Integrated risk assessment for Oil and Gas

installations in sensitive areas

Marta Bucelli1,2, Nicola Paltrinieri2, Gabriele Landucci3,*

1
LISES - Dipartimento di Ingegneria Civile, Chimica, Ambientale e dei Materiali, Alma Mater
Studiorum - Università di Bologna, via Terracini n.28, 40131 Bologna (Italy)
2
Department of Production and Quality Engineering, Norwegian University of Science and
Technology NTNU, 7491 Trondheim (Norway)
3
Dipartimento di Ingegneria Civile e Industriale - Università di Pisa, Largo Lucio Lazzarino n.2,
56126 Pisa (Italy)

* Author to whom correspondence should be addressed. tel. (+39)-050-2217907; fax (+39)-050-

2217866 e-mail: gabriele.landucci@unipi.it

Submitted for publication in:

OCEAN ENGINEERING
Special Issue on Safety and Integrity in Harsh Environments

0
 Abstract
Oil and gas installations in sensitive areas with harsh environmental conditions may require improved
risk management. Intensified monitoring, assessment and mitigation of risk on a (quasi-) real time
basis would advantage not only the operators, but also the surrounding environment. A systematic
tool for continuous quantitative evaluation of safety and environmental issues is still lacking. The
present work introduces a novel methodology for the integrated assessment of human and
environmental risk. A dynamic perspective is adopted to systematically consider the performance of
safety barriers. Environmental risk is further investigated by using the risk matrix approach, which
evaluates both frequency and severity of oil spill. The methodology is applied to the case of a real oil
platform in the Barents Sea. A set of simulations on how the platform is conducted demonstrated that
the proposed method may be suitable for risk analysis in such critical conditions. It also showed that
dynamic risk assessment may allow identifying critical safety barrier elements, whose correct
performance needs to be prioritized to control risk. This is also supported by environmental risk
assessment, showing that further safety measures may be considered for biological and environmental
conservation.

Keywords

Risk barometer; Oil spill risk assessment; safety barriers; harsh environment; sensitive areas

1
 1 Introduction
The oil and gas (O&G) industry is focusing its attention North, in the Arctic and sub-Arctic regions,
as they represent promising production sources (Barabadi et al., 2015; Bercha et al., 2003; Gao et al.,
2010; Musharraf et al., 2013; Song et al., 2016). According to the United States Geological Survey
(USGS) World Petroleum Assessment 2000 (USGS World Assessment Team, 2000), the sum of the
mean estimates for each province indicates that about 13% of the mean estimated global undiscovered
oil resource and about 30% of the gas one may be contained in the Arctic. Approximately 84% of
such sources is expected to be found in offshore areas (Bird et al., 2008).
The Arctic area presents significant technical, logistical and safety challenges regarding construction
and operation, including a lack of detailed standard, optimization with respect to winterization and
data scarcity (Khan et al., 2015a). The primary factors that make activities in the Arctic peculiar are
the presence of ice – in many different forms – and snow as well as a seasonal darkness. Such harsh
climate is associated with remoteness, long distances from customer and supplier’s markets.
Moreover, rich and important ecosystems were identified in the Arctic and sub-Arctic regions
(Barabadi et al., 2015; Gao et al., 2010). These factors have a considerable influence on the choice of
design as well as operations and maintenance (Barabadi et al., 2015). Operability may be critical,
maintenance may be ineffective and components may deteriorate relatively quickly due to severe
conditions (Barabadi et al., 2015; Gao et al., 2010; Landucci et al., 2017).
The Norwegian Arctic shelf is unique in this respect. Due to the Gulf Stream ocean currents, ice is
relatively less present and access to infrastructure may be facilitated (Norheim, 2010). On the other
hand, particular attention must be focused on the environment of such areas. Recent major accidents
increased public concern on oil and gas. For instance, the crude oil spill accidentally released in 2004
from the Terra Nova FPSO (Floating, Production, Storage and Offloading) Unit in Newfoundland
(Canada), affected Cape St. Mary’s ecological reserve and caused the death of thousands seabirds
(Wilhelm et al., 2007). Moreover, the Deepwater Horizon oil spill (occurred in 2010 in the Gulf of
Mexico and described as the worst environmental disaster in the United States) released about 0.78
Mm3 of crude oil and caused extensive damage to marine and wildlife habitats (BP, 2010; Deepwater
Horizon Study Group, 2011).
Therefore, the need for improved safety and environmental assessment in this sensitive area claims
for advanced tools for risk estimation and evaluation. Despite the fact that several methods are
available for personnel risk evaluation (Lees, 1996; Paltrinieri and Khan, 2016) and for environmental
risk assessment (EPA, 1998; Guo, 2017; Valdor et al., 2015), integrating the peculiar aspects of both
frameworks is a challenging task and requires research developments. Moreover, the analysis and
management of safety barriers1 may not be systematically undertaken, despite being requested by
local competent authorities, such as in the case of the Norwegian Petroleum Safety Authority (PSA)
requirements (PSA, 2013a).
The present study is aimed at providing a methodology for the integrated safety and environmental
assessment dedicated to offshore O&G facilities located in sensitive areas. Firstly, a methodology for
dynamic risk assessment, the Risk Barometer (RB) (Paltrinieri and Khan, 2016), was adapted in order
to develop a barrier management model. The aim was to investigate how barrier performance might
influence the overall level of risk during the lifecycle of the facility, considering specific risk
worsening elements induced by harsh environment. Secondarily, environmental risk assessment was

1
According to Sklet (2006), a safety barrier is a physical or non-physical mean planned to prevent, control or mitigate
undesired events or accidents.
2
performed using an approach based on simulation of oil spill evolution. This is aimed at the
verification of safety barriers effectiveness for offshore facilities located in sensitive areas.
The methodology was applied to a real reference case study in the Goliat oil field (Norway), which
represents a relevant example of innovative facility operating offshore in the Arctic sensitive region.
Information about Goliat are gathered exclusively from public sources and the results obtained are
derived from theoretical simulations.

2 Definition of the reference case study

2.1 Characteristics of the oil field

The Goliat field is the first oil field to be developed in the Barents Sea (Eni Norge, 2015a). It is
located 85 km Northwest of Hammerfest, North of Russia and Norway (Figure 1). The production
license is owned by ENI Norge, with 65%, and by Statoil, with 35%. Goliat field has two separate
main reservoirs, Kobbe and Realgrunnen, characterized by low pressure. The recoverable reserves
amount to 174 million barrels (28 Mm3). The field is expected to be in production for fifteen years,
but field life may be extended with new discoveries.

Legend

• very high priority

• high priority

• Priority

• Goliat location

• Norwegian coast and

Tromsø bank

Figure 1 Priority areas for biodiversity conservation in the Barents Sea ecoregion (adapted from Larsen
et al. (2004)). The map indicates the location of the Goliat field.

Compared to the neighbour Arctic Sea, the Barents Sea is relatively shallow and free from ice all
through the year due to warm Gulf Stream currents from the North Atlantic and high salt level.
Average ocean depth in the area is between 200 and 300 m (Larsen et al., 2004). Goliat field water
depth varies from 325 to 390 m (Eni Norge, 2015b). The Barents Sea and the Kara Sea belong to one
of the Marine Ecoregions included in the World Wide Fund for Nature (WWF) Global 200 (Olson

3
and Dinerstein, 2002). WWF biologists defined the Norwegian coast (Figure 1) as a “very high
priority” area for maintenance of biodiversity based on the following criteria (Larsen et al., 2004):
- Naturalness;
- Representativeness;
- High biological diversity;
- High productivity;
- Ecological significance for species;
- Source area for essential ecological processes or life-support systems;
- Uniqueness; and
- Sensitivity
The ecoregion supports abundant fish stocks as well as high concentration of nesting seabirds and a
diverse community of sea mammals (Larsen et al., 2004).

