically expected exposure of the target population;
- the safety/health effects related to that level of exposure;
- the impact on structures;
- the environmental impact.

3.3.5 Risk representation

Risk representation mainly deals with putting together the results obtained so far in the
risk assessment (frequency and consequences) in a format easy to be communicated and
relevant in the decision-making process.
The most frequently encountered methods for risk representation are:
— Risk matrix;
— F-N curve;
— Risk profile;
— Risk isopleth
— Risk index
Within the context of this document, we will only present the Risk Matrix, as it stands out
as the most frequently used risk representation and communication method.

3.3.5.1 Risk matrix

Risk matrices are probably the most common approach used for representing and
communicating the risk assessment results.
The risk matrix is a way of graphically put together the consequences and the
frequencies of a hazard event to provide an integrated description of risk.
The main use of the risk matrices is to deliver an expression of the size of the risks.
Hence, a risk matrix allows the analyst to rank the risks in order of significance, screen
out the insignificant ones and evaluate the need of further risk reduction/preventions
measures to be taken in case of various hazards.
A risk matrix has two dimensions: consequence (also known as severity) and frequency
(also known as likelihood or probability). Within the space defined by these dimensions,
three areas are delimited, namely (Figure 5):
— the green area, corresponding to the low-probability, low-consequence;
— the yellow area, corresponding to the medium-probability, medium-consequences;
and
— the red area, corresponding to the high-probability, high-consequences.

16
 Figure 5. Typical risk matrix structure and acceptance areas

Each of dimensions of the matrix is divided into several categories (typically between 3
and 6). Each of the hazardous events identified in the hazard identification phase is
placed on one of these positions, based on the results of the frequency and consequence
assessment phases. The value of the risk are not absolute, but relative: low, medium and
high risk are chosen on the bases of acceptability criteria, that express the tolerable risk
of a given contest. For this reason, the position of an event in the risk matrix should be
interpreted as:
— event in the green zone – the risk of the occurrence of the event is acceptable, and
no risk reduction/mitigation actions are required; the risk must however be part of
the continuous risk management process, for further reduction;
— event in the yellow zone – the risk should be monitored, yet at the current moment it
is controlled as low as reasonable practicable (ALARP);
— event in the red zone – the risk is intolerable and risk reduction/mitigation actions
must be put into place.
There is little standardization in terms of the layout, the size, labelling, definition of the
qualitative levels, or sorting the categories for a risk matrix. Several approaches are
however more and more adopted, such as the ISO 17776 and the Defence Standard8
(UK) or MIL-STD-882D9 (US) matrices.
The strengths of the risk matrix are:
— easy to apply;
— easy to understand;
— widely accepted and thus, a powerful risk communication tool;
— allows risks to people, environment, assets and business to be treated consistently
(ISO 17776);
— allows prioritization of the hazards, hence supporting the risk reduction effort.
On the weaknesses side is that risk matrix ignores the risk accumulation. This comes
from the fact that a risk matrix addresses one hazards one at a time. Thus, this may lead
to the situation in which the potential accumulation of smaller risks resulting in a total
unacceptable risk is not addressed.

8
Defence Standard 00-56 “Safety Management Requirements for Defence Systems Part 1: Requirements”
(1996)
9
MIL-STD-882D, Standard practice for system safety, Department of Defense (10 February 2010)

17
 Figure 6. Example of risk matrix (5x6) with the level of impacts declared.

This concludes the overview of the risk assessment process. In the next section, several
techniques mentioned throughout this chapter will be detailed. Without being exhaustive,
the selection was made based on the frequency of the indication of the respective
methods in the industry and regulatory documents reviewed.

18
4 Risk assessment techniques

4.1 The Hazard Identification Technique

Used in: hazard identification
According to ABS, HAZID is ‘a general term used to describe an exercise whose goal is to
identify hazards and associated events that have the potential to result in significant
consequence’ (ABS, 2000).
For an offshore installation HAZID is conducted to identify the potential hazards that
could lead to the impairment of personnel (injuries and fatalities), environment (oil spills)
and financial assets. HAZID technique is also used for assessing various operational
procedures. Once identified, the hazards are ranked in terms of criticality and prioritize
for further evaluation in subsequent phases of the assessment.
This technique can be applied on different scales. Depending on the size of the system
assessed and the available resources, HAZID can be performed by a single analyst or by
a team. If latter the case, the system is usually divided in separate parts, and the team
is conducted through a series of brainstorming sessions to identify the potential hazards
associated with each part being evaluated.
Hazard identification involves having a solid knowledge of the system analysed. For an
installation for instance, the design and operation of that particular facility is essential in
having proper results at the outcome of this process.

4.2 Hazard review

Used in: hazard identification
One of the most used HAZID techniques for MODUs (Ambion, 1997), this technique
consists in a qualitative review of an installation to identify the hazards that are present
and to gain understanding of their significance.
The technique mainly relies on reviewing the already existing information and
documentation in respect to a given installation (for an existing installation) or specific
for a particular type of installation (if in design phase).
Relevant information sources in this phase comprise (yet not limited to): previous safety
assessments; previous accidents/incidents reports on similar installations; previous
experience of personnel and visual inspections of an existing installation; hazardous
materials data; conformance with good engineering practice and classification rules.
Due to its simplicity and minimum effort required, hazard review is an appropriate
starting point for hazard identification, yet cannot stand itself as sufficient for a solid risk
assessment process.
Among the strengths of hazard review are (Det Norske Veritas, 2002):
— it can be performed by a single analyst;
— low cost;
— makes use of experience from a variety of sources;
— requires minimal information about the installation.
Its weaknesses are:
— the lack of structure that makes it difficult to audit;
— it is limited to previous experience, thus having limited value in case of novel
systems;
— it does not produce a list of failure cases to be used in the subsequent risk
assessment phases.

19
4.3 The What-if Analysis
Used in: hazard identification
The What-if analysis technique is a loosely structured, brainstorming approach in which a
group of experienced people voice concerns about possible undesired events.
The what-if analysis:
— postulates the potential disruptions that may lead to accidents or abnormal system
performances; and
— ensures that the protective measures / safeguards against the disruptions are in
place.
The range of applicability of this technique is vast, potentially being used for any offshore
system and / or activity. Moreover, due to its flexibility, the What-if technique can be
applied in any stage in the process life-cycle, using whatever information and knowledge
is available (Schuller, 1997).
The use of the what-if analysis is however recommended to be mainly limited to systems
/ activities with relatively simple failure scenarios (ABS, 2000).
What-if analysis is a team effort. The analysis implies brainstorming sessions performed
by a team of experts with expertise in various fields, whose output is a comprehensive
review of the potential problems, the (ultimate) consequences and the available
safeguards against the identified problems, and recommendations for preventing them.
(Figure 7)

Figure 7. What-if analysis output example

Source: ABS (2000)

Due to its loose structure, the what-if is rarely used alone, most of the time
accompanying or being part of other, more structured techniques (especially checklist
analysis).

4.4 The Checklist Analysis

Used in: hazard identification

20
API defines checklist analysis as a systematic evaluation against a predefined set of
criteria (ABS, 2000). In practice, this method comprises a list of written questions that
address a full range of safety issues in respect to the system/process analysed.
Checklist analysis makes intensively use of previous experience and best practice in
respect to the analysed system. Previous risk assessments and the experience gained
from previous accidents are the foundation on which this method relies. This method’s
strength is given by its ability to prevent past accidents, and / or identify design flaws
that would pose a risk to the analysed system.
This characteristic of the method makes it best suitable in design phase. The use of
checklists allows the analyst to verify a project against existing solutions and confirm
that good practice is incorporated. The (almost exclusive) use of historical information
and knowledge is, however, a shortcoming of this method. Checklist analysis is unable to
identify new hazards and / or novel accidents. For this reason, checklist analysis is
frequently used as a supplement of another method (especially the what-if analysis (ABS,
2000)).
The American Petroleum Institute (API) has developed a range of checklists for offshore
activities, mainly addressing process and drilling risks (eg. API 14C, 14E, 14F, 14G, 14J)
and a safety and environment management checklist in API RP75. This is consistent to
the American prescriptive posture adopted by the regulatory bodies in the US in respect
to risk management. Figure 8 reproduces an excerpt checklist analysis of a vessel’s
compressed air system, as provided by ABS (2000).

Figure 8. Checklist analysis output example

Source: ABS (2000)

Other types of checklists that are widely used in the offshore risk assessment are the
generic hazards checklists (Det Norske Veritas, 2002). Unlike other types, these lists
provide support for further risk assessment and are not oriented towards decision making
in respect to the design of the system.

4.5 The Hazard and Operability (HAZOP) Analysis

Used in: hazard identification
The Hazard and Operability analysis (HAZOP) was developed to identify and evaluate the
safety hazards in a process system and to identify potential operability problems that,

21
without representing a hazard per se, may affect system’s capability of operating as
designed. The HAZOP is suitable for the identification of safety hazards and operability
problems of continuous process systems. This is a key characteristic that makes it both:
— one of the most commonly used HAZID technique in the offshore industry when
addressing process risks; and
— not suitable for other risks (e.g. marine risk assessment)
The HAZOP Analysis allows identifying hazards that might affect the safety and
operability of a system based on the use of guidewords describing the potential
deviations from the design intend.
The HAZOP requires a team of experts in various fields, conducted by an experienced
team leader, who’s knowledge of the system and the processes is at a very high level.
The leader guides the team through the analysed process by applying the guidewords to
specific points in the system. The guidewords are created by applying a predefined set of
adjectives (i.e. high, low, no, etc.) to a pre-defined set of process parameters (flow,
pressure, composition, etc.), characteristic to the analysed point. The team
systematically brainstorm over the causes and consequences of each of the identified
deviation and, if a legitimate concern is identified, they ensure that appropriate
safeguards are in place to help prevent the deviation from occurring (ABS, 2000)
(Schuller, 1997). Recommendations on additional safeguards are also provided, if
required.
The conclusions of each session are recorded in a standard format (Figure 9).

Figure 9. HAZOP analysis example

Source: ABS (2000)

Summing up, a HAZOP process can be sketched as follows:

— identify the deviations from the design by applying guidewords to different points in
the analysed system;
— investigate the causes, the consequences and the potential mitigation factors for each
of the identified deviations.
— recommend follow-up actions that would reduce the risks, if necessary.

22
From the above one may see that the HAZOP analysis represents a powerful tool that
allows both prevention and mitigation actions to be carried out for ensuring an
acceptable level of risks (hence, safety).
Among the advantages of this technique one finds (Det Norske Veritas, 2002):
- it is a highly systematic process;
- it is widely used;
- its advantages and disadvantages are well known;
- it uses the experience of operating personnel as part of the team;
- it is comprehensive and should lead to the identification of all the process
deviation resulting hazards;
- it is effective in identifying both technological faults and human errors;
- it recognizes existing safeguards;
- it recommends additional safeguards, if required.
The main weaknesses of the method are:
- it is developed for process hazards;
- requires modifications for addressing other types of hazards;
- its success depends on the leader capabilities and the level of expertise of the
team;
- the final documentation is lengthy.
Usage in offshore industry:
- standard tool for process plant design;
- the procedural HAZOP is widely used for HAZID assessment for EER in case of
combined operations.
It is important to stress out that the HAZOP is designed to be applied to hazard
identification in (continuous) process systems. The HAZOP technique can be modified10 to
accommodate non-process hazards, yet ad hoc modifications are not recommended since
they could easily lead to overlooking a series of hazards (Det Norske Veritas, 2002).
There are, however, standard modifications that address non-process hazards. The
drillers’ HAZOP for HAZID of offshore operations (Comer et.al, 1986) and EER HAZOP for
HAZID of evacuation, escape and rescue are two examples of such standards.

Detailed description of the HAZOP technique (including team selection and composition,
timing, the detailed process, etc.) is provided in the referenced documents. Among
these, the TNO Red Book (Schuller, 1997) is highly recommended.

4.6 Failure Modes and Effects Analysis (FMEA)

Used in: hazard identification
The Failure Modes and Effects Analysis (FMEA) is an inductive reasoning technique that
has been developed to help in evaluating the ways an equipment can fail and the effects
of the failure on the analysed system.
This technique was firstly developed in 1960’s in the aeronautical field and, for a period,
it has been specific to aeronautics, aerospace, and nuclear engineering. The uses were
later extended to the chemical industry and other industrial sectors (Ericson, 2005).
The FMEA technique:
1. considers how the failure mode of each system component can result in system
performance problems; and
2. ensures that appropriate safeguards against such problems are in place.
10
i.e. changes in the list of the guidewords.

23
The analysis uses a form that contains the list of all components in the system, and
typically includes:
— Component name.
— Component function.
— Possible failure modes.
— Causes of failure.
— Indications (how failures are detected).
— Effects of failure (local, system).
— Safeguards.
If required, the forms may also contain in a qualitative or quantitative form the failure
frequency and/or consequence estimations (ABS, 2000):
— Rating of frequency.
— Rating of severity (i.e. consequence).
In this case, this method is referred to as FMECA (Failure Modes and Effects and
Criticality Analysis).

Figure 10. FMEA output example

Source: ABS (2000)

FMEA can be applied to any well-described system. Its primary applicability, however, is
in the review of the hardware (mechanical and electrical) systems (ABS, 2000). In the
same line, FMEA is best suited for systems for which the danger comes from (the failure
of) the hardware, as opposed to the dynamics of the process (Schuller, 1997).

24
FMEA implies the following actions:
— the definition of the single equipment failures – done by the analysts as a preliminary
phase;
— investigating the effects of each of the equipment failure both locally and at the
system levels.
FMEA is typically a qualitative technique that produces as output the potential
performance problems (e.g. failure modes, root causes, effects and safeguards).
Moreover, the outcomes of FMEA provide the analyst with the basis for determining
where the (hardware) changes can be made to improve the safety (Schuller, 1997).
One think worth mentioning is that in FMEA, each individual failure is considered as an
independent occurrence with no relation with other failures, except for the ones it may
produce as a subsequent effect (Schuller, 1997).
The method focuses on individual equipment failure modes. This characteristic makes
FMEA a valuable resource for planning and optimizing of the planned maintenance of
equipment.

Figure 11. FMECA example

Source: Det Norske Veritas (2002)

Requirements:
- familiarity with the components of the system analysed;
- familiarity with the failure modes and the local and global effects of the failures;
Strengths:
- easy to understand and learn;
- not difficult to be applied (for small to medium complexity of the system/sub-
system analysed);
- widely adopted;
- at a minimum, can be performed by a single analyst;
- systematic and comprehensive;

25
 - identifies the safety-critical elements whose failure would result in a serious
failure of the entire system;
Weaknesses:
- time-consuming: for a complete analysis, all the failures must be fully analysed,
regardless the final consequence of the failure;
- difficult to be applied for complex systems;
- focuses on a single failure, thus must be accompanied by studies of failure
combinations;
- does not cover human and/or organizational related aspects of failures;
- does not apply to procedures or process equipment

4.7 (Statistical) Analysis of Historical records

‘The best way to assign a frequency to an event is to research industry databases and
locate good historical frequency data which relates to the event being analyzed’ (ABS,
2000)
In the oil and gas business (such as in other high risk industries), the analysis of
historical data is the foundation of many risk analyses. Since any model has its
limitations (it basically is a simplification of reality, sometimes governed by a set of
mathematical equations) the use of data coming from the real world plays a key
advantage in the risk assessment. Relying on historical records gives confidence in the
results of the assessment and can be seen as the least judgemental and the most
objective risk evaluation (Det Norske Veritas, 2002).
The objectives of the analysis of historical records can be summarized as:
— development of frequency datasets, relevant in the risk assessment process;
— obtaining insights on accidents and identifying the lessons learned that could be used
in further enhancements on safety;
— calibration of the models against experience data.
The use of historical data is not always at hand. This depends to the availability, the
quality and the adequacy of the data. Most of the datasets have been developed (both on
the industry and regulatory sides) out of necessity. The main effect of this development
is the heterogenic character of the datasets, both in terms of format and information.
Moreover, the data collected is geographically specific (e.g. North Sea, GoM) and,
naturally, the figures reflect the characteristics of the respective area.
Hence, simply using the historical data does not a guarantee the quality of results per se.
The main aspects that should be thoroughly considered in the selection of the datasets
are:
— suitability of dataset to the problem at hand;
— the statistical quality of data (e.g. interval, completeness, number of records, etc,);
— the relevance of the dataset, in the context of the specific subject of the assessment
(e.g. location).
Recording and reporting of the major accidents has been a common practice in the
countries with prestigious history and high level of industrial activities. Despite the fact
that these requirements were not specifically addressing the offshore activities (e.g. the
RIDDOR database in the UK or the 5 year accident reporting requirement of the Risk
Management Plan, in the US) the presence of the offshore-specific type of incidents in
the overall categories of reported incidents provides a valid statistical basis for further
developments of generic frequencies to be used in the offshore risk assessment.
In terms of the recommended datasets, NORSKOK provides an overview of the prime
source datasets in the industry. The datasets are groped in 11 categories as follows:

26
— Process leak;
— Riser/pipeline leak;
— Blowout;
— Offshore collision;
— Dropped object;
— Helicopter transport;
— Occupational accidents;
— Human tolerability levels;
— Safety and production systems;
— Environmental resources;
— General.
The list encompasses open datasets, limited (access based on subscription) and
restricted (usually industry datasets, restricted to the constituent consortium; examples
include SINTEF11 and OREDA12). Several statistics based on the restricted datasets are
available (both public and based on commercial basis).
One of the most valuable open source of data identified during this project are the IOGP 13
datasheets. Available online14, these reports provide the statistics performed on various
datasets and the corresponding frequency figures that may be used in the quantitative
risk assessment. The list of these reports is given next:
— Process release frequencies
— Blowout frequencies
— Storage incident frequencies
— Riser and pipeline release frequencies
— Human factors
— Ignition probabilities
— Consequence modelling
— Mechanical lifting failures
— Land transport risks
— Water transport risks
— Air transport risks
— Occupational risks
— Structural risks for offshore installations
— Human vulnerability
— Structural vulnerability
— Ship collision risks
— Major accidents
— Construction accidents
— Escape, evacuation and rescue

11
SINTEF Offshore Blowout Database
12
OREDA reliability database
13
International Association of Oil & Gas Producers.
14
http://www.iogp.org

27
— Emergency systems: reliability data and methods
In terms of the primary source of data on offshore marine accidents, the Worldwide
Offshore Accident Databank (WOAD)15 database stands out as the most referenced and
used dataset. WOAD is operated by DNV-GL (Det Norske Veritas, 2013). The database
contains information on more than 6000 events, including accidents, incidents and near
misses from 1970 until today (the database version we used was updated up to 2013).
Summing up we would mention that the analysis of historical records provides one of the
most powerful resources in risk assessment that, when properly applied, confer the
analysis a confidence level based on reality.
Within this report we will illustrate the aforementioned through an analysis performed on
the WOAD database. We will analyse the accident database from a fresh perspective, to
our knowledge not tackled in other studies: the NATECH accidents.

