Executive Health and Safety

Offshore hydrocarbon releases 2001-2008

Prepared by the Health and Safety Laboratoryfor the Health and Safety Executive 2008

RR672 Research Report

Executive Health and Safety

Offshore hydrocarbon releases 2001-2008

Alison McGillivray & John Hare Health and Safety Laboratory Harpur Hill Buxton Derbyshire SK17 9JN

The offshore industry employs about 28 000 personnel involved in a wide range of activities. Since the Piper Alpha disaster in 1988, health and safety issues concerning offshore platforms have vastly reduced, however, the work practices involved are not risk free and still have the potential to cause considerable loss of life when things go wrong. Increases in oil prices, declining reserves and an ageing infrastructure have resulted in increased drilling activity around marginal fields. Operators have looked for new ways in which to cut costs, which could affect the health and safety of the workforce.

HSE’s Major Hazards Strategic Programme Plan outlined targets that hope to reduce the number of major and significant releases from the 2001/02 baseline of 113 to 67 by the end of 2006/07 (10% year-on-year reduction) and to 60 by the end of 2007/08 (10% year-on-year reduction). However, in recent years there has been an increase in the number of major and significant hydrocarbon releases on offshore platforms that require investigation. This work hopes to identify the immediate cause of hydrocarbon leaks, and determine if there are discernable reasons for the increasing trends.

Two databases currently used by HSE when dealing with offshore releases were utilised, namely the Hydrocarbon Release (HCR) and RIDDOR databases. Cross-referencing between the two catalogues was expected to yield complete information including platform location, release size and type, as well as possible failure causes. When brought together over a range of different releases, this information can generate an overall picture of issues related to increasing release frequency.

Once an analysis had been completed, areas that require improvement, such as structural limitations, system and equipment faults as well as failings in procedural and operational methods, were indicated where possible.

This report and the work it describes were funded by the Health and Safety Executive (HSE). Its contents, including any opinions and/or conclusions expressed, are those of the authors alone and do not necessarily reflect HSE policy.

HSE Books

© Crown copyright 2008

First published 2008

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording or otherwise) without the prior written permission of the copyright owner.

Applications for reproduction should be made in writing to:Licensing Division, Her Majesty’s Stationery Office,St Clements House, 2-16 Colegate, Norwich NR3 1BQor by e-mail to hmsolicensing@cabinet-office.x.gsi.gov.uk

ii

ACKNOWLEDGEMENTS The authors wish to thank Kevin Quinn and Chris Mawdsley for their help in accessing the appropriate databases.

iii

iv

CONTENTS

1 INTRODUCTION..........................................................................................1

2 DATABASES...............................................................................................22.1 HCR Database .........................................................................................22.2 RIDDOR Database...................................................................................2

3 HYDROCARBON RELEASES OVERVIEW................................................33.1 Yearly and monthly release trends ...........................................................33.2 Release trends in relation to process type................................................53.3 Release trends in relation to platform.......................................................63.4 Release trends in relation to platform age ................................................73.5 Release trends in relation to system pressure..........................................83.6 Other information....................................................................................10

4 HYDROCARBON RELEASE ANALYSIS .................................................154.1 Partial data .............................................................................................154.2 Full data..................................................................................................244.3 Overall analysis ......................................................................................26

5 REVIEW OF OTHER RELEVANT STUDIES / GUIDANCE.......................285.1 OSD hydrocarbon release reduction campaign......................................285.2 Loss of containment manual...................................................................315.3 Assessment of the major accident hazard aspects of safety cases........34

6 DISCUSSION.............................................................................................396.1 Comparison with Hydrocarbon release reduction campaign ..................396.2 Comparison with loss of containment manual ........................................396.3 Comparison with GASCET .....................................................................40

7 CONCLUSION AND RECOMMENDATIONS............................................427.1 Conclusions............................................................................................427.2 Recommendations..................................................................................43

8 APPENDIX A – SEVERITY CLASSIFICATION ........................................44

9 APPENDIX B – RELEASE CAUSES PER YEAR .....................................47

10 APPENDIX C – RELEASES IN TERMS OF AGE OF PLATFORM.......5010.1 Further investigation – Flanges ..............................................................5110.2 Further investigation – Piping .................................................................5210.3 Further investigation – Internal corrosion ...............................................5310.4 Further Investigation – Normal production..............................................5310.5 Further investigation – Mechanical fatigue .............................................54

11 APPENDIX D – RELEASE CAUSES PER QUARTER..........................5511.1 Further investigation – Start up ..............................................................58

v

12 APPENDIX E – RELEASE CAUSES FOR EACH PROCESS TYPE.....61

13 REFERENCES.......................................................................................65

14 BIBLIOGRAPHY....................................................................................66

15 NOMENCLATURE.................................................................................67

vi

EXECUTIVE SUMMARY Objectives

To utilise the Hydrocarbon Release (HCR) and RIDDOR databases in order to identify the main causes of major and significant releases between 2001 and 2007. The analysis should also highlight possible reasons to explain why the number of these releases has been increasing over recent years, and follows on from previous work [1].

Main Findings

The main findings, based on the sum of significant and major releases, are:

• The total annual number of releases has decreased over the study period. However, this decrease is due mainly to the reduction of significant releases, as major releases have stayed fairly constant in number;

• Typically, the number of releases peaks during November, April and August, and experiences corresponding troughs during May, June, January and September. The releases per month may be influenced by plant intervention i.e. high interventions in summer and low in winter;

• Gas releases are the most common followed by oil, non-process and 2-phase (which are tied) and lastly condensate;

• Older platforms aged 20 years and over experience the most releases;

• Releases from installations in most age ranges seem to be decreasing over time except the 10-15 age range which seems to be increasing;

Comments on the full set of major and significant releases were:

• Gas compression is the system that results in most releases, then export, then utilities;

• Piping is the most common equipment type that experiences releases, then instruments, then flanges;

• The most frequent equipment failure cause is mechanical failure, then none, then mechanical fatigue. Note that the subgroup ‘failure’ is a default under mechanical causes of releases and may include some cases of ‘fatigue’ or ‘wear-out’ not adequately described in the Form OIR12;

• Incorrectly fitted equipment is the most widespread operational cause that is explicitly stated, then improper operation – human factors issue. ‘None’ appears most frequently;

• Non-compliance with a procedure is the most common procedural cause that is explicitly stated, then deficient procedure – human factors issue. ‘None’ appears most frequently;

• Most releases occur in the normal production operational mode, followed by start up and reinstatement.

vii

Main causes per year:

The number of releases for each category is either roughly consistent, or reducing in number with time. With all causes, except releases due to system failure, the number of blank inputs has increased in later years, particularly between 2005 and 2007. This is mainly due to the manner in which the release reports are recorded, so it may be worthwhile checking why these areas have been left blank. There seemed to be no major issues relating to the year.

Age of platform:

The oldest platforms at 20+ years have the most instances of releases for export and utilities systems, perhaps confirming the importance of management of ageing installations. Relatively new platforms, between 5-10 years of age at the time of release, account for the most gas compression system releases. In fact, these platforms have high numbers of releases in general when compared to the surrounding platform ages, so it may be useful to investigate the issues surrounding these installations.

Considering the equipment, piping is an issue with installations aged 20+, this suggests an issue with the management of ageing installations. Releases concerning flanges are fairly common with installations aged 5-10 years. Ring Type Joint (RTJ) flange joints are the most troublesome, again with 5-10 year old platforms and usually with smaller diameter flanges. This may be due to the population of smaller sized flanges on installations.

Mechanical failure is the most common equipment cause for releases. There are a significant number of mechanical fatigue releases, again with platforms aged 5-10 years at the time of release. Internal corrosion also causes a significant number of releases for platforms aged 20+ years compared with smaller numbers for other ages.

Normal production is the most common operational mode in which releases could occur. The values over all platform ages are fairly consistent except with the oldest platforms experiencing the most releases. However platforms aged 5-10 years also show a significant number of releases during normal production.

Main causes per quarter:

There is no obvious pattern that indicates seasonal variance for the number of releases. The only area with possible questions is the start up operational mode that has the vast majority of releases in the third quarter (July to September), compared to lower numbers the rest of the year. Most of the third quarter start up releases involved gas. It may be worthwhile for operators to investigate if their procedures change during this time or if start up does not usually occur during the colder months. The number of releases will be influenced by plant interventions, i.e. high interventions in the summer and low interventions in the winter.

viii

Recommendations

On the whole, older platforms and processes involving gas result in the most releases. Piping failures in terms of internal corrosion are also an issue, as is mechanical failure of all equipment in general. As a result, operators should focus on resolving any outstanding concerns dealing with these areas; taking account of guidance on ageing platforms (Dalzell, 2007).

It is possible to continue this work in the future in order to monitor offshore safety issues, which could highlight areas that need further improvement. Further investigation could yield more patterns. The HSE OSD Incident reports could also be sampled. However, relevant incidents would first have to be identified by platform name and OIR9B number. The recommendation on the HSE Intranet version of the HCR database also applies here (see below).

The HSE Intranet version of the HCR database should be modified so that all data filters can be used to fully identify, by platform name and OIR9B number, relevant releases. At present only a limited number of data filters can be applied, mostly relating to the type of release, size of release and date. The current arrangement makes data sampling or full identification of releases (particular types of system, equipment, operational mode and cause type etc) very difficult.

ix

x

1 INTRODUCTION

The offshore industry employs about 28 000 personnel involved in a wide range of activities. Since the Piper Alpha disaster in 1988, health and safety issues concerning offshore platforms have vastly reduced, however, the work practices involved are not risk free and still have the potential to cause considerable loss of life when things go wrong. Increases in oil prices, declining reserves and an ageing infrastructure have resulted in increased drilling activity around marginal fields. Operators have looked for new ways in which to cut costs, which could affect the health and safety of the workforce [3, 4].

HSE’s Major Hazards Strategic Programme Plan [2] outlined targets that hope to reduce the number of major and significant releases from the 2001/02 baseline of 113 to 67 by the end of 2006/07 (10% year-on-year reduction) and to 60 by the end of 2007/08 (10% year-on-year reduction). However, in recent years there has been an increase in the number of major and significant hydrocarbon releases on offshore platforms that require investigation. This work hopes to identify the immediate cause of hydrocarbon leaks, and determine if there are discernable reasons for the increasing trends.

Two databases currently used by HSE when dealing with offshore releases were utilised, namely the Hydrocarbon Release (HCR) and RIDDOR databases. Cross-referencing between the two catalogues was expected to yield complete information including platform location, release size and type, as well as possible failure causes. When brought together over a range of different releases, this information can generate an overall picture of issues related to increasing release frequency.

Once an analysis had been completed, areas that require improvement, such as structural limitations, system and equipment faults as well as failings in procedural and operational methods, were indicated where possible.

1

2 DATABASES

As this project follows on from previous work [1] and because it is recent releases that require investigating, only data between 01/01/2001 and 31/12/2007 are used in the analysis. In addition, the scope of this work deals solely with significant and major releases and definitions and criteria for each can be found in Appendix A.

The HCR and RIDDOR databases were used to obtain relevant information that fully describes the steps occurring prior, during and after a release. Each has its merits, as described below.

2.1 HCR DATABASE

The HCR database allows the user to download data relating to all hydrocarbon releases for a particular year. In this case, data between 01/01/2001 and 31/12/2007 was downloaded into eight Excel spreadsheets. Note that the 2007/08 data was downloaded on 16/01/2008. As the data is updated periodically, the data for the fourth quarter of 2007 (October to December) in this report is incomplete. It was manipulated to remove scenarios corresponding to minor releases and then extracted to form one complete data set. In total, 35 major and 560 significant release records were found, giving a total of 595. However, this method has its limitations because the data in this format is completely anonymous, so a particular release cannot be cross-referenced with the RIDDOR database to obtain further information.

When the search facility was used, however, a table was produced that listed the installation name, incident date, location, process type, leak size and severity, which was then used to identify the corresponding releases in the downloaded data. This was feasible for the 35 major releases, but it was not possible to match all 560 significant releases. In order to encapsulate the most severe releases, a cut-off point was taken to extract only significant release records where over 100 kg of gas was released. This produced 55 records, which was more practical to use in the initial analysis where installation name matching was required.

It is also useful to note that the HCR database supplies a completed copy of the OIR/12 form, which is submitted by operators following a release. In essence, the downloaded data mentioned previously is what is contained in this form but in an Excel format.

2.2 RIDDOR DATABASE

This database was used mainly to corroborate information found in the HCR records through examination of the OIR/9B form, which is available on the RIDDOR database. This form details information about the incident and injured parties as well as a description of what happened, which is most useful when cross-referencing.

The particular releases were identified using information in the HCR database. These incident reports tend to be historical, describing a sequence of events. They show the release detection method as being either gas detection or by some manual form of detection (see section 3.6.1 for the HCR information on this). They describe the various shutdown and mustering events that occur. Sometimes the source of the release is identified but release causes are not generally described.

2

3 HYDROCARBON RELEASES OVERVIEW

3.1 YEARLY AND MONTHLY RELEASE TRENDS

Before any analysis can be performed on recent data, it is useful to briefly examine release trends prior to the date range of interest (2001 to 2007). Figure 1 below illustrates the total number of minor, significant and major releases that have occurred each year between 1992/1993 and 2006/2007; it also indicates how many releases suffered ignition.

0

li

50

100

150

200

250

300

350

Num

ber o

f rel

ease

s

No. Re eases No. Ign ted

92/93 93/94 94/95 95/96 96/97 97/98 98/99 99/00 00/01 01/02 02/03 03/04 04/05 05/06 06/07

Year

Figure 1 Total number of minor, significant and major releases between1992/1993 and 2006/2007

Between 1992/1993 and 1994/1995 there is a noticeable peak in hydrocarbon releases, before suddenly dropping during 1995/1996. However, there is a slight trend increase after this date. After 2004/2005, there is again a noticeable drop in the number of releases. Ignitions, however, seem to be fairly consistent from year to year despite the variable number of releases.

As the scope of work does not involve minor releases, Figure 1 is not truly representative of the variation in significant and major releases. Figure 2 can be obtained from a breakdown of the data used to obtain Figure 1, and illustrates the number of major and significant releases between 2001 and 2007, which is within the year range of interest. Figure 2 reports the actual number of releases for the calendar year 2007, not the incomplete data for this year used elsewhere in this report. Despite the fact that it appears the overall number of releases is decreasing, it could be seen that there is not a corresponding decrease in the number of major releases; it does in fact appear consistent between 2001 and 2007. In this report, calendar years have mostly been used in tables, graphs and in analysis. The internet and intranet versions of the HCR database tend to use financial years.