2.2 Characteristics of the installation

Goliat installation is a circular geostationary FPSO unit. It is the largest and most complex of its kind
and it was specifically designed to ensure safe and reliable production in the harsh conditions of the
Barents Sea (Eni Norge, 2016).
It is possible to identify seven main areas on the FPSO, as schematized in Figure 2 (adapted from
Rekdal and Hansen, 2015). Production is facilitated by subsea system consisting of 22 wells: 12
production wells, 7 water injectors and 3 gas injectors.

Legend:
1 Process Area
2 Utility Area
3 Living Quarter
4 Main Deck Area
5 Central Shaft
6 North Shaft
7 Riser Area

1 3

4 5 4
7

Figure 2. Main areas on Goliat FPSO (adapted from Rekdal and Hansen, 2015).

The extracted crude oil is processed, stabilized, stored and then directly offloaded from the FPSO to
shuttle tankers through the offloading station (Bjornbom, 2011). The offloading system is one of the
safest and most reliable offloading system ever fabricated for offshore operations. The distance
between the shuttle tanker and the platform is greater than in similar installation and video cameras
and a light system are in place for frequent status monitoring of the offloading hose (Eni Norge,
2015a).

4
 3 Improved safety and environmental assessment for sensitive areas

3.1 Need for dynamic risk assessment

Quantitative Risk Assessment (QRA) in the framework of Oil & Gas (O&G) upstream operations is
based on consolidated procedures and methods (Crawley, 1999; Crawley and Grant, 1997; ISO-
International standardization organization, 2009; Khan et al., 2002). Nevertheless, the challenges
associated with the operation in harsh and sensitive environment claim for more advanced tools for
risk estimation and evaluation.
In particular, operational and organizational factors often may affect risk in terms of likelihood of
undesired failure (Ale et al., 2014; Attwood et al., 2006; Griffin et al., 2014; Landucci and Paltrinieri,
2016; Vinnem et al., 2012). Training, workload, motivation to safety culture, procedures are aspects
that may be disregarded by conventional QRA techniques, which are traditionally focusing on
technical aspects (Paltrinieri and Khan, 2016).
Moreover, periodic evaluation and update of the system risk picture is not commonly performed.
Static risk estimation in a frozen instant of the system life represent the basis on which everyday
operations are planned, without capturing customary risk fluctuations during the lifecycle of a
production plant (I et al., 2009; Kalantarnia et al., 2009; Paltrinieri et al., 2014; Pasman and Reniers,
2014; Pitblado et al., 2011). International standards (e.g. ISO 31000 on risk management (ISO-
International standardization organization, 2009) and NORSOK z-013 on risk and emergency
preparedness analysis (NORSOK-standards, 2001)) and relevant regulations (e.g. EU Seveso
directives on the control of major-accident hazards involving dangerous substances (European
Commission, 2012)) suggest updates of risk analysis only in conjunction with major changes in the
plant/organization or every five years. Falck et al. (2015, 2000) share such concern and affirm that
risk assessment performed for the design phase of a plant is not suitable for the following operation
phases.
Therefore, real-time data and periodical risk evaluation may be considered as a key improvement to
allow for effective decision-making support. A tool translating system data into the (quasi-)real-time
risk picture is required. New techniques of dynamic risk assessment are necessary to overcome QRA
staticity by considering the process behaviour (Khakzad et al., 2016; Paltrinieri et al., 2016; Scarponi
et al., 2016; Scarponi and Paltrinieri, 2016). In the present work, the RB methodology (Paltrinieri et
al., 2016; Scarponi et al., 2016) represents a preliminary response to this need and was chosen to
support the dynamic risk evaluation for the analysis of the reference case described in Section 2.

3.2 Need for advanced environmental assessment

In the marine environment, it is estimated that about 14 million barrels (2.2 million m3) of oil are
released in the sea annually. About 18% of this comes from refineries, offshore operations and tanker
activities (Ivshina et al., 2015). The average number of severe oil spills during 2010s to date (in
particular, larger than 5 thousand barrels (around 800 m3), according to the International Tanker
Owner Pollution Federation ITOPF (2016)) is about 7% of the total oil spills released in the 1970s
(ITOPF, 2016). This reduction is due to the combined efforts of the oil industry and government to
improve safety and pollution prevention (ITOPF, 2016). Nevertheless, there are very limited research
efforts in developing effective and integrated decision making frameworks and systems to support oil
spill response, particularly in cold and harsh environment (Li et al., 2016; McCoy and Salerno, 2010;
Walker et al., 1994; Walker et al., 1995).

5
The environmental impact of a spill depends on a large number of parameters, such as its size and
type of released substance (ITOPF, 2013). This work refers only to petroleum spill, such as kerosene,
gasoline and crude oil. The location at which the oil spill occurs has also a fundamental importance,
as the severity depends on the ambient conditions and the sensitivity of the affected organisms and
their habitats to the oil (ITOPF, 2013). Spills in sensitive areas have serious biological impact on
vegetation, birds and mammals (Duke, 2016; Bejarano and Michel, 2016).
Therefore, particular attention should be paid to environmental issues concerning an installation in
the Barents Sea. Hasle et al. (2009) warn about a series of environmental and safety challenges related
to oil and gas exploration in this area. One of these challenges, the risk of oil spills, may also apply
to Goliat. Harsh environmental conditions, such as low temperatures, long periods of darkness and
scarce onshore infrastructure, represent operational challenges potentially increasing the frequency
of accidents (Khan et al., 2015b). Such events may lead to consequences for the environment and
subsistence of economy activities. Moreover, they may represent important economic and reputation
losses (Kyaw and Paltrinieri, 2015), due to the increased costs of remedial action, the media coverage
and the possibility of a moratorium on petroleum activities in that area. In these conditions,
environmental risk assessment is a critical issue. The approach proposed in this analysis involves a
computational advanced tool able to track the oil spreading on the ocean surface due to wind, currents
and diffusion processes.

4 Methodology

4.1 Overview of the methodology

The methodology described in the flowchart in Figure 3 has been applied to the reference case of
Section 2. The RB methodology has been implemented and preliminary environmental analysis
(based on a risk screening matrix) has been conducted on the evaluated frequency of oil spill to sea
(Figure 3).

PRELIMINARY ENVIRONMENTAL
RISK ANALISYS

RISK BAROMETER
GNOME
Barrier Grid Definition of
Quantitative Performance Risk Pictures
Characterization Indicators

Barriers
Establishing of POTENTIAL
Sensitivity LOSS OF LIFE
the Risk Model
Analyses OIL SPILL Consequences
FREQUENCY
Assessment

RISK
SCREENING
MATRIX

Figure 3. Methodology applied in the present study.

6
 4.2 Dynamic risk assessment

4.2.1 Improved RB
The RB methodology (Paltrinieri and Khan, 2016) was extended in order to develop a dynamic risk
assessment framework. RB is based on the definition of relevant indicators for the real-time
monitoring of safety barrier performance, contemplating technical elements and associated
operational and organizational systems. In this way, the health of safety barriers is assessed and their
probability of failure is evaluated. Further description of the method is reported elsewhere (Paltrinieri
and Hokstad, 2015; Paltrinieri and Khan, 2016).
The RB is established as an iterative process with seven major steps, summarized in Table 1.