4.8 SWIFT
Used in: hazard identification
The Structured What-If Technique (SWIFT) is a systematic brainstorming, team-oriented
technique for identifying hazards. In relationship with other techniques SWIFT is a more
structure form of the ‘What-if’ (hence, the name) and a less rigorous alternative of
HAZOP (Det Norske Veritas, 2002).
The SWIFT technique is performed by a team of experts under the guidance of a leader.
The leader guides the discussion focusing on the systems and procedures at a high level,
rather than individual items or tasks (such as HAZOP or FMEA). An online record of the
discussions is kept by the SWIT recorder, in a standard log sheet.
SWIFT considers deviations from normal operations identified with questions beginning
“What if…?”, “Is it possible” or “How could…?”. The brainstorming is supported by
checklists to help avoid overlooking hazards.
SWIFT may be used either to identify hazards for subsequent quantitative evaluation, or
to provide a qualitative evaluation of the hazards and to recommend further safeguards,
where appropriate.
A possible SWIFT workflow can go as follows:
1. Define the systems/processes being analysed.
2. For each of them:
(a) Identify and list the possible hazards (brainstorming) yet do not discuss them yet.
Use the checklists for avoiding double-accountability and checking for
completeness.
(b) Structure and prioritize the hazards.
(c) Address each of the hazards; consider:
o the possible causes;
o the possible consequences;
o the safeguards in place to prevent the event occurring;
o frequency and consequence;
o record the discussions on the SWIFT log sheet.

15
https://www.dnvgl.com/services/world-offshore-accident-database-woad-1747

28
Figure 12 depicts an example of a SWIFT analysis on the Ballast system of an offshore
installation (Det Norske Veritas, 2002).
Requirements:
— a team of experts familiar with the system/process analysed;
— the operating personnel may (and must) be part of the team;
— the SWIFT expert to structure the analysis and conduct the team
Strengths:
— flexibility;
— quick by using checklists to avoid repetitive analyses;
— applicability to any type of installation, operation or process;
— applicability in any stage of the lifecycle;
— it makes use of the experience of the operating team.
Weaknesses:
— some hazards may be omitted due to the high level of the analysis;
— difficult to audit;
— adequate preparation of a checklist in advance is critical;
— depends on the level of experience of the leader and the expertise of the team.

Figure 12. Example of SWIFT worksheet

Source: Det Norske Veritas (2002)

29
4.9 Fault Tree analysis
Used in: hazard identification, frequency assessment
The Fault Tree Analysis (FTA) is a deductive, prescriptive, top-down method that
illustrates the logical combination of events and component failures that lead to a main
critical event (the top event).
The Fault Tree Analysis (FTA) permits the evaluation of an abnormal event (the top
event) through the creation of the cause or combination of causes that lead to that
specific top event. Once the fault tree is built, the cut sets (i.e. the failure combinations
that lead to the top event) are determined.
FTA was initially developed in the 60’s at the Bell laboratories and refined by Boeing
Company for quantitative safety assessment. Same as other risk assessment methods, it
was soon adopted by other high-risk industries, such as nuclear, chemical processing and
offshore oil and gas (Vario, 2002).
The method focuses on one failure (top event) and provides the means of determining
the causes (base events) of that event, in the form of a (usually vertical) logical diagram
that illustrates the various combination of equipment failures, dependent failures and
human failures leading to the top event (Schuller, 1997).
FTA can be applied in a qualitative or quantitative manner. In qualitative assessments, it
provides the description of potential problems (combinations of events causing specific
problems of interest); as a quantitative tool, it provides estimates of failure
frequencies/likelihoods and the relative importance of various failures
sequences/contributing events.
This technique proves extremely valuable through its capability of depicting the means of
escalation of smaller initiating events into a major hazard top event, through the failure
of various safeguards. The events and safeguards are anticipated conditions (e.g. storm)
or technical, procedural or human errors.
For illustrating the sequence of events, component failures and the relationship between
them, FTA uses Boolean gates (usually AND and OR).
The fault tree construction starts with the top event, usually a major hazard (e.g. loss of
containment). For the top event, the conditions necessary for producing the event are
identified and registered as new events, at the next level of the tree. The process
continues until the initial (base) events are reached. At each level, if one or more events
can cause an event on an upper level, they are combined with OR. Alternatively, if one or
more events must occur simultaneously to produce the higher event, they are combined
through an AND gate.
FTA proves a valuable tool in hazard identification and frequency estimation. As a hazard
identification technique, the FTA is used in a qualitative or semi-qualitative approach. The
structure of the tree itself provides in this case sufficient information to the analyst in
terms of the adequacy of the safeguards, hence, in judging acceptability in respect to a
given event (Det Norske Veritas, 2002).
For complex systems (hence fault trees) a technique called “Cut Set Analysis” is
recommended for avoiding the potential loss of common causes (i.e. a single failure
breaking more than one safeguards). In short, the technique assumes the assignation of
a unique label to every base event on the tree; this allows presenting all possible ways in
which the events can combine into the top event as a sequence of labels. Usually, capital
Latin letters are used as labels. With this notation, examples of cut sets can be A or AB,C
or ABCD. Depending on the number events, the cut sets are called Single Event Cut Set,
Two Event Cut Set, etc.
A top event having a Single Event Cut Set is more likely to occur than one with a cut set
comprising several basic events. This should be read as the fact that single or two event
cuts implies no or little safeguarding between the initiating events and the top event.

30
 Figure 13. Fault tree analysis example

Source: ABS (2000)

A cut set is a set of basic events whose simultaneous occurrence lead to the occurrence
of the top event.
A cut set is minimal if the set cannot be reduced (using Boolean algebra) without losing
its status as a cut set. A minimal cut set represents the minimum number of basic events
that lead to the occurrence of the top event.
Det Norske Veritas (2001) provides a rule of thumb used to evaluate the major hazards
using the FTA. Accordingly:
— one or two event cut sets require additional mitigation / safeguarding;
— three and four event cut sets require additional evaluation;
— five and more event cut sets are adequate.
In the quantitative approach the development of the tree should be stopped once all
branches have been reduced to events that can be quantified. The probability figure of
the top event can then be computed either by hand (for simple fault trees) or with the
help of specialized computer programs.
The FTA has a solid history and is widely accepted and used in risk assessment, as being
regarded as on of the most thorough for general system analyses. The quality of the
results of the FTA however, strongly depend on the presumption that all the (top) events
and the contributing factors have been adequately identified (Schuller, 1997).
Requirements:
— solid knowledge of the system / process analysed;
— several years of experience in FTA, when dealing with complex systems;
— involvement of the operators for providing the most valuable results;
— prior knowledge of Boolean Algebra / logic gates.

31
Strengths:
— easy to understand and familiarize with;
— clear and logical representation;
— widely used and well accepted;
— provides results that are often easy to communicate;
— can be used in different stages of the lifespan of a project;
— wide applicability, including hazard identification, frequency / probability estimation,
past accident analyses;
— suitable for many hazards that arise from combinations of adverse circumstances;
— often generates credible likelihoods for novel, complex systems.
Weaknesses:
— the diagrams can easily become complicated and time-consuming to depict, in case of
complex systems; this might be overcome with the use of computer systems;
— depends on the experience of the analysts (common cause failures might not be
identified; failure modes might get overlooked)
— all (top) events are assumed to be independent.

4.10 Event Tree analysis

Used in: hazard identification, frequency assessment
The Event Tree Analysis (ETA) is a graphical branching technique with the objective of
tracing out all the possible outcomes of an initial disruptive event. It is a logic model of
success and failure combinations of events leading to all the possible outcomes of that
particular event. The ETA is (usually) a binary tree, each branch having assigned the
success or failure value (usually YES/NO). This characteristic gives the event tree an
exponential growth.
Many of the outcomes of the event are the same. What ETA achieves is the identification
of the different paths that lead to the same outcome.
One thing that is worth mentioning is that in the ETA all paths should be depicted,
including the ones leading to a successful outcome. This is a major difference in respect
to FTA, where the analyst must focus only on the failures of a particular component. In
fact, many see the ETA as the opposite of FTA. We (the authors) would state that, in a
logical sequence, the ETA follows the FTA; first, identify the possible disruptive events
caused by a failure of a component (i.e. FTA), next, draw upon the possible outcomes of
the disruptive event (ETA).
The ETA is used in both quantitative and qualitative manners. As a qualitative tool, its
value resides in the structure of the tree itself. By simply analysing the structure of the
tree the assessor can get insights on how a disruptive event’s outcomes can escalate and
how safeguards are deployed for mitigating these outcomes. This characteristic makes
ETA a valuable tool in the Hazards identification phase of the risk assessment.
In the quantitative approach, a frequency/probability is assigned to each of the branches.
This is a time-consuming process, and the values to be used are not always easy to
identify. When data is available, the probability values should come from reliable,
industry data sources (e.g. IOGP blowout frequency). When this is not the case (i.e. data
is scarce or not applicable, which is mostly the case for new technologies) the analyst
makes use of other analytical tools such as reliability theory (e.g. probability of failure on
demand, wear and tear modelling, etc.)
In terms of constructing the event tree (ET), this is a bottom up, inductive method. The
process starts from the disruptive event (e.g. fire, release of hazardous substance,

32
blowout). Next, the consequences of the event are followed through a series of possible
paths. At each step (presence of a barrier, human action, etc.), both the success and
failure states should be considered. Hence, the paths represent the failure or success
mode of the assigned barriers / preventive actions for the particular event. The process
ends when the final consequences are reached.
In the quantitative form, the conditional failure probabilities along each path gives the
probability of each outcome, giving the failure probability of each barrier / action. The
total probability of a particular outcome is given by the cumulative probability of the leafs
corresponding to the particular outcome.

Figure 14. Generic Event Tree example

Requirements:
— solid knowledge of the system / process analysed;
— practical training and experience of the analyst;
— prior knowledge of basic probability theory.
Strengths:
— easy to understand and familiarize with;
— clear and logical representation;
— widely used and well accepted;
— provides results that are often easy to communicate;
— can be used in different stages of the lifespan of a project;
— wide applicability, including hazard identification, frequency / probability estimation,
post-accident analyses;
— suitable for many hazards that arise from sequences of successive failures.
Weaknesses:
— all events are assumed to be independent;
— easily become complex since it has an exponential growth;
— loses its clarity when applied to systems with complex failure sequences; this might
be overcome with the use of computer systems;

33
— depends on the experience of the analysts;
— all (top) events are assumed to be independent.

4.11 CCFA – Common cause failure analysis

Used in: hazard identification, frequency assessment
The CCFA is a systematic approach for examining sequences of events originating from
multiple failures that occur due to the same root cause (hence, with the possibility of
bypassing multiple barriers).
As an outcome, it provides a comprehensive review of the dependent disruptive events,
the common causes of the events and ensures that the safeguards against the common
cause failure events are in place (ABS, 2000).
A Common Cause Failure (CCF) event is defined as component failures that satisfy four
criteria (NUREG):
— two or more individual components fail, are degraded (including failures during
demand or in-service testing), or have deficiencies that would result in component
failures if a demand signal had been received;
— components fail within a selected period of time such that the success of the
probabilistic risk assessment mission would be uncertain;
— components fail because of a single shared cause and coupling mechanism (factor);
— components fail within the established component boundary.

Figure 15. CCF causes, coupling factors, failure state events relationship

The root causes are frequently categorized in pre-operational and operational. The first
category groups the errors occurring during the lifecycle of a project. The typical
operational root causes are related to operation and maintenance (e.g. inadequate
procedures, competence, etc.) and environmental stresses (such as exposure to stresses
beyond the design or natural events).
A seven-group categorization of the causes is recommended by the NRC. Accordingly, the
causes cover a wide span of sources, from design to internal wear and tear causes. Same
document also recommends a five-classes classification scheme for the coupling factors
as depending on: quality, design, maintenance, operation, and environment.
(NUREG/CR5485).
Both qualitative and quantitative approaches can be employed in CCFA.
When used as a qualitative method, the level of detail vary from basic screening models
to more complex processes involving reviews of operating experience, plant designs and
operating practices, to identify the failure causes, the coupling factors and the defence

34
mechanisms. The results of a qualitative study is most of the time delivered in the form
of a cause defense matrix (Error! Reference source not found.).

Figure 16. Example of cause defense matrix

Source: NUREG/CR-5485

In the quantitative approach, the main objective is the computation of the probabilities of
the basic CCF events. It implies 6 steps, as follows (NUREG/CR-5485):
1. identification of the Common Cause Basic Events (CCBE);
2. incorporation of the CCBEs into the system fault tree;
3. the development of the parametric representation of the CCBEs; several models
are available, among which:
(a) the Basic parameter model;
(b) the Beta-factor model;
(c) the Binomial failure rate model;
(d) the Basic parameter model;
(e) the Alpha-factor model;
(f) the Greek-letter model;
(g) the Multiple beta-factor model.
4. parameter estimation;
Idealy the parameters estimation should rely on actual operating experience. In
most of the cases, however, this data is not available. Alternative sources can be
adopted, such as generic plant/operation data or event component specific data.
5. system unavailablity estimation;
6. documentation and results evaluation.
As also emerging from the above, CCFA is exclusively used as supplement to other
techniques (such as FTA or ETA) (ABS, 2000).

35
For a comprehensive coverage of the subject, including explicit guidance and
requirements for this type of analysis we recommend the user to consult the US NRC
documents NUREG/CR-5485 (Mosleh A. et. al, 1998) and NUREG/CR-6268 (Wierman T.E.
et al., 2007).
Summing up, the outcomes of CCFA are:
- a qualitative description of the possible dependencies among events;
- the quantitative estimate of dependent failure frequencies/likelihoods;
- list of recommendations for reducing the dependencies.

4.12 Human Reliability Analysis

Used in: hazard identification, frequency assessment
Human Reliability Analysis (HRA) is ‘a general term for methods by which human errors
can be identified, and their probability estimated for those actions that can contribute to
the scenario being studied, be it personnel safety, loss of the system, environmental
damage, etc.’ (ABS, 2000)
In some sources the term ‘human failures’ is preferred to ‘human error’. The reason is
that the later may be misleading, in the sense that in the majority of cases the ‘errors’
are not caused by the human being under consideration, but by circumstances beyond
his/her control or influencing his/her behavior (Schuller, 1997). These circumstances can
have various sources that include technical, operational, spatial and organizational
aspects.
Considering the aforementioned, we may state the main objective of the HRA as the
process of identification of the potential human failures, of the frequency of occurrence
and of the technical/procedural/organizational measures to reduce that frequency.
One thing to be noted is that HRA techniques can model and quantify only some types of
human errors. For all the rest, expert (subjective) judgement remains the only way of
assessment.
The basic process of HRA can be summarized as follows: a task analysis is conducted in
the first place having as result a hierarchical list of individual tasks and steps within an
activity. Potential (human) errors and the error mechanisms (e.g. right action on wrong
object, wrong action on right object, skipped step, etc.) are then identified and
associated to each of the steps. In the quantitative approach probabilities are estimated
for each failure mechanisms, followed by the determination of nominal error rate. The
influence of the relevant performance shaping factors is then introduced in the
assessment. The effects of the performance shaping factors can lead to an increase or
reduce of the likelihood of error for a given task. The final probability reflects the average
error rate for the task, while accounting for the relevance of the influential factors. This
result allows the identification of the actions required to minimize the impact of the
errors on the system or to increase the reliability of the human performance within the
task.
The TNO Red book (Schuller, 1997) provides a comprehensive coverage of the subject of
human errors. The same source proposes a four steps human reliability assessment
procedural framework, as follows:
1. Familiarization with the plant, including:
— collection of information;
— review of the written procedures;
— plant visit
2. Qualitative analysis, including:
— Task analysis;

36
— Identification of potential human errors;
— Classification of human failures;
— Modelling of human errors in risk analysis
3. Quantification of human failures:
— Calculation of human errors probabilities;
— Consequence analysis;
— Recovery analysis.
4. Evaluation of the results:
— Sensitivity and uncertainty analysis;
— Recommendations;
— Reporting.
Going beyond the scope of this document we shall not dive into the details of each of
these steps. The reader is strongly recommended to consult the reference source for a
thorough understanding of the complex HRA.
HRA is an extremely complex process, yet highly required in risk assessment since the
history shows the importance role of human failures in the occurrence of the accidents.
The complexity of the process arises not necessarily from the techniques employed
(whether qualitative or quantitative) but from the wide span of the issues that should be
addressed and, even more, from the variability of the analysis subjects (i.e. humans).
Because of its importance, there are many qualitative and quantitative methods available
for HRA. Most of them have been developed for specific high risk industries (e.g.
nuclear), being adapted for the specificities of that particular industry. A restricted set of
these have emerged as the most accepted and adopted in the risk assessment in major
hazard industries, and in oil and gas industries in particular. In a 2009 report 16 HSE
provides an overview of 17 of these methods focusing on the general description,
applicability and the strengths and weaknesses. In these authors’ opinion, the HSE report
plays a valid starting point for further documentation and deeper insights on the subject.