Figure 3 illustrates how the number of significant and major releases varies on a monthly basis between 2003/2004 and 2007/2008. The earlier years of interest between 2001 and 2003 are not

3

depicted here, as there would be too much information on the graph to assess it accurately. The graph clearly shows that there are distinct peaks in the number of releases during the months of November (45), April (43) and particularly August (54). There are troughs visible during May (31), June (33), January (28) and September (39). It is possibly worth investigating why there are almost twice as many releases in August than January. The releases per month, shown in Figure 3, may be influenced by plant intervention i.e. high interventions in the summer and low interventions in the winter.

Figure 1 is based on all recorded releases, including minor, significant and major, while Figures 2 and 3 are based on the full set of data available for major and significant releases.

120

100

80

60

40

20

0

2000 2001 2002 2003 2004 2005 2006 2007 2008

j i ifi lj l

Si ifi l

Ma or and S gn cant Re eases Ma or Re eases

gn cant Re eases

Year of Release

Figure 2 Number of major and significant releases per year between 2001 and 2007

Num

ber o

f Rel

ease

s

4

5

Figure 3 Number of major and significant releases per month between

2003/2004 and 2007/2008

3.2 RELEASE TRENDS IN RELATION TO PROCESS TYPE

The releases can also be broken down into process type, as illustrated by Figure 4. Gas releases (273) are the most common kind of release, followed by oil (43), non-process (22), 2-phase (22) and then condensate (11). This is useful for operators, as more attention should be paid to the processes involving gas. It appears that safety precautions must be working, as the number of gas releases has fallen from 51 to 41 between 2003 and 2007, however, the same cannot be said for releases involving 2-phase and oil. There is a sharp peak in 2-phase releases during 2005 and 2007 for oil, so it would be worth investigating whether these are anomaly values or if there has been a breakdown in procedures. On the whole, all processes with the exception of gas appear to have consistent numbers of releases over the seven years in question. Of the non-process releases, diesel is the most common form substance to be released.

Figure 4 is based on the full set of data for major and significant releases.

0

10

20

30

40

50

60

APR MAY JUN JUL AUG SEP OCT NOV DEC JAN FEB MAR

Month

Num

ber o

f Rel

ease

s

03/0404/0505/0606/0707/08Overall

70

60

50

40

30

20

10

0

2003 2004 2005 2006 2007

Oil

Num

ber o

f Maj

or a

nd S

igni

fican

t Rel

ease

s

Gas 2-Phase Condensate

Non-Process

Release Year

Figure 4 The number of major and significant releases corresponding to Hydrocarbon type between 2003 and 2007

3.3 RELEASE TRENDS IN RELATION TO PLATFORM

Factors including operational procedures vary between different operators to some extent, so some platforms may suffer more hydrocarbon releases than others. Figure 5 illustrates the number of releases that occur for each platform between the beginning of 2001 and the end of 2007, using anonymous platform codes, in alphabetical order of anonymous code. It indicates that, on the whole, most platforms experience one release at most, but others suffer multiple significant and major releases. Four platforms have more than two major releases, and seven platforms have more than three major or significant releases. Note that two platforms would appear in both counts. The KP3 inspection reports (HSE, 2007) were examined for most of these platforms, which seem to have problems with hydrocarbon releases. Topics with red traffic lights (denoting that issues were found during inspection) were maintenance of safety critical elements, backlogs, deferrals, measurement of compliance with performance standards, review of Independent Competent Person (ICP) recommendations/verification and physical state of plant.

It is important to note here that the platforms described in Figure 5 and section 3.3 are based on the partial dataset of 35 major releases (all process types) and 55 significant releases (gas) as detailed in section 2.

6

3.4

0

1

2

3

4

5

6

S i i f i ca R e l se M a j R e l se

Num

ber o

f rel

ease

s

g n n t e a o r e a

AWWAYR

BDZBJHBNK

BPGBSK

CYNDBL

EBLECU

ELXETHEW

MFKY

FPAGCP

HPZHRV

HXBHXC

JSYJY

CKEE

KEXKHU

LBALR

TLX

XMEE

MLUNGZNUM

PAHPHY

PXNRW

RRXM

SERSKW

SNWSW

NTJSUTD

VGVGNJVJNVXG

WNUW

RW

UCYW

ZBXDF

XGDYNP

YTTYTX

YWXZJH

ZMH

Platform

Figure 5 The number of major and significant releases corresponding to platform

RELEASE TRENDS IN RELATION TO PLATFORM AGE

It is also interesting to note how the number of major and significant releases is affected by the age of the installation as shown in Figure 6. The HCR database allows the platforms to be categorised as < 5 years, 5-10 years, 10-15 years, 15-20 years and 20+ years, noting that the platform age corresponds to its age at the release date and is not calculated retrospectively. It is perhaps reasonable to assume that older platforms contribute the most releases as they suffer the most wear and tear, however it could also be said that younger platforms should be the most reliable, resulting in fewer releases. Evidence from 2001 and 2002 shows this to be inaccurate as younger platforms contribute to a significant portion of releases, possibly due to faults with new equipment. The number then falls, possibly due to platforms ageing and moving into the 5-10 year bracket. This could also explain the increasing number of releases from platforms aged 10-15 years. The 15-20 year bracket seems to contain the most consistent platform performance, with the fewest number of releases overall. It is therefore possibly worth investigating if platforms built in the 1980s and 1990s (corresponding to an age of 15-20 years) were constructed using different equipment or procedures to current practices. However caution must be taken in any analysis, as the number of platforms in each age bracket will vary from year to year.

Figure 6 is based on the full set of data for major and significant releases.

7

40

35

30

25

20

15

10

5

0

2001 2002 2003 2004 2005 2006 2007

Num

ber o

f Maj

or a

nd S

igni

fican

t Rel

ease

s

20+ years 15-20 years 10-15 years 5-10 years <5 years

Year of release

Figure 6 The number of major and significant releases corresponding to platform age between 2001 and 2007

3.5 RELEASE TRENDS IN RELATION TO SYSTEM PRESSURE

The systems present on board offshore platforms are designed to work within a safe range of pressures. Risk of releases is increased whenever the actual working pressure at the time of incident is found to be greater than the maximum allowable working pressure (MAWP) of the system. Having higher pressures than the equipment is able to deal with could cause ruptures at any weak points in the system, thereby causing a release.

Figure 7 depicts how the maximum and actual system pressure varies for each platform experiencing major releases, using anonymous platform codes in alphabetical order. In this case there are only two instances where the working system pressure was greater than the maximum allowable working pressure (MAWP), so it appears that this is not a factor leading to an increase in releases. Figure 8 illustrates the same as Figure 7 but deals with platforms experiencing significant releases, again using anonymous platform codes. As before, system pressure does not seem to be an important factor in the increasing trend of hydrocarbon releases, because there are only three cases recorded. In general as wells become depleted, pressures fall below the original design pressure. However, higher pressures may be needed for gas injection and/or gas lift.

The figures below are based on the partial dataset of 35 major releases (all process types) and 55 significant releases (gas).

8

0

1 0 0

2 0 0

3 0 0

4 0 0

5 0 0

6 0 0

7 0 0

Pres

sure

(Bar

g) M A W P A ct u a l P r e ssu r e

BDZBJH BPG

DBL DBL

ECUETH

FKYFPA

GCPHRV

JSY

KHULX

XMLU NGZ

NGZNUM

PAH PAH

PXNRW

RSER

SERSNW

UTDVGJ

WUC

WZB

WZB

XDFYNP

YTTZJH ZMH

Platform

Figure 7 System pressure (barg) at each platform experiencing major releases

0

5 0

1 0 0

1 5 0

2 0 0

2 5 0

3 0 0

3 5 0

4 0 0

4 5 0

5 0 0

Pres

sure

(Bar

g)

M A W P A ct u a l P r e ssu r e

AWWAYR

BDZBNK

BSKCYN

EBLECU

ELXELXETHETH

ETHETH

EWMEW

MHPZ

HRVHRV

HXBHXC

JYCKEE

KEXKEX

KHUKHU

LBALB

ALR

TMEE

PHYPXN

RXMSER

SERSKW

SWNTJSTJSTJSUTD

VGNVJNVXG

WNU

WRY

WZB

XDFXDF

XGDYTT

YTXYW

XYW

X

Platform

Figure 8 System pressure (barg) at each platform experiencing significant releases

9

3.6 OTHER INFORMATION

There is other information available from the databases which is not crucially important in explaining why hydrocarbon releases are on the rise. However, information such as how the release is detected, if the platform is manned and what zone the release occurs in can be useful to gain a background understanding of lesser issues.

All the tables and figures in section 3.6 use the partial set of data that includes all major releases and a selection of significant releases.

3.6.1 Detection type

Poor detection systems may not sense smaller releases, which, when given the chance, could escalate into much more serious releases resulting in potential loss of life. Table 1 indicates how often each of the four main automatic detector types, namely heat, smoke, flame and gas, observed a release. Gas detectors detected 23 out of 36 major releases and 18 out of 58 significant releases, and are therefore the most prolific at observing releases, so it is particularly important for operators to regularly maintain onboard gas detectors. The figures for successful release detection relate to larger releases (>100 kg). There may be significant issues for successful detection of smaller significant gas releases (<100 kg). From Figure 4, gas is the most common form of process release, so it would be reasonable to assume that gas detectors should be the main detector type. However, it appears that gas detectors fail to spot a large proportion of releases, which in turn are detected by other means as shown in Table 2.

Table 1 Number of releases detected by different detection equipment

Detection Type Release Type Number of releases detected

Heat Major 0 Significant 1

Smoke Major 0 Significant 1

Flame Major 0 Significant 1

Gas Major 23 Significant 18

Other Major 13 Significant 37

Total Major 36 Significant 58

It appears that manual forms of detection by visual means are the common form of detection when the four main automatic types fail, followed closely by sound and smell. Operators should note that there are reliability issues related to automatic detectors and also issues related to their design and deployment. It appears a significant proportion of releases may be discovered by chance, especially if there happens to be personnel in the vicinity of a release. As a result, it may be prudent to investigate why these detectors fail to respond, and if there are any ways to improve the systems or even to introduce more effective systematic methods.

10

Table 2 Break down of ‘Other’ detection type from Table 1

Detection Type - Other Release Type Number of releases detected

Sound Major 4 Significant 8

Smell Major 2 Significant 8

Pressure change Major 1 Significant 0

Visual Major 3 Significant 18

ROV Major 0 Significant 2

Level change Major 3 Significant 0

Hand held detector Major 0 Significant 1

Total Major 13 Significant 37

These tables are based on the 35 major and 55 significant releases mentioned in previous sections. However, the totals from the automatic detector table (Table 1) give values of 36 major releases and 58 significant releases. This is because, on some occasions, more than one detector is activated.

3.6.2 Manned / Unmanned platforms

As illustrated in the previous section, automatic detection sometimes fails and it is by manual means that the alarm is raised, usually when personnel see a release. This could be problematic, particularly on platforms that are not manned, as releases could continue for some time before one of the detectors is eventually activated. By this time, the release could escalate into a more serious situation which could be prevented, provided personnel are present and act swiftly once a release has been detected. This also raises issues with automatic system shutdown mechanisms which may suffer failures, so having personnel present on site allows the system to be shutdown manually, with reduced risk of shutdown failure. Conversely, unmanned platforms do not have the associated consequences to personnel whenever a serious accident occurs, so in this respect there are benefits to having no personnel present or at least reduced numbers. The main issue is maintenance crews approaching a unmanned platform, where there is already a leak, without knowing it is there.

Table 3 Number of manned and unmanned platforms for major and significant releases

Platform type Release type Number of releases

Manned Major 33 Significant 48

Unmanned Major 2 Significant 7

11

As shown in Table 3, most platforms are manned at the time of release: this is true for 33 out of 35 major releases and 48 out of 55 significant releases.

3.6.3 Zone classification

Zones are classified in the following categories:

• Zone 1: Area in which an explosive atmosphere is likely to occur in normal operation;

• Zone 2: Area in which an explosive atmosphere is not likely to occur in normal operation, and if it does should be infrequent;

• Unclassified zone: Area not known to contain any concentrations of flammable materials in the atmosphere e.g. accommodation.

These zones are used to determine the types of electrical equipment and other potential ignition sources which are allowed in each zone. Releases in the unclassified zone are also a cause for concern as accommodation blocks can be located within these zones, so there could be a large number of personnel affected. [Thyer, 2004] states that 3% of releases in zone 1 ignite, followed by 6% and 16% for zones 2 and unclassified respectively.

Table 4 is based on the partial data set, and illustrates the number of releases that occur in each zone for both major and significant releases. Zone 2 appears to experience the most releases as 23 out of 35 major and 42 out of 55 significant releases occur here.

Table 4 Number of major and significant releases per zone

Release type Zone Number of releases 1 9

Major 2 23 Unclassified 3

1 6 Significant 2 42

Unclassified 7

3.6.4 Wind

Weather conditions could possibly affect offshore operations as well as influencing the behaviour of any releases, for example, high wind speeds have the potential to affect the structural integrity on the side of the platform that faces the oncoming wind. Tables 9 and 10 illustrate the wind speed that was recorded at the time of release for major and significant releases respectively. Each zero wind speed corresponds to a value of “not known” in the records.

12

25

20

15

10

5

0 Feb-01 Aug-01 Feb-02 Aug-02 Feb-03 Aug-03 Feb-04 Aug-04 Feb-05 Aug-05 Feb-06 Aug-06 Feb-07 Aug-07

()

Wi (m/s) Li (Wi (m/s))

Win

d sp

eed

m/s

nd speed near nd speed

Incident date

Figure 9 Wind speed (m/s) observed at time of release for major releases

Win

d sp

eed

(m/s

)

30

25

20

15

10

5

0

Wind speed (m/s) Linear (Wind speed (m/s))

Feb-01 Jan-02 Aug-03 Feb-04 Jan-05 Jul-05 Apr-06 Sep-06 Apr-07 Oct-07

Incident date

Figure 10 Wind speed (m/s) observed at time of release for significant releases

13

It is interesting to note that between 2001 and 2007, the wind speeds recorded appear to be gradually increasing; this may or may not be due to global warming. This means that it may be important for operators to assess the structural reliability of platforms, particularly areas feeling the full force of the wind. This could also raise issues for personnel working near the edges of platforms, as they could experience strong gusts of winds that could potentially cause fatal falls from height.