Table 1. Summary of the steps which constitute the RB method (Hauge et al., 2015).
Step Description Potential iteration
to step
1 Define major accident scenarios /
2 Review relevant information sources /
3 Establish barrier functions and associated barrier systems 7
4 Evaluate relative importance of the barrier systems 2 or 3
5 Establish barrier performance indicators 2
6 Establish risk model based on barrier indicators 4
7 Establish risk visualization format 1 or 6

Major accident scenarios are typically gathered from the QRA of the specific installation. The major
accident scenarios for a floating offshore installation, such as the case-study, include process leaks,
ship collisions with visiting vessels, well leaks, blowout, etc. These events have a significant
contribution to the major accident risk to personnel and/or environment. In order to identify relevant
hazards (step 1), defining the associated barrier functions (step 3) and their relative importance (step
4) various information sources are required and they must be collected and made available (step 2).
A single source of information is not able to provide the whole required information. It is necessary
to combine several different inputs, such as the specific installation QRA, event and investigation
reports, barrier analyses and strategies, various qualitative safety analyses, results from interviews or
discussion with expert and operational personnel.
Real-time information about barrier performances should be collected. Their availability varies based
on their age, type, novelty of safety and automations systems. The status of the barriers and of the
barrier elements is assessed using specific indicators. Hence, information that can be made
automatically available for such elements represent relevant indicator candidates (step 5).
The most challenging step is establishing a risk model based on the logical relationship between the
status of the barrier indicators and the risk level of an area (step 6). The risk pictures are shown in an
established visualization format (step 7) by means of two diagrams:
- a plot of risk over time, highlighting the risk trend, and
- the RB diagram, which is a circular shaped where the traffic light analogy is adopted to show
immediately and effectively changes in the risk level.

7
 4.2.2 Safety barrier description
In order to comply with the requirements of PSA, barriers must be established and maintained to
handle the risk faced at any given time, by preventing an undesirable incident from occurring or by
limiting the consequences should such an incident occur (PSA, 2013b).
According to the PSA definition, the barrier function (BF) is the task or role of a barrier. Examples
include preventing leaks or ignition, reducing fire loads, ensuring acceptable evacuation and
preventing hearing damage. Bow-tie diagrams may be used to represent a sequential qualitative
overview of the potential Defined Situation of Hazard and Accidents (DSHAs), defined by PSA, and
Initiating Events (IEs) including the BFs relevant to prevent and/or mitigate them. The target of
interest is represented by the End Consequences (ECs).
Bow-tie diagrams were defined for each area of Goliat FPSO shown in Figure 2. Bow-tie diagrams
represent a basis for the execution of step 6 of the RB methodology, aiming to provide a quantitative
model to show risk variation over time due to the performance of safety barriers.
Figure 4 shows an example concerning the Goliat process area. DSHAs, IEs and ECs and BFs are
represented respectively by red and blue boxes. In particular, in the example shown in Figure 4, BF1
aims at protecting the process module of the floating installation from potential dropped objects from
crane operation. BF2 prevents the occurrence of hydrocarbon release, while BF3 is a mitigating
barrier that limits and control the size of the spill. BF4 represents the task of ignition prevention and
finally BF5 aims at preventing the escalation of the release to other areas of the installation.

IE 1
Process
Upsets

IE 2
Human Error

Escalation
IE 3
Prevent
Prevent
Ignition

DSHA 4 EC 1
Technical Fire and Fatalities
Control Size

Degradation Explosion
Release
Prevent

DSHA 3
Hydrocarbon
IE 4
Leak
Offloading BF 4 BF 5
Operations

BF 2 BF 3
dropped
Prevent

IE 5
objects

DSHA 1
Crane Dropped
Operations Objects

BF 1
DSHA 2 EC 2
Ship Collision Environmental
pollution

Figure 4 Process area bow-tie diagram modified for the RB application. DSHA = defined situation of
hazard and accident; IE = Initiating Event; EC = End Consequence; BF = Barrier Function.

Each BF is organized into an articulated hierarchical structure, graphically represented by means of

a “barrier tree”, shown in Figure 5. The BF is decomposed into sub-functions. The lowest level in the
barrier hierarchy is represented by barrier elements. These are measures or solutions which play a
part in realizing a BF and they may be classified, according to PSA, as technical, operational or
organizational. Technical barrier elements may correspond with Safety Instrumented System (SIS).
A SIS is composed of any combination of sensors, logic solvers and final elements. According to IEC
61511 standard (Internationa Electrotechnical Commission, 2003), a SIS implements a function

8
which is intended to achieve or maintain a safe state for the process, with respect to a specific
hazardous event, is defined as Safety Instrumented Function (SIF).

Figure 5 Representative barrier tree (adapted from Rekdal & Hansen, 2015). BD = blowdown; HC =
hydrocarbon; SIF = safety instrumented function; SIS = safety instrumented system.

Suitable indicators are collected in order to assess the performance of technical, operational and
organizational barrier elements. Results of this monitoring process are visualized in a barrier status
panel and will support critical decision-making.

4.2.3 Definition of risk model

The application of the RB methodology requires the definition of a specific risk model (see Table 2).
Such model is based on the logical relationship between the status of the barriers and the area risk
level. Bow-tie diagrams and related barrier trees represent the baseline for the modelling of the present
analysis. The aggregation rules defining the risk model are listed in Table 2, which allowed for the
analysis of O&G facilities operating in sensitive areas.
Frequencies of IEs may be retrieved from several data sources, such as the “Purple Book” by TNO
(2005), API RP 581 standard (American Petroleum Institute, 2000) and NORSOK standard (Norsok,
2008), and allow defining the baseline for the failure probabilities of the related BFs.
Focusing on both risk to personnel and environmental risk allows assessing barrier performance for
the most critical issues encountered in a sensitive area such as the Barents Sea. Relative importance
of safety barriers may be evaluated to facilitate risk-based selection of indicators.
Sensitivity analysis may be performed on the barrier function BF,j by assessing its Birnbaum-like
measure 𝐼 𝐵 (𝐵𝐹, 𝑗) (Scarponi et al., 2016). This represents the partial derivate of the risk measure R
with respect to the parameter describing the barrier, which, in this case, coincides with the failure
probability of the BF (FProbBF,,j):

𝜕𝑅(𝑡)
𝐼 𝐵 (𝐵𝐹, 𝑗|𝑡) = 𝜕𝐹𝑃𝑟𝑜𝑏 (1)
𝐵𝐹,𝑗 (𝑡)

Thus, generic risk at time t is defined as:

𝑅(𝑡) = 𝑅0 + ∑𝑖 𝐼 𝐵 (𝐵𝐹, 𝑗|𝑡) ∙ ∆𝐹𝑃𝑟𝑜𝑏𝐵𝐹,𝑗 (t) = 𝑅0 + ∆𝑅(𝑡) (2)

where:

9
𝑅0 = value of risk at a reference time 0 (e.g. the time in which the QRA is performed)
∆𝐹𝑃𝑟𝑜𝑏𝐵𝐹,𝑗 = 𝐹𝑃𝑟𝑜𝑏𝐵𝐹,𝑗 (𝑡) − 𝐹𝑃𝑟𝑜𝑏𝐵𝐹,𝑗 (𝑡 = 0)

A Birnbaum-like measure based on risk to personnel will presumably differ from a Birnbaum-like
measure based on environmental risk. For this reason, both the evaluations should be performed for
this case.
Section 4.2.4 shows the technical features adopted in establishing the RB procedure. Results of the
dynamic risk assessment are presented in Section 5. The simulation performed in this study is referred
to a sample period of five years.