4.13 The Bow Tie Analysis

Used in: hazard identification, consequence assessment, risk communication
The Bowtie Analysis is a qualitative, graphical risk evaluation method used to analyse
and demonstrate causal relationships in high risk scenarios.
Its name comes from the shape of the diagram created during the analysis (also known
as a bowtie diagram). A Bowtie diagram is another way of representing the risk in one,
holistic picture.
The bowtie diagram allows not only the depiction of the risks, but also of the preventive
and mitigation measures. The power of a bowtie diagram resides in its ability of
presenting an overview of the multiple accident scenarios.
The analysis consists in a series of steps taken to build the bowtie diagram. These can be
grouped in three phases as:
— Represent the risks;
— Control the risks;
— Evaluate and manage the escalation factors.

16
Review of human reliability assessment methods, HSE 2009

37
 Figure 17. Generic Bowtie diagram

Represent the risk

The construction of a Bowtie starts from the Hazard. The list of hazards is usually the
result of the hazard identification process, and obtained with one of the methods
described earlier in this chapter. As a rule of thumb, Bowties are only constructed for
those Hazards identified as having a great potential of harm.
Once a Hazard is considered, the next step in the construction of the Bowtie is the
selection of the Top Event. The Top Event is the event that corresponds to the moment
when the control of the Hazard was lost. In other words, the selection of the Top Event
should reflect the situation in which no damages are done yet but the danger is
imminent.
With the Hazard and Top Event at hand, the analyst should drive his/her attention to the
Threats. The Threats encompasses all the technological and human failures, human
actions, and environmental factors that could cause the Top Event. In a typical Bowtie
diagram the threats are depicted on the left side of the Top Event.
The next task is the identification of the possible consequences of the Top Event. These
should be listed in the right side of the Bowtie diagram.
The actions performed so far resulted in the construction of the Bowtie diagram in a form
that clearly represent the risks associated with a given Hazard. The Top Event, Threats
and Consequences picture gives the analyst the clear picture of what can go wrong and
which are the effects that should be avoided.
Each line connecting a Threat with a Consequence (through the Top Event) represents a
plausible accident scenario. A logical continuation of the analysis would imply the
identification of the ways and means of braking a scenario from becoming reality; and
this is the task in the next stage.
Control the risks

38
In the Bowtie analysis the control of the risks is performed in a first phase through the
use of (safety) Barriers. The Safety Barriers are a fundamental component of the concept
of defence-in-depth. There is, however, a broad variety of definitions of a barrier, both in
the scope and form. We would propose a definition that states that a Safety Barrier is
any physical or non-physical means planned to prevent, control, or mitigate an undesired
event, or any combination of the above. Another definition is given by IOGP and states
that a Barrier is “a functional grouping of safeguards and controls selected to prevent the
realization of a hazard. Each barrier typically includes a mix of: plant, process and
people.” [IOGP, 2008] For more information on the barriers and their role in the offshore
oil and gas we would strongly indicate the user the IOGP 2008 Report “Asset integrity –
the key to managing major incident risks” (IOGP, 2008) and the 2016 supplemental
report “Standardization of barrier functions” (IOGP, 2016), both available online.
Building on this, in the Bowtie context, the role of a Barrier is either to prevent the
Threat to result in the Top Event (i.e. prevention) or to escalate into a major accident
(i.e. mitigation).
The basic Barriers are identified and placed on the diagram either on the left, or the right
side of the Top Event, depending on the role of the barrier. For a barrier to be valid, it
must comply with the following (Saoud, 2013):
— be able to stop a threat; or
— be effective in minimizing a consequence; and
— be independent from other barriers in the same line (i.e. the line connecting the
Threat to the Top Event, or the Top Event to Consequence).
Depending on the level and the requirements of analysis, this analysis can continue with
the estimation of the barrier effectiveness (usually adequacy and reliability); this process
gives the analyst an indication on how well the barrier performs. Moreover, the analyst
should then focus on the activities required to ensure that the barriers are implemented
and their effectiveness is ensured. In other words, this means that the Bowtie Analysis is
perfectly suited for the integration of the Safety Management System in the analysis.
Evaluate and manage the escalation factors
The barriers previously identified ensures an acceptable level of risks, if everything works
as designed. Due to their main purpose, those barriers are typically called Control and
Recovery Barriers. However, since no barrier is ever faultless, the understanding of the
reasons of which a barrier can fail is also required in a comprehensive analysis. In the
Bowtie Analysis, this is done through the escalation factors.
The escalation factors are encompassing everything that would make a barrier fail. A
more formal definition goes as ‘(the escalation factors) are the conditions that lead to
increased risk by defeating or reducing the effectiveness of barriers’ (Saoud 2013).
From the above, one may notice that in the Bowtie diagram the escalation factors must
be linked to a barrier. Moreover, the next logical step is the management of escalation
factors. This is also done using the Escalation Factor Barriers.
In the end, the Bowtie diagram represents a full picture allowing the analyst to get a
thorough insight on the level of management of the risk at hand. The Bowtie analysis
also helps in the better understanding of the weaknesses of the system, to identify where
further prevention/mitigation measures are required or assessing the criticality and
importance of each of the barrier. Other said, the Bowtie diagrams effectively include the
main elements of the risk management process: identify, prevent, mitigate, and assess
(Saoud, 2013).
The Bowtie analysis provides the most illustartive tool demonstrates how major hazards
are identified and controlled. This characteristic made it the main communication means
to support safety reports and health, safety, and environment (HSE) cases in the
offshore oil and gas industry.

39
5 Analysis of natural hazard impacts at offshore facilities
Natural hazards, such as storms, earthquakes, and lightning are a major threat to
industrial sites. They can cause technological accidents at chemical plants, pipelines and
offshore oil and gas facilities, where they impact equipment, workers and the
environment. Such accidents that involve hazardous-materials (hazmat) releases are
commonly referred to as Natech accidents. This chapter is aimed to provide an overview
of the threat to offshore installations due to natural events.
Past accident analysis is an important tool for learning from past disasters, which enables
the understanding of how and why accidents happen. In this study, damage and
accidents triggered by natural events at offshore oil and gas facilities were analyzed, with
the aim to further investigate the matter and to contribute to preventing their occurrence
in the future. Accident database analysis was carried out to screen a large amount of
accident data and to divide the accidents into categories (e.g. per natural hazard,
consequences, installation type, etc.). For this purpose, the Worldwide Offshore Accident
Databank (Det Norske Veritas, 2013) was analysed to identify and analyse the accidents
subset that was triggered by natural events.
Both qualitative and quantitative accident data was retrieved in order to draw the most
complete picture of the natural hazard characteristics, infrastructure damage
mechanisms, and their consequences. Also the facilities were analysed in order to spot
vulnerabilities. Among all the events, those that occurred in Europe were further
discussed and developed in detail, with a focus on two main regions: the Mediterranean
Sea and the North Sea. Significant differences in accident modalities with respect to
location of the offshore facilities and of the platform type were found.

5.1 The WOAD survey

The Worldwide Offshore Accident Databank (WOAD) is an offshore accident and incident
database operated by DNV-GL (Det Norske Veritas, 2013). The database contains
information on more than 6000 events, including accidents, incidents and near misses
from 1970 until today (the database version we used was updated up to 2013, at the
time the analysis was made). A screening of the data reported was carried out in order to
retrieve valuable information regarding past accidents triggered by natural events. The
aim was to better understand natural hazard impacts at offshore facilities, allowing not
only the identification of possible accidents and natural hazards, but also to detect the
most frequent damage and failure mechanisms.
As much as it was practicable, the WOAD terminology (see more on the WOAD web site 17
and the WOAD whitepaper, available on request18) was used in the analysis for better
comparison with future (or past) studies. It should be noted that in a relevant portion of
the records (especially when a large number of incidents was reported as a consequence
of a hurricane) detailed information on the accidents was missing.
A data subset composed of 1085 incidents, which were caused or promoted by the effect
of natural events, was created. The elements of the dataset include damage and failure
of different types of offshore facilities, as well as hazardous-materials releases from
these structures. This data subset was used as a basis for all the following statistical
analysis.
Figure 18 summarizes the location of the accidents composing the dataset. As expected,
most accidents recorded happened in North America and in Europe. In particular, up to
80% of all the accidents concerning this study occurred in the Gulf of Mexico (55%), due
to the extremely high number of installations in a hurricane-prone region, and in the
North Sea (25%), because of the general extreme weather conditions and the frequent
storms. For the sake of clarity, it is important to highlight that WOAD features mainly
accident data from the Gulf of Mexico and the North Sea. On the one hand, this is
17
https://www.dnvgl.com/services/world-offshore-accident-database-woad-1747
18
https://www.dnvgl.com/software/campaigns-2015/safeti-woad-whitepaper.html

40
because those are the two areas with the highest density of offshore facilities; on the
other hand, accident reporting is also the most accurate in these two regions.

Figure 18. Offshore accidents triggered by natural hazards grouped according to their geographic
location.

From the incident data subset, useful information regarding the type of triggering natural
hazard can be obtained, in order to highlight the main threat to offshore infrastructure.
Table 2 summarizes the main natural hazards to offshore facilities. In order to obtain a
wide sight of the natural threats and, at the same time, to keep the focus on the region
of our concern, the list of natural hazards selected have been reported for both the whole
database and those events occurred in Europe (including four additional accidents
occurred in African countries, in the Mediterranean sea). As expected, bad weather
conditions and hurricanes are by far the main causes of incidents at offshore facilities.
Lightning strikes follow as triggers, although with a very limited number of events;
earthquakes and freezing cold are also mentioned in a few records.
In the framework of this study, bad weather refers to storms and it includes the effect of
strong wind and high waves impacting the installations or vessels. We decided to
separate storms from other causes such as freezing or lightning strikes, which sometimes
were also labelled as bad weather in WOAD. The use of the label hurricane was added to
the incident causes listed in WOAD to identify extreme storm conditions that are
characteristic for a tropical storm. We distinguished hurricanes from the more generic
bad weather events or storms, because of their destructive capability: in some cases,
tens of accidents were due to a single hurricane (e.g. hurricanes Katrina and Rita in 2005
(Cruz and Krausmann, 2008)). Thus, in this analysis this label was considered only when
the database specifically referred to this kind of event.
While hurricanes are an important natural cause of accidents at offshore installations
worldwide, they are only a marginal incident cause when considering European events.
This result is further highlighted in Figure 19, which reports the number of offshore
Natech incidents, on a yearly basis. It should be noted that many events were reported
when the most violent hurricanes in history hit the Gulf of Mexico. If we consider an
average of 25 incidents per year, this number is as big as five times the average in 1992,
due to hurricane Andrew, and it is eleven times bigger in 2005, due to hurricanes Katrina
and Rita. Among all the incidents reported in the database, about one quarter belongs to
2005.
In order to categorize the hazard locations by the main geographic regions, Table 2
summarizes the most severe storm conditions reported in the WOAD. The worst
conditions were documented in Australia in 1989 during cyclone Orson with winds at 83
m/s and wave heights of up to 30 m. However, due to the low density of offshore oil and
gas production sites, the overall number of accidents reported in this region is limited.
Gulf of Mexico follows for what concerns the wind speed, due to the impact of frequent

41
hurricanes, or tropical storms. However, it is only the fifth region with respect to wave
height, due to its morphology. The area labelled as North Sea, which includes also the
Norwegian Sea and the Barents Sea, is the European region where the strongest winds
and the highest waves are recorded. Such high values can easily match those obtained in
other areas affected by frequent tropical storms: the South Asian and the American East
coast. Much less severe are the storms recorded in the Atlantic Europe and in the
Mediterranean Sea. Still, due to the large number of activities associated with oil and gas
extraction, a small, yet significant amount of incidents was reported in these two areas.

Figure 19. Yearly distribution of offshore incidents caused by natural events

Table 2. Number and type of the main natural hazards to offshore facilities recorded in WOAD

Natural Hazard World Europe

Bad weather 546 279

Lightning 17 13

Earthquake 5 3

Hurricane 513 7

Freeze 4 1

TOTAL 1085 303

Figure 20 reports the damage extent statistics of the events recorded. The same damage
categorization as that provided by WOAD was used. The meaning of terms used is
described as follows (Det Norske Veritas, 2013):
 insignificant damage: insignificant or no damage to part(s) of essential
equipment; damage to towline, thrusters, generators and drivers;
 minor: minor to single essential equipment; damage to more non-essential
equipment, and damage to non-loadbearing structures;

42
  significant damage: significant/serious damage to module and local area of the
unit; minor damage to loadbearing structures; significant damage to single
essential equipment, and damage to more non-essential equipment;
 severe damage: severe damage to one or more modules of the unit;
large/medium damage to loadbearing structures; major damage to essential
equipment;
 total loss: total loss of the unit, including constructive total loss from an
insurance point of view; however, the unit may be repaired and put into operation
again.

Table 3. Summary of the most severe storm conditions recorded in WOAD, subdivided on the basis
of regional attribution

Location Wind speed Wave height

(m/s) (m)

Australia 83 30

Gulf of Mexico 62 21

South Asia 57 27

North Sea 55 25

North America - East coast 51 26

North America - West coast 50 10

Atlantic Europe 43 17

Mediterranean Sea 40 12

South America 36 8

Figure 20. The distribution of damage extent categories for accidents triggered by natural events

43
5.2 Damage/failure mechanisms for natural-hazard impacts
In order to rank the vulnerability to natural hazards among all the off-shore structure
types, Figure 21 reports the number of accidents distributed over the different
categories. The most frequently damaged units were jackets, jackup rigs and semi-
submersible rigs, with over 200 accidents recorded for each. Other numerically relevant
equipment are underwater pipelines, with over 100 cases, well-support structures with
83 cases, and barges (either for drilling or for support operations) with 64 accidents.
The statistical distribution of accident scenarios, describing the damage modalities, is
shown in Figure 22. Breakage of platform parts and platform overturning are the most
common accident outcomes, with more than 200 cases, each. The Natech scenario, i.e.
the accident scenario involving releases of oil, gas or other hazardous substances, follows
with more than 202 records. It should be noted that about half of the releases occurred
due to pipeline rupture, since 106 out of 118 pipeline accidents resulted in releases
(Figure 21).
About 100 accidents happened because of a collision with another vessel, with potential
damage to the platform, to the vessel or to both of those. This category also includes
helicopter accidents, which ended in a collision with the platform. Another frequent
damage mode is the failure of mooring or anchors, with 74 records, and towline failure in
41 cases. On top of those, other 40 records have been labelled as out of position-adrift,
but their cause is basically the failure of either mooring or towline connections. Collisions
and cable detachments can be caused by the effect of: strong winds, heavy wave load
and/or intense marine current. It is interesting to notice how the wind speed and the
intensity of waves required to cause a collision or the rupture of cable connections are
much less severe than the almost-hurricane conditions required to directly deal damage
to the structure.
Figure 23 shows the distribution of accidents by the operation type. As expected,
production and drilling (overall) are the most frequently affected operations, with 452
and 270 accidents records, respectively. This is possibly because platforms and rigs are
involved in these operations for most of the time. Nevertheless, a surprisingly high
number of accidents (159) happened during transfer operations, which usually last for a
limited amount of the whole lifetime of an installation. This number clearly indicates an
increase of accident probability while the structure is under towing, highlighting the
relevance of the transportation risk, which is often underestimated during natural hazard
conditions.
In the following sections the natural-hazard damage modes of the different types of
offshore structures are shown. Table 4 summarizes the damage mechanisms reported for
the main structure types as a function of the impacting natural hazard.

5.2.1 Environmental actions and loads

Offshore sites are subjected to a number of different actions or loads to their structural
parts. The performance of the structures can be described with reference to a specific set
of limit states beyond which the structure fails to satisfy design requirements. Limit
states are usually divided in the following categories (ISO 19900, 2012):
— the Ultimate Limit States (ULS) that correspond to the ultimate resistance to extreme
applied actions;
— the Serviceability Limit States (SLS) that correspond to the criteria governing normal
functional use;
— the Fatigue Limit States (FLS) that correspond to the accumulated effect of repetitive
actions;
— the Accidental Limit States (ALS) that correspond to situations of accidental or
abnormal events;

44
Figure 21. Distribution of accidents by offshore structure type

Figure 22. Distribution of accidents by final outcomes

Figure 23. Distribution of the ongoing operations’ type

45
Table 4. Main damage mechanisms due to natural hazards based on our accident analysis

Structure NatHaz Damage modes

Fixed Storm and Damage to steel jackets or jackup's legs; overturning and toppling; deck flooding;
structure hurricanes scour; damage to helideck; wind damage to derrick; wind damage to hatches,
windwalls and insulating layers

(and Earthquake Damage to steel jackets or jackup's legs; scour; damage to derrick
stationing
jackup) Lightning Ignition of flammable material in storage tanks; flare damage

Subsidence Damage to steel jackets or jackup's legs; scour; damage to derrick; promote
landslide vulnerability to future waves

Freezing cold Damage to steel jackets or jackup's legs; promotes corrosion and fatigue;
and ice collision with icebergs

Floating Storm and Damage to station keeping mooring system; rigs and MOUs set adrift;
structure hurricanes overturning and toppling; deck flooding; damage to helideck; wind damage to
derrick; wind damage to hatches, windwalls and insulating layers

Lightning Ignition of flammable material in storage tanks; flare damage

Pipeline Storm and Pulled when host platform is set adrift; soil erosion, cratering and subsidence;
hurricanes anchor dragging from drifting rigs; wave damage during pipe lying

Earthquake Pipeline bending because of soil cratering

Subsidence Pipeline bending because of soil cratering

landslide

FPSO/FSU Storm and Damage to station keeping mooring system; support rigs and MOUs set adrift;
hurricanes wind damage to hatches and insulating layers; damage to helideck

Lightning Ignition of flammable material in storage tanks; flare damage

Loading Storm and Damage to station keeping mooring system; hose damage; damage to helideck
buoy hurricanes

All relevant limit states should be considered in the design, which should also account for
uncertainties with respect to actions and loads, the response of the structure as a whole
and of each of its components, and the effect of the environment. Each structure is
designed around a set of distinct design situations, accounting for different structural
systems, design values and environmental conditions (OGP, 2014).
Permanent, operating and environmental actions are, normally, always acting on the
structure, and can be easily forecast and/or panned. Examples of these actions are: the
structure’s own weight, the ballast systems, the weight of machinery, accommodation
and other equipment. They also include the hydrodynamic forces and the hydrostatic
pressure forces, as well as the operating loads, which are only acting while the
operations are ongoing (e.g. drilling, manpower, equipment, storage, life-support
systems, etc.). On top of these, there are a number of environmental actions, which are
rather stochastic, and thus, not easy to assess. They may be subdivided into the
following categories (ISO 19900, 2012):

46
— Wind acts on the portion of the platform above the sea surface, via wind forces of
varying severity. Normally the effect of wind can be considered negligible, but it
becomes a major concern when it reaches gale to hurricane strength;
— Snowfall or frost can add additional loading to structures, potentially threating the
structure’s integrity;
— Temperature variation causes thermal expansion, contraction and sometimes
deformation of the construction materials, promoting fatigue and corrosion on
structural parts;
— Seismic activity often takes place in the underwater oceanic plates where they drift,
vibrate, close in or recede from each other. Eventually, intense seismic events may
produce tsunamis;
— Lateral loads from the soil, or seabed may threaten the resistance of legs or
foundations. Occasionally, leg feet and foundations may subside in the seabed,
causing the platform to list;
— Wave loads are the main threat to all offshore structures, ranging from light ripples to
gigantic waves. Thus, the preliminary design of any offshore structure should consider
its resilience to the waves it will face.
The characteristic value of an action is generally associated with the probability of not
being exceeded within a certain period, usually a year. The return period is the average
duration between consecutive occurrences of an event exceeding a given characteristic
value. Typical characteristic values are: 1) the extreme value (associated with extreme
events), which is used in design to verify ULS, and the abnormal value (associated with
abnormal/accidental events), which is used in design to verify ALS. The former indicates
the ultimate value of the action, for which the global behavior of the structure is not
compromised (usually when it remains in the elastic range) and has a probability of being
exceeded of the order of 10-2 per year. The latter indicates the characteristic value for
which the global behavior of the structure does not suffer complete loss of integrity and
has a probability of being exceeded of the order of 10 -3 to 10-4 per annum. In addition,
explicit safety factors were incorporated in design procedures to deal with uncertainties,
such as construction loads and stresses, changing in loading assumptions and, most
importantly, uncertainties in environmental loads.