The wind can also disperse releases of gas, possibly reducing the puff to a concentration that may not be sensed by the detectors, or even into zones other than the initial leak zones. As a result, it may be important to monitor wind conditions or at least to position the most dangerous process equipment away from the side of the platform that experiences direct wind.

14

4 HYDROCARBON RELEASE ANALYSIS

Section 3 deals with possible minor causes of releases and issues that could cause a release to escalate. This section investigates further the main causes of a release including:

• The system involved;

• What equipment is used;

• What caused the equipment to fail;

• The operational cause;

• The procedural cause; and

• The operational mode at the time of release.

This investigation should highlight if there are any mechanical issues involved, perhaps due to wear and tear or the age of the system, as well as identifying if any procedures are deficient. The partial data section begins a brief analysis on a smaller data set to identify the most common issues surrounding a failure. These findings are then applied to the full set of data (all major and significant releases) to see if they are still appropriate.

4.1 PARTIAL DATA

As mentioned in section 2, the initial approach analyses all major releases and only significant gas releases where quantities greater than or equal to 100 kg are released. This is due mainly to the large number of significant release records that were found, which means a detailed analysis could not be carried out.

As a result, the 35 major and 55 significant releases were used to obtain the following sets of graphs and tables within section 4.1.

4.1.1 System

Figures 11 and 12 demonstrate what system was in use at the time of the release for major and significant releases respectively. As illustrated, it appears that most major releases occur from the export system (eight releases), followed by processing (six releases) and gas compression (four releases). Gas compression (18 releases) is the most common system operation for significant releases, followed by export (eight releases) and flowlines (six releases).

It is not surprising that gas compression has been identified as the most common system for significant releases but not with major releases, mainly because the significant data is based purely on releases of gas. This means, for example, that export concerning oil would not be highlighted but it would be for gas, so the numbers for export could be lower than expected compared to using complete data. Therefore, the values for significant releases may not be completely representative.

4.1.2 Equipment

The equipment in use at the time of release is illustrated in Figures 13 and 14 for major and significant releases respectively. As with the system analysis, different equipment issues arise depending on the severity of the release. For example, there are 12 major releases concerning piping, but with significant releases the most common is valve-actuated, again with 12 releases.

15

The second most common equipment type for major releases is instruments (four releases) followed by storage tanks, valve manual and flanges, which are tied with three releases each. For significant releases, piping and instruments are the cause of nine releases each, followed by valve manual with six releases. Based on this, operators should take particular care in ensuring the reliability of equipment types mentioned here.

It is worth investigating further why valve-actuated releases appear so prominently for significant releases but do not feature at all in the top three major equipment types. As before, valve-actuated could be more commonplace based on the cut-off point of the significant releases. Analysis of the full set of data in later sections could highlight the reason for this.

4.1.3 Equipment cause

The equipment failure causes are fairly similar for both major and significant releases except with erosion, which appears to be more common with major releases than significant, as shown in Figures 15 and 16 respectively. Mechanical failure is the most common type of malfunction resulting in nine major and 17 significant releases. Note that ‘failure’ is the default option between the choices of failure / wear-out / fatigue and could include some failures arising from some other options not fully established at the time of reporting, such as corrosion. However, the keyword “none” appears for both types of release severity (nine major and 13 significant) and means that either equipment failure did not cause the release or, depending on who fills in the details, that investigators were unsure what equipment failed. Mechanical fatigue is the third most common equipment failure for both major (three releases) and significant (six releases) releases. Again, reference should be made to the full data analysis in later sections to see if the same pattern arises.

It is important for operators to ensure that equipment in the previous section is fully maintained to prevent the most common types of equipment failure as discussed here.

4.1.4 Operational cause

As with equipment cause, “none” appears as the most common operational cause given for both major (18) and significant releases (32) and can be seen in Figures 17 and 18 respectively. Improper operation (five releases) and improper maintenance (four releases) are the next two main issues with major releases; while left open (10 releases) and incorrectly fitted (six releases) are associated with significant releases.

From this analysis, it seems that there is no pattern to operational causes as different issues occur with each of the severity types, therefore, reference should be made to the full data analysis in section 4.2 to see if this is representative using a wider set of data.

4.1.5 Procedural cause

Procedural causes do not seem to be an overwhelming issue with either major or significant releases, as “none” appears 23 and 40 times respectively. Deficient procedures result in five major releases, and four releases occur due to non-compliance with a Permit to Work. Non-compliance with a procedure accounts for six significant releases and deficient procedures for five, as illustrated in Figures 19 and 20. From this it appears that in general, procedures are effective in most cases and that there are other reasons causing releases. The full data analysis should corroborate or contradict this finding.

16

4.1.6 Operational mode

Figures 21 and 22 confirm that normal production is the most common operation in which releases occur, and is true for both major (19) and significant (27) releases respectively. Reinstatement causes four major releases and four significant releases while start up failures occur with three major and 11 significant releases. It is therefore expected that normal production will be the most common cause when the full data set is analysed.

The partial set of data containing 35 major and 55 significant releases was used to generate the following figures: The first graph is for the major releases and the second for the significant releases. Figures 11 and 12 show what offshore system had the release. Figures 13 and 14 show what type of equipment had the release. Figures 15 and 16 highlight the equipment cause, Figures 17 and 18 the operational cause and Figure 19 and 20 the procedural cause. Figures 20 and 21 show the operational mode at the time of the release.

Refer to Table 5 for a breakdown of the most common failures for both the partial and full sets of data.

17

Num

ber o

f Rel

ease

s N

umbe

r of r

elea

ses

0

1

2

3

4

5

6

7

8

9

DRAINS EXPORT FLARE

FLOWLINES GAS COMPRESSION IMPORT MANIFOLD

PROCESSING SEPARATION UTILITIES VENT WELL

Figure 11 System – major releases

0

2

4

6

8

10

12

14

16

18

20

DRAINS EXPORT FLARE FLOWLINES GAS COMPRESSION IMPORT MANIFOLD PROCESSING SEPARATION UTILITIES VENT WELL WELL OPS METERING

Figure 12 System – significant releases

18

Num

ber o

f rel

ease

s N

umbe

r of r

elea

ses

0

2

4

6

8

10

12

14

STORAGE TANKS PIPING XMAS TREES HEAT EXCHANGERS VALVE MANUAL DRAIN OPENING FLANGES INSTRUMENTS PIG LAUNCHERS WELLHEADS VALVE ACTUATED

FILTERS RISERS

Figure 13 Equipment – major releases

0

2

4

6

8

10

12

14

STORAGE TANKS PIPING XMAS TREES HEAT EXCHANGERS VALVE MANUAL DRAIN OPENING FLANGES INSTRUMENTS PIG LAUNCHERS WELLHEADS VALVE ACTUATED COMPRESSORS PIPELINES PRESSURE VESSEL PUMPS BLANK

Figure 14 Equipment – significant releases

19

0

1

2

3

4

5

6

7

8

9

10 N

umbe

r of M

ajor

Rel

ease

s

NONE AWAITING INVESTIGATION MECHFAIL MECHFAT MECHWEAR EROSION CORREXT CORRINT BLANK SPECIFICATION MANUFACTURING

Equipment Cause

Figure 15 Equipment cause – major release

0

2

4

6

8

10

12

14

16

18

Num

ber o

f Sig

nific

ant R

elea

ses

NONE AWAITING INVESTIGATION MECHFAIL MECHFAT MECHWEAR EROSION CORREXT CORRINT BLANK MATLDEF

Equipment Cause

Figure 16 Equipment cause – significant release

20

0

2

4

6

8

10

12

14

16

18

20 N

umbe

r of M

ajor

Rel

ease

s

NONE LEFTOPEN INCORRFIT IMPROPOP IMPROPMAINT IMPROPINSP OPENED BLANK

Figure 17 Operational cause – major release

0

5

10

15

20

25

30

35

Num

ber o

f Sig

nific

ant R

elea

ses

NONE LEFTOPEN INCORRFIT IMPROPOP IMPROPMAINT DROPOBJ SPECIFICATION

Figure 18 Operational cause – significant release

21

25

20

15

10

5

0

Num

ber o

f Maj

or R

elea

ses

NONE DEFPROC NONCOMPROC BLANK NONCOMPTW QUALITY CONTROL

Figure 19 Procedural cause – major release

0

5

10

15

20

25

30

35

40

45

Num

ber o

f Sig

nific

ant R

elea

ses

NONE DEFPROC NONCOMPROC BLANK

Figure 20 Procedural cause – significant release

22

0

2

4

6

8

10

12

14

16

18

20

Num

ber o

f Maj

or R

elea

ses

PIGGING REINSTATEMENT NORMPROD INSPECTION STARTUP TESTING ROUTINEMAINT BLANK FLUSHING MAINTCOLDWORK

Figure 21 Operational mode – major release

30

25

20

15

10

5

0

Num

ber o

f Sig

nific

ant R

elea

ses

PIGGING REINSTATEMENT NORMPROD INSPECTION STARTUP TESTING ROUTINEMAINT BLANK WELLOP BLOWDOWN WELL SERVICES REPLACEMENT SHUTTINGDN

Figure 22 Operational mode – significant release

23

4.2 FULL DATA

The findings obtained in section 4.1 will now be corroborated by analysis of the full dataset of 35 major and 560 significant releases as shown in Appendices B, D and E. They detail the main causes per year, the main causes per quarter, and the main causes per process type. Appendix C looks at releases in terms of the age of platform.

4.2.1 Main causes per year

Appendix B gives information on what releases occur on a yearly basis. The number of releases for each category is either roughly consistent or reducing in number with time. There seem to be no anomalous values, except with improper maintenance as an operational cause; there are 10 releases in 2001, which drops to one in 2002 and rises again to 10 in 2003. It may be useful to determine why these values are so varied. It is also noticeable that with all causes, except releases due to system failure, the number of blank inputs has increased in later years, particularly between 2005 and 2007. This is mainly due to the manner in which the release reports are recorded, so it may be worthwhile checking why these areas have been left blank. On the whole, because there are no major issues relating to the year, further analysis has not been carried out.

4.2.2 Main causes per age of platform

The tables in Appendix C detail the typical failures that can occur based on the age of the platform. For example, Table 7a illustrates the top three failures occurring that concern the system that is in use; it lists gas compression, export and utilities as the most common. The oldest platform at 20+ years has the most instances of releases during export and utilities. It is interesting to note that relatively new platforms, between 5-10 years of age at the time of release, account for the most gas compression releases. In fact, these platforms have high numbers of releases in general when compared to the surrounding platform ages, so it may be useful to investigate the issues surrounding these installations.

Table 7b describes releases associated with a particular set of equipment, and lists piping, instruments and flanges as the most common equipment failures. Furthermore, it is associated with Table 7c which further describes issues surrounding flange releases. Table 7b highlights that releases concerning flanges are fairly common with installations aged 5-10 years at the point of release. It also illustrates that piping is an issue with installations aged 20+. Table 7c shows that Ring Type Joint (RTJ) flange joints are the most troublesome, again with 5-10 year old platforms and usually with smaller diameter flanges. This may be due to the population of smaller sized flanges on installations.

Table 7d illustrates that mechanical failure is the most common cause for equipment failure, however, there is an anomalous value of 27 mechanical fatigue releases, again with platforms aged 5-10 years at the time of release. Internal corrosion causes 33 releases for platforms aged 20+ years compared with smaller numbers for other years. It may be that, if inadequately managed, corrosion allowances run out on these older platforms.

Tables 7e and 7f describe issues for procedural and operational causes respectively, but because this is unlikely to be affected by the age of the platform, it is not necessary to analyse them further.

Normal production is the most common operational mode in which releases could occur, as shown in Table 7g. The values over all platform ages are fairly consistent except with the

24

oldest platforms experiencing the most releases. Platforms aged 5-10 years also show a significant number of releases (87) during normal production.

4.2.2.1 Further investigation into platform age

On the whole, the number of releases is consistent for each area of interest, for example, the incorrectly fitted column in Table 7f has a similar number of releases for each of the platform ages. However, with Table 7b, it is apparent that the flanges of platforms aged 5-10 years are particularly problematic, resulting in 23 releases compared to releases of six and eight for other platform ages. This is also true of piping on platforms aged 20+, as there are 54 releases recorded compared to numbers such as 13 and 23 obtained for other platforms.

Table 7c illustrates that most flange releases for platforms aged 5-10 years is due to Ring Type Joint (RTJ) flange joints of lower to middle sized diameters. As a result, flanges have been investigated further as illustrated in Tables 8a to 8c, which were obtained by filtering the entire dataset to reveal only flange releases occurring on platforms aged 5-10 years. From this, it is easy to see that mechanical fatigue is the main cause of equipment failure, normal production is the most common mode of operation, and incorrectly fitted equipment is the main operational cause.

Piping is also highlighted as a problem for platforms aged 20 years and over at the time of the release so further examination can be found in Table 9 in section 10.2. From this table it appears that just under half of the 54 releases that meet this criteria are due to internal corrosion, particularly for steel pipes with smaller diameters. Flexible pipes seem to experience less releases, perhaps because they are easier to replace. Fewer releases may however be due to a small sample population.

Table 10a illustrates further investigation into platforms aged 20 years and over that suffer from internal corrosion. Oil appears to be the main substance that causes internal corrosion (especially in pipes) and accounts for half of the 33 records found. As illustrated in the previous paragraph, piping is the main equipment type that suffers, resulting in 22 releases out of the 33 records.

Normal production is the most common operational mode at time of failure for platforms aged 5-10 years so this is filtered to see if any patterns arise. No particular equipment item seems to dominate from Table 11a. However, from Table 11b in section 10.4, it appears that mechanical issues such as failure and fatigue result in most releases.

Section 10.5 does not highlight any patterns that could account for high numbers of mechanical fatigue in platforms aged 5-10 years old, so further investigation may be required. However it may be useful to note that 11 out of 27 results indicate a design failure of some kind, which is the highest of the whole analysis discussed in this section.

4.2.3 Main causes per quarter

Tables 13a to 13f in Appendix D list the number of the releases that occur for each area of interest, for example, system or equipment during each quarter of the year. This is mainly to investigate whether or not any seasonal variations could affect the occurrence of releases, allowing operators to apply caution during particular months as shown below.

1Q – 1 January to 31 March2Q – 1 April to 30 June3Q – 1 July to 30 September4Q – 1 October to 31 December

25

From this Appendix, based on the top three occurrences for each area of interest, there is no obvious pattern that indicates seasonal variance for the number of releases. The only area with possible questions is the start up operational mode that has 27 releases in the third quarter, compared to lower numbers the rest of the year. The first quarter in particular experiences only three releases, so it may be worthwhile for operators to investigate if their procedures change during this time or if start up does not usually occur during the colder months. The number of releases will be influenced by plant interventions, i.e. high interventions in the summer and low interventions in the winter. Lower values compared to the rest of the year also occur with instruments (2Q), internal corrosion (3Q) and incorrectly fitted (1Q). Tables 14a to 14f investigate start up during the third quarter in more depth to see if any patterns arise. On the whole, these tables do not identify any obvious causes. However most of the releases seem to involve gas.