Table 2 Aggregation rules defined for the RB application to sensitive areas.

Level Aggregation rule Description

Frequencies of initiating events (FreqIEV,i) are

∏ 𝐹𝑟𝑒𝑞𝐼𝐸𝑉,𝑖 ∙ 𝐹𝑃𝑟𝑜𝑏𝐵𝐹,𝑗 multiplied by failure probabilities of the related
= 𝐹𝑟𝑒𝑞𝐶𝑜𝑛𝑠 barrier functions (FProbBF,,j) to evaluate frequencies
of consequences.
Bow-tie Direct proportionality with FProbBF,,j allows
diagram/ 𝐹𝑃𝑟𝑜𝑏𝐵𝐹,𝑗 ∝ 𝐷𝑒𝑔𝐵𝐹,𝑗
Barrier estimating the degradation status (DegBF)
function
𝐷𝑒𝑔𝐵𝐹 = ∑ 𝑤𝑆𝐹,𝑖 ∙ 𝐷𝑒𝑔𝑆𝐹,𝑖 ; 𝑤𝑆𝐹,𝑖
DegBF is evaluated by weighted summation of DegSF,i
1 (degradation status of sub function). Weights are
=
𝑁𝑆𝐹 preliminary defined as uniform.

𝐷𝑒𝑔𝑆𝐹 = ∑ 𝑤𝐸𝑙,𝑖 ∙ 𝐷𝑒𝑔𝐸𝑙,𝑖 DegSF is evaluated by weighted summation of DegEl,i

Sub
functions (degradation status of Element). Weights are
1
𝑤𝐸𝑙,𝑖 = preliminary defined as uniform.
𝑁𝐸𝑙

𝐷𝑒𝑔𝐸𝑙 = ∑ 𝑤𝐼𝑛𝑑,𝑖 ∙ 𝐼𝑛𝑑𝑖 DegEl is evaluated by weighted summation of Indi

(indicator defined for the element). Weights are
Element
1/𝑟𝑎𝑛𝑘𝐼𝑛𝑑,𝑖 preliminary defined by means of the related indicator
𝑤𝐼𝑛𝑑,𝑖 =
∑ 1/𝑟𝑎𝑛𝑘𝐼𝑛𝑑,𝑗 ranking and the Zipf’s law (Chen, 2016)

𝐼𝑛𝑑 = M(𝑥) Collected indicator measures (x) are defined on a

Indicator
qualitative scale ranging from 1 to 6.

4.2.4 RB settings
In the present section, the features of the RB methodology and the settings used for the Goliat case
are described in detail. The section presents the settings according to the different steps of the RB
methodology.

10
4.2.4.1 Define major accident scenarios, review relevant information sources and establish BFs and
barrier systems (steps 1, 2,3)
The collection of relevant information concerning major accident scenarios and the related safety
system in place on Goliat preventing or mitigating them (step 1-3, Table 1) results in specific bow-
tie diagrams. According to the approach of the present work, the contribution of safety barriers to the
installation risk level is linked to a parameter in the QRA (QRA-parameter), particularly in this case
to the potential loss of life (PLL) value and to the frequency of oil spill to sea.

4.2.4.2 Evaluate relative importance of the barrier systems (step 4)

A relative ranking was established in order identify the BFs defined in the bow-tie diagrams, which
mostly affect the risk level.
In order to determine the most critical BFs, sensitivity analyses were conducted, both at BF and barrier
element level, according to the barrier structure described in Figure 5. Results obtained from
sensitivity analyses considering safety devices fully impaired are shown in Figure 6.

1.0E+06 a)
Percentage Variation of PLL

1.0E+05 Prevent Dropped Objects

from Crane Operations
1.0E+04 Prevent HC Leak
(% )

1.0E+03 Limit Size of HC Leak

Prevent Ignition
1.0E+02

Prevent Escalation to Other

1.0E+01 Equipment

1.0E+00

1.0E+06 b)
Percentage Variation of Oil
Spill to Sea Frequency (% )

1.0E+05 Prevent Dropped Objects

from Crane Operations
1.0E+04 Prevent HC Leak

1.0E+03 Prevent HC Leak from

Offloading Hose during
Offloading Operations
1.0E+02 Limit Size of HC Leak

1.0E+01 Limit Size of HC Leak from

Offloading Hose during
Offloading Operations
1.0E+00

Figure 6. Results of sensitivity analyses conducted at BF level considering safety devices fully impaired.
A) Percentage variation of PLL; B) Percentage variation of oil spill to sea frequency.

The BF that mostly influences PLL trend is “Prevent HC Leak”, while the effect of safety barriers
“Prevent HC Leak from Offloading Hose during Offloading Operations” and “Limit Size of HC Leak
from Offloading Hose during Offloading Operations” on the PLL trend could be neglected even if
these barriers are fully impaired.
Instead, the BF that mostly influence spill frequency are almost at the same manner “Prevent HC
Leak” and “Prevent Hydrocarbon Leak from Offloading Hose during Offloading Operations”. The
effect of safety barriers “Prevent Ignition” and “Prevent Escalation to Other Equipment” on the spill
to sea frequency is negligible.

11
4.2.4.3 Establish barrier performance indicator (step 5)
Information about the status of the barrier and barrier elements can be retrieved from various
information systems. Each type of barrier element, namely technical, operational and organizational
elements, is considered in the RB analysis. Information concerning technical elements may be
captured automatically in real-time, depending on the age of the installation. Data on operational and
organizational elements are typically difficult to gather and manual input (e.g. from audits and
reviews) is often required (Øien et al., 2011a, 2011b). The information concerning the technical
elements include data gathered from the maintenance system, as results from functional tests, alarms
condition monitoring systems on failed or degraded elements, information about elements that are
blocked or supressed from process control systems, information about deviations, temporary
degradations and risk reducing measures, findings and actions from inspection systems. Information
related to operational and organizational barrier elements include, for example, the status on required
courses and training for offshore personnel, the current age of governing documents that describe e.g.
the execution of the safety critical tasks, results from scenario based simulator training.

Barrier Performance

TECHNICAL MEASURES OPERATIONAL MEASURES

Performance Indicator Performance Indicator

Performance Indicator Performance Indicator
… …
a)

ESD valve Performance

TECHNICAL MEASURES OPERATIONAL MEASURES

Failed Tests Indicator Operational Support Indicator

Failure on Demand Indicator Compliance with Maintenance Indicator
Control Panel Indicator
Inspections/Audits Indicator
Functional Tests Indicator
Personnel training Indicator

b)
Figure 7. a) Generic representation of the barrier structure; b) Specific representation of the ESV
(Emergency Shut Down valve) structure.

Each barrier element is described by a structure which includes technical, operational

and/organizational measures. The generic structure of a barrier is schematized in Figure 7a, while
Figure 7b shows a specific example of barrier structure, i.e. the Emergency Shut Down (ESD) valve,
which includes both technical and operational measures.
The RB focuses on indicators for the status of the barrier and barrier elements. A suitable indicator is
identified to show whether the measure can deliver the desired outcome or it has failed. A different
weight is preliminarily assigned to each measure according to Zipf’s Law (Zipf, (1949); Adamic and
Huberman, (2002)).
12
Due to scarcity of data, the model developed in the present analysis was tested on typical indicator
trends depending on the type of barrier measure to which the indicator itself is related. The simulation
performed in this study is referred to a sample period of five years. The indicators related to each
barrier measure are checked every two months, for a total of thirty checks in the defined period of
interest. Technical indicators are simulated considering the well-known “bathtub” curve model (see
(CCPS - Center of Chemical Process Safety, 2000; Lees, 1996) for more details) while operational
indicators as homographic function. Exemplified results, including disturbances, are shown in Figure
8.