5.2.2 Damage to fixed structures

A relevant portion of accident reports simply recorded platform collapse due to inclement
weather conditions, without further details added. However, the data available in the
present data subset and in past reports are sufficient for identifying the main causes of
accidents (Det Norske Veritas, 2013). Past studies showed that the main threat to fixed
platforms is the impact of high waves on the deck as this causes a strong overturning
moment (Kaiser, 2007). During a recent OGP workshop (OGP, 2014), the experts
concluded that in case of wave hitting the deck there are very few chances of survival for
a platform or rig. Wind is usually responsible for minor damage to sensible parts, but it
also produced serious accidents under the right circumstances. For instance, occasionally
wind gusts caused the rig to collapse and to fall over the platform. These unexpected
events often occur during extraordinarily intense storms or hurricanes. Other failure
causes include lightning strikes, earthquakes (see also API RP 2EQ (2014); ISO 19901-
2(2004)) and extreme cold or ice (see also (ISO 19906)). For instance, in one case,
natural gas froze in a platform's flow line and caused it to rupture.
More than two thirds of the accidents involving platforms with metal jackets occurred
during hurricanes resulted in a total loss of the installation. These platforms commonly
operate in shallower waters and their environmental impact in case of collapse is not
considered major. Consequently, in the Gulf of Mexico, for example, design criteria for
jacket platforms are lower than for deep-water systems (Cruz and Krausmann, 2008).
Frequently, the platforms listed or capsized because of wave impact during heavy

47
storms, and eventually grounded on the seabed. Therefore, also pipe connections, risers
and occasionally the wellhead suffered damage, with subsequent release or leakage of oil
and/or natural gas.
In some cases, these phenomena were a consequence of problems with the foundations
which sustain the jacket’s or jackup’s feet. This phenomenon is labelled scour and can be
triggered by soil erosion, field subsidence or submarine landslides. During storms, and in
particular during hurricanes, waves and sea currents add additional loads to foundations
and cause soil erosion, which can ultimately end in scour. OGP workshop reports the
results of an analysis of 13 scour events that happened during hurricanes (OGP, 2014).
The data subset we analyzed also includes other cases in which the wave hit fragile parts
and caused their rupture or detachment. For instance, in several cases, damage to the
helideck was reported, ranging from scratching and buckling of the light components
(e.g. hatches, hoses, insulating material, etc.), to the detachment of the whole helideck
unit.
Concrete supports are much more resistant. The low number of accidents reported for
these structures is due on the one hand to the lower number of concrete platforms and
on the other hand to an inherently more resistant structure. As a result, complete
structural collapse was never reported and the loss of one or more units was extremely
rare due to natural hazards.
According to the recorded accidents, direct damage to the platform occurred because the
impacting winds and waves often overcame the design specifications. The tendency to
choose inadequate design specifications and the underestimation of the storm’s strength
can be blamed for the frequent failures. In order to comply with the need for more
reliable storm data, the most recent releases of Metocean data, i.e. API RP 2MET (2014)
and ISO 19901-1 (2006), were reviewed and updated, based on storm observations from
1957 to the present. Following the extensive damage caused by several severe
hurricanes in the Gulf of Mexico in the past decade, which drastically overcame the
expected storm intensity associated with the design return time, the characteristic values
associated to wind speed and wave height were significantly raised. Moreover, recent
studies on climate change (Reale and Atlas, 2001; Haarsma et al. 2013; Debernard et al,
2002) raise concern on the possibility to have more intense and more frequent tropical
storms in the years to come due to global warming. Consequently, Metocean data should
be constantly reviewed kept updated.

5.2.3 Damage to floating structures

Floating units, such as semi-submersible platforms (SSP), tension leg platforms (TLP)
and spar platforms (SP), are, in general, much more resistant to the impact of hurricane-
force storms than fixed installations. In particular, the threat of high waves impacting on
deck is much less probable than in fixed installations. On the one hand, the buoyancy
allows the structure to dissipate part of the wave energy and on the other hand,
semisubmersible platforms are selected for drilling and production operations in deep
waters, where the waves are less likely to reach extreme heights. Up to some extent this
conclusion also applies to MODUs, which, in turn, have lower design requirements and,
therefore, are more likely to fail. In fact, in a large number of incidents in the dataset,
the natural event was just the triggering cause of the accident while it was often
accompanied by contributing factors (e.g. corrosion, fatigue, wrong procedures, etc…).
Consequently, wind or sea conditions well below the design specifications were often
responsible for extensive damage to platform parts. Other studies (PSA, 2014; OGP
2014) arrived at similar conclusions.
With these premises, it is no surprise that bad weather was found to be a more frequent
source of damage at semi-submersible platforms than hurricanes. Even generic storms,
which happen with much greater frequency than hurricanes, have the potential to trigger
an accident in the presence of contributing factors. Besides, the environment that
produces hurricanes, the GoM, is less likely to cause corrosion and fatigue phenomena, in

48
contrast to the North Sea environment. Actually, hurricanes in the data subset accounted
for only one fourth of the accidents occuring at floating installations, while bad weather
was indicated as cause for the remaining portion. Unlike what was previously said for
jacket platforms, past accidents at semi-submersible structures were mainly low-
consequence events, which were triggered by strong, but not extreme weather
conditions. The majority of semi-submersible platforms failed in the North Sea region,
since it features frequent storms in an environment prone to produce fatigue and
corrosion phenomena to mechanical parts. Moreover, the occurrence of storms in the
North Sea cannot be easily forecast, limiting the capability to take actions to prevent
losses.
The main damage mode for floating structures is the failure of station keeping systems
due to the rupture of mooring or anchors, caused by the effect of strong winds and
waves. According to a dedicated PSA study on station keeping malfunctions (PSA, 2014),
mooring failure is contributed to by corrosion and fatigue phenomena, as well as by the
application of poor design specifications and wrong procedures. During the OGP
workshop a few facts on mooring systems were highlighted (OGP, 2014):
— the high number of mooring failure is a factor of concern, especially for the North Sea
region;
— the return time for the characteristic value used in standards are low, generally 10
years;
— the failure occurred with loads well below the stress caused by the characteristic
value, due to problems in manufacturing, installation and operations;
— the use of higher factors of safety could lead to very large components, which may
add significant load to the structure and may be less reliable while in service.
As a consequence, the OGP committee concluded that actions should be taken to improve
the manufacturing quality, testing and maintenance of components, rather than to
increase design requirements (OGP, 2014).
Damage to station keeping systems can cause the control loss of operations, and often
results in damage to risers and pipelines. Eventually, the platforms were sent adrift in
the open sea, up to a hundred miles away from their initial location. In a few cases, the
platform grounded and/or was washed ashore. Similarly, also the failure of towing cables
under heavy weather was reported in one quarter of the accidents at semi-submersible
units. Other natural phenomena like earthquakes, lightning strikes and extreme cold
were not reported for floating platforms in the current data subset. However, there are
reports of a ship (not involved in offshore operations) affected by an earthquake while
sailing in deep waters off Sumatra. As a consequence of the earthquake, the ship
stopped, the electronics failed and the crankshaft was broken, for a total loss of $10
million. The earthquake caused a compression wave leading to high frequency vibrations
(OGP, 2014).
Natural-hazard triggered accidents at tension leg platforms (TLP) were reported in 11
cases. In almost all cases, the accidents were triggered by hurricane forces, resulting in
various damage mechanisms to the unit. The most severe damage occurred at a small
TLP of the sea star class, which capsized due to the exceptional wave height. In another
case, a huge derrick fell on the platform’s deck due to hurricane winds and wave motion.
Other minor accidents are reported for TLPs and include the stopping of production
operation, damage to flare, near misses and a worker who fell from a storage container
because of platform rocking.

5.2.4 Storage and production facilities: FSU, FPSO and loading buoys
A few cases of accidents at FPSOs were reported, many of which occurred in the North
Sea. The hull of FPSOs has shown to be resistant to intense windstorms. Only very
limited damages were caused by wind actions, such as the loss of insulating material and
the loss of a VHS cable. However, the sea in stormy conditions can be a major threat. In

49
several cases, waves and sea currents have managed to break anchor cables, causing
the vessel to be set adrift. In one case, the rupture of one anchoring cable caused a
malfunctioning of the stability control system of the vessel resulting in rocking, with
subsequent failure of the remaining moorings. In another case, the mooring rupture
caused the vessel to list. Structural damage due to the impact of massive waves was also
reported. Eventually, the wave impact opened cracks in the superstructure in the bow
area of one vessel. A few additional records address the damage to FPSOs’ piping and
loading hoses during severe weather.
The WOAD database also reported accidents that happened at loading buoys. Most of the
accidents consisted in hose rupture and produced a hydrocarbon release. In one case,
the upper section of the buoy was torn off by a winter storm. Loading buoy moorings are
also frequently damaged during storms, causing a stop of the oil production operations
for several hours or even days.

5.2.5 Transport, towing and collision

Of a total of 182 accidents that occurred during towing, about half (93) involved jackups
and one fourth (45) semi-submersible platforms. Most of the accidents only resulted in
towline snapping, with subsequent loss of control of the vessel and no further damage to
the platform. In some cases, however, more serious losses occurred. Occasionally, the
vessel collided with the tug, resulting in severe damage to both hulls. Some accidents
reported that either the towed platform or the platform and the tug went adrift and
grounded. In some extreme cases, the deck began to take water, followed by flooding of
one or more units. In other cases, the towed vessel capsized and, eventually, sunk.
Collapse of derricks and cranes was frequently reported, as well as bending or buckling of
jackup legs, which, occasionally, were swept away by the storm.
The large majority of the vessels went adrift after the towline had parted. However, in
many cases the tug was able to restore the tow, in others the vessel was completely
caught in the heavy weather and stopped only when it grounded. A few times, restoring
the tow was very complicated, especially considering the bad weather conditions, so that
it took days (with a maximum of five days) to reconnect tow to a vessel that went adrift.
A few semi-submersible rigs could stop drifting by using their emergency anchors.
Vessel colliding with the platform structure usually results in minor damage to platforms
or rigs, and in more severe consequences for the vessel or barge. However, a few cases
of severe damage to rigs due to impacting vessels were recorded. Ocasionally, some
collision accidents were reported twice: once for the vessel hitting the platform and once
for the platform itself. For this reason, the actual number of accidents may be smaller
than what appears from a skin-deep analysis (see Figure 5).
Jacket legs and pipelines are likely to be ruptured or buckled by vessel impact. More
often than not, helicopters collided with the structure because of strong winds and,
eventually, the pilot or the passengers were killed in the process. Rarely, damage to
platform and to the helideck was reported. Since helicopter collisions occur in the higher
deck, damage to the derrick may be assumed as a potential damage mode, even though
it has never been actually recorded. In one case that occurred in arctic waters, the rig
was hit by an ice floe, causing three anchor cables to break.

5.2.6 Pipelines
Pipeline ruptures and leakages are quite frequent in extreme storm conditions.
Concerning the natural hazards, underwater pipelines have shown low vulnerability with
respect to most natural events, but they failed in bulk when the strongest hurricanes
occurred. According to the data in the WOAD, over 95% of pipeline that failed because of
natural events, failed during a hurricane. In particular, over 88% of underwater pipeline
accidents occurred during hurricanes Katrina and Rita in 2005 (Cruz and Krausmann
2008). Unfortunately, the database fails to add details on the damage modalities for the
largest portion of the accidents reported.

50
Several reports and articles concerning offshore accidents that occurred as a
consequence of hurricanes Katrina and Rita are available. According to Cruz and
Krausmann (2008), “drifting rigs dragged lines and anchors along the ocean floor
resulting in damage to pipelines and minor pollution incidents”. Pipeline damage was a
direct consequence of the failure/displacement of the host platform, damage to its risers,
impact of dragging anchors and pipeline interactions at crossings (Cruz and Krausmann,
2008; Det Norske Veritas, 2007).
Other accidents occurred during pipe-laying operations, where uncontrolled motion of the
pipe-laying barge or ship resulted in damage to pipelines. Only one case reports soil
erosion beneath the pipeline, due to marine current, to have caused pipeline failure and
leakage.

5.3 Fatalities, serious injuries and pollution

An assessment of the consequences on human health was also carried out. Luckily, the
number of fatal accidents is rather limited: only 40 on a total of more than one thousand.
This number, which is rather low considering the large number of accidents reported, is
due to the actuation of evacuation procedures when a storm alert was given. Figure 24
shows both the yearly distribution for accidents with fatalities and injuries.
The accidents which caused the greatest human losses were those in which the shut-
down and evacuation operations did not start in time or were not affected at all. The
deadliest accident of all was reported in Europe: the Alexander L. Kielland capsize, which
occurred in Norwegian waters in 1980, and caused the death of 123 persons. Another
accident featuring a huge number of fatalities occurred in Thailand on the drillship
“Seacrest” during typhoon "Gay” in 1989. The ship capsized and the sea claimed the life
of 91 people. Other three similar accidents were reported, two of which occurred in China
(72 and 81 fatalities, respectively) and the other in Canada (84 fatalities). In all these
accidents the structure sank and the crew was tossed to the sea.
The accident with the highest number of injured people is similar. In 1991 during
typhoon "Fred", “McDermott lay barge 29” overturned and sank while it was involved in
pipe-laying work. Helicopters, tugs and other vessels successfully saved 173 out of 195
workers, who were spread over an area of several miles by the storm. The number of
injured people is unknown but the accident report states that the majority of the
personnel was injured. In Figure 25, which reports the yearly distribution of fatalities and
injured, the symbolic number of 100 was reported for the year 1991.
A more detailed analysis of the offshore incidents and their consequences is required to
highlight the actual Natech accidents, among the many events reported. In order to
assess the health and environmental impact of Natechs occurring at offshore facilities, an
analysis of the hazmat releases caused by natural events was carried out. Spills and
releases are the precursors for technological accidents such as: fire, explosion and water
contamination. Therefore, they pose a significant threat to the lives of workers and to the
marine environment.

Figure 26 shows the statistics of release events reported in the database. In 60% of the
cases, no release of hazardous materials was reported. On the one hand, this is because
a relevant portion of the accidents only resulted in a limited amount of damage to the
facilities. On the other hand, also many of those accidents with severe consequences not
necessarily ended in a release. Even though collisions, mooring failure and listing are
considered serious accidents and may result in significant economic losses, they
produced hazmat releases only in a very few cases.
On top of this, it is also important to remark that only 45% of the accidents happened
during production operations (see Figure 23). The remainder occurred in other phases, in
which releases were less likely, e.g. during installation, drilling, construction,
maintenance and transport operations.

51
Moreover, violent storms and hurricanes can be easily forecast nowadays. Due to early
warning systems, companies are able to shut-down the extraction operation and to
secure the installations in advance, before the storm strikes. Nevertheless, releases did
occur, sometimes causing severe pollution. A total of 202 well documented loss-of-
containment (LOC) events were recorded, and in some 230 records, this information is
missing and the presence of a release is inconclusive. It is therefore likely that more
Natech events occurred but may not have been recorded as such.

Figure 24. Yearly distribution of accidents with injuries and fatalities due to natural-hazard impact

Figure 25. Yearly distribution of victims: injuries and fatalities

Figure 27 shows the distribution of the 202 documented releases, divided according to
the hazardous material released. Unfortunately, the data regarding the substance
released is missing for pipelines and in the figure they are reported with the label:
“Other/not specified”. However, since the pipelines’ main duty is the transport of
hydrocarbons, it is likely that the substances released were crude oil and natural gas.