4.2.4 Main causes per process type

Tables 15a to 15f details the number of releases that occur for each process type in terms of particular areas of interest such as system and equipment. Some areas such as internal corrosion, piping, mechanical failure and improper operation affect all types of process so it is appropriate to ensure these particular are either maintained or reviewed regularly. Other areas such as flushing, compressors and top up are applicable to only one or two process types.

4.3 OVERALL ANALYSIS

Table 5 illustrates the common failures for both partial and full datasets. For example, the major and significant (partial data) columns represent the partial dataset that consists of 35 major and 55 significant releases. The last column, major + significant, describes the full dataset that is based on 35 major releases and 560 significant releases. This column is based on Appendices B to D, which indicate the most common causes.

26

Table 5 Most common failures based partial and full data sets

Failure

Release Type

Major (partial data)

Significant (partial data) Major + Significant

Equipment Piping, instruments, storage tanks, valve manual, flanges

Valve-actuated, piping, instruments, valve manual

Piping, instruments, flanges

System Export, processing, gas compression

Gas compression, export, flowlines

Gas compression, export, utilities

Equipment cause Mechanical failure, none, erosion, mechanical fatigue

Mechanical failure, none, mechanical fatigue

Mechanical failure, none, mechanical fatigue

Operational cause None, improper operation, improper maintenance

None, left to open, incorrectly fitted

None, incorrectly fitted, improper operation

Procedural cause

None, deficient procedure, non-compliance with a Permit to Work

None, non-compliance with a procedure, deficient procedure

None, non-compliance with a procedure, deficient procedure

Operational mode Normal production, reinstatement, start up

Normal production, start up, reinstatement

Normal production, start up, reinstatement

27

5 REVIEW OF OTHER RELEVANT STUDIES / GUIDANCE

5.1 OSD HYDROCARBON RELEASE REDUCTION CAMPAIGN

5.1.1 SPC/TECH/OSD/27

Information on this campaign was obtained from SPC/TECH/OSD/27 [6]. The campaign lasted for four years. The report notes that doubts have been expressed about the reliability and completeness in the reporting of minor releases via OIR 12. Information is provided on release rates per installation per year. The report also lists installations with three or more major or significant major releases in 2000/1 and 2003/4.

The report includes a section on analytical taxonomy. The taxonomy, which was first used in OTH 2001 055, is not the same as the OIR12 reporting system but there is often sufficient harmony for comparisons to be made. Data was available for two years, April 2000 to March 2001, and April 2003 to March 2004. During these periods, HSE OSD inspectors investigated all offshore hydrocarbon releases. The effect of operating mode was examined with the majority (around 60%) of all releases occurring in normal production with start-up / reinstatement the next (13 and 21%) highest. The distribution by hydrocarbon type is also discussed. The majority of all releases are of gas (55% and 51%), with oil the next most common type (23% and 29.5%). The remaining releases are diesel (both 6%), condensate (8% and 9%) and two-phase (3% and 2.6%). The majority of major and significant releases were found to involve gas or two-phase fluids.

Information is provided on release sites for all releases. Pipework was the largest contributor (at 56%, of which small bore 20%), then valves (17%) and vessels (18%). Small-bore tubing was the subject of a UKOOA/IP good practice guide designed to improve standards and competency. As the percentage of small-bore tube failures rose from 18% in 2000/1 to 21% in 2003/4, more work needed to be done in this area. 70% of the associated releases were from connections and the rest from the pipe body. 75% of the releases were classified as minor and 25% as significant. Flanges accounted for 12.4% of releases (2003/4); this was a decrease from 15% (in 2000/1). This may indicate that the UKOOA/IP guide on bolted pipe joints was having some effect. Flexible hoses were subject of another UKOOA/IP guide issued in 2003. Releases from these were at 4% in 2000/1 and 3% in 2003/4. About 20% of releases were due to body failures of pipe, vessel or valves. The body failure is mostly caused by mechanical degradation including corrosion and erosion. 16.7% of 2003/4 releases were from seals and packing (14% in 2000/1). The percentage of releases associated with the temporary repairs was 3%, which included one major release. This is a problem area that appeared to be growing in importance, as there were no corresponding releases from this source reported in 2000/1.

Analysis of all immediate causes of releases was provided for 2000/1, and 2003/4. For 2003/4, the biggest single immediate cause was: (1) corrosion/erosion at 23%, (2) degradation of material properties at 16% and incorrect installation at 16%, (3) fatigue/vibration at 12% and operator error at 12%. In 2000/1, operator error and failure to follow procedures were significant immediate causes, but were not so in 2003/4. The largest immediate cause was discussed for various principal release sites:

• Flanges – Incorrect installation (40% and 28%) and degradation of material properties (20 and 20%);

• Small bore tubing – Fatigue and vibration (35% and 29%) and Incorrect installation (18% and 15%);

• Open ends – Inadequate procedures (47%) and operator error (25%); and

28

• Valve stem releases – Hardening of the stem packing (70%) i.e. a degradation of material properties.

The report classifies immediate causes as either hardware-related (corrosion, erosion, fatigue, vibration, degradation of material properties, inadequate equipment and line blockage) or software-related (inadequate isolation, inadequate installation, inadequate procedures, operator error and procedural violation). Nearly 60% of all releases had hardware-related immediate causes. The underlying causes of these releases were:

• Inadequate inspection / condition monitoring (48%); • Inadequate design (26%); • Inadequate maintenance (11%); and • Inadequate installation (4%).

The remaining 40% of releases would have had a software-related cause. The underlying causes were:

• Inadequate procedures (26%); • Inadequate compliance monitoring (10%); • Procedural violation; • Risk assessment; • Inadequate installation; and • Inadequate task specification (4%).

Underlying causes of all releases is also discussed. The most important were inadequate design (29% in 2000/1 and 21% in 2003/4) and inadequate inspection/condition monitoring (28% in 2000/1 and both 30% and 35% are quoted for 2003/4). Other important underlying causes were inadequate procedures, inadequate competency and inadequate maintenance. Inadequate design is often related to inadequate piping support, which left the pipe vulnerable to vibration and fatigue problems.

Failed safeguards are also mentioned. If these had operated correctly the release might have been prevented. Failure to operate an effective corrosion/erosion monitoring system was implicated in 28% of the 2003/4 releases (10% in 2000/1). This is to be expected with ageing plants. Also implicated were inadequate inspection / condition monitoring (26% of 2003/4 and 32% of 2000/1 releases), procedural review (12% of 2003/4 and 18% in 2000/1), competency assurance (11% in 2003/4 and 10% in 2000/1) and design review (8% in 2003/4 and 15% in 2000/1).

5.1.2 HSR 2002 002

This section uses information in HSR 2002 002 [7] to complete the analytical taxonomy for the year 2001/2 in comparison with 2000/1. The taxonomy was first used in OTO/2001/055 in which all releases reported in 2000/01 were investigated as part of the Process Integrity Initiative. There were 241 reportable releases in 2001/02, of which 47 investigation reports were received for analysis, representing 21% of the total. These have been analysed according to the same taxonomy. Any conclusions are therefore based on that particular sample.

In terms of release sites, again pipework accounted for the majority of releases at, 62%, which was comparable with the 2000/1 value of 61%. However, there were some differences within this grouping between the two years. A greater proportion of the 2001/2 release sites were assigned to small bore pipework and associated connections, including instruments at 25% as opposed to 18% in the previous year. Perhaps of more significance was the marked reduction in releases from pipe open ends, down from 16% to 4%. Valves were involved in 21% of releases, vessels 6% and pumps 6%. Other findings were:

29

• 70% of releases were cracks, splits or holes in the containment envelope. This was an increase compared to the 47% of the previous year.

• 23% of releases were from the body of the pipe, vessel or valve. This was in line with 21% for 2000/1. Mostly these resulted from degradation of the containment envelope caused by degradation of material properties.

• 25% of releases were associated with small-bore piping including instruments, the bulk of these were associated with connections.

• Flanges accounted for 15% of releases, which was exactly the same proportion as the previous year.

• 19% of releases were from seals or valve stems. This was an increase over the previous year’s proportion of 14%.

• There were no hose releases in the sample investigated.

In terms of immediate causes, the largest single cause was again degradation of material properties, which accounted for 28% of the incidents compared with 26% in 2000/1. Incorrect installation and fatigue/vibration both at 21%, were the second largest contributors. Both of these were almost double the 2000/1 figures of 12% and 11% respectively, and more significant than corrosion/erosion which accounted for 13% of incidents, compared to 19% in the previous year. Procedural type causes were all less than 10%.

When it came to analysis of the most important release sites, the most prominent cause for flange leaks (15% of all releases) was incorrect installation in 60% of cases, which was a significant increase compared to the previous year. Degradation of material properties was much less significant at 15%. For small bore tubing and associated connections (responsible for 25% of releases), the main causes were fatigue (33%), incorrect installation (25%) and degradation of material properties (17%). This was in line with the previous year’s findings, although incorrect installation played a more prominent role. Open ends only accounted for 10% of releases in this analysis. The causes were evenly distributed, although most were procedural rather than hardware-related.

The same hardware versus software classification was used. The immediate causes could be divided into hardware or software related as follows:

• Hardware: Degradation of material properties, fatigue/vibration, internal corrosion, erosion. 62% of releases had hardware-related immediate causes. Of these the underlying causes were mainly inadequate inspection/condition monitoring in 48% of these incidents. The next most significant underlying cause was inadequate design (34%).

• Software: Incorrect installation, operator error, procedural violation, inadequate isolation, inadequate procedures. The remaining 38% of releases had software-related immediate causes of these the causes were mainly inadequate procedures (40% of these incidents). The next most frequent cause was inadequate compliance (28%).

The underlying causes of many incidents are complex and more than one cause can be identified in many cases. When these were analysed independently of immediate cause, the largest contribution was from inadequate inspection/condition monitoring in 32% of investigated incidents, closely followed by inadequate design in 30%. These were very similar to the previous year’s figures of 28% and 29%. The next four most significant underlying causes were inadequate procedures in 23% of incidents, incorrect installation in 15%, incorrect material specification/usage in 13% and inadequate risk assessment in 13%. Other underlying causes were identified in less than 10% of investigated incidents.

As in the previous year, inspection/condition monitoring was the most prevalent failed safeguarding system that might have prevented the release of 30% of all incidents investigated.

30

Of the remaining safeguarding systems, competency assurance was the next highest with corrosion/erosion monitoring and change control also featuring. Design review was less significant than the previous year’s analysis. There was no identifiable pattern for major releases.

5.2 LOSS OF CONTAINMENT MANUAL

One of the purposes of this document [8] is to reduce offshore hydrocarbon releases. It was produced during the Key Programme, discussed in section 5.1, on the same issue. It discusses 10 important elements on the management of the containment of the process containment envelope and provides advice for inspection within each of the elements. The maintenance of high standards of operation in these areas should help to reduce the frequency of offshore hydrocarbon leaks. Relevant information under each element will now be outlined below.

5.2.1 Management of Process Integrity

One important aspect of successful process integrity management is the identification of the basic and underlying causes behind process incidents.

5.2.2 Small bore tubing and piping systems

Small bore tubes, piping systems and flexible hoses have to be successfully managed if they are used for hydrocarbon duties. The IP/UKOOA guidance on this subject should be referred to. Vibration induced fatigue was not generally considered in the design of process piping systems. Vibration induced fatigue can be made worse by both increased flowrates / relaxation of erosion velocity limits, resulting in more turbulent energy. It also results from the greater use of thin-walled pipework, made possible by the use of higher strength materials, allowing use of more flexible pipework and higher stress concentration at small bore connections. Use of small bore tubing in practice and the control of small bore flexible hoses are also discussed.

5.2.3 Information, instructions and training

The safe operating limits of process plant equipment should be set and clearly documented. Limits should be set for pressure, temperature, level and flow. Process composition and material additions may also have to be limited. Related trip and alarm settings should also be recorded together with a clear record of plant equipment.

5.2.4 Isolations and permits to work

Included here are isolation standards, locked valve controls, long-term isolations, isolations for relief and vent systems, permit systems and monitoring. The OIAC / HSE guidance documents ‘The safe isolation of plant and equipment’ (HSG 253) and ‘Guidance on permit to work systems’ (HSG 250) should be referred to.

5.2.5 Process plant protection systems

The systems prevent process excursions from violating the safe operating envelope of the process equipment. Both instrumented protection and relief & blow down systems are involved. Issues include instrumented protection and ESD systems, control of inhibits/overrides, control of programmable systems, alarm systems integrity, and relief/blow down system integrity.

31

5.2.6 Change control

Many of the catastrophic events that have occurred on process facilities are attributable to changes. There have also been numerous deficiencies in offshore process systems arising from the failure to control change.

A typical change control problem concerns a failure to re-evaluate relief requirements adequately when process fluids or operating conditions are changed, or when mechanical changes are made. Another example involves change from dry gas to wet gas operations. Key safety issues include different corrosion/erosion rates, liquid slugging effects, increased pigging frequency, hydrate formation/inhibition, and effects on blow down, flare and vent systems.

Duty holders need to have systems to ensure that changes to the process and its equipment, or to the management system, are properly evaluated before their introduction. This part of the manual reviews the way in which change is initiated, communicated, analysed, implemented, and reviewed. It involves a mix of onshore and offshore inspection; inspectors will need to decide on the best place to obtain the relevant information.

It is intended that the guidance should be used flexibly. If it is sufficient to open a meaningful dialogue then the inspection topics/action will have served its purpose.

5.2.7 Maintenance and verification of process safety-critical elements

This part of the manual examines the way in which process safety-critical elements are managed. OSD’s analysis of incidents indicates that particular attention needs to be given to systems for managing corrosion and erosion, and leaks at flanges. It involves a mix of onshore and offshore inspection. UKOOA Guidance sets out various recommendations for industry to follow e.g.. CP029 Management of Safety-Critical Elements (1996), and CP001 Fire and Explosion Hazard Management (1995).

5.2.8 Control of miscellaneous process hazards

This part reviews the way in which some miscellaneous process hazards are managed. Not all the hazards are relevant to every installation, and the notes concentrate on preventive controls rather than loss of containment etc.