6 6
Operational Indicator (with Techincal Indicator (with
5 Disturbances) 5 Disturbances)

Indicator Values
indicator Values

operational indicator (without technical indicator (without

4 disturbances) 4 disturbances)

3 3

2 2

1 1
0 10 20 30 40 50 60 0 10 20 30 40 50 60
Time (Months)
a) b) Time (Months)

Figure 8. Exemplified trend of operational (a) and technical (b) indicators.

The range in which the indicator values may vary is 1 – 6, where 1 represents the situation in which
the measure works perfectly, while 6 the worst scenario in which the measure is fully impaired. It is
worth noticing that the extreme values of the interval are not considered as credible scenarios in
assessing the indicators trend.

4.2.4.4 Establish risk model based on barrier indicators (step 6)

The barrier element performances, assessed through the indicators, are input values to the risk model
shown in Table 2. Barrier performances, assessed by the indicators, are translated in risk variations
through the risk model and expressed in absolute terms through the PLL.

4.2.4.5 Establish risk visualization format (step 7)

Risk variations are shown in visualization formats easy to read and use. These consist of a
representation of risk over time and a RB diagram that applies the traffic light analogy. Results are
shown in Figures 9 and 10 in section 5.

4.3 Environmental impact assessment

Environmental risk estimation requires assessing both the severity and the frequency of hazardous
events. Risk matrixes are convenient methods of ranking and presenting the results (HSE, 2006) and
are widely espoused approach to assess and analysing risk in O&G industry due to their intuitive
appeal and simplicity (Thomas et al., 2013). In order to assess the environmental risk level associated
with a defined scenario, five severity classes and six frequency categories are defined, according to
risk matrix approach suggested in ISO 17776:2002 (ISO, 2002). The matrix adopted in this study is
shown in Figure 9 and allowed defining tolerability criteria dedicated to offshore oil and gas

13
installations in sensitive areas. Three risk matrix regions identify the limits of risk tolerability,
according to the ARAMIS (Accidental Risk Assessment Methodology for Industries) research project
(Andersen et al., 2004):
 The green area (“negligible effects” zone) represents the continuous improvement region; the
risk level is broadly acceptable and generic control measures are required aimed at avoiding
deterioration.
 The yellow area (“medium effects” zone) represents the risk reduction measures region; the
risk level can be tolerable only once a structured review of risk-reduction measures has been
carried out.
 The red area (“high effects” zone) represents the intolerable risk region; the risk level is not
acceptable and risk control measures are required to move the risk figures to the previous
regions.
Risk matrixes are easy to use and do not require extensive training. However, they suffer from
limitations due to lack of standardization, focusing only on the identified hazardous event and
analysing them one by one rather than in accumulation (Rausand, 2011). These issues cannot be
overcome because they are inherent in the risk matrix structure (Thomas et al., 2013).
A critical issue to perform the QRA is the definition of quantitative ranges for consequences and
frequencies in the matrix. The ranking is usually based on arbitrary values, set by company standards,
since unified references to quantify risk matrixes are lacking (Thomas et al., 2013).
Five classes of consequences in terms of effects on the environment are defined as shown in Figure
9. The severity class was assigned to each scenario according to the released oil inventory (m3) and
impact area (km2), considering that the installation is located in an environmental sensitive area and
then more stringent criteria should be applied. Each severity class is defined considering a range of
area involved in the spill and of released oil inventory. Since these range of data are sensitive, the
present analysis shows the results ranked in normalized classes.
According to ARAMIS project (Andersen et al., 2004), six classes are then defined for frequency,
based on expert judgement. In Figure 9 the screening matrix applied in the preliminary environmental
risk assessment is shown.
Severity

Frequencies (event/year)
Class

Consequences
Environmental Risk 0 A B C D E
< 10-6 10-6 – 10-4 10-4 – 10-3 10-3 – 10-1 10-1 – 1 >1
SLIGHT EFFECTS
I Involved area < 0,10 Continuous Improvement
Offshore spill < 0,1
MINOR EFFECTS
II Involved area < 1 Risk Reduction Measures
Offshore spill < 1
LOCAL EFFECTS
III Involved area < 10
Offshore spill < 10
MAJOR EFFECTS
IV Involved area < 100
Offshore spill < 100
EXTENSIVE EFFECTS
V Involved area < 100 Intolerable Risk
Offshore spill > 100

Figure 9. Environmental risk screening matrix adopted in the present study (adapted from ISO, 2002).

14
In the present analysis, hydrocarbon spilt to sea is considered to cause severe environmental impact
because of the location of the reference facility. According to the bow-tie analysis described in Figure
4, environmental damage may be caused by both process leaks and leaks from offloading station.
Analysing the two contributions, the frequency of occurrence of a release from the offloading station
is one order of magnitude lower than the one from the process deck. Furthermore, the analysis of the
bow-tie diagram considers generic releases from the offloading station but, as for environmental risk
assessment the consequences have to be estimated on the basis of quantitative data, the approach is
to consider random ruptures of the offloading hose (see Figure 2) and applying to these standard
release categories.
Random ruptures may be devoted to thermal stress, corrosion, vibrations, etc. and are normally
associated with standard release categories (Pitblado et al., 1990; Spouge, 2005). For this purpose,
the API RP 581 (American Petroleum Institute, 2000) random rupture frequency assessment was
performed. According to API 581, four rupture categories were considered, based on the release
equivalent diameter (i.e., 0.25” (6.35 mm), 1” (25.4 mm), 4” (101.6 mm) and full bore, where the
release diameter is taken equal to the pipe diameter). For each of these rupture categories, two
different release time are considered, depending on if the scenarios are mitigated or not. For big
rupture, S5 and S6, a release time of 600 s is not considered as credible according to API 581.
The scenarios considered in the present analysis are summarized in Table 3.

Table 3. Summary of scenarios considered in the analysis.

Release equivalent Release
ID
diameter (mm) duration (s)
S1 6.35 180
S2 6.35 600
S3 25.4 180
S4 25.4 600
S5 101.6 180
S6 508 180

To each category, an expected frequency was associated and consequence assessment of potential
spills was carried out. Source term was estimated through conventional integral models (Van Den
Bosh and Weterings, 2005), while the dynamic development of contaminated area was simulated
trough the adoption of the modelling tool GNOME (General NOAA Operational Modelling
Environment), developed by the National Oceanic and Atmospheric Administration (NOAA)
(Zelenke, B., C. O’Connor, C. Barker, C.J. Beegle-Krause, 2012). GNOME is a Eulerian/Lagrangian
model extensively applied in the framework of oil spill impact assessment studies, which was
previously verified and validated. GNOME simulates the particle trajectories only on the ocean
surface (Cheng et al., (2011), Marta-Almeida et al., (2013), Farzingohar et al., (2011)) and is written
using the latest object-oriented programming methodologies in the C++ programming language
(Beegle-Krause, 2001).
The oil spills are modelled as Lagrangian Elements (LEs) advected with the surface Eulerian current
velocity field and the diffusion is simulated as a random walk (Marta-Almeida et al., 2013). Spilled
substances are modelled as point masses, namely the LEs. Further information about models

15
implemented in GNOME are available in technical documentation (Zelenke, B., C. O’Connor, C.
Barker, C.J. Beegle-Krause, 2012) provided by NOAA.
NOAA has developed GNOME to investigate the effects of different pollutants and environmental
condition on trajectory results (Cheng et al., 2011). GNOME supports the NOAA/National Ocean
Service (NOS), Office of Response and Restoration (OR&R), Emergency Response Division (ERD)
standard for best guess and minimum regret trajectories, by providing information about where the
spill is most likely to go (namely, “Best Guess Solution”) and the uncertainty bound (namely,
“Minimum Regret Solution”). Compared with other models, the GNOME model can be used
anywhere in the world and requires fewer input parameters than most other models (Cheng et al.,
2011). The details of the GNOME simulations performed for the present case study are collected and
described in the dedicated section 4.3.1.