52
 Figure 26. Distribution of natural-hazard triggered accidents resulting in release events

Figure 27. Distribution of release events by substance

Table 5 shows the final outcomes of the release scenarios (same definitions as in Figure
5). The largest portion of the releases (133) was labelled as Release of fluid or gas, since
the release of pollutant liquid was identified as the main loss for the installation. Among
these, the large majority (106) is constituted by releases from pipelines as a
consequence of Hurricanes in the Gulf of Mexico. Additionally, 18 leakages into hull and 6
well blowouts were experienced due to the impact of natural events. For the remaining
outcomes, the damage to the structure was the main event, while the spill of hazardous
material was considered a secondary effect. This explains why in 230 cases the
information regarding spills was missing in our data subset. It is likely that information
that is more complete in this regard could lead to different results.
For instance, past studies aimed to analyze the damage caused by hurricanes in the Gulf
of Mexico (Cruz and Krausmann, 2008; MMS, 2007) reported a prevalence of spills from
damaged platforms, rather than from leaking pipelines. Cruz and Krausmann (2008)
concluded: “The larger number of hazardous-materials releases from platforms as
compared to pipelines during both hurricanes indicates, possibly, that pipelines had been
de-inventoried prior to the storms and that this practice was successful. Nevertheless, oil
and natural gas releases from pipelines did occur. In fact, most natural-gas releases
reported occurred from pipelines rather than from platforms”. Analysis of an MMS report
of July 2007 (MMS, 2007) on hazmat releases triggered in 2005 by hurricanes Katrina

53
and Rita blames the failure of the platforms or the damage of their riser as the main
causes for hazmat release.

Table 5. The final outcomes that resulted in releases

Final outcome n°

Blowout 6

Breakage or fatigue 7

Capsizing, overturning, toppling 8

Collision 7

Falling load / Dropped object 1

Fire 16

Grounding 2

List, uncontrolled inclination 3

Other 1

Leakage into hull 18

Release of fluid or gas 133

Total 202

A total of 16 fire events were reported, ten of which were directly triggered by lightning
strikes. None of the reported fires caused serious damage to the installation, nor did they
result in fatal accidents. However, three fires produced a total of 11 wounded. In the first
case, the fire occurred when a lightning hit the flare boom, injuring one operator. In the
second, the fire occurred when a loading buoy broke its mooring chains in a storm, just
while a ship was about to conclude its loading operations, injuring two crew members.
The third occurred at an oil storage tank, after a pipe-laying barge and a jacket platform
collided; a total of eight people were injured among the crew of the barge and of its tug.

5.4 Offshore Accidents triggered by natural events in Europe

5.4.1 The Mediteranean

5.4.1.1 Natural Hazards

Mediterranean tropical-like cyclones (sometimes called medicanes) are rare
meteorological phenomena observed in the Mediterranean Sea. Due to the dry nature of
the Mediterranean region, formation of tropical-like cyclones is infrequent, with only 100
recorded events between 1948 and 2014 (Reale and Atlas, 2001). The majority of
medicanes forms over two main regions: the first and most active area is located in the
north-western Mediterranean in the area between the Balearic Islands, southern France,
Corsica and Sardinia; the latter overlaps the Ionian Sea and the Sea of Sicily.
Occasionally, in the Aegean and Adriatic seas, sporadic medicanes can also be generated.
The presence of mountains in the region is usually a factor that promotes severe
precipitation, but it mitigates the formation of medicanes.

54
According to recent studies conducted on global warming effects on the Mediterranean
region, tropical-like cyclones are likely to happen with lower frequency in the next 100
years, yet with stronger intensity (Reale and Atlas, 2001). Usually, these events are less
violent than most of the tropical cyclones, but occasionally the wind speed reaches
hurricane strength. Waves produced in these events had a maximum height of about
15m. The paper by Hewson and Neu (2015) gives an overview of the most important
assessments with climate models on the expected climate changes in Europe and their
impacts on extreme weather events.
Earthquakes are also a relevant threat to industrial activities in the whole Mediterranean
region and a potential threat to offshore platforms. shows all the past earthquakes, which
have a magnitude of 5 or higher (EMSC, 2016). The very most of the events were
reported off the Greek and Turkish shores, but several other events occurred in other
nations: Portugal, Gibraltar, Morocco, Algeria, Italy, Albania and Bosnia and Herzegovina.
As a consequence of the numerous earthquakes, tsunamis are also a potential threat to
offshore facilities in the region. The well documented 1908 Messina earthquake (7.1 M)
and tsunami (12 m), a very paragon of this hazard, caused some 123,000 fatalities and
the cities of Messina and Reggio Calabria were almost completely destroyed. Rare, yet
devastating earthquakes and tsunamis also occurred in the Atlantic coast off Portugal,
like the earth shock and wave surge which almost destroyed the city of Lisbon in 1755.

Figure 28. Locations of last M5+ earthquakes in the Mediterranean region, recorded since 2004

Source: EMSC, 2016

Many active volcanoes can be a threat to offshore installations located in the

Mediterranean Sea (see Figure 29). Volcanoes are not widespread in the whole basin, but
they are concentrated in three areas: southern Italy, Greece and Turkey. The main threat
of volcanoes is due to falling ashes, produced on eruption, which can cover everything
within several miles. Even though there is no evidence of offshore infrastructure damage
due to ashes in the past, many episodes of structural damage to buildings due to ash
overload have been reported. Under certain circumstances, volcanoes can literally
explode and throw fragments, rocks and lava several miles away. Moreover, volcanic
eruptions are usually associated with an intense seismic activity and landslides,
eventually generating tsunami waves in the process. Finally, submarine volcanoes can
release gases during eruption, causing loss of buoyancy in those vessels transiting on the
sea surface.

55
 Figure 29. Locations of volcanoes in the Mediterranean region

Source: Smithsoninan Institution, 2016

5.4.1.2 Accident Analysis

According to the accident records in the dataset, only 13 of a total of 1085 natural-
hazard triggered offshore accidents occurred in the Mediterranean Sea. Both wind forces
and wave impacts were highlighted as having caused at least one accident each, while
the most frequently reported cause was general bad weather. All of these accidents were
caused by either rough sea or storm. Units involved were mostly barges and jackups, and
one semi-submersible rig. The jackup sustained damage to its legs due to wave impact
and to its derrick due to strong winds. One of the barges suffered direct damage to its
structure, another to its risers. In the other cases, barges lost their anchors, eventually
damaging their risers also.
In two cases, the accident cause was vessel collision with a platform, which caused
damage to both infrastructures. Four accidents occurred during towing of the units to
another position. When the cable connection was lost during bad weather the platforms
went adrift and, in one case, subsequently grounded. A drillship was under construction
when strong winds broke the cable connections that kept its rig in place, which in turn
crashed on the bridge. No injuries, fatalities or spills were reported in any of the recorded
accidents.

5.4.2 The North Sea and West Europe

5.4.2.1 The natural hazards

The North Sea emerged as a key oil producing area in the late 1980s. A large number of
companies operate in in the North Sea, spread over five different countries: Great
Britain, The Netherlands, Germany, Denmark and Norway. To be more specific, the
extraction sites of the Barents Sea and of the Norwegian Sea are also included when
referring to the North Sea region within the framework of this analysis.
Oil extraction in the North Sea’s inhospitable climate was one of the greatest challenges
to offshore technology of the last century. Sere storms are likely to strike the North Sea
region, with winds up to 200 km/h and waves up to 25 m high (see Table 2). Even
though the consequences of storms may be similar to those experienced in tropical
areas, the causes of heavy storms in the North Sea region are many and less predictable.

56
Most of European storms are generated from extratropical cyclones. While larger-scale
aspects of extratropical cyclones can be easily forecast, the occurrence, location, and
severity of the local major wind damage, are not. The strong wind phenomena that give
rise to "damage footprints" at the surface are dubbed European windstorms. Those
storms can be placed into three categories, namely: the warm jet, the cold jet and the
sting jet. These phenomena vary in terms of physical mechanisms, atmospheric
structure, spatial extent, duration, severity level, predictability, and location relative to
the cyclone and its fronts. Out of the three windstorm classes the strongest, yet the
rarest, is the sting jet. Table 5 gives a summary of windstorms that occurred in Europe in
the last 35 years (XWS, 2016; Roberts et al., 2014).
In the present climate, West European storms primarily occur in winter and are
associated with mid-latitude “baroclinic instability”. However, global warming and
increased sea surface temperatures (SSTs) have the potential to alter the frequency and
the intensity of West-European storms (Haarsma et al. 2013). This raises concern
regarding the possibility of storm intensity increase in the northern Atlantic region, in the
near future. Furthermore, based on global warming scenarios, rougher wave conditions
and higher sea levels should be expected (Debernard et al, 2002). According to Kushnir
et al. (1997), North Atlantic wave heights have increased in the past years. The same
conclusion was drawn by Gulev and Hasse (1999), who also relate the increase of wave
height with the increase of wind speed in the northern Atlantic.
Wind storms could be a major problem for the southern part of the North Sea, in
particular for the UK and Netherlands. At higher latitudes, however, different atmospheric
phenomena trigger heavy storm weather. A polar low is a small-scale, atmospheric low
pressure system (depression) that is found over the ocean areas poleward of the main
polar front in both the Northern and Southern Hemispheres. Due to hurricane-force winds
and high waves they can produce, together with its circular shape with an eye in the
center, they are often referred to as Arctic hurricanes. These systems expire quickly and
they usually exist for no more than a couple of days. Polar lows are a major hazard to
high-latitude operations, such as shipping and oil or gas extraction. They frequently
occur at the fields in the northern Norwegian Sea and at the Barents Sea.
Freezing is a major issue in northern regions, causing random rupture to process
equipment and pipelines. Occasionally, corrosion due to high water salinity and fatigue
contributed to freezing cold and heavy storms, to produce an accident. Lightning is also
an important hazard: 11 out of a total of 17 lightning-triggered accidents occurred in the
North Sea. Seismic activity is weak and active volcanoes are absent in this region.

5.4.2.2 The Accident Analysis

Harm to human health was recorded in 22 accidents that occurred in this area. In 16 of
the reported accidents, injuries were documented, while fatalities were reported in 7
cases. The accident resulting in the highest number of fatalities, 6, also produced the
highest number of injured people, namely 15. In 1976, the rig Deep sea driller was
escorted by two tugs when it was blown aground. All but six crew members were
evacuated into a lifeboat. Eventually, the lifeboat was also washed ashore and the crew
was tossed into the sea.
It is worth to highlight how the large majority of accidents occurred at semi-submersible
platforms and in particular to the mooring and anchoring systems. Corrosion is likely to
happen, due to the high salinity of the sea, accompanied by the salt precipitation when of
sea sprays freeze on the metal surfaces. Moreover, the frequent storms and rough sea
conditions add a considerable fatigue to chains and cables. As a result, the overall
resistance of the anchor and mooring system is considerably reduced, so badly that it
often fails to meet the design requirements (PSA, 2014).
Of particular interest are the fields in the northern Barents Sea with demands for
additional design requirements for arctic structures (ISO 19906; Barent 2020 project).
Even though there are no records of accidents that occurred at those sites, they add a

57
novel risk to the many already affecting offshore facilities in this region: the unavailability
of rescue teams. Some fields, e.g. the exploration field Castberg, are located very far
from the coastline up to several hundred miles out of the northern Norwegian shores and
are in practice isolated from the in-land emergency responders. Northern Norwegian
waters feature by big distances and little support infrastructures. These conditions mean
that rescue and evacuation capacity is currently limited.

5.5 Wrapping-up and future work

Threats due to natural hazards are a major risk for oil and gas offshore installations that
operate, by definition, in a hazardous environment. Accidents at extremely expensive
structures with a large crew and which share the same operational zone with coastal
areas, fishing zones and shipping lanes may have tremendous consequences. Therefore,
large investments are necessary to ensure the safety of drilling, processing, construction,
installation and transportation activities. Despite the best efforts of engineers, some risks
to a very small extent, losses and extreme natural events can never be entirely
eliminated.
Additionally an analysis of natural-hazards risks to offshore installations was carried out
for two European regions: the Mediterranean Sea and the North Sea. If in the first region
the main natural hazards are sporadic storms and non-negligible seismic activity, in the
North Sea frequent winter storms and lightning are directly responsible for a number of
accidents, and the harsh cold weather is a promoter of many others due to corrosion and
fatigue effects.
One interesting result of this analysis is the reduction of the number of accidents due to
natural events in the very last years, after the impact of hurricanes Andrew, Katrina and
Rita forced the industrial standards and recommended practices to be revised. While this
improvement is worthy to be acknowledged, accidents still occur and more dangerous
extreme events are expected in the future due to global warming. Moreover, due the
exponential growth of offshore installations worldwide together with the tendency to build
bigger and more complex systems, novel and unpredicted hazards may emerge.
Therefore, the efforts of oil companies and of policy makers toward safer industrial
design and practice should continue in the years to come.
It is these authors’ intention to build up on the findings of this report during the activities
enviaged for the second year of the project. More statistical analyses are foreseen,
conducive in deriving various frequency distributions and figures useful in further QRA
studies.

58
6 Conclusions
The present work is a short introduction to the offshore risk assessment and an overview
of the main analysis techniques, as emerging from the industry and regulatory
documents in the business. Mainly based on bibliographic research, the report had as
objective the introduction of the reader to the context and complexity of the offshore risk
assessment.
Moreover, it was these authors’ intention to cover the concepts and notions that would
represent the foundation on which the further activities within this project will develop
(the illustration of different type of analyses).
Already in anticipation of these activities, the reader was presented to a practical
example of one of the fundamental analysis methods in the offshore risk assessment, i.e.
the analysis of historical records. The WOAD accident database has been analysed by
investigating the role of the natural environment on triggering, promoting and escalating
accidents at offshore facilities. A statistical analysis was carried out of a dataset of
incidents triggered by natural events, to sort the natural hazards based on their
occurrence, likelihood, severity and characteristics. An in-depth analysis for every
offshore structure type provided clear indications of the wide spectrum of damage modes
due to natural hazards. Also, to identify possible Natech events and to understand their
gravity, a consequence-driven analysis of the dataset was carried out. The accidents
resulting in immediate or delayed harm to humans or to the environment were selected
and assessed.
In respect to the offshore risk assessment several remarks could be made: first, on the
methods of assessment, we would state that no ‘offshore-only’ methods have been
identified. The ‘classical’ methods are offered as practical tools for performing the
assessment, naturally, adapted for the petrochemical industry in the first place, and to
the offshore specificities in the second place. The identification of the appropriate
methods required and suitable for a task, as well as the level of details of the analysis, is
the role (and also the responsibility) of the ‘risk assessment supervisor’.
Both qualitative and quantitative risk assessment methods are used, mainly depending
on:

— the risk assessment phase (e.g. Hazard Identification, Consequence assessment, etc.)
— the risk assessment ‘objective’ (i.e. environmental, human, installation, operation)
— the phase in the lifecycle (i.e. design, construction, operation)
— the offshore operation (e.g. drilling, production, work-over)
— the maturity (technical and operational) of the activity/facility analysed.
The qualitative methods are the most used techniques; the qualitative assessment is
applied in many of the offshore activities, including, yet not limited to: drilling and well
services, production, maintenance, modifications of design, transportation, marine
operations and organizational changes. The qualitative assessment is most frequently a
group effort, involving experts with various competencies and experience in factors.
Therefore, key factors for a valid assessment are the experience of the risk team leader;
and the competence and experience in the team of experts.
In respect to the quantitative assessment, these studies are more recommended for new
or innovative designs. Over the time there was (and in these authors’ opinion still is) a
general posture in the practitioners’ community (and the offshore makes no difference)
to look at the quantitative risk assessment with reluctance, especially in the operational
phase. As consequence, the quantitative methods are mainly used in the engineering and
fabrication phases. The reasons for this reluctance have both subjective and objective
causes. Among these:
— they are at the interface between scientist, practitioners and regulators;

59
— the failure of communication of the quantitative risk results;
— the inherent limitation of the models employed (especially with the consequence
assessment);
— variability in terms of the assessment results (a difference of two order of magnitude
between the results of two models addressing the same phenomenon are acceptable
in the scientific community)
— the complexity of the models which, in turn, is translated in the feasibility of a
practical use (in the operational phase), mainly due to the lack of input data
(frequency data, monitoring data).
Over the last decades, however, there have been improvements in some of the aspects
presented above. These mainly come from:
— the experience data size and availability developed dramatically, by
— improvements in the sensor technologies, i.e. more parameters to be recorded,
greater sensitivity, etc.;
— huge improvements in data storage and accessibility;
— improvements of the analytical models (ignition, smoke and fire, explosion loads,
atmospheric dispersion, aquatic dispersion)
— computational power and data availability;
— the advent of the Internet and the technologies such as GIS that hugely help in the
risk communication.
As a consequence, the request of QRA is included nowadays in most of the regulatory
documentation.
As mentioned before, this report is intended to lay down the main concepts on which the
future activities will unfold. The activities as foreseen include an in-depth description of
some of the methods and models mentioned in this report, and the illustration of their
practical application into a coherent risk assessment of an offshore facility.