Control of H2S and CO2

Gas streams associated with some reservoirs have to be treated to reduce the Carbon Dioxide (CO2) or Hydrogen Sulphide (H2S) to levels to meet export pipeline gas specifications. Two main methods are used. These are:

a) counter current contact in which the gas stream rises through a column against a downward flowing stream of amine or proprietary solvent, and

b) b) absorption, where the gas stream may be passed through a column packed with zinc oxide in powder or granular form.

Sand management

Production of sand with well fluids presents several potential hazards for topsides pipework and equipment, as detailed in SPC/Tech/OSD/19 - Offshore Produced Sand Management. For example:

• Sand plugging causes valves to seize, potentially compromising ESD action; 32

• Accumulated sand requires operator intervention to remove it, by sand-washing, digging out, or dismantling of plate exchangers;

• Sand accumulation can prevent corrosion inhibitor reaching the material surface leading to increased corrosion; and

• Sand accumulation in level instruments and bridles can lead to false readings and poor control, and may compromise shutdown initiation.

Control of hydrates

Hydrates are ice-like solids that can form when wet gas and light condensate at high pressures cools to lower temperatures. Hydrates are formed by gas cooling to below its water dew point, or when free water is present. Cooling may be due to operational pressure drop, or during start-up when hydrocarbon is introduced into cold pipework or equipment. Once formed, hydrates are difficult to remove; prevention is better than cure. Hydrate inhibitor, such as glycol, methanol or industrial methylated spirits, is used to inhibit the formation of hydrates by removal of free water. Hazards caused by hydrates include:

• Blockage of pipework, and instrument tappings, causing false readings;

• Plugging of valves, giving operational problems, and potentially compromising ESD action;

• Hydrate particles travelling at high gas velocities can cause large forces at elbows and tees; and

• Removal of hydrates may require physical intervention, with associated risks. Sand particles can erode piping and fittings, particularly chokes and flowlines.

Sampling arrangements

Sampling involves directly breaking into the hydrocarbon containment envelope. Hazards associated with potential loss of containment, and with static electricity, should be recognised.

Protection against air ingress and flammable mixtures in process plant

Flammable mixtures can form in piping, plant and equipment when air enters systems that normally contain hydrocarbon, as a result of operational or maintenance activities. Correct purging and operational procedures will ensure that the risks are minimised.

Segregation of hazardous drains

Open drain systems are typically classified as hazardous and non-hazardous. It is important that segregation of the drain systems is maintained at all times to prevent migration of hydrocarbons into safe areas where they may present an ignition risk.

5.2.9 FPSO specific systems

In this part of the manual is discussed: • The effects of motion on process plant systems; • Turret arrangements/swivel joints and seals, leakage and recovery; • Integrity of flexible hoses; • Inert gas controls/cargo tank blanketing; • Marine and process systems interfaces; and

33

• HP fuel gas and gas compression.

5.2.10 Process plant construction and commissioning

In construction, important issues include piping, flange joints and small bore pipework/tubing and the control of change. In commissioning, important issues include cleaning/flushing/drying, pressure testing/leak testing and function testing.

5.3 ASSESSMENT OF THE MAJOR ACCIDENT HAZARD ASPECTS OF SAFETY CASES

The topic guidance [9], commonly known as GASCET, discusses a number of situations where hydrocarbon releases have occurred. These releases are generally discussed under specific technical issues.

5.3.1 Degradation in Service

This is an issue for pressure vessels, piping and piping components and valves.

To avoid corrosion, piping containing hydrocarbons should avoid 'dead legs' and be designed to facilitate drainage to prevent trapping of fluid.

Fatigue is a damage mechanism by which cracks can propagate in a structure under the influence of repeated cycles of stress well below the level capable of causing general yielding. Fatigue is often characterised as occurring in two phases; the first is that of initiation, i.e. from manufacture up to the point where a detectable crack is present. The second is the phase of defect growth, where propagation from the point of detectability to the point of failure occurs.

Fatigue is addressed initially at the design stage. There are a number of methodologies by which this can be done. However we note that for plant with a limited fatigue load, the codes normally provide for the exclusion of a full analysis, providing that certain pre-conditions can be met, i.e. it is established that there will only be a limited number of full pressure cycles etc.

In general though, the fatigue loads from all sources of repetitive stress have to be characterised both in terms of the stress amplitude and their number. This can be used to determine a fatigue lifetime for the component.

A suitable demonstration should be provided for the integrity of joints and seals where failure could lead to a release of hydrocarbons. General information should be provided to indicate that flanges and other joints have been adequately designed and properly made to avoid flammable and toxic hazards. Further guidance is available in IP/UKOOA Guidelines for the Management of Integrity of Bolted Pipe Joints.

The use of fully welded pipework topsides is one of the approaches to adhere to the principle of inherently safer design. However, for ease of access for operation, inspection, maintenance and repairs, it is not possible to have fully welded pipework everywhere on topsides plant. The duty holder should avoid routing of pipework containing hazardous fluid through non-hazardous areas. If this is unavoidable, then pipework shall be all welded (no flanges) and not located in a vulnerable position where it may be mechanically damaged.

34

5.3.2 Materials

Materials chosen should be suitable for the application in terms of the process fluid, environment and applied loading. Again, pressure vessels, piping and piping components, and valves are relevant here.

The prevention of brittle fracture is addressed within design codes. Prevention involves the correct choice of materials, operation within strict temperature/pressure limits and monitoring ageing phenomena such as embrittlement. Ferritic steels are subject to a ductile to brittle transition as temperature decreases, rendering them highly vulnerable to brittle fracture when cold. Transition temperatures vary, but are typically below ambient values for offshore applications. Ageing though can lead to a shift in the transition temperature and render components more susceptible to brittle fracture. Austenitic steels remain ductile at low temperatures and may be preferred for application such as blowdown lines.

Brittle fracture is possible whenever low temperatures are involved, in particular low temperatures associated with gas expansion. This is particularly the case when systems are still pressurised, although in some circumstances, the differential stresses through the wall of a vessel by sudden cooling could lead to crack propagation.

The effect of ageing is undoubtedly one of the major integrity issues facing the older installations. Ageing encompasses degradation mechanisms such as fatigue and corrosion. There are also other phenomena, for example creep and the deterioration in mechanical properties such as fracture toughness. The latter phenomenon is associated with changes in transition temperatures. Provision against these mechanisms is explicitly required, as part of the design criteria and operational monitoring exists for the express purpose of detecting these phenomena.

Nevertheless, age-related failures are occurring. The implication of this is that either plant is being operated beyond its original design life, that conditions have changed because modification has rendered the initial assumptions invalid, or that inspection regimes are inadequate.

In recent years, the popularity of risk-based inspection schemes has led to situations where inspection intervals have been lengthened for some plant. Where such decisions have been made, the requirements on the knowledge about plant state are high.

5.3.3 Gasketed Plate Heat Exchangers

There is a likelihood of significant hydrocarbon release to the atmosphere on gasket failure. Shields should normally be fitted to prevent fluids from contacting personnel in the event of gasket failure. There is a working pressure limitation for gasketed plate heat exchanger of approx 25 barg.

5.3.4 Hazardous Drains/Caissons

Dip pipes can be subjected to accelerated rates of corrosion at, or just below, the liquid level in the caisson. Perforation resulting from such corrosion may result in the migration of hydrocarbon vapour from the caisson into the drains system (this has resulted in a number of hydrocarbon releases). Confirmation should be obtained that there is an inspection scheme in place to address this phenomenon.

A number of hydrocarbon releases have resulted from poor design involving inappropriate interconnections between the closed/flare system and the open drains. Plant blowdown then

35

causes gas to discharge from the open drains. Confirmation should be sought that this possibility has been examined during the plant HAZOP studies.

5.3.5 External Corrosion

External corrosion of topsides on an ageing installation does not usually receive the same degree of attention as the management of the internal corrosion. The result of this is that on a number of installations, the primary threat of hydrocarbon release is from external corrosion. In addition, a significant number of personnel injuries on such installations are due to falls and trips resulting from failure of corroded members used as temporary supports or steps. Corroded walkways have also featured in a number of incidents. Particular issues that should be probed as part of the safety case assessment include:

• Management of process plant integrity around corrosion traps such as pipe supports, penetrations, saddles, etc;

• Management of the risks associated with surface preparation and painting on ‘live’ plant;

• Management of corrosion under insulation;

• Management of bolt corrosion;

• Management of pitting and stress corrosion cracking in corrosion resistant alloy piping and tubing operating in areas exposed to sea spray/deluge. See RR129 Review of external Stress Corrosion Cracking of 22% Cr Duplex Stainless Steel for further guidance;

• Painting and refurbishment planning systems and performance standards including short-term remedies;

• Maintenance of spring supports;

• Corrosion management of walkways, hand railings, escape equipment attachment points and other similar secondary structural components.

5.3.6 Erosion

There have been a number of major hydrocarbon releases recently caused by solids particle erosion where failure of a number of crucial control measures had occurred. Wall thinning is usually very rapid and hence prevention rather then control should be the guiding principle. Operations staff do not always appreciate the impact of the production rate on erosion risk. Prevention of erosion in the production plant can be achieved by design, whereas for well servicing and drilling operations process management is usually the only available option. Erosion tends to be a localised effect, which means that a very good knowledge of the local rather then global flow velocities is required in order to assess erosion risks. Sand detection systems have proved to have varying reliability and hence their effectiveness should be explored as part of the assessment process.

Relevant guidance documents include

RR115 Erosion in Elbows in Hydrocarbon Production systems: Review Document and

SPC/TECH/OSD/19 Offshore Produced Sand Management.

36

5.3.7 Incorrect Material Specification

The guidance notes that confirmation should be obtained that material selection has been based on a rigorous evaluation of all internal and external environments, operational and non-operational conditions including upset conditions, design life and system performance standards, failure modes and consequences, inspection and monitoring requirements and health conditions. In addition, various standards are listed in the guidance. Most process plant component standards also cover material performance requirements to some extent.

Although the standards provide a good basis for evaluation of materials selection they are not all-encompassing and hence the following should also be examined:

• How has the industry experience been captured and fed into the materials selection process?

• What is being done to design out corrosion under lagging?

• Have the various problems with vessel internal coatings experienced by a number of duty holders been recognised?

• Are risks of preferential weld corrosion adequately addressed?

• How are the significant erosion risks in vessel sand wash drains tackled?

• Are ESD and Control valve trims adequate to maintain seal tightness under the operating environment?

• Are the limitations and problems in using corrosion allowance approach to manage degradation recognised?

• Do provisions for testing include the need to demonstrate adequacy of the material’s corrosion resistance as well as physical properties?

• Have the limitations of 316SS tubing been considered in the material selection process?

• Are the particular requirements for bolting material and its corrosion protection adequately addressed?

5.3.8 Isolations

Confirmation should be obtained that isolation procedures are in accordance with recognised standards or codes of practice including Oil Industry Advisory Committee – The safe isolation of plant and equipment (OIAC / HSE HSG 253). Where a standard or code of practice other than that listed above has been employed, judgement as to the adequacy can only be made on an individual basis and the dutyholder should be requested to justify why equivalent standards of safety should result.

5.3.9 Permit to Work Systems

Although a sub-set of the procedural assessment element within Human Factors, this is so major it needs to be a topic in its own right, particularly given that failure of permit to work [PTW] procedure has been a key causal factor in the major offshore accidents and incidents.

Confirmation should be obtained that clearly defined permit to work procedures are in place for all activities on the installation, and that these comply with a recognised standard or code of practice. Recognised standards/codes of practice would include:

37

OIAC Permit to work guidance (OIAC/HSE HSG250);

HSG 65 Successful Health and Safety Management;

HSG 48 Reducing Error and Influencing Behaviour.

Where a standard/code of practice is listed above, but an alternative has been employed, judgement as to the adequacy of the system in place can only be assessed on an individual basis, and the duty holder should be required to justify why its system will deliver an equivalent level of health and safety performance.

38

6 DISCUSSION

6.1 COMPARISON WITH HYDROCARBON RELEASE REDUCTION CAMPAIGN

The campaign report [6] noted problems in the reporting of minor releases. These problems are not relevant to this project, which was only concerned with major and significant releases.

The trend of releases being concentrated in normal production and start up / reinstatement operational modes was also found to be true in the current study, although based on differently specified data sets. When considering the number of releases in various operational modes the frequency of that mode will affect the frequency of hydrocarbon releases. It may be that the frequency of releases in start-up and reinstatement is higher than normal production expressed as the number of releases per hour.

The current study highlighted the number of releases from piping, instruments, storage tanks, valves and flanges. The campaign report also highlighted these release sites.

The current study showed the importance of releases from piping and flanges, that platform age was generally significant and that more releases were associated with smaller diameter flanges. This may be due to population, i.e. are there more small/medium size flanges than large ones? There may be a higher number of failures involving smaller sizes, but this is not necessarily the same as saying small flanges have more leaks than large ones. The campaign report also found that flange failures were sometimes related to degradation of mechanical properties.

The current study found that mechanical failure, erosion and mechanical fatigue were the most frequent equipment causes. The campaign report highlighted erosion / corrosion, degradation of mechanical properties and fatigue/vibration as immediate causes. Thus similar causes are being highlighted.

The current study found that improper operation, improper maintenance, left open and incorrectly fitted were the most important types of operational causes. The current study found that deficient procedures, non-compliance with PTW and non-compliance with procedures were the most important procedural causes. The campaign report highlighted incorrect installation and operator error as immediate causes. Thus similar causes are being highlighted.

6.2 COMPARISON WITH LOSS OF CONTAINMENT MANUAL

Some of the same issues discussed in this manual [8] could also be identified in the current project; see the appendices on release causes per year and releases in terms of platform age. The manual [8] stresses the importance of maintaining process integrity and looking at the underlying causes behind process incidents. In terms of pressure limits, using the partial dataset, there were only two cases where the actual pressure exceeded the maximum pressure. The OIR12 reporting system ensures that the duty holder makes some attempt to look at underlying causes for hydrocarbon releases.

The manual [8] highlights the importance of guidance to ensure that isolations and PTW are carried out properly. The current study found that improper operation, improper maintenance, left open and incorrectly fitted were the most important types of operational cause. Similarly deficient procedures, non-compliance with PTW and non-compliance with procedures were the most important procedural causes. Clearly the two OIAC/HSE guidance documents on isolation and PTW need to be more closely followed.