4.3.1 GNOME simulation setup

GNOME (http://response.restoration.noaa.gov) provides the capability of simulating the behaviour
of a spilled amount of oil under different weather conditions. The GNOME version applied in the
simulations of this study is the 1.3.9. More details related to the code may be found in the technical
documentation (Zelenke, B., C. O’Connor, C. Barker, C.J. Beegle-Krause, 2012) provided by NOAA,
hereby the key elements supporting the evaluation of the case study are discussed. Each release
scenario was located at Goliat coordinate, i.e. 71°30 North and 22°30 East. Windage parameters were
kept as default settings, according to (Zelenke, B., C. O’Connor, C. Barker, C.J. Beegle-Krause,
2012). The simulations performed in the present studies refer to a sample period, adopting real data
of March 2016. Each simulation was started at 8.00 am of March 9th, 2016 and was run for 108 hours
(4 days and 12 hours). This period was selected for demonstration purposes of the present
methodology. Other meteorological data, when available, may as well be implemented in the
software. The impact assessment results are shown in Section 5.2. During each simulation, the
minimum regret solution is calculated. The beaching algorithm include the “prevent land jumping”
box.

4.3.1.1 Spill Characterization

Spilled substances are modelled as point masses called Lagrangian Elements (LEs). In order that the
quality of the statistics do not suffer, it is best to use at least 1000 LEs. The present analysis considers
1000 LEs. To each point mass, the location, age and status is assigned over time the simulation runs.
The computational time step was set to 15 minutes, as indicated in (Zelenke, B., C. O’Connor, C.
Barker, C.J. Beegle-Krause, 2012).
The movement of the LEs is either to remain on the water, to evaporate, to be beached, to be
weathered and disappear or to travel out of the modelling space domain. The evaporation process is
modelled with a simplified algorithm that does not take into account of temperature variation and
strong wind effect on the evaporation.
Simplified assumptions are adopted in order to simulate the adhesiveness of the oil to the shoreline.
In particular, an empirical parameter, namely the “half-life”, was adopted in the simulations. The
half-life is a function of substrate porosity, the presence or the absence of vegetation, the inherent
stickiness of the oil and other physical properties and processes of the environment as well. The
refloat half-life is set as one hour (Zelenke, B., C. O’Connor, C. Barker, C.J. Beegle-Krause, 2012).
16
The source term, quantified through integral models (Lees, 1996; Van Den Bosh and Weterings,
2005), was implemented in GNOME as an oil spill point source. To set this type of spill, it is necessary
to provide information, including:
 Name of the spill;
 Location of the spill;
 Pollutant type;
 Amount released;
 Release start and stop dates and times.
The characterization of the spill adopted in the simulations of the present analysis is shown in Table
7. The spill name, the amount and the release times change in the different simulations. The summary
of the simulations performed is reported in Table 3.

Table 4. Spill characterization adopted in the present analysis.

Item Value or description
Name of the spill Goliat Simulation – Scenario No. #
Location of the spill 71°30’ N, 22°30’ E
Pollutant type Medium Crude Oil
Amount released Based on source term characterization, see Table 7
Release start and stop date March 9, 2016
Release start and stop time 3 – 10 minutes, see Table 3

4.3.1.2 Maps and Movers

The settings related to map and movers allow defining the region of interest for the oil spill impact
assessment study and the related movers (e.g., wind, currents, tides, etc), which allow promoting the
oil spread and transport. Table 5 summarize the procedure and data adopted to characterize the region
of interest in GNOME simulations. More details on the parameters and models adopted in GNOME
are reported elsewhere (Zelenke, B., C. O’Connor, C. Barker, C.J. Beegle-Krause, 2012).

17
Table 5. Summary of the steps adopted to characterize the maps and movers supporting GNOME
simulations
Step Description Tools Reference
I Create the Global Self-consistent, Hierarchical, High- https://gnome.orr.noaa.gov/goo
ds
vector map resolution Shoreline Database (GSHHS) accessed
of the through GOODS (GNOME Online
shoreline Oceanographic Data Server)
for the area
of interest
II Create Ocean surface currents data are obtained from the http://ftp.opc.ncep.noaa.gov/gri
ds/operational/GLOBALHYCO
surface Real Time Ocean Forecast System (RTOFSO) M/
currents
forecast file
III Create Ocean surface winds are obtained from the https://www.ncdc.noaa.gov/data
-access/model-data/model-
surface National Centre for Environmental Prediction datasets/global-forcast-system-
winds (NCEP) Global Forecast System (GFS). gfs
forecast file
IV Select Windage is aimed at accounting for the Default settings, as
windage displacement of oil due to wind. Windage is specified by (Zelenke,
parameter assumed in the range 1–4% of the wind speed with B., C. O’Connor, C.
a uniform distribution* Barker, C.J. Beegle-
V Select Persistency is the time interval in which the Krause, 2012)
persistency windage value is kept by GNOME. In the present
value analysis, a persistency value of 15 minutes is
chosen
VI Select the D = 100,000 cm2s-1. Oil diffusion and spreading
global are treated as stochastic processes. Gravitational
diffusion and surface tension effects are ignored, as these
coefficient, are only important during the first moment of a
D spill

* GNOME selects a random number within the user-selected range of windage values for each LE, and moves
the LE according to that number at each time-step

4.3.1.3 Best estimate and minimum regret trajectories

Two different trajectory pictures are obtained in each GNOME simulation, as shown in Figure 12 in
section 5: a best guess and a minimum regret trajectory. The best guess trajectory represents the most
likely movement path of the spill, whereas the minimum regret trajectory provides an uncertainty
bound. This second solution allows the model to predict other possible trajectories that are less likely
to occur but which may have higher associated risks. The minimum regret trajectory gives
information about areas that could be impacted if, for example, the wind blows from somewhat
different direction than the one specified, or if the currents in the area flow somewhat faster or slower
than expected. All of the movers have default uncertainty parameters – diffusion, currents, winds,
and the component mover (Zelenke, B., C. O’Connor, C. Barker, C.J. Beegle-Krause, 2012).
Forecast wind and currents are usually not accurate to generate trajectories within 1.5 km of accuracy
after 48 hours. Therefore, GNOME supports user-specified uncertainty parameters, which are set
18
according to the uncertainty in the input data. The currents and wind dataset and the diffusion
coefficient mentioned in Table 5 have parameters for start-time and duration of the uncertainty, which
is treated according to the scheme shown in Table 6. The start time in the model run indicates the
time at which the winds and currents forecast starts. The duration indicates how long an LE will keep
the given uncertainty value, before having it randomly reset. Since the reference-case does not deal
with the modelling of large object drift, default setting were kept for duration and uncertainty
parameters, as recommended in (Zelenke, B., C. O’Connor, C. Barker, C.J. Beegle-Krause, 2012).