60
References
Ambion (1997), Approaches to Hazard Identification, Ambion Consultants, Offshore
Technology Report OTO 97 068, Health & Safety Executive, HSE Books.
American Bureau of Shipping, Guidance notes on Riak Assessment Applications for the
Marine and Offshore Oil and Gas Industries. American Bureau of Shipping, June 2000.
American Petroleum Institute, API RP 2MET Derivation of Metocean Design and
Operating Conditions, ISO 19901-1:2005 (Modified), Petroleum and natural gas
industries - Specific requirements for offshore structures - Part 1: Metocean design and
operating considerations, American Petroleum Institute , US, First Edition, 2014.
A.M. Cruz, E. Krausmann, Damage to offshore oil and gas facilities following hurricanes
Katrina and Rita: An overview, Journal of Loss Prevention in the Process Industries, 21,
Issue 6, 2008, 620-626
A.M. Cruz, E. Krausmann, Hazardous-materials releases from offshore oil and gas
facilities and emergency response following Hurricanes Katrina and Rita, Journal of Loss
Prevention in the Process Industries, 22, Issue 1, 2009, 59-65
Bell J., Holroyd J. (2009), Review of human reliability assessment methods, report
prepared for Health and Safety Executive, RR679. HSE Books, 2009
(available online at: http://www.hse.gov.uk/research/rrpdf/rr679.pdf)
Coca D., Garcia de Blas R., Gallejones C.F., Moral R.G., Calvo J., Alvarez J., Canto A.
Operational risk management in the energy industry. ©Management Solutions, 2014;
on-line report (www.managementsolutions.com)
Comer, P.J., Fitt, J.S. & Ostebo, R. (1986), A Drillers’ HAZOP Method, Paper SPE 15876,
European Petroleum Conference, Society of Petroleum Engineers, London.
J. Debernard, Ø. Saetra, L. P. Røed, Future wind, wave and storm surge climate in the
northern North Athlantic, Clim Res, 23, 2002, 39-49
Department of Homeland Security, DHS Risk Lexicon. 2010 Edition, DHS Risk Steering
Committee. September 2010
Det Norske Veritas (2002). Marine risk assessment, prepared for Health and Safety
Executive, UK (HSE). HSE Offshore Technology Report OTO 2001/063, ISBN 0 7176 2231
2.
Det Norske Veritas (2007). Pipeline damage assessment from hurricanes Katrina and Rita
in the Gulf of Mexico, Det Norske Veritas Report 448 14183 Rev.1.
EMSC (2016). European Mediterranean Seismological Centre (Available at
http://www.emsc-csem.org)
Ericson, C. A. Hazard Analysis Techniques for System Safety. New York, John Wiley &
Sons Ltd. (2005)
Gulev, S. K., and L. Hasse (1999), Changes of wind waves in the North Atlantic over the
last 30 years, Int. J. Climatol., 19, 1091–1117.
R. J. Haarsma, W. Hazeleger, C. Severijns, H. de Vries, A. Sterl, R. Bintanja, G. Jan van
Oldenborgh, and H. W. van den Brink, More hurricanes to hit Western Europe due to
global warming, GEOPHYSICAL RESEARCH LETTERS, vol. 40, 2013, 1783–1788
T. D. Hewson and U. New Cyclones, windstorms and the IMLAST project. Tellus A 2015,
67 27128, http://dx.doi.org/10.3402/tellusa.v67.27128
Health and Safety Executive UK (HSE) Guidance on Risk Assessment for Offshore
Installations. Offshore Information Sheet N0. 3/2006.
IPIECA/IOGP Oil spill risk assessment and response planning for offshore installations,
IPIECA/IOGP report, 2013

61
IOGP (2008). Asset integrity – the key to managing major incident risks, IOGP Report
No. 415, December 2008.
IOGP (2016). Standardization of barrier definitions, IOGP Report No. 544, supplement of
IOGP Report 414. April 2016.
IEC/ISO 31010:2009, Risk management — Risk assessment techniques
ISO 17776:2000, Petroleum and natural gas industries — Offshore production
installations – Guidelines on tools and techniques for hazard identification and risk
assessment
ISO 19900, Petroleum and natural gas industries — General requirements for offshore
structures
ISO 19902, Petroleum and natural gas industries — Fixed steel offshore structures
ISO19901-2, Petroleum and natural gas industries — Specific requirements for offshore
structures — Part 2: Seismic design procedures and criteria
ISO 19904, Petroleum and natural gas industries — Floating offshore structures including
stationkeeping
ISO 19905-1, Petroleum and natural gas industries — Site-specific assessment of mobile
offshore units — Part 1: Jack-ups
ISO/TR 19905-2, Petroleum and natural gas industries — Site-specific assessment of
mobile offshore units — Part 2: Jack-ups commentary
Kaiser M. J. World offshore energy loss statistics, Energy Policy 35, 2007, 3496-3525
Kushnir, Y., V. J. Cardone, J. G. Greenwood, and M. A. Cane, 1997: The recent increase
in North Atlantic wave heights. J. Climate, 10, 2107–2113
NORSOK, Risk and emergency preparedness assessment. NORSOK Standard Z-013.
Edition 3, October 2010.
O. Reale and R. Atlas, 2001: Tropical Cyclone–Like Vortices in the Extratropics:
Observational Evidence and Synoptic Analysis. Wea. Forecasting, 16, 7–34
PSA - Petroleum Safety Authority Norway (2014). Anchor line failure - Norwegian
Continental Shelf - 2010-2014.
Mosleh A., Rasmuson D.M., Marshall F.M (1998), Guidelines on Modeling Common-Cause
Failures in Probabilistic Risk Assessment. U.S. Nuclear Regulatory Commission (U.S.
NRC), Report NUREG/CR-5485, INEEL/EXT-97-01327 (November 1998)
(online at:https://nrcoe.inel.gov/resultsdb/publicdocs/CCF/NUREGCR-
5485_Guidelines%20on%20Modeling%20Common-ause%20Failures%20in%20PRA.pdf)
NPD - National Petroleum Directorate, 2016- http://gis.npd.no/factmaps/html_20/ (last
access 25/08/2016), 209-215
OGP (2010), Consequence modelling, Risk Assessment Data Directory, Report No. 434-7
(March 2010)
OGP, Reliability of offshore structures— Current design and potential inconsistencies,
Workshop proceedings, OGP Report No. 486, March 2014, International Association of Oil
and Gas Producers, Blackfriars Road London SE1 8NL United Kingdom, 2014
Oil & Gas UK, Guidance on the Conduct and Management of Operational Risk Assessment
for UKCS Offshore Oil & Gas Operations. Issue 1, January 2012
OSD (2013). Directive 2012/18/EU of the European Parliament and of the Council of 4
July 2012 on the control of major-accident hazards involving dangerous substances,
amending and subsequently repealing Council Directive 96/82/EC
http://eurlex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32012L0018.

62
Extreme Wind Storms (XWS) Catalogue, 2016: http://www.europeanwindstorms.org/cgi-
bin/storms/storms.cgi?sort=date&opt= last access (25/08/2016)
Rasmussen N., et.al Reactor Safety Study: An Assessment of Accident Risks in U.S.
Commercial Nuclear Power Plants [NUREG-75/014 (WASH-1400)]. U.S. N.R.C., 1975
Saoud Y.E., Israni K., Goddard J. Bow-Tie Diagrams in Downstream Hazard Identification
and Risk Assessment. Wiley Online Library (wileyonlinelibrary.com). DOI
10.1002/prs.11576
Schuller J.C.H et.al (1997) Methods for determining and processing probabilities – the
Red Book. Second Edition. Committee for Prevention of Disasters, The Netherlands. CPR
12E
Smithsoninan Institution (2016), National Museum of Natural History, Global Volcanism
Program http://volcano.si.edu/
(kml file available at www.volcano.si.edu/ge/GVPWorldVolcanoes-List.kmz - last access
(30/08/2016))
van den Bosch C.J.H, et.al. (1992) Methods for the determination of possible damage –
the Green Book. First Edition. Committee for Prevention of Disasters, The Netherlands.
CPR 16E
van den Bosch C.J.H, Wetrings R.A.P.M. Editors. (2005) Methods for calculation of
physical effects – the Yellow Book. Third Edition. Committee for Prevention of Disasters,
The Netherlands. CPR 14E
U.S. Department of Energy (2006), Impact of the 2005 Hurricanes on the Natural Gas
Industry in the Gulf of Mexico Region, U.S. Department of Energy’s Office of Fossil
Energy, Final Report 2006 (Available at:
http://dnr.louisiana.gov/assets/docs/oilgas/productiondata/hurricane/Impact%20of%200
5%20hurricanes%20on%20gas%20industry%20-%20DOE.pdf)
Vario, J. K. "Fault tree analysis of phased mission system with repairable and non-
repairable components." Reliability engineering and System Safety. Vol.74: 169-180
(2002)
Wierman T.E., Rasmuson D.M., Mosleh A. (2007), Common-Cause Failure Database and
Analysis System: Event Data Collection, Classification, and Coding, U.S. Nuclear
Regulatory Commission (U.S. NRC), Report NUREG/CR-6268 Rev.1, INL/EXT-07-12969
(September 2007)
J. F. Roberts, A. J. Champion, L. C. Dawkins, K. I. Hodges, L. C. Shaffrey, D. B.
Stephenson, M. A. Stringer, H. E. Thornton, and B. D. Youngman, The XWS open access
catalogue of extreme European windstorms from 1979 to 2012, Nat. Hazards Earth Syst.
Sci., 14, 2487–2501, 2014
Det Norske Veritas, 2013. WOAD – Worldwide Offshore Accident Databank.

63
64
List of figures
Figure 1. Risk assessment in the risk management context ......................................... 7
Figure 2. Quantitative vs qualitative methods selection ............................................10
Figure 3. Possible screening process for determining the appropriate assessment level 10
Figure 4. Consequence Phenomena and their relationship ........................................14
Figure 6. Example of risk matrix (5x6) with the level of impacts declared. ..................18
Figure 7. What-if analysis output example ...............................................................20
Figure 8. Checklist analysis output example ...........................................................21
Figure 9. HAZOP analysis example ..........................................................................22
Figure 10. FMEA output example ............................................................................24
Figure 11. FMECA example ....................................................................................25
Figure 12. Example of SWIFT worksheet ..................................................................29
Figure 13. Fault tree analysis example ....................................................................31
Figure 14. Generic Event Tree example ...................................................................33
Figure 15. CCF causes, coupling factors, failure state events relationship ...................34
Figure 16. Example of cause defense matrix ............................................................35
Figure 18. Offshore accidents triggered by natural hazards grouped according to their
geographic location. ..............................................................................................41
Figure 19. Yearly distribution of offshore incidents caused by natural events ................42
Figure 20. The distribution of damage extent categories for accidents triggered by
natural events ......................................................................................................43
Figure 21. Distribution of accidents by offshore structure type ..................................45
Figure 22. Distribution of accidents by final outcomes ..............................................45
Figure 23. Distribution of the ongoing operations’ type ............................................45
Figure 24. Yearly distribution of accidents with injuries and fatalities due to natural-
hazard impact ......................................................................................................52
Figure 25. Yearly distribution of victims: injuries and fatalities ..................................52
Figure 26. Distribution of natural-hazard triggered accidents resulting in release events
..........................................................................................................................53
Figure 27. Distribution of release events by substance .............................................53
Figure 28. Locations of last M5+ earthquakes in the Mediterranean region, recorded
since 2004 ...........................................................................................................55
Figure 29. Locations of volcanoes in the Mediterranean region ..................................56

65
List of tables
Table 1. Risk assessment characteristics throughout the lifespan of a project ............... 9
Table 2. Number and type of the main natural hazards to offshore facilities recorded in
WOAD .................................................................................................................42
Table 3. Summary of the most severe storm conditions recorded in WOAD, subdivided
on the basis of regional attribution .........................................................................43
Table 4. Main damage mechanisms due to natural hazards based on our accident
analysis ...............................................................................................................46
Table 5. The final outcomes that resulted in releases ...............................................54
Table A-1. List of Natech accidents recorded in the Mediterranean Sea ........................68
Table A-2. List of Natech accidents recorded in West Europe ......................................68
Table A-3. List of Natech accidents recorded in the North Sea and Baltic Sea ...............70

66
Annexes
Annex 1. Offshore NATECH accidents in European waters
The following is a list of offshore infrastructure damage and Natech accidents case
studies in European waters (West Europe, Mediterranean Sea and North Sea).
The list has been extracted from the WOAD database and represented the base of the
study in Chapter 5.

67
Table A-1. List of Natech accidents recorded in the Mediterranean Sea
Accident ID No. Name of Unit Type of Unit Function Nation Main Operation Natural Damage Spill Type Main Event
A2 (ISO) Hazard
1972-09-13/001 WESTERN OFFSHORE 5 Drill barge Drilling TN Drilling, unknown phase Bad weather Significant No spill Anchor/mooring failure
1972-12-05/001 WESTERN OFFSHORE 5 Drill barge Drilling TN Drilling, unknown phase Bad weather Significant No spill Other
1974-03-13/001 RAYDRILL NO 1 Drill barge Drilling DZ Drilling, unknown phase Bad weather Severe No spill Breakage or fatigue
1976-02-05/001 WESTERN OFFSHORE 5 Drill barge Drilling GR Drilling, unknown phase Bad weather Insignificant No spill Collision, offshore units
1977-01-20/002 OLYMPIA Jackup Drilling ES Transfer, wet Bad weather Minor No spill Grounding
1978-12-90/001 WESTERN POLARIS 1 Jackup Drilling IT Drilling, unknown phase Bad weather Significant No spill Breakage or fatigue
1979-02-19/001 DYVI GAMMA Jackup Drilling IT Testing Bad weather Insignificant No spill Falling load
1982-01-12/001 ZAGREB NO.1 Semi-Sub Drilling LY Drilling, unknown phase Bad weather Minor No spill Collision, offshore units
1984-12-05/005 PANON Jackup Drilling BA Transfer, wet Bad weather Minor No spill Breakage or fatigue
1987-03-20/005 PEARL MARINE Barge (Other) Crane IT Repair work/under rep Bad weather Minor No spill Breakage or fatigue
1999-10-01/001 ATWOOD EAGLE Semi-Sub Drilling LY Transfer, wet Bad weather Insignificant No spill Out of position, adrift
1999-10-02/000 DISCOVERER ENTERPRISE Drill ship Drilling ES Under construction Bad weather Minor No spill Breakage or fatigue
2002-08-24/000 KEY SINGAPORE Jackup Drilling CY Transfer, wet Bad weather Insignificant No spill Out of position, adrift

Table A-2. List of Natech accidents recorded in West Europe

Accident ID No. Name of Unit Type of Unit Function Nation Main Operation Natural Damage Spill Type Main Event
A2 (ISO) Hazard
1975-12-29/001 NICO Jackup Drilling ES Transfer, wet Bad weather Significant No spill Collision, offshore units
1976-01-06/001 GENERAL ENRIQUE MOSCONI Semi-Sub Drilling FR Under construction Bad weather Significant No spill Leakage into hull
1976-10-14/001 NO. 4 Barge (Other) Service GB Construct. work unit Bad weather Total loss No spill Loss of buoyancy or sinking
1977-12-08/001 MER D'IROISE 1 Jackup Drilling FR Transfer, wet Bad weather Severe No spill Leakage into hull
1978-01-30/002 CHRIS CHENERY Semi-Sub Drilling FR Idle Bad weather Significant No spill Collision
1978-03-04/002 ORION Jackup Drilling GB Transfer, wet Bad weather Significant No spill Grounding
1981-07-28/001 IB 901 Jackup Drilling IE Transfer, wet Bad weather Significant No spill Breakage or fatigue
1981-10-10/001 KINGSNORTH UK Semi-Sub Drilling IE Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1982-00-90/002 GP-11 Drill barge Drilling FR Transfer, dry Bad weather Significant No spill Collision, offshore units
1985-06-03/008 GIANT 1 Mobile unit Crane ES Transfer, wet Bad weather Total loss No spill Grounding
1986-05-06/005 SANTA FE RIG 140 Semi-Sub Drilling FR Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1990-09-21/006 JOHN SHAW Semi-Sub Drilling ES Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1990-10-22/008 H.M.D. MARINER Barge (Other) Crane GB Idle Bad weather Significant No spill Grounding
1994-03-11/002 H.D. BARGE NO. 3 Barge (Other) Service GB Construct. work unit Bad weather Severe No spill Loss of buoyancy or sinking
1994-03-11/003 NO. 3 Barge (Other) Service GB Construct. work unit Bad weather Significant No spill Collision, offshore units
1994-03-11/004 NINIAN NORTH 3/3 CENTRAL Concrete structure Drill.&Prod. GB Under construction Bad weather Significant No spill Leakage into hull
1994-03-11/005 H.D. BARGE NO. 4 Barge (Other) Service GB Construct. work unit Bad weather Significant No spill Collision
1994-04-01/008 GP-12 Drill barge Drilling FR Transfer, dry Bad weather Significant No spill Collision, offshore units
1999-10-06/000 SCHIEHALLION FPSO FPSO/FSU Production GB Production Bad weather Significant No spill Breakage or fatigue
2000-04-08/000 ROWAN GORILLA 5 Jackup Drilling FR Transfer, wet Bad weather Significant No spill Breakage or fatigue
2003-03-01/008 TOG MOR Barge (Other) Crane GB Construct. work unit Bad weather Insignificant No spill Anchor/mooring failure