39

6.3

The manual highlights change control. The current study also gives some information on this topic. As well as normal production, re-instatement and start up are operating modes during which hydrocarbon releases are occurring. Mechanical fatigue was significant for platforms between 5 and 10 years old. Mechanical changes may be contributing to this increased mechanical fatigue. Internal corrosion was significant for platforms over 20 years old. It may be that the change from dry gas to wet gas was not anticipated in the original design, thus change control needs more careful management.

The loss of containment manual discusses the control of miscellaneous process fluids. The current study found that in terms of equipment causes the order (most common first) is mechanical failure, mechanical fatigue, internal corrosion, erosion, and external corrosion. Thus internal corrosion seems to be more of an issue than erosion and external corrosion. However the manual [8] shows that internal and external corrosion and erosion are all related. The presence of sour gases will increase the rates of corrosion. Sand seems to prevent corrosion inhibitors from working properly. Hydrate particles cause releases at Ts and elbows. Sand can also erode pipes and fittings, particularly chokes and flow lines.

COMPARISON WITH GASCET

Some of the same issues highlighted in Gascet [9] could also be identified in the current project: see the appendices on release causes per year and releases in terms of platform age. Piping and flanges were pieces of equipment involved in a considerable number of hydrocarbon releases. Most piping releases involved platforms over 20 years old. Most flange releases involved platforms aged between 5 and 10 years.

Internal corrosion was more of an equipment cause for platforms older than 20 years. This may be because the expected corrosion allowance had been lost over time or because the fluid had changed its characteristics to become more corrosive. Oil seems to be the main substance that causes internal pipe corrosion. Gascet states that ‘dead legs’ should be avoided and piping be designed to prevent trapping of fluid. The current study finding on oil seems to link in with this. Some wells are becoming sourer as they become depleted. Piping is also the item of equipment likely to be affected.

Mechanical fatigue was more of an equipment cause for platforms between 5 and 10 years. Presumably this would be the defect growth phase mentioned in the sub-section on degradation. No particular patterns were observed which may cause the fatigue, but a significant proportion involved a design failure of some kind. This also seems to link in with the Gascet comments on mechanical fatigue on design.

Flange problems were particularly common in platforms in the 5-10 year age range. Ring Type Joint (RTJ) flange joints had the most problems and the lower to middle sized diameters seemed to have more problems. Mechanical fatigue and mechanical failure seem to the main equipment causes for these flanges. Releases from flanges could be due to poor bolt tightening or unsuitable gasket materials. The UKOOA guidance on bolted joints mentioned in Gascet should perhaps be consulted here.

Piping problems were particularly common in platforms over 20 years old. Internal corrosion was the main equipment cause with the mechanical causes (fatigue failure and wear) also contributing. Smaller diameter steel pipes seemed particularly prone. There seemed to be less releases for flexible pipes. Guidance on ageing platforms (Dalzell, 2007) is pertinent to the prevention of failures on older platforms.

Gascet discusses fracture, but this does not appear as an equipment cause on the HCR database but may perhaps be represented as mechanical failure. Particular types of fracture such as brittle

40

fracture, also discussed in Gascet, are not indicated as such. If brittle fractures are associated with low temperatures, then it may be possible to relate mechanical failure and equipment that operates at low temperatures.

In terms of equipment causes, the order (most common first) is mechanical failure, mechanical fatigue, internal corrosion, erosion, and external corrosion. Thus internal corrosion seems to be more of an issue than erosion and external corrosion, which are discussed in some detail in Gascet. Releases from heat exchangers (equipment) and drains (systems and equipment) do occur but are not particularly significant. Liquid levels in caissons are discussed in Gascet. The current study’s observations on the relationship between internal corrosion and oil seems relevant here. Material specification as an equipment cause was not particularly significant.

Normal production is the most common operational mode at failure for platforms between 5 and 10 years old. No particular equipment type seems to dominate. Mechanical issues such as failure and fatigue result in most releases.

41

7 CONCLUSION AND RECOMMENDATIONS

7.1 CONCLUSIONS

The main findings, based on the sum of significant and major releases, are:

• The total annual number of releases has decreased over the study period. However, this decrease is due mainly to the reduction of significant releases, as major releases have stayed fairly constant in number;

• Typically, the number of releases peaks during November, April and August, and experiences corresponding troughs during May, June, January and September. The releases per month may be influenced by plant intervention i.e. high interventions in summer and low in winter;

• Gas releases are the most common followed by oil, non-process and 2-phase (which are tied) and lastly condensate;

• Older platforms aged 20 years and over experience the most releases;

• Releases from installations in most age ranges seem to be decreasing over time except the 10-15 age range which seems to be increasing;

Comments on the full set of major and significant releases were:

• Gas compression is the system that results in most releases, then export, then utilities;

• Piping is the most common equipment type that experiences releases, then instruments, then flanges;

• The most frequent equipment failure cause is mechanical failure, then none then mechanical fatigue. Note that the subgroup ‘failure’ is a default under mechanical causes of releases and may include some cases of ‘fatigue’ or ‘wear-out’ not adequately described in the Form OIR12;

• Incorrectly fitted equipment is the most widespread operational cause that is explicitly stated, then improper operation – human factors issue. ‘None’ appears most frequently;

• Non-compliance with a procedure is the most common procedural cause that is explicitly stated, then deficient procedure – human factors issue. ‘None’ appears most frequently;

• Most releases occur in the normal production operational mode, followed by start up and reinstatement

Main causes per year

The number of releases for each category is either roughly consistent, or reducing in number with time. With all causes, except releases due to system failure, the number of blank inputs has increased in later years, particularly between 2005 and 2007. This is mainly due to the manner in which the release reports are recorded, so it may be worthwhile checking why these areas have been left blank. There seemed to be no major issues relating to the year.

42

7.2

Age of platform

The oldest platforms at 20+ years have the most instances of releases for export and utilities systems, perhaps confirming the importance of management of ageing installations. Relatively new platforms, between 5-10 years of age at the time of release, account for the most gas compression system releases. In fact, these platforms have high numbers of releases in general when compared to the surrounding platform ages, so it may be useful to investigate the issues surrounding these installations.

Considering the equipment, piping is an issue with installations aged 20+, this suggests an issue with the management of ageing installations. Releases concerning flanges are fairly common with installations aged 5-10 years. Ring Type Joint (RTJ) flange joints are the most troublesome, again with 5-10 year old platforms and usually with smaller diameter flanges. This may be due to the population of smaller sized flanges on installations.

Mechanical failure is the most common equipment cause for releases. There are a significant number of mechanical fatigue releases, again with platforms aged 5-10 years at the time of release. Internal corrosion also causes a significant number of releases for platforms aged 20+ years compared with smaller numbers for other ages.

Normal production is the most common operational mode in which releases could occur. The values over all platform ages are fairly consistent except with the oldest platforms experiencing the most releases. However platforms aged 5-10 years also show a significant number of releases during normal production.

Main causes per quarter

There is no obvious pattern that indicates seasonal variance for the number of releases. The only area with possible questions is the start up operational mode that has the vast majority of releases in the third quarter (July to September), compared to lower numbers the rest of the year. Most of the third quarter start up releases involved gas. It may be worthwhile for operators to investigate if their procedures change during this time or if start up does not usually occur during the colder months. The number of releases will be influenced by plant interventions, i.e. high interventions in the summer and low interventions in the winter.

RECOMMENDATIONS

On the whole, older platforms and processes involving gas result in the most releases. Piping failures in terms of internal corrosion are also an issue, as is mechanical failure of all equipment in general. As a result, operators should focus on resolving any outstanding concerns dealing with these areas; taking account of guidance on ageing platforms (Dalzell, 2007).

It is possible to continue this work in the future in order to monitor offshore safety issues, which could highlight areas that need further improvement. Further investigation could yield more patterns. The HSE OSD Incident reports could also be sampled. However, relevant incidents would first have to be identified by platform name and OIR9B number. The recommendation on the HSE Intranet version of the HCR database also applies here (see below).

The HSE Intranet version of the HCR database should be modified so that all data filters can be used to fully identify, by platform name and OIR9B number, relevant releases. At present only a limited number of data filters can be applied, mostly relating to the type of release, size of release and date. The current arrangement makes data sampling or full identification of releases involving, for example, particular types of system, equipment, operational mode and cause type, very difficult.

43

8 APPENDIX A – SEVERITY CLASSIFICATION

Within the scope of this work, only significant and major releases are considered, but for completeness the definition and criteria for minor releases is included here.

Definitions

MAJOR: "Potential to quickly impact out with the local area e.g. affect the TR, escape routes, escalate to other areas of the installation, causing serious injury or fatalities." A major leak, if ignited, would be likely to cause a "major accident", i.e. it would be of a size capable of causing multiple casualties or rapid escalation affecting TR, escape routes, etc.

SIGNIFICANT: "Potential to cause serious injury or fatality to personnel within the local area and to escalate within that local area e.g. by causing structural damage, secondary leaks or damage to safety systems." A significant leak, if ignited, might have the potential to cause an event severe enough to be viewed as a "major accident" or be of a size leading to significant escalation within the immediate area or module.

MINOR: "Potential to cause serious injury to personnel in the immediate vicinity, but no potential to escalate or cause multiple fatalities." A minor leak, even if ignited, would not be expected to result in a multiple fatality event or significant escalation, but could cause serious injuries or a fatality local to the leak site or within that module only.

Criteria

MAJOR: (i) Gas Releases:

EITHER [Quantity released > 300 kg] OR [Mass release rate>1kg/s AND Duration >5 mins]

This could result in a jet fire of over 10 m length (>1kg/s) capable of causing significant escalation after 5 minutes duration, or a flash fire/explosion on reaching LFL. Where 300 kg equates to approx. 3000 m3 explosive cloud at NTP, enough to fill an entire module or deck area, and to cause serious escalation if ignited.

(ii) Liquid Releases (Oil/Condensate/Non-process): EITHER [Quantity released > 9,000 kg] OR [Mass release rate>10kg/s AND Duration >15 mins]

This could result in a pool fire over 10 m in diameter (>10kg/s) filling a module or cutting off a deck, hindering escape and affecting more than one person directly if lasting for over 15 minutes duration.

(iii) 2-Phase Releases: EITHER [Quantity of liquids released > 300 kg] OR [Liquids mass release rate>1kg/s AND Duration >5 mins]

Combinations of the major gas and liquids scenarios described above are possible, depending on the gas to oil ratio (GOR) involved.

MINOR: (i) Gas Releases:

EITHER [Quantity released < 1 kg] OR [Mass release rate <0.1 kg/s AND Duration < 2 mins]

44

This could result in a jet fire of less than 5 m length (< 0.1 kg/s) which is unstable (< 2 mins duration) and therefore unlikely to cause significant escalation, or a flash fire/explosion on reaching LFL. Where <1 kg equates to <10 m3 explosive cloud at NTP, probably insufficient to cause a significant hazard if ignited.

(ii) Liquid Releases (Oil/Condensate/Non-process): EITHER [Quantity released < 60 kg] OR [Mass release rate <0.2 kg/s AND Duration < 5 mins]

This could result in a pool fire smaller than 2 m in diameter (< 0.2 kg/s) unlikely to last long enough to hinder escape (< 5 mins), but could cause serious injury to persons nearby.

(iii) 2-Phase Releases: EITHER [Quantity released < 1kg] OR [Liquids release rate <0.1 kg/s AND Duration < 2 mins]

Combinations of the gas and liquids scenarios described above are possible, depending on GOR involved.

SIGNIFICANT: (Those between major and minor) (i) Gas Releases:Capable of jet fires of 5 to 10 m lasting for between 2-5 minutes, or release rates between 0.1 to1.0 kg/s lasting 2- 5 minutes giving explosive clouds of between 10 and 3000 m3 in size. (ii) Liquids Releases (Oil/Condensate/Non-process):Pool fires between 2 and 10 m in diameter, lasting for between 5 and 15 minutes.(iii) 2-Phase Releases:Combinations of the gas and liquids scenarios described above are possible.

45

9 APPENDIX B – RELEASE CAUSES PER YEAR

The table below is based on the full dataset of 35 major releases and 560 significant releases. The blue bold text indicates the top three causes in each category.

Table 6a Release causes per year - System

System Year Total 2001 2002 2003 2004 2005 2006 2007 Blowdown 1 0 0 2 1 0 0 4 Drains 1 3 6 3 2 4 2 21 Drilling Equipment 1 0 0 0 2 0 0 3 Drilling Ops 3 1 2 0 0 2 0 8 Export 16 15 13 9 10 6 12 81 Flare 3 3 2 1 0 1 1 11 Flowlines 7 7 4 6 7 7 6 44 Gas Compression 26 23 22 28 18 23 16 156 Import 2 0 1 1 4 2 0 10 Manifold 4 4 4 2 2 3 3 22 Metering 5 6 7 5 2 4 0 29 Processing 3 7 9 5 6 9 3 42 Separation 7 3 9 2 3 4 3 31 Utilities 9 10 8 14 10 7 4 62 Vent 2 0 0 3 5 0 3 13 Well 13 5 2 2 3 3 5 33 Well Ops 10 3 4 2 3 2 1 25 Total 113 90 93 85 78 77 59 595

Table 6b Releases causes per year - Equipment

Equipment Year Total 2001 2002 2003 2004 2005 2006 2007 Compressors 4 5 3 3 7 6 4 32 Drain Opening 0 2 3 3 1 2 2 13 Drain Plug 0 0 0 1 0 1 0 2 Filters 0 1 2 1 2 3 3 12 Flanges 10 12 9 11 8 3 6 59 Heat Exchangers 2 3 4 3 0 5 1 18 Instruments 25 14 12 14 11 16 15 107 Mud 1 0 0 0 2 0 0 3 Pig Launchers 0 0 2 1 1 2 2 8 Pipelines 2 0 0 0 3 0 1 6 Piping 28 17 22 24 18 11 8 126 Pressure Vessels 2 2 0 0 1 2 0 7 Pumps 4 1 4 1 2 1 2 15 Risers 0 0 0 1 0 1 0 2 Storage Tanks 1 5 6 1 1 0 0 14 Turbines 2 0 1 1 2 2 1 9

47

Valve-actuated 6 8 10 10 8 9 6 57 Valve Manual 3 10 6 6 4 7 7 43 Wellheads 5 3 1 1 0 1 0 11 Xmas Trees 5 2 1 1 3 0 0 12 Blanks 13 5 7 2 4 5 1 37 Total 113 90 93 85 78 77 59 595