Table 6. Uncertainty assessment in the determination of minimum regret trajectories

Mover Parameter Uncertainty assessment
Wind Speed Scale 2
Angle Scale 0.4 radians
Start Time 0 hour
Duration 3 hours
Current Along Current 30 %
Cross Current 30 %
Start Time 0 hour
Duration 48 hours
Diffusion Uncertainty Factor 2

5 Results and discussion

Results are described in the following sections. It is necessary to stress that every finding is derived
from theoretical simulations performed during the development of this research.

5.1 Dynamic risk assessment

Results of dynamic risk assessment are shown in Figure 10, according to the RB established
visualization format (Table 1). Human and environmental risks were respectively assessed and
expressed as PLL (Figure 10a) and frequency of oil spill to sea (Figure 10b). PLL is a widely used
risk metric describing the expected value of human fatalities per year (Johansen and Rausand, 2014).
Due to scarcity of data, the model was tested on simulated indicator trends, in order to evaluate its
response.

1.8E-06 2.7E-03
Potential Loss of Life (y-1)

Oil spill frequency (y -1)

1.7E-06 2.6E-03

1.6E-06 2.5E-03

1.5E-06 2.4E-03

1.4E-06 2.3E-03
0 10 20 30 40 50 60 0 10 20 30 40 50 60
Time (months) Time (months)
a) b)
Figure 10 Results of dynamic risk assessment: a) Potential Loss of Life trend (y-1) and b) frequency of
Oil Spill to Sea (y-1) trend during the five years in which the simulation is performed.

19
As shown in Figure 10, the trend over time of the two risk indexes decreases in the first months of
the performed five-year-simulation. After the first months, the risk indexes vary around an average
value due to simulated deviations of indicators.
Figure 11 shows an example of RB diagram, indicating the risk level worst condition, thus associated
with the maximum PLL value.

Increased Risk

Figure 11 Simulated risk barometer.

5.2 Environmental impact assessment

Figure 12 show the results obtained through the application of GNOME to scenario S5 (see Table 3)
with the settings described in section 4.3.1. The Figure shows the potential impact of the oil spill. The
movers (wind, currents, and other factors affecting the behaviour of spilled oil) are represented by
arrows, which indicate direction and intensity of the vectors that promote the transport of oil during
the simulated period. The black dots represent the best guess solution, while the red dots show the
uncertainty bound (namely, minimum regret solution).
Figure 12a) shows the oil spreading in the first few hours after the spill. The physical and chemical
characteristics of petroleum change almost immediately when spilled in the marine environment, due
to oil weathering processes (Evans et al., 2002). In the first hours, the slick is fairly compact and a
small percentage of oil spilled is evaporated. The oil spread area is extended for more than 250 km2.
Advancing in time, the oil slick expands due to ocean currents, wind effects and diffusion processes,
as shown in Figure 12 (panels b, c and d). The slick moves away from the release source meanwhile
evaporates, affecting a larger impact area (more than 450 km2).

20
 a)
N

b)
N

c) N

d)
N

Best Estimate Minimum Regret

Movers
Figure 12 Results of oil spill simulation. a) 03/12/2016, time 00.00; b) 03/12/2016, time 12.00; c)
03/13/2016, time 00.00; d) 03/13/2016, time 18.00.
21
Table 7. Summary of scenario characterization and results (normalized) of the environmental risk
assessment of the case study.
Oil Spilt
Scenario Frequency Involved Frequency Severity
Inventory Risk Class
ID. (y-1) Area (km2) Class Class
(m3)
Continuous
S1 4.9 10-5 1 4.5 A 3
Improvement
Continuous
S2 4.9 10-5 3 3.2 A 3
Improvement
Risk Reduction
S3 1.6 10-4 15 3.8 B 4
Measures
Risk Reduction
S4 1.6 10-4 50 3.5 B 4
Measures
Risk Reduction
S5 1.6 10-5 >100 4.7 A 5
Measures
Risk Reduction
S6 8.2 10-6 >100 4.8 A 5
Measures

The results of the environmental risk assessment using the screening matrix are shown in Table 7.
Large spills may lead to intermediate risk values due to the severe consequences shown in Figure 12.
Therefore, monitoring of environmental safety barriers is of crucial importance to control risk at
acceptable levels.
Oil spill preparedness in the region may be improved through implementation of increased measures,
as remote sensing and detection, offshore helicopter, stand by and supply vessel and specialized
operational units for the coastal and shore zone (Holand, 2012; IPIECA and IOGP, 2013).
Furthermore, a system is in place for frequent status monitoring of the hose, enabling it to be inspected
in a variety of ways. During loading operations, each time the hose is reeled in its entire length is
scanned by a video camera and light system, ensuring the safety of operations (Bjornbom, 2011).

5.3 Discussion
The study is an example of integrated evaluation of risk for operators and environment associated
with installations in sensitive areas and harsh environment.
The RB application allowed demonstrating that capturing real-time information on the most critical
safety barriers may be translated into the variation of the overall risk level. In this way, risk may be
periodically evaluated by analysing the barrier conditions, supporting decision making and eventually
improvements/actions. However, the methodology also resulted in some limitations, which may be
object of further development.
Since the RB is strongly based on the periodical update of QRA parameters, the preliminary step
(identification of reference QRA-parameters) is of utmost importance and it affects the overall risk
evaluation process. On one side, incorporating a large number of parameters, and the correspondent
monitoring indicators, induces higher data collection costs. On the other side, neglecting relevant
parameters, may induce to underestimating risk. Therefore, despite the preliminary RB step is based
on the analysis QRA documentation, which may be considered fixed and well-defined, assumptions
and approximations should be carefully and knowingly carried out.
Similar considerations may be extended to the selection of indicators, since they strongly affect the
periodical variation of QRA parameters and the final risk picture. It is also worth mentioning that if
the reference QRA is periodically updated, the effect on risk of each indicator should be remodelled.
22
In order to limit costs and efforts related to data gathering and monitoring without losing a
representative risk evaluation, a sensitivity analysis was performed to drive the selection of the most
critical BFs and barrier elements. Section 4.2.4 shows the details of the sensitivity analyses
performed, where it is evidenced how the most critical elements are shared among multiple critical
BFs, such as the emergency shut down system. The monitoring of critical safety barriers provides
more information about the risk evolution rather than the indiscriminate measuring of every device
performance. In that perspective, the RB aggregation rules described in Table 2 represent a more
sophisticated tool for barrier monitoring than the simple collection of information for each single
barrier element. In fact, the mere collection of data about the status of the components does not
support the operator in taking risk-oriented decisions and, moreover, it may be a source of
underestimation and misperception of the actual risk level.
Due to computational reason, the RB simulation of this study considers a sample amount of critical
barrier elements. This explains the limited variations in the PLL and in the frequency of spilt oil
respectively shown in Figure 10a and 10b. Firstly, it is worth noticing that the reference installation
features several thousands of barrier elements. The performance variations of many of them would
not affect the risk performance in a substantial way. In fact, as shown in Figure 11, the risk level of
the installation is not changing during the simulation (“Low Risk”). However, as the elements
considered are addressed as critical, the risk variations shown in Figure 10 are meaningful. The risk
profile changes due to performance variation of a small set of critical barrier elements.
Another limitation of the RB technique concerns the use of linear functions to measure risk (Paltrinieri
et al., 2014). When the contribution from each indicator is taken into account using a weighted sum,
two issues are neglected. The first is that the aggregation of indicator scores may not correspond to
the complete risk picture associated with a scenario, since the effect of having several failed barriers
features a higher impact than simply summing the individual effects, on the basis of “defence in
depth” principle (IAEA- International Atomic Energy Agency, 1996). This effect may adopt an
exponential trend (Hauge et al., 2015). The second issue addresses the combinations of degraded
states and condition, which result more dangerous than others. Therefore, further research
developments may be addressed at including a dedicated approach to develop indicators, which
reflect the issue of common cause failure, such as Bayesian approaches (Khakzad et al., 2013).
The results of the RB simulation have been validated using the reality check approach suggested by
Suokas (1985). This method investigates the risk analysis approach in term of quality of its hazard
identification, the backbone of the QRA. It is based on the comparison with occurred accidents.
Suokas (1988) tested the effectiveness of different accident identification techniques comparing the
output of these processes with the insights given from accident descriptions.
The validation of the RB approach proposed in this work follows the insights suggested by (Goerlandt
et al., 2017). The RB technique is based on a bow-tie approach. Different contributors to the accident
(in that case, the HC release) are identified by hazard and operability (HAZOP) studies and by
reviewing past accidents in the petroleum offshore industry. According to the comparison analysis
performed by Suokas (1988), HAZOP technique is the most effective in identifying accidents and
their contributors.
Appropriate barriers are considered and addressed in the bow-tie analysis. A series of sensitivity
analyses has been performed in order to assess the criticality of the different barrier elements. This
showed that the ESD is the most critical barrier system, in agreement with the results of different