68
69
Table A-3. List of Natech accidents recorded in the North Sea and Baltic Sea
Accident ID No. Name of Unit Type of Unit Function Nation Main Operation Natural Damage Spill Type Main Event
A2 (ISO) Hazard
1970-00-90/004 GLOMAR NORTH SEA Drill ship Drilling GB Drilling, unknown phase Bad weather Significant No spill Anchor/mooring failure
1970-10-22/002 STAFLO Semi-Sub Drilling GB Drilling, unknown phase Bad weather Significant No spill Anchor/mooring failure
1971-10-21/001 TRANSWORLD RIG 61 Semi-Sub Drilling GB Drilling, unknown phase Bad weather Significant No spill Breakage or fatigue
1972-01-25/001 STAFLO Semi-Sub Drilling GB Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1972-03-07/001 OCEAN VIKING Semi-Sub Drilling NO Repair work/under rep Bad weather Insignificant No spill Anchor/mooring failure
1972-04-13/001 H 101,WITH EKOFISK JACKET Mobile unit Service NO Transfer, wet Bad weather Total loss No spill Grounding
1973-00-90/002 ZEPHYR 1 Semi-Sub Drilling GB Drilling, unknown phase Bad weather Significant No spill Breakage or fatigue
1973-11-20/001 BLUE WATER NO. 3 Semi-Sub Drilling GB Drilling, unknown phase Bad weather Minor No spill Anchor/mooring failure
1973-11-20/002 STAFLO Semi-Sub Drilling GB Drilling, unknown phase Bad weather Significant No spill Anchor/mooring failure
1973-11-28/001 SEA QUEST Semi-Sub Drilling GB Drilling, unknown phase Hurricane Insignificant No spill Other
1973-12-15/001 BLUE WATER NO. 3 Semi-Sub Drilling GB Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1973-12-29/001 OCEAN VOYAGER Semi-Sub Drilling NO Transfer, wet Bad weather Minor No spill Towline failure/rupture
1973-12-31/001 NEPTUNE 7 Semi-Sub Drilling NO Drilling, unknown phase Bad weather Significant No spill Breakage or fatigue
1974-00-90/003 TRANSWORLD RIG 58 Semi-Sub Drilling GB Drilling, unknown phase Bad weather Severe No spill Breakage or fatigue
1974-01-07/001 GLOMAR GRAND ISLE Drill ship Drilling GB Drilling, unknown phase Bad weather Severe No spill Breakage or fatigue
1974-01-22/001 TRANSWORLD RIG 61 Semi-Sub Drilling GB Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1974-01-22/002 TRANSWORLD RIG 61 Semi-Sub Drilling GB Drilling, unknown phase Bad weather Severe No spill Breakage or fatigue
1974-03-02/001 WEST VENTURE Semi-Sub Drilling GB Drilling, unknown phase Bad weather Insignificant No spill Other
1974-10-28/001 BAR 323 Barge (Other) Residence GB Other Bad weather Minor No spill Other
1975-01-27/001 VENTURE ONE Semi-Sub Drilling FI Under construction Bad weather Significant No spill Collision
1975-04-11/001 BEDFORD 10 Jackup Drilling GB Idle Bad weather Significant No spill Leakage into hull
1975-09-03/001 AUK,30/16,A Jacket Production GB Under construction Bad weather Severe No spill Collision, offshore units
1975-12-11/001 BERYL 9/13,A SPM-1 Loading buoy Storage GB Under construction Bad weather Significant No spill Grounding
1976-01-09/002 TRANSWORLD RIG 58 Semi-Sub Drilling GB Drilling, unknown phase Bad weather Significant No spill Anchor/mooring failure
1976-03-10/001 DEEP SEA DRILLER Semi-Sub Drilling NO Transfer, wet Bad weather Total loss No spill Grounding
1976-11-23/001 STARDRILL Semi-Sub Drilling GB Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1976-11-24/001 FORTIES,21/10,FC Jacket Drill.&Prod. GB Production Bad weather Minor Oil & lube Release of fluid or gas
1977-02-26/001 ORCA Barge (Other) Pipelaying NO Mobilizing Bad weather Minor No spill Falling load/Dropped object
1977-11-19/001 HEATHER,2/5,A Jacket Production GB Under construction Bad weather Insignificant No spill Other
1979-07-09/001 PORA EERO Mobile unit Drilling FI Transfer, wet Bad weather Severe No spill Loss of buoyancy or sinking
1979-12-05/001 STATFJORD,33/9A,A Concrete structure Drill.&Prod. NO Production Bad weather Minor No spill Breakage or fatigue
1980-04-21/001 ALEXANDER L.KIELLAND Semi-Sub Accommodation NO Accommodation Bad weather Total loss No spill Capsizing, overturn, toppling
1980-09-09/002 STATFJORD,33/9,SPM A Loading buoy Storage NO Loading of liquids Bad weather Insignificant Oil & lube Fire
1980-12-09/001 BRENT,211/29,C Concrete structure Drill.&Prod. GB Production Bad weather Significant No spill Collision, offshore units
1981-02-24/002 DIRK Jackup Drilling SE Transfer, wet Bad weather Minor No spill Collision, offshore units
1981-02-24/003 DYVI DELTA Semi-Sub Drilling NO Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1981-09-08/002 WEST VENTURE Semi-Sub Drilling NO Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1981-11-24/001 SS PHILLIPS Semi-Sub Service NO Service Bad weather Minor No spill Anchor/mooring failure
1981-11-25/001 TRANSWORLD RIG 58 Semi-Sub Production GB Production Bad weather Significant No spill Anchor/mooring failure
1982-02-20/001 BUCHAN A Semi-Sub Production GB Production Bad weather Insignificant No spill Breakage or fatigue
1982-05-04/001 SEMAC 1 Barge (Other) Pipelaying GB Other Bad weather Significant No spill Loss of buoyancy or sinking
1982-10-18/001 WESTERN APOLLO 2 Jackup Drilling GB Mobilizing Bad weather Insignificant No spill Towline failure/rupture
1982-12-21/001 ARGYLL,30/24,SPM Loading buoy Storage GB Loading of liquids Bad weather Insignificant Oil & lube Other
1982-12-24/001 SEAFOX 1 Jackup Residence NL Transfer, wet Bad weather Minor No spill List, uncontrolled inclination

70
Accident ID No. Name of Unit Type of Unit Function Nation Main Operation Natural Damage Spill Type Main Event
A2 (ISO) Hazard
1982-12-29/001 TRANSOCEAN 4 Jackup Drilling NL Transfer, wet Bad weather Significant No spill List, uncontrolled inclination
1983-01-06/001 COLOMBINE,SALM BUOY Loading buoy Storage GB Loading of liquids Bad weather Severe No spill Breakage or fatigue
1983-01-12/001 STATFJORD,33/12,B SPM Loading buoy Storage NO Loading of liquids Bad weather Significant Oil & lube Release of fluid or gas
1983-01-22/008 BORGSTEN DOLPHIN Semi-Sub Drilling NO Exploration drilling Bad weather Significant No spill Breakage or fatigue
1983-02-04/001 STC PLATON Jackup Drilling NL Transfer, wet Bad weather Significant No spill Breakage or fatigue
1983-06-29/001 PENROD 85 Jackup Drilling GB Exploration drilling Bad weather Minor Oil & lube Collision, offshore units
1983-10-20/008 MAERSK EXPLORER Jackup Drilling DK Transfer, wet Bad weather Insignificant No spill Out of position, adrift
1983-10-20/009 DEEP SEA SAGA Semi-Sub Drilling NO Idle Bad weather Significant No spill Anchor/mooring failure
1983-10-25/001 OCEAN KOKUEI Semi-Sub Drilling NO Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1983-12-02/001 MONTROSE,22/17,SPM/A Loading buoy Storage GB Loading of liquids Bad weather Minor No spill Out of position, adrift
1983-12-10/008 SOVEREIGN EXPLORER Semi-Sub Drilling GB Under construction Bad weather Insignificant No spill Anchor/mooring failure
1984-11-05/001 EKOFISK,2/4A,A Jacket Drill.&Prod. NO Production Hurricane Significant No spill Leakage into hull
1984-11-05/004 MAUREEN,16/29A,SPM Loading buoy Storage GB Loading of liquids Bad weather Minor No spill Breakage or fatigue
1984-11-05/008 ALI BABA Semi-Sub Drilling GB Development Drilling Bad weather Significant No spill Grounding
1984-12-05/001 GLOMAR ARCTIC 1 Semi-Sub Drilling NO Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1984-12-06/001 DYVI OMEGA Semi-Sub Drilling GB Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1984-12-07/007 INTEROCEAN 2 Jackup Drilling GB Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1985-08-14/007 VALHALL,2/8A,QP Jacket Residence NO Residence Bad weather Insignificant No spill Collision, offshore units
1985-12-03/003 DYVI EPSILON Jackup Drilling DK Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1985-12-20/003 MSV THAROS Semi-Sub Residence GB Residence Bad weather Significant No spill Anchor/mooring failure
1986-01-07/002 DYVI BETA Jackup Drilling NO Development Drilling Bad weather Significant No spill Falling load/Dropped object
1986-01-15/007 STATFJORD,33/12,B Concrete structure Drill.&Prod. NO Production Bad weather Insignificant Light oil Release of fluid or gas
1986-02-05/003 EKOFISK,2/4A,P Jacket Pumping NO Production Lightning Insignificant No spill Fire
1986-02-06/007 ELDFISK,2/7,B Jacket Drill.&Prod. NO Production Bad weather Significant No spill Falling load/Dropped object
1986-02-15/001 EKOFISK-EMDEN,B11 Jacket Pumping NO Production Lightning Insignificant No spill Fire
1986-03-14/008 TYRA,5504/6.2,TE-E Jacket Riser DK Under construction Bad weather Severe No spill Breakage or fatigue
1986-05-15/000 SUPER PUMA SA332?,? Helicopter Transfer Air GB Other Lightning Minor No spill Other
1987-08-13/004 FRIGG,25/1,TCP2 Concrete structure Compression NO Production Lightning Insignificant No spill Fire
1987-08-14/003 FRIGG,25/1,TCP2 Concrete structure Compression NO Production Lightning Insignificant Nat. gas,H2S Fire
1987-12-23/001 SMIT SEMI 1 Semi-Sub Service GB Service Bad weather Minor No spill Grounding
1987-12-29/005 ROWAN GORILLA 2 Jackup Drilling GB Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1988-01-28/001 EKOFISK 2/4B-2/4C Pipeline Transfer Gas NO Under construction Bad weather Significant No spill Breakage or fatigue
1988-01-28/004 STATFJORD,33/9,C Concrete structure Drill.&Prod. NO Production Bad weather Minor No spill Breakage or fatigue
1988-04-02/007 STATFJORD 33/9 Loading buoy Storage NO Under construction Bad weather Insignificant No spill Towline failure/rupture
1988-05-16/003 LAUNCELOT Jackup Residence NL Residence Bad weather Minor No spill Leakage into hull
1988-05-16/004 SEMAC 1 Semi-Sub Pipelaying DK Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1988-05-16/005 SANTA FE RIG 135 Semi-Sub Drilling NO Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1988-05-18/002 WEST SOLE,48/6,WC Jacket Drill.&Prod. GB Production Bad weather Significant No spill Falling load/Dropped object
1988-05-18/003 SOVEREIGN EXPLORER Semi-Sub Drilling GB Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1988-05-19/001 K14-FA-1 Jacket Drill.&Prod. NL Production Bad weather Minor No spill Collision
1988-05-20/001 SAFE BRITANNIA Semi-Sub Residence GB Residence Bad weather Significant No spill Breakage or fatigue
1988-05-20/002 BAR 420 Semi-Sub Pipelaying GB Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1988-05-30/000 COD,7/11,A Jacket Drill.&Prod. NO Production Bad weather Insignificant No spill Collision
1988-11-09/000 TRANSOCEAN 3 Semi-Sub Drilling GB Development Drilling Bad weather Total loss No spill Capsizing, overturn, toppling
1989-01-11/001 FULMAR,30/16,SALM Loading buoy Storage GB Loading of liquids Bad weather Severe No spill Breakage or fatigue
1989-02-16/000 BELL 212,? Helicopter Transfer Air DK Other Bad weather Total loss No spill Other

71
Accident ID No. Name of Unit Type of Unit Function Nation Main Operation Natural Damage Spill Type Main Event
A2 (ISO) Hazard
1990-01-17/001 INTEROCEAN 2 Jackup Drilling GB Mobilizing Bad weather Total loss No spill Capsizing, overturn, toppling
1990-01-19/000 S61N,LN-OQI Helicopter Transfer Air NO Other Bad weather Significant No spill Other
1990-01-19/007 KOLSKAJA Jackup Drilling NO Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1990-02-08/004 S61N,G-BHOH Helicopter Transfer Air GB Other Bad weather Significant No spill Collision, offshore units
1990-09-12/000 WEST GAMMA Jackup Drilling DK Transfer, wet Bad weather Total loss Light oil Capsizing, overturn, toppling
1990-09-20/008 STATFJORD,33/9,C Concrete structure Drill.&Prod. NO Production Bad weather Insignificant No spill Other
1990-09-21/007 GILBERT ROWE Jackup Drilling NL Transfer, wet Bad weather Minor No spill Grounding
1990-09-21/009 HUNTER Semi-Sub Residence NO Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1990-09-22/001 SAFE GOTHIA Semi-Sub Residence GB Residence Bad weather Significant No spill Anchor/mooring failure
1990-09-24/008 BELL 212,G-BDIL Helicopter Transfer Air GB Other Bad weather Total loss No spill Other
1990-10-22/007 BELL 212,LN-OOZ Helicopter Transfer Air NO Other Bad weather Insignificant No spill Breakage or fatigue
1990-11-05/007 FRIGG,25/1,TCP2 Concrete structure Compression NO Production Freezing Minor Nat. gas,H2S Release of fluid or gas
1990-12-03/000 S61N,G-BHOH Helicopter Transfer Air GB Other Bad weather Significant No spill Collision, offshore units
1990-12-06/001 TRIDENT X Jackup Drilling GB Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1991-01-25/005 DAN COUNTESS Semi-Sub Drilling GB Well workover Bad weather Minor No spill Anchor/mooring failure
1991-01-25/006 MAERSK VINLANDER Semi-Sub Drilling GB Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1991-01-25/007 SAFE SUPPORTER Semi-Sub Residence NO Residence Bad weather Insignificant No spill Anchor/mooring failure
1991-01-25/008 GLOMAR ARCTIC 3 Semi-Sub Drilling GB Exploration drilling Bad weather Minor No spill Other
1991-01-25/009 SANTA FE RIG 135 Semi-Sub Drilling GB Development Drilling Bad weather Significant No spill Anchor/mooring failure
1991-01-26/000 NORTH SEA PIONEER Semi-Sub Production GB Production Bad weather Significant No spill Anchor/mooring failure
1991-01-26/001 SEDCO 704 Semi-Sub Drilling GB Exploration drilling Bad weather Insignificant No spill Collision
1991-01-26/002 STATFJORD 33/9A Loading buoy Storage GB Other Hurricane Minor No spill Other
1991-01-26/003 EKOFISK WEST,2/4A,D Jacket Drill.&Prod. NO Production Bad weather Significant No spill Breakage or fatigue
1991-01-26/004 BENVRACKIE Semi-Sub Drilling GB Exploration drilling Hurricane Significant No spill Anchor/mooring failure
1991-01-26/005 SEA EXPLORER Semi-Sub Drilling GB Exploration drilling Hurricane Significant No spill Anchor/mooring failure
1991-04-05/003 WEST SOLE,48/6,WC Jacket Drill.&Prod. GB Production Bad weather Significant No spill Collision, offshore units
1991-04-05/008 ARCH ROWAN Jackup Drilling GB Exploration drilling Bad weather Minor Light oil Collision, offshore units
1991-09-02/008 PETROLIA Semi-Sub Service GB Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1991-09-21/002 OSEBERG,30/9,A Concrete structure Production NO Production Bad weather Insignificant No spill Collision, offshore units
1991-09-21/003 STATFJORD,33/9A,A Concrete structure Drill.&Prod. NO Well workover Bad weather Insignificant No spill Falling load/Dropped object
1991-09-27/004 FRIGG,25/1,TCP2 Concrete structure Compression NO Production Lightning Insignificant Nat. gas,H2S Fire
1992-03-02/000 BRENT,211/29,C Concrete structure Drill.&Prod. GB Production Bad weather Significant No spill Collision, offshore units
1992-03-03/005 MCDERMOTT DB 102 Semi-Sub Crane GB Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1992-03-04/003 WEST STADRILL Semi-Sub Drilling GB Development Drilling Bad weather Insignificant No spill Other
1992-03-04/004 OCEAN BOUNTY Semi-Sub Drilling GB Exploration drilling Bad weather Significant No spill Leakage into hull
1992-03-04/005 BORGNY DOLPHIN Semi-Sub Drilling GB Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1992-03-04/006 MSV THAROS Semi-Sub Pipelaying GB Construct. work unit Bad weather Insignificant No spill Anchor/mooring failure
1992-03-04/008 DRILL STAR Semi-Sub Drilling GB Exploration drilling Bad weather Significant No spill Anchor/mooring failure
1992-03-04/009 BORGNY DOLPHIN Semi-Sub Drilling GB Development Drilling Bad weather Minor No spill Anchor/mooring failure
1992-03-05/000 SEDCO 700 Semi-Sub Drilling GB Development Drilling Bad weather Minor No spill Anchor/mooring failure
1992-03-05/001 BENREOCH Semi-Sub Drilling GB Exploration drilling Bad weather Minor No spill Anchor/mooring failure
1992-03-05/002 SAFE SUPPORTER Semi-Sub Residence NO Residence Bad weather Insignificant No spill Anchor/mooring failure
1992-03-05/003 SAFE GOTHIA Semi-Sub Residence GB Residence Bad weather Minor No spill Anchor/mooring failure
1992-03-20/006 ROSS ISLE Semi-Sub Drilling NO Exploration drilling Bad weather Significant No spill Breakage or fatigue
1992-03-20/008 YATZY Semi-Sub Drilling NO Exploration drilling Bad weather Significant No spill Breakage or fatigue
1992-03-20/009 MURMANSKAYA Jackup - NO Transfer, wet Bad weather Significant No spill Breakage or fatigue