Table 6c Release causes per year – Equipment Cause

Equipment Cause Year Total 2001 2002 2003 2004 2005 2006 2007

Awaiting Investigation 5 0 4 2 0 0 0 11 External Corrosion 2 3 3 3 4 0 1 16 Internal Corrosion 9 6 10 7 9 5 4 50 Erosion 3 3 3 3 5 4 1 22 Manufacturing 0 0 1 0 0 0 0 1 Material Defect 2 1 2 1 3 0 1 10 Mechanical Failure 58 26 35 30 27 22 14 192 Mechanical Fatigue 11 11 6 12 8 9 5 62 Mechanical Wear 7 5 6 4 4 5 2 33 None 34 30 23 22 16 15 9 149 Not Known 0 2 0 0 0 0 0 2 Specification 2 3 0 1 0 1 0 7 Blanks 0 0 0 0 2 16 22 40 Total 113 90 93 85 78 77 59 595

Table 6d Release causes per year - Operational Cause

Operational Cause Year Total 2001 2002 2003 2004 2005 2006 2007

Adverse Weather 1 0 0 0 0 0 0 1 Awaiting Investigation 2 0 2 0 0 0 0 4 Dropped Object 2 1 4 0 1 0 0 8 Improper Inspection 3 5 2 2 2 0 1 15 Improper Maintenance 10 1 10 3 5 7 1 37 Improper Operation 12 13 11 6 10 5 0 57 Improper Testing 1 1 0 0 0 0 0 2 Incorrectly Fitted 13 11 8 15 6 6 4 63 Left to Open 7 9 7 9 8 10 6 56 None 60 48 45 48 41 41 26 309 Opened 1 1 4 1 4 2 2 15 Specification 1 0 0 1 0 2 0 4 Blanks 0 0 0 0 1 4 19 24 Total 113 90 93 85 78 77 59 595

48

Table 6e Release causes per year – Procedural Cause

Procedural Cause Year Total 2001 2002 2003 2004 2005 2006 2007

Awaiting Investigation 0 0 2 2 0 0 0 4 Deficient Procedure 15 11 5 8 10 3 1 53 Non-compliance with Procedure

a 13 10 11 10 5 9 4 62

Non-compliance with Permit to Work

a 2 1 2 1 3 1 2 12

None 82 68 73 64 59 59 43 448 Quality Control 1 0 0 0 0 1 0 2 Blanks 0 0 0 0 1 4 9 14 Total 113 90 93 85 78 77 59 595

Table 6f Release causes per year – Operational Mode

Operational Mode Year Total 2001 2002 2003 2004 2005 2006 2007

Blowdown 0 4 2 2 1 0 1 10 Cleaning 0 1 2 1 0 0 0 4 Drill gas 1 0 0 0 0 0 0 1 Drill Oil 1 0 0 0 0 0 0 1 Drill Operation 3 1 2 0 0 2 0 8 Flushing 0 2 3 0 0 0 1 6 Inspection 0 0 1 2 2 0 0 5 Cold Maintenance Work 0 0 0 1 2 0 0 3 Draining for Maintenance 0 2 0 0 0 0 0 2 Normal Production 62 41 50 48 37 46 36 320 Pigging 1 0 2 1 0 1 3 8 Reinstatement 11 9 3 10 6 10 3 52 Replacement 0 2 1 3 0 0 0 6 Routine Maintenance 2 3 0 3 1 1 2 12 Sampling 0 1 0 0 0 2 0 3 Shut down 3 1 1 1 3 0 0 9 Shutting down 3 2 3 2 1 1 0 12 Start Up 9 11 11 6 15 10 7 69 Testing 2 1 5 1 3 1 1 14 Top up 1 1 2 0 0 0 0 4 Well Services 4 3 1 2 1 0 0 11 Well Operation 10 3 4 2 3 2 1 25 Well Operation with Xmas Tree in Place

0 2 0 0 3 0 0 5

Blanks 0 0 0 0 0 1 4 5 Total 113 90 93 85 78 77 59 595

49

10 APPENDIX C – RELEASES IN TERMS OF AGE OF PLATFORM

Tables 7a to 7g illustrate the number of releases that occur for each area of interest, for example, system and equipment. Table entries in red bold are investigated further in section 10.1 to 10.5.

Table 7a System releases per age of platform

Age (years) Type Gas compression Export Utilities < 5 System 20 9 6

5-10 System 48 20 15 10-15 System 36 12 11 15-20 System 21 10 9 20+ System 31 30 21

Table 7b Equipment releases per age of platform

Age Type Piping Instruments Flanges < 5 Equipment 13 9 8

5-10 Equipment 23 20 23 10-15 Equipment 23 27 6 15-20 Equipment 15 19 9 20+ Equipment 54 32 13

Table 7c In-depth analysis of flanges from the previous table

Age Flange joints Sizes (Inches)

RTJ Compressed joint

(Grayloc) clamp

Spiral wound Chicsan D<=3 3<D<=11 D>11

< 5 5 3 5 2 1 5-10 11 6 4 1 1 7 10 6

10-15 4 1 1 3 2 1 15-20 3 1 3 2 3 5 1 20+ 7 5 1 6 6 1

Table 7d Cause of equipment failure per age of platform

Age Type Mechanical failure None Internal

corrosion Mechanical

fatigue

< 5 Equipment cause 18 20 2 7

5-10 Equipment cause 52 34 6 27

10-15 Equipment cause 43 25 6 5

15-20 Equipment cause 30 24 3 9

20+ Equipment cause 49 46 33 14

50

Table 7e Procedural cause per age of platform

Age (years) Type None Non-compliant procedure

Deficient procedure

< 5 Procedural cause 43 8 4 5-10 Procedural cause 108 11 11

10-15 Procedural cause 86 12 14 15-20 Procedural cause 65 12 4 20+ Procedural cause 146 19 20

Table 7f Operational cause per age of platform

Age (years) Type None Incorrectly fitted

Improper operation

< 5 Operational cause 29 10 7 5-10 Operational cause 81 14 11

10-15 Operational cause 57 9 17 15-20 Operational cause 43 13 6 20+ Operational cause 99 17 16

Table 7g Operational mode per age of platform

Age (years) Type Normal

production Start up Reinstatement

< 5 Operational mode 31 4 10 5-10 Operational mode 87 10 12 10-15 Operational mode 58 14 8 15-20 Operational mode 37 14 11 20+ Operational mode 107 27 11

10.1 FURTHER INVESTIGATION – FLANGES

Tables 8a to 8c are obtained by filtering the full dataset to reveal only flange releases on platforms aged 5-10 years. In total, there are 23 records.

Table 8a Equipment causes for flange releases for platforms aged 5-10 years

Equipment Cause Number of releases Mechanical failure 7

None 6 Mechanical fatigue 8 Mechanical wear 1

Blanks 1

51

Table 8b Operational mode for flange releases for platforms aged 5-10 years

Operational Mode Number of releases Normal Production 18

Well operation with xmas tree 1 Flushing 1 Start up 2

Shutting down 1

Table 8c Operational cause for flange releases for platforms aged 5-10 years

Operational Cause Number of releases Incorrectly fitted 8

None 11 Improper operation 1

Awaiting investigation 1 Blanks 2

In addition, nine of the 23 records indicate gas compression as the most common system failure. Furthermore, there is one major release out of 23 records, the remainder being significant.

Most are gas releases. Two out of 23 are due to design failures and none are ignited.

10.2 FURTHER INVESTIGATION – PIPING

Filtering all piping releases occurring on platforms aged 20 years and over yields 54 release records. Of these, six are major and 48 are significant.

Table 9 Equipment causes for piping releases for platforms aged 20+ years

Equipment Number of releases Piping/steel/D<=3 27 Piping/steel/D>11 7

Piping/steel/3<D<=11 16 Piping/flexible/D<=3 3

Piping/flexible/3<D<=11 1

Of the 54 equipment cause releases, 22 are due to internal corrosion, and 10 are due to some kind of mechanical fault including fatigue, failure and wear.

There appears to be no solid reason for both operational and procedural causes as none appears most commonly.

The most common operational mode is normal productions, which accounts for 36 out of 54 releases.

Six out of 54 releases are due to design failures while one release results in ignition.

52

10.3 FURTHER INVESTIGATION – INTERNAL CORROSION

Filtering all platforms aged 20 years and over that experience equipment failure due to internal corrosion yields 33 records. Of these, there is one major and 32 significant releases.

Table 10a Process types involved in release for platforms aged 20+ years

Process Type Number of releases Oil 17

2-phase 6 Gas 9

Condensate 1

Table 10b Operational causes for platforms aged 20+ years

Operational Cause Number of releases Improper maintenance 6

None 17 Specification 1

Improper inspection 4 Improper operation 2

Opened 1 Left to open 1

Blanks 1

For system releases, six are classified as occurring during export and a further six duringseparation.

Piping is the equipment type that fails most, resulting in 22 releases out of 33.

21 out of 33 releases occur during the normal production operational mode.

Two out of 33 releases are due to design flaws while one release is ignited.

10.4 FURTHER INVESTIGATION – NORMAL PRODUCTION

Filtering the complete data set for platforms aged 5-10 years and with an operational mode of normal production yields 87 release records. Major releases account for six out of 87 records. In addition, 70 out of 87 are gas releases.

Table 11a Equipment item failing on platforms aged 5-10 years

Equipment item Number of releases Flanges 18 Piping 15

Instruments 14 Valve-actuated 12 Valve manual 8

53

Table 11b Cause of equipment failure on platforms aged 5-10 years

Equipment cause Number of releases Mechanical failure 36 Mechanical fatigue 21 Internal corrosion 5 Mechanical wear 4

Table 11c Operational cause on platforms aged 5-10 years

Operational cause Number of releases None 59

Incorrectly fitted 7 Improper maintenance 4

Left to open 4 Improper inspection 3

76 out of 87 releases have none as the main procedural cause.15 out of 87 releases are due to design failures. Only one release results in ignition.

10.5 FURTHER INVESTIGATION – MECHANICAL FATIGUE

Filtering platforms aged 5-10 years that suffer mechanical fatigue as an operational mode yields 27 results from the full set of data. Two releases are classified as major while 21 involve gas.

Table 12 Equipment item failing on platforms aged 5-10 years

Equipment item Number of releases Flanges 8

Instruments 6 Piping 6

17 releases out of 27 are due to the system operation of gas compression. The main procedural cause is none, accounting for 26 out of 27 releases. The operational mode of normal production accounts for 21 out 27 releases, while 23 operational cause releases are classified as none.

11 releases are due to a design failure of some kind. No releases were ignited.

54

11 APPENDIX D – RELEASE CAUSES PER QUARTER

The table below is based on the full dataset of 35 major and releases and 560 significant releases. The blue bold text indicates the top three causes in each category.

Table 13a Release causes per quarter – System

System Quarter Total 1 2 3 4 Blowdown 0 1 3 0 4 Drains 3 8 5 5 21 Drilling Equipment 0 2 0 2 3 Drilling Ops 1 3 2 2 8 Export 15 22 29 15 81 Flare 2 3 6 0 11 Flowlines 8 10 8 18 44 Gas Compression 44 31 42 39 156 Import 1 2 5 2 10 Manifold 8 4 5 5 22 Metering 6 6 6 11 29 Processing 11 10 10 11 42 Separation 8 8 6 9 31 Utilities 16 10 17 19 62 Vent 3 3 1 6 13 Well 7 7 11 8 33 Well Ops 5 7 9 4 25 Total 138 137 165 155 595

Table 13b Release causes per quarter - Equipment

Equipment Quarter Total 1 2 3 4 Compressors 12 4 11 5 32 Drain Opening 1 5 3 4 13 Drain Plug 1 0 0 1 2 Filters 2 4 3 3 12 Flanges 11 16 18 14 59 Heat Exchangers 7 2 6 3 18 Instruments 32 15 27 33 107 Mud 0 2 0 1 3 Pig Launchers 2 4 2 0 8 Pipelines 1 3 0 2 6 Piping 30 32 32 34 128 Pressure Vessels 0 4 2 1 7 Pumps 1 3 3 8 15 Risers 0 0 0 2 2 Storage Tanks 2 5 5 2 14 Turbines 1 0 4 4 9 Valve-actuated 10 17 16 14 57

55

Valve Manual 12 5 14 12 43 Wellheads 5 1 4 1 11 Xmas Trees 1 4 4 3 12 Blanks 7 11 11 8 37 Total 138 137 165 155 595

Table 13c Release causes per quarter – Equipment Cause

Equipment Cause Quarter Total 1 2 3 4 Awaiting Investigation 1 4 5 1 11

External Corrosion 3 4 2 7 16 Internal Corrosion 13 15 7 15 50 Erosion 5 4 8 5 22 Manufacturing 0 1 0 0 1 Material Defect 2 2 3 3 10 Mechanical Failure 50 40 53 49 192 Mechanical Fatigue 19 18 15 10 62 Mechanical Wear 8 8 7 10 33 None 30 29 47 43 149 Not Known 1 0 1 0 2 Specification 2 3 1 1 7 Blanks 4 9 16 11 40 Total 138 137 165 155 595

Table 13d Releases causes per quarter – Operational Cause

Operational Cause Quarter Total 1 2 3 4 Adverse Weather 0 0 0 1 1 Awaiting Investigation 0 1 1 2 4

Dropped Object 0 3 2 3 8 Improper Inspection 9 0 1 5 15 Improper Maintenance 8 11 10 8 37

Improper Operation 12 14 19 12 57

Improper Testing 0 1 0 1 2 Incorrectly Fitted 7 16 24 16 63 Left to Open 14 6 18 18 56 None 78 73 75 83 309 Opened 5 3 4 3 15 Specification 2 1 1 0 4 Blanks 3 8 10 3 24 Total 138 137 165 155 595

56

Table 13e Releases causes per quarter – Procedural Cause

Procedural Cause Quarter Total 1 2 3 4 Awaiting Investigation 1 1 1 1 4

Deficient Procedure 14 9 20 10 53 Non-compliance with a Procedure 13 9 20 20 62

Non-compliance with a Permit to Work 2 3 4 3 12

None 105 112 113 118 448 Quality Control 1 0 1 0 2 Blanks 2 3 6 3 14 Total 138 137 165 155 595

Table 13f Releases causes per quarter – Operational Mode

Operational Mode Quarter Total 1 2 3 4 Blowdown 4 2 1 3 10 Cleaning 1 1 0 2 4 Drill gas 0 0 0 1 1 Drill Oil 0 1 0 0 1 Drill Operation 1 3 2 2 8 Flushing 1 0 3 2 6 Inspection 2 0 2 1 5 Cold Maintenance Work 0 0 2 1 3

Draining for Maintenance 1 1 0 0 2

Normal Production 75 77 84 84 320 Pigging 2 5 1 0 8 Reinstatement 16 10 14 12 52 Replacement 2 0 3 1 6 Routine Maintenance 5 1 3 3 12 Sampling 1 1 1 0 3 Shut down 0 4 3 2 9 Shutting down 13 3 3 6 25 Start Up 3 10 27 19 59 Testing 2 4 4 3 13 Top up 2 1 1 0 4 Well Services 5 4 0 5 14 Well Operation 2 7 9 4 22 Well Operation with Xmas Tree in Place 0 1 1 1 3

Blanks 0 1 1 3 5 Total 138 137 165 155 595

57

11.1 FURTHER INVESTIGATION – START UP

Filtering the third quarter of the year with start up in the operational mode field yields 27 releases records, one of which is a major release.

Tables 14a to 14f illustrate the number of releases that occur for each area of interest, for example, process type or equipment.

Table 14a Process type involved in release on start up

Process Number of releases Gas 20 Oil 4

2-phase 2 Condensate 1 Non-process 0

Table 14b System failures on start up

System Number of releases Gas compression 8

Export 5

Table 14c Equipment failures on start up

Equipment Number of releases Compressors 3

Flanges 4 Instruments 6

Piping 3 Valve-actuated 3 Valve manual 3

Table 14d Cause of equipment failure on start up

Equipment cause Number of releases Mechanical failure 8 Mechanical fatigue 3

None 5 Erosion 1

Mechanical wear 3 Internal corrosion 1

58

Table 14e Operational cause leading to failures on start up

Operational cause Number of releases Improper maintenance 2

Improper operation 4 Incorrectly fitted 4

Left to open 2 None 12

Table 14f Procedural cause leading to failures on start up

Procedural cause Number of releases Deficient procedure 3

Non-compliance with a procedure 4 None 20

Four releases are due to a design fault of some kind. No releases are ignited.

59

12 APPENDIX E – RELEASE CAUSES FOR EACH PROCESS TYPE

The table below is based on the full dataset of 35 major and releases and 560 significant releases.

Table 15a Release causes per process type - System

System Process Type

Total Gas Oil Condensate 2-Phase Non-

Process Blowdown 4 0 0 0 0 4 Drains 12 7 0 1 1 21 Drilling Equipment 2 0 0 0 1 3 Drilling Ops 3 1 0 1 3 8 Export 30 44 5 1 1 81 Flare 10 1 0 0 0 11 Flowlines 33 0 0 11 0 44 Gas Compression 149 0 2 1 4 156 Import 6 1 0 3 0 10 Manifold 16 2 0 4 0 22 Metering 18 9 2 0 0 29 Processing 27 5 3 1 6 42 Separation 15 9 2 5 0 31 Utilities 40 0 0 0 22 62 Vent 10 1 1 1 0 13 Well 26 0 0 5 2 33 Well Ops 17 1 0 7 0 25 Total 418 81 15 41 40 595

Table 15b Release causes per process type – Equipment

Equipment Process Type

Total Gas Oil Condensate 2-Phase Non-

Process Compressors 29 0 0 0 3 32 Drain Opening 11 2 0 0 0 13 Drain Plug 1 0 0 0 1 2 Filters 7 4 0 0 1 12 Flanges 53 2 2 1 1 59 Heat Exchangers 13 5 0 0 0 18 Instruments 87 11 1 6 2 107 Mud 2 0 0 0 1 3 Pig Launchers 3 5 0 0 0 8 Pipelines 2 2 0 2 0 6 Piping 64 30 4 17 13 126 Pressure Vessels 4 2 0 0 1 7 Pumps 1 9 4 0 1 15

61

Risers 2 0 0 0 0 2 Storage Tanks 6 4 0 0 4 14 Turbines 5 0 0 0 4 9 Valve-actuated 52 0 3 2 0 57 Valve Manual 37 1 1 2 2 43 Wellheads 10 0 0 0 1 11 Xmas Trees 8 0 0 3 1 12 Blanks 21 4 0 8 4 37 Total 418 81 15 41 40 595

Table 15c Release causes per process type – Equipment Cause

Equipment Cause Process Type

Total Gas Oil Condensate 2-Phase Non-

Process Awaiting Investigation 7 3 0 1 0 11

External Corrosion 13 1 0 2 0 16 Internal Corrosion 16 20 4 9 1 50 Erosion 12 3 2 5 0 22 Manufacturing 1 0 0 0 0 1 Material Defect 7 0 0 1 2 10 Mechanical Failure 138 22 7 8 17 192 Mechanical Fatigue 43 7 1 5 6 62 Mechanical Wear 27 3 1 0 2 33 None 118 15 0 8 8 149 Not Known 2 0 0 0 0 2 Specification 6 0 0 0 1 7 Blanks 28 7 0 2 3 40 Total 418 81 15 41 40 595

Table 15d Release causes per process type – Operation Cause

Operational Cause Process Type

Total Gas Oil Condensate 2-Phase Non-

Process Adverse Weather 1 0 0 0 0 1 Awaiting Investigation 3 1 0 0 0 4

Dropped Object 4 2 0 2 0 8 Improper Inspection 9 4 0 1 1 15 Improper Maintenance 26 5 1 2 3 37

Improper Operation 35 10 3 3 6 57 Improper Testing 2 0 0 0 0 2 Incorrectly Fitted 53 5 1 1 3 63 Left to Open 46 6 0 0 4 56 None 211 42 10 27 19 309 Opened 11 2 0 2 0 15

62

Specification 2 0 0 2 0 4 Blanks 15 4 0 1 4 24 Total 418 81 15 41 40 595

Table 15e Release causes per process type – Procedural Cause

Procedural Cause Process Type

Total Gas Oil Condensate 2-Phase Non-

Process Awaiting Investigation 4 0 0 0 0 4

Deficient Procedure 38 7 1 3 4 53 Non-comlipance with a Procedure 48 8 0 0 6 62

Non-compliance with a Permit to Work

11 1 0 0 0 12

None 308 61 14 37 28 448 Quality Control 2 0 0 0 0 2 Blanks 7 4 0 1 2 14 Total 418 81 15 41 40 595

Table 15f Release causes per process type – Operational Mode

Operational Mode Process Type

Total Gas Oil Condensate 2-Phase Non-

Process Blowdown 8 0 2 0 0 10 Cleaning 2 2 0 0 0 4 Drill gas 1 0 0 0 0 1 Drill Oil 0 0 0 0 1 1 Drill Operation 3 1 0 1 3 8 Flushing 6 0 0 0 0 6 Inspection 3 1 0 1 0 5 Cold Maintenance Work 3 0 0 0 0 3

Drainingfor Maintenance 0 2 0 0 0 2

Normal Production 219 50 10 20 21 320 Pigging 3 5 0 0 0 8 Reinstatement 47 2 1 0 2 52 Replacement 6 0 0 0 0 6 Routine Maintenance 5 3 0 2 2 12

Sampling 3 0 0 0 0 3 Shut down 6 1 0 0 2 9 Shutting down 10 1 0 1 0 12 Start Up 53 9 1 6 0 69 Testing 6 3 0 2 3 14

63

Top up 0 0 0 0 4 4 Well Services 9 0 0 1 1 11 Well Operation 17 1 0 7 0 25 WellOperation with Xmas Tree in Place 5 0 0 0 0 5

Blanks 3 0 1 0 1 5 Total 418 81 15 41 40 595

Blue text Failures applicable to ALL process types

Green text Failures applicable to MOST process types

Red text Failures applicable to one or two particular process types

64

13 REFERENCES

1. Thyer, A. M., Offshore ignition probability arguments, HSL Report FS/04/13, 2004

2. Bale, Evan, HSE - Major Hazards Strategic Programme Plan 2006/7, version 1.0, 2006

3. HID Operating Plan 2006-2007

4. http://www.hse.gov.uk/offshore/index.htm

5. Hydrocarbon Releases System, Internet Help File

6. Summary report on the OSD hydrocarbon release reduction campaign, April 2000 to March 2004, March 2005, HSE, SPC/TECH/OSD/27

7. Offshore hydrocarbon releases statistics and analysis, HID statistics report HSR 2002 002, Feb 2002

8. Loss of Containment Manual, HSE, HID, Offshore Division, March 2007

9. Guidance on the topic assessment of the major accident hazard aspects of safety cases, HSE, HID, Offshore Division, April 2006

65

14 BIBLIOGRAPHY

Hydrocarbon leak reduction offshore – Report on the findings of the HSE’s process integrity National Inspection Project (NIP) 200-2004, HSE, July 2005, Revision 1 (SPC/TECH/OSD/28)

Offshore technology report – OTO 96 956 – Revised guidance on reporting of offshore hydrocarbon releases, HSE, Nov 1996

OSD hydrocarbon release reduction campaign – Report on the hydrocarbon release incident investigation project – 1/4/200 to 313/2001, HSE Offshore Technology Report 2001/055

Supplementary guidance for the reporting of hydrocarbon releases, UKOOA, September 2002

Dalzell G A et al Guidance on fire and explosion hazards associated with ageing offshore installations, HSL Report PS/07/06, 2007

Key Programme 3 - Asset Integrity Programme, HSE Hazardous Installations, Directorate, Offshore Division, HSE Website, November 2007

66

15 NOMENCLATURE

The bullet points below briefly detail some of the causal and mode terms, which are used in OIR/12 records, analysed in this report.

• EQUIP_CAUSE - Equipment causation is sorted in the database into six primary categories, two secondary categories, and keywords to further describe ‘other’ categories. This field contains an abbreviated code word to describe the reported equipment - related failure as follows:

CORRINT = Internal corrosion CORREXT = External corrosion MECHFAIL =Mechanical Failure, other than fatigue or wear out MECHFAT = Fatigue e.g. due to vibration effects MECHWEAR = Wear out of component EROSION = Erosion MATLDEF = Material defects, e.g. metallurgical deficiencies MANUFACTURING = Defects due to manufacture, e.g. welding defects NONE = No equipment failure involved

• OP_CAUSE - Operational causation is sorted into seven primary categories, two secondary categories, and keywords to further describe ‘other’ categories. This field contains an abbreviated code word to describe the reported operational failure as follows:

INCORRFIT = Incorrectly fitted IMPROPMAINT = Improper maintenance IMPROPINSP = Improper inspection IMPROPTEST = Improper testing IMPROPOP = Improper operation DROPOBJ = Dropped object OTHIMPACT = Impact other than a dropped object e.g. struck by something or someone LEFTOPEN = Left open whilst containing hydrocarbons OPENED = Opened up whilst containing hydrocarbons LIGHTNING = Struck by lightning SPECIFICATION = Incorrectly specified (but not defective) e.g. inappropriate rating or material NONE = No operational cause involved

• PRO_CAUSE - Procedural causation is sorted into four primary categories, one secondary category, and keywords to further describe ‘other’ categories. This field contains an abbreviated code word to describe the reported procedural failure as follows:

NONCOMPROC = Non-compliance with a procedure NONCOMPTW = Non-compliance with a Permit to Work (PTW) DEFPROC = Deficient procedure QUALITY CONTROL = Quality control failure, e.g. poor inspection of incoming goods, usually linked with manufacturing failure NONE = No procedural failure involved

67

• OP_MODE - The operational mode in the area at the time of release is sorted into nine primary categories, seven secondary categories, two tertiary categories, and keywords to further describe ‘other’ categories. This field contains an abbreviated code word to describe the reported operational mode in the area as follows:

DRILLOIL = Drilling an oil well DRILLGAS = Drilling a gas well WELLOPTREE = Carrying out a Well Operation with the Xmas tree in place WELLOPEXTREE = Carrying out a Well Operation with the Xmas tree removed NORMPROD = Normal production PIGGING = Pipeline pigging operation underway SHUTTINGDN = In the process of shutting down SHUTDOWN = Already shutdown BLOWDOWN = Blowing or blown down FLUSHING =In the process of flushing out CLEANING = In the process of cleaning INSPECTION = In the process of inspection MAINTHOTWK = Carrying out hot work during maintenance MAINTCOLD WORK = Cold maintenance work not otherwise specified MAINTDRAINING = Draining for maintenance activities TOPUP = Replenishing of stocks (e.g. of fuel oil, etc.) REPLACEMENT = Replacing equipment during maintenance ROUTINEMAINT = Routine or planned maintenance not otherwise specified WELL SERVICES = Servicing or maintaining well equipment CONSTHOTWK = Carrying out hot work during construction CONSTCOLD WORK = Cold construction work not otherwise specified CONSTDRAINING = Draining for construction activities COMMISSIONING = Carrying out the commissioning of newly installed equipment INSTALLATION = Installing equipment during construction REMOVAL = Removing equipment during construction TEMPORARY = Using temporary equipment WELLCONST = Construction work on wells not otherwise specified under well operations TESTING = Testing equipment SAMPLING = Sampling fluids, etc REINSTATEMENT = Reinstatement of equipment after maintenance STARTUP = Initial start-up of equipment after commissioning or shutdown

Published by the Health and Safety Executive 12/08

Executive Health and Safety

Offshore hydrocarbon releases 2001-2008

The offshore industry employs about 28 000 personnel involved in a wide range of activities. Since the Piper Alpha disaster in 1988, health and safety issues concerning offshore platforms have vastly reduced, however, the work practices involved are not risk free and still have the potential to cause considerable loss of life when things go wrong. Increases in oil prices, declining reserves and an ageing infrastructure have resulted in increased drilling activity around marginal fields. Operators have looked for new ways in which to cut costs, which could affect the health and safety of the workforce.

HSE’s Major Hazards Strategic Programme Plan outlined targets that hope to reduce the number of major and significant releases from the 2001/02 baseline of 113 to 67 by the end of 2006/07 (10% year-on-year reduction) and to 60 by the end of 2007/08 (10% year-on-year reduction). However, in recent years there has been an increase in the number of major and significant hydrocarbon releases on offshore platforms that require investigation. This work hopes to identify the immediate cause of hydrocarbon leaks, and determine if there are discernable reasons for the increasing trends.

Two databases currently used by HSE when dealing with offshore releases were utilised, namely the Hydrocarbon Release (HCR) and RIDDOR databases. Cross-referencing between the two catalogues was expected to yield complete information including platform location, release size and type, as well as possible failure causes. When brought together over a range of different releases, this information can generate an overall picture of issues related to increasing release frequency.

Once an analysis had been completed, areas that require improvement, such as structural limitations, system and equipment faults as well as failings in procedural and operational methods, were indicated where possible.

This report and the work it describes were funded by the Health and Safety Executive (HSE). Its contents, including any opinions and/or conclusions expressed, are those of the authors alone and do not necessarily reflect HSE policy.

RR672

www.hse.gov.uk