72
Accident ID No. Name of Unit Type of Unit Function Nation Main Operation Natural Damage Spill Type Main Event
A2 (ISO) Hazard
1992-03-23/000 CORMORANT SOUTH,211/26,A Concrete structure Drill.&Prod. GB Production Bad weather Significant No spill Breakage or fatigue
1992-03-23/001 SANTA FE RIG 140 Semi-Sub Drilling GB Development Drilling Bad weather Minor No spill Anchor/mooring failure
1992-05-21/005 DEEPSEA PIONEER Semi-Sub Production GB Production Hurricane Minor No spill Anchor/mooring failure
1992-05-29/004 CORMORANT NORTH,211/21,A Jacket Drill.&Prod. GB Production Bad weather Insignificant No spill Breakage or fatigue
1992-05-29/005 STATFJORD,33/12,B SPM Loading buoy - NO Loading of liquids Bad weather Insignificant Oil & lube Release of fluid or gas
1992-08-07/007 FRIGG,25/1,TCP2 Concrete structure Compression NO Production Lightning Insignificant No spill Fire
1992-10-28/000 ROWAN CALIFORNIA Jackup Drilling NL Exploration drilling Bad weather Minor No spill Breakage or fatigue
1992-11-01/001 WEST OMIKRON Jackup Drilling GB Transfer, wet Bad weather Insignificant No spill Out of position, adrift
1992-11-01/005 S76A,G-BOND Helicopter Transfer Air GB Other Bad weather Insignificant No spill Other
1993-02-09/000 WEST BONANZA Jackup Drilling GB Exploration drilling Bad weather Minor No spill Falling load/Dropped object
1993-02-19/000 BORGNY DOLPHIN Semi-Sub Drilling GB Development Drilling Bad weather Minor No spill Anchor/mooring failure
1993-02-22/000 SAFE SUPPORTER Semi-Sub Residence GB Residence Bad weather Minor No spill Anchor/mooring failure
1993-03-01/002 WEST ALPHA Semi-Sub Drilling NO Testing Bad weather Insignificant Oil and gas Release of fluid or gas
1993-03-02/004 STATFJORD,33/9,C Concrete structure Drill.&Prod. NO Production Bad weather Minor Light oil Release of fluid or gas
1993-06-05/000 EKOFISK,2/4A,T(TANK) Concrete structure Production NO Production Earthquake Insignificant No spill Other
1993-06-05/001 GORM,5504/6.2,A Jacket Drilling DK Production Earthquake Insignificant No spill Other
1993-09-01/000 OCEAN VIKING Semi-Sub Drilling NO Development Drilling Bad weather Significant No spill Anchor/mooring failure
1993-09-01/001 OCEAN VIKING Semi-Sub Drilling NO Drilling, unknown phase Bad weather Significant No spill Anchor/mooring failure
1993-09-01/002 OCEAN VIKING Semi-Sub Drilling NO Drilling, unknown phase Bad weather Minor No spill Anchor/mooring failure
1993-09-01/003 HERMOD Semi-Sub Crane GB Construct. work unit Bad weather Significant No spill Anchor/mooring failure
1993-09-03/000 OCEAN VIKING Semi-Sub Drilling NO Transfer, wet Bad weather Insignificant No spill Out of position, adrift
1993-11-24/000 VILDKAT EXPLORER Semi-Sub Drilling NO Exploration drilling Bad weather Insignificant No spill Falling load/Dropped object
1993-11-25/006 TAYJACK 1 Jackup Drilling GB Idle Bad weather Total loss Light oil Collision
1994-01-03/003 BUCHAN A Semi-Sub Production GB Production Bad weather Minor No spill Anchor/mooring failure
1994-01-03/004 OCEAN GUARDIAN Semi-Sub Drilling GB Exploration drilling Bad weather Minor No spill Anchor/mooring failure
1994-01-06/000 TREASURE FINDER Semi-Sub Residence GB Residence Bad weather Minor No spill Helicopter accident
1994-01-06/002 BELL 212,? Helicopter Transfer Air GB Other Bad weather Insignificant No spill Other
1994-01-06/007 BOLKOV 105,G-BGKJ Helicopter Transfer Air GB Other Bad weather Significant No spill Other
1994-01-07/000 BELL 212,G-BARJ Helicopter Transfer Air GB Other Bad weather Severe No spill Collision, offshore units
1994-06-07/003 PETROJARL 1 FPSO/FSU Production GB Production Bad weather Significant No spill Anchor/mooring failure
1994-06-08/005 POLYCONCORD Semi-Sub Residence NO Repair work/under rep Bad weather Significant No spill Grounding
1995-01-02/005 BRITANNIA, RIG 65 Jackup Drilling GB Development Drilling Bad weather Significant No spill List, uncontrolled inclination
1995-01-03/005 BRENT,211/29,B Concrete structure Drill.&Prod. GB Repair work/under rep Bad weather Minor No spill Other
1995-01-04/006 ALBA,16/26,FSU FPSO/FSU Storage GB Stacked Bad weather Significant No spill Other
1995-01-20/000 SUPER PUMA,AS332L,? Helicopter Transfer Air GB Other Lightning Total loss No spill Other
1995-02-01/001 SNORRE,34/7,TLP TLP Drill.&Prod. NO Production Bad weather Significant No spill Breakage or fatigue
1995-02-02/001 OSEBERG,30/9,B Jacket Drilling NO Development Drilling Bad weather Insignificant No spill Other
1995-02-02/002 OSEBERG,30/9,B Jacket Drilling NO Development Drilling Bad weather Insignificant No spill Other
1995-02-02/004 EKOFISK,2/4A,T(TANK) Concrete structure Production NO Production Bad weather Insignificant No spill Breakage or fatigue
1995-02-07/005 VILDKAT EXPLORER Semi-Sub Drilling GB Development Drilling Bad weather Insignificant Chemicals Release of fluid or gas
1995-03-02/009 TREASURE SAGA Semi-Sub Drilling NO Exploration drilling Bad weather Insignificant No spill Falling load/Dropped object
1995-03-03/009 SNORRE,34/7,TLP TLP Drill.&Prod. NO Production Bad weather Insignificant No spill Falling load/Dropped object
1995-03-07/000 VESLEFRIKK,30/6,B Semi-Sub Production NO Production Bad weather Significant No spill Breakage or fatigue
1995-08-28/008 TREASURE PROSPECT Semi-Sub Drilling NO Development Drilling Bad weather Insignificant No spill Helicopter accident
1996-01-11/005 BRAGE,31/4 Jacket Drill.&Prod. NO Production Bad weather Insignificant No spill Falling load/Dropped object
1996-01-11/007 BRAGE,31/4 Jacket Drill.&Prod. NO Development Drilling Bad weather Insignificant No spill Falling load/Dropped object

73
Accident ID No. Name of Unit Type of Unit Function Nation Main Operation Natural Damage Spill Type Main Event
A2 (ISO) Hazard
1996-01-12/002 GULLFAKS,34/10,C Concrete structure Drill.&Prod. NO Production Bad weather Minor No spill Breakage or fatigue
1996-01-12/004 ROSS RIG Semi-Sub Drilling NO Exploration drilling Bad weather Insignificant No spill Well problem, no blowout
1996-04-11/006 SCARABEO 5 Semi-Sub Drilling NO Development Drilling Bad weather Insignificant No spill Falling load/Dropped object
1996-04-12/004 VESLEFRIKK,30/6,B Semi-Sub Production NO Production Bad weather Significant No spill Breakage or fatigue
1996-05-23/002 SCARABEO 6 Semi-Sub Drilling GB Development Drilling Bad weather Insignificant No spill Anchor/mooring failure
1996-05-24/000 DYVI STENA Semi-Sub Drilling GB Demobilizing Bad weather Insignificant No spill Anchor/mooring failure
1996-10-02/006 ULA,7/12A,P Jacket Production NO Production Bad weather Insignificant No spill Falling load/Dropped object
1996-10-06/003 MAERSK GIANT Jackup Drilling NO Development Drilling Bad weather Insignificant No spill Falling load/Dropped object
1996-10-07/003 SNORRE,34/7,TLP TLP Drill.&Prod. NO Well workover Bad weather Insignificant No spill Falling load/Dropped object
1996-10-07/006 SUPER PUMA AS332L,LN-OLB Helicopter Transfer Air NO Other Lightning Minor No spill Other
1996-10-15/005 GULLFAKS,34/10,A Concrete structure Drill.&Prod. NO Well workover Bad weather Insignificant No spill Falling load/Dropped object
1996-10-16/004 OSEBERG,30/9,B Jacket Drilling NO Production Bad weather Insignificant No spill Falling load/Dropped object
1996-10-26/002 GYDA,2/1 Jacket Drill.&Prod. NO Production Lightning Insignificant Nat. gas,H2S Release of fluid or gas
1996-10-27/005 EKOFISK WEST,2/4A,D Jacket Drill.&Prod. NO Development Drilling Bad weather Minor No spill Collision, offshore units
1996-10-28/003 STATPIPE,16/11S,RISER Jacket Riser NO Production Bad weather Insignificant No spill Collision, offshore units
1996-11-11/001 OCEAN EXPLORER Semi-Sub Drilling GB Transfer, wet Bad weather Insignificant No spill Towline failure/rupture
1996-11-25/002 BELL 214,? Helicopter Transfer Air GB Other Bad weather Insignificant No spill Other
1997-01-03/000 SHELF 4 Semi-Sub Drilling GB Transfer, wet Bad weather Significant No spill Grounding
1997-01-03/006 SEDCO EXPLORER Semi-Sub Drilling GB Transfer, wet Bad weather Insignificant No spill Out of position, adrift
1997-08-02/002 WEST VANGUARD Semi-Sub Drilling NO Development Drilling Bad weather Insignificant No spill Falling load/Dropped object
1997-08-03/000 SCARABEO 5 Semi-Sub Drilling NO Mobilizing Bad weather Insignificant No spill Anchor/mooring failure
1997-08-03/005 SNORRE,34/7,TLP TLP Drill.&Prod. NO Production Bad weather Insignificant Light oil Release of fluid or gas
1997-08-03/009 SCARABEO 5 Semi-Sub Drilling NO Development Drilling Bad weather Insignificant No spill Falling load/Dropped object
1998-02-03/008 SUPER PUMA,SA332S,G-BWZX Helicopter Transfer Air GB Other Lightning Insignificant No spill Other
1998-09-04/000 SCARABEO 5 Semi-Sub Drilling NO Development Drilling Bad weather Insignificant No spill Falling load/Dropped object
1998-09-18/007 MAERSK JUTLANDER Semi-Sub Drilling NO Exploration drilling Bad weather Insignificant No spill Falling load/Dropped object
1998-09-20/004 VALHALL,2/8A,PCP Jacket Production NO Production Bad weather Insignificant Nat. gas,H2S Release of fluid or gas
1998-10-03/001 GULLFAKS,34/10,A Concrete structure Drill.&Prod. NO Development Drilling Bad weather Insignificant Nat. gas,H2S Falling load/Dropped object
1998-10-03/007 TROLL B Concrete structure Drill.&Prod. NO Production Bad weather Insignificant No spill Falling load/Dropped object
1998-10-03/008 EDDA,2/7,C Jacket Drill.&Prod. NO Production Bad weather Minor No spill Crane accident
1998-10-04/001 MAERSK JUTLANDER Semi-Sub Drilling NO Exploration drilling Bad weather Insignificant Light oil Release of fluid or gas
1998-10-04/005 TROLL B Concrete structure - NO Production Bad weather Insignificant No spill Falling load/Dropped object
1999-09-03/000 TRANSOCEAN WINNER Semi-Sub Drilling NO Development Drilling Bad weather Insignificant No spill Falling load/Dropped object
1999-09-03/008 MAERSK JUTLANDER Semi-Sub Drilling NO Exploration drilling Bad weather Insignificant No spill Other
1999-10-04/002 LB-200 Barge (Other) Pipelaying NO Construct. work unit Bad weather Significant No spill Out of position, adrift
1999-10-08/005 WEST OMIKRON Jackup Drilling NO Mobilizing Bad weather Significant No spill Breakage or fatigue
1999-10-09/001 JACK BATES Semi-Sub Drilling GB Exploration drilling Bad weather Significant No spill Anchor/mooring failure
1999-10-09/005 MAERSK JUTLANDER Semi-Sub Drilling NO Exploration drilling Bad weather Insignificant No spill Other
1999-10-17/002 TRANSOCEAN LEADER Semi-Sub Drilling NO Exploration drilling Bad weather Insignificant No spill Falling load/Dropped object
1999-10-18/006 FRIGG,10/1,DP2 Jacket Drill.&Prod. NO Production Bad weather Insignificant No spill Falling load/Dropped object
2000-04-05/001 SUPER PUMA,AS332L,G-TIGT Helicopter Transfer Air GB Other Lightning Insignificant No spill Other
2000-04-06/005 RAMFORM BANFF FPSO FPSO/FSU Production GB Production Bad weather Insignificant No spill Other
2000-04-07/005 SEDCO 706 Semi-Sub Drilling GB Exploration drilling Bad weather Insignificant No spill Falling load/Dropped object
2000-04-09/002 SLEIPNER,15/9,A2 Concrete structure Drill.&Prod. NO Development Drilling Bad weather Significant No spill Falling load/Dropped object
2000-11-17/006 BIDEFORD DOLPHIN Semi-Sub Drilling NO Development Drilling Bad weather Minor No spill Out of position, adrift
2001-05-20/000 STENA SPEY Semi-Sub Drilling GB Exploration drilling Bad weather Minor No spill Out of position, adrift

74
Accident ID No. Name of Unit Type of Unit Function Nation Main Operation Natural Damage Spill Type Main Event
A2 (ISO) Hazard
2001-05-30/003 SUPER PUMA,? Helicopter Transfer Air GB Other Lightning Insignificant No spill Other
2002-08-23/001 MAGNUS PIPELINE Pipeline Fluid Transport GB Under construction Bad weather Significant No spill Breakage or fatigue
2002-08-23/006 EKOFISK,2/4A,FTP Jacket Production NO Production Earthquake Insignificant No spill Falling load/Dropped object
2002-08-23/008 BYFORD DOLPHIN Semi-Sub Drilling NO Transfer, wet Bad weather Insignificant No spill Out of position, adrift
2003-01-08/000 VISUND,34/8,FPDU Semi-Sub Drill.&Prod. NO Production Bad weather Insignificant No spill Falling load/Dropped object
2003-01-09/007 TRANSOCEAN LEADER Semi-Sub Drilling NO Exploration drilling Bad weather Insignificant No spill Other
2003-01-10/006 TRANSOCEAN ARCTIC Semi-Sub Drilling NO Mobilizing Bad weather Insignificant No spill Towline failure/rupture
2003-01-12/005 TRANSOCEAN WINNER Semi-Sub Drilling NO Development Drilling Bad weather Insignificant No spill Falling load/Dropped object
2003-01-17/000 VARG,15/12B,B-FPSO FPSO/FSU Production NO Production Bad weather Significant No spill Breakage or fatigue
2003-01-17/003 OSEBERG EAST,30/6 Jacket Production NO Production Bad weather Insignificant No spill Falling load/Dropped object
2003-02-07/009 TRANSOCEAN WILDCAT Semi-Sub Drilling NO Mobilizing Bad weather Minor No spill Collision, offshore units
2003-02-08/007 OSEBERG,30/9,D Jacket Production NO Production Bad weather Minor No spill Falling load/Dropped object
2003-02-18/005 BYFORD DOLPHIN Semi-Sub Drilling NO Exploration drilling Bad weather Insignificant No spill Falling load/Dropped object
2003-03-03/002 SCARABEO 6 Semi-Sub Drilling NO Development Drilling Bad weather Insignificant No spill Anchor/mooring failure
2006-08-21/049 Ocean Vanguard Semi-Sub Drilling NO Exploration drilling Bad weather Significant Unknown Anchor/mooring failure
2007-12-05/118 LB 200 Semi-Sub Pipelaying NO Construct. work unit Bad weather Insignificant Unknown Out of position, adrift
2007-12-05/181 Oseberg Sør Jacket Production NO Production Bad weather Insignificant Unknown Other
2008-11-04/011 Murdoch Jacket Production GB Production Bad weather Insignificant Unknown Collision
2008-11-04/012 CAISTER,44/23A Jacket Drill.&Prod. GB Production Bad weather Insignificant Unknown Collision
2008-11-04/039 Port Reval Semi-Sub Residence NO Residence Bad weather Minor Unknown Anchor/mooring failure
2008-11-04/164 FRIGG,10/1,DP2 Jacket Production NO Production Bad weather Insignificant Unknown Falling load/Dropped object
2008-11-04/169 ELDFISK,2/7,FTP Jacket Production NO Production Bad weather Minor Unknown Breakage or fatigue
2008-11-04/321 OSEBERG EAST,30/6 Jacket Production NO Production Bad weather Insignificant Unknown Falling load/Dropped object
2008-11-04/360 VALHALL,2/8A,PDP Jacket Production NO Production Bad weather Insignificant Unknown Falling load/Dropped object
2008-11-04/393 Transocean Winner Semi-Sub Drilling NO Exploration drilling Bad weather Minor Unknown Anchor/mooring failure
2008-11-04/396 TOR,2/4,E Jacket Production NO Production Bad weather Insignificant Unknown Falling load/Dropped object
2008-11-04/399 ELDFISK,2/7,B Jacket Production NO Production Hurricane Minor Unknown Breakage or fatigue
2008-11-04/422 SNORRE,34/7,B Semi-Sub Production NO Production Bad weather Insignificant Unknown Helicopter accident
2008-11-04/423 North Sea Helicopter Helicopter Transfer Air NO Other Bad weather Insignificant Unknown Collision, offshore units
2008-11-04/455 VISUND,34/8,FPDU Semi-Sub Production NO Production Bad weather Insignificant Unknown Release of fluid or gas
2008-11-04/458 Kristin platform Semi-Sub Production NO Production Bad weather Insignificant Unknown Falling load/Dropped object
2008-11-04/493 SNORRE,34/7,B Semi-Sub Production NO Production Bad weather Insignificant Unknown Falling load/Dropped object
2008-11-04/551 NJORD,6407/7,A Jacket Production NO Production Bad weather Insignificant Unknown Falling load/Dropped object
2009-01-16/001 STATFJORD,33/9,C Concrete structure Production NO Production Bad weather Minor Unknown Falling load/Dropped object
2010-03-04/000 Ekofisk K Waterflood Jacket Residence NO Residence Bad weather Insignificant Unknown Falling load/Dropped object
2010-04-28/030 BRAGE,31/4 Jacket Production NO Production Bad weather Insignificant Unknown Falling load/Dropped object
2010-04-29/016 Northern Producer Semi-Sub Production GB Idle Bad weather Minor Unknown Collision
2011-02-04/000 Gryphon A FPSO FPSO/FSU Production GB Production Bad weather Severe Unknown Out of position, adrift

75
76
 Europe Direct is a service to help you find answers
to your questions about the European Union.

Freephone number (*):

00 800 6 7 8 9 10 11
(*) The information given is free, as are most calls (though some operators, phone boxes or hotels may
charge you).

More information on the European Union is available on the internet (http://europa.eu).

HOW TO OBTAIN EU PUBLICATIONS

Free publications:
• one copy:
via EU Bookshop (http://bookshop.europa.eu);

• more than one copy or posters/maps:

from the European Union’s representations (http://ec.europa.eu/represent_en.htm);
from the delegations in non-EU countries (http://eeas.europa.eu/delegations/index_en.htm);
by contacting the Europe Direct service (http://europa.eu/europedirect/index_en.htm) or
calling 00 800 6 7 8 9 10 11 (freephone number from anywhere in the EU) (*).

(*) The information given is free, as are most calls (though some operators, phone boxes or hotels may charge you).

Priced publications:
• via EU Bookshop (http://bookshop.europa.eu).