23
accident investigations and reports (Pearson, 1992; PSA, 2017, 2015). Moreover, it shows that the
RB risk model correctly reflects the effect of ESD valve performance on the accident risk.
The analysis of the safety issues through RB allowed for integration with the conventional procedures
for oil spill risk assessment (see Section 3.2). The results shown in Section 5.2 clearly show the
importance of a deeper investigation of safety barriers performance, in order to prevent oil spill
scenarios featuring large impact and, thus, high risk level. The main limitation of oil spill frequency
evaluation for the environmental risk assessment is related to the selection of conservative standard
values (American Petroleum Institute, 2000). Leak frequency tailorization (Bagster and Pitblado,
1991; Pitblado et al., 2011) and its periodical update may be an effective approach in order to integrate
the operational, organizational and technical aspects affecting the likelihood of oil spill and to update
the environmental risk level (Landucci and Paltrinieri, 2016, 2015). Dynamic leak frequency
evaluation may be also achieved through advanced approaches, such as dynamic fault trees (Dugan
et al., 1992; Manno et al., 2012; Merle et al., 2016), Markov chain models for the life-cycle analysis
(Howard, 1971; Limnios and Oprisan, 2001; Yevkin, 2016), and Weibull failure analysis (Hall and
Strutt, 2003; Khakzad et al., 2012). Moreover, complex system modelling involving the effect of
safety barriers (alarms, backups, redundancy of components, interlocks, etc.) may be also based on
advanced tools such as Bayesian networks (Kalantarnia et al., 2009b; Khakzad et al., 2013; Khakzad
et al., 2013) or Montecarlo simulation (Chiacchio et al., 2016; Das and Samuel, 2014; Noh et al.,
2014; Savage et al., 2013).
Concerning the limitations of consequence evaluation, it is worth mentioning that the impact of oil
spill was simulated through GNOME imposing predefined meteorological conditions, lasting for 108
hours. Thus, results are specific for the wind and ocean currents conditions implemented, which can
be also the result of data averaged over prolonged period of observation (Cheng et al., 2011; Marta-
Almeida et al., 2013; Ventikos and Psaraftis, 2004). Nevertheless, the development of a tool able to
capture and forecast the comprehensive behaviour of movers in the region of interest was out of the
scope of the present study. Moreover, despite the effect of the shut-down system intervention was
accounted for determining of oil spilt quantitates, the possible effect of mitigation barriers was not
included in the consequence assessment. Thus, the present study may provide support to the situation
in which clean-up techniques are performed. In this way, removing oil from water may be facilitated
by monitoring where the spill moves and predicting potential impact on sensitive areas.

6 Conclusions
The present work illustrates the development an innovative approach for the integrated safety and
environmental risk assessment for the analysis of offshore O&G plants in sensitive areas, such as the
first oil production platform in the Barents Sea.
Safety assessment was conducted by applying a novel tool for dynamic risk assessment, the RB
methodology, which allowed to relate the risk level of the installation to the performance of critical
safety barriers. Environmental risk assessment has been conducted using the risk matrix approach,
evaluating both frequency of crude oil spill occurrence and severity. The latter has been assessed
using the General NOAA Operational Modelling Environment (GNOME) software.
The analysis of the case study evidenced the potentialities of the present method, that relies on
advanced methods for safety assessment of O&G facilities operating in sensitive areas, in which
environmental risk assessment is integrated.

24
The introduction of periodic revision and time update of relevant indicators may be adopted to drive
identification of critical safety issues in a facility, integrating technical and managerial aspects and
supporting continuous monitoring, either involving plant personnel and management.

Supplementary material
The maps reporting the results of oil spill simulation are collected in the supplementary material in
separate PNG files. The maps legend is shown in Figure 12. The following files are provided:
 A.png oil spill simulation results 03/12/2016, time 00.00
 B.png oil spill simulation results 03/12/2016, time 12.00;
 C.png oil spill simulation results 03/13/2016, time 00.00;
 D.png oil spill simulation results 03/13/2016, time 18.00.

Acknowledgments
The authors gratefully acknowledge ENI Norge for their support and feedback and all the SINTEF
colleagues that have indirectly contributed to this study. Information presented in the paper are result
of careful selection. Authors are the solely responsible for the results and conclusions, which do not
express the view of ENI Norge. This research was partially supported by the project Lo-Risk
(“Learning about Risk”).

References

Adamic, L. a., Huberman, B. a, 2002. Zipf’s Law and the Internet. Glottometrics 3, 143–150.
Ale, B., van Gulijk, C., Hanea, A., Hanea, D., Hudson, P., Lin, P.-H., Sillem, S., 2014. Towards BBN
based risk modelling of process plants. Saf. Sci. 69, 48–56. doi:10.1016/j.ssci.2013.12.007
American Petroleum Institute, 2000. API Publication 581. Risk-based inspection base resource
document.
Andersen, H., Casal, J., Dandrieux, A., Debray, B., De Dianous, V., Duijm, N.J., Delvosalle, C.,
Fievez, C., Goossens, L., Gowland, R.T., Hale, A.J., Hourtoulou, D., Mazzarotta, B., Pipart, A.,
Planas, E., Prats, F., Salvi, O., Tixier, J., 2004. User Guide. Technical Report EVG1 - CT - 2001
- 00036. Bruxelles, Belgium.
Attwood, D., Khan, F., Veitch, B., 2006. Occupational accident models-Where have we been and
where are we going? J. Loss Prev. Process Ind. 19, 664–682. doi:10.1016/j.jlp.2006.02.001
Bagster, D.F., Pitblado, R.M., 1991. Estimation of domino incident frequencies - an approach.
Process Saf. Environ. Prot. Trans. Inst. Chem. Eng. Part B 69, 195–199.
Barabadi, A., Tobias Gudmestad, O., Barabady, J., 2015. RAMS data collection under Arctic
conditions. Reliab. Eng. Syst. Saf. 135, 92–99.
Beegle-Krause, C.J., 2001. General noaa oil modeling environment (GNOME): a new spill trajectory
model. Int. Oil Spill Conf. Proc. 2001, 865–871. doi:10.7901/2169-3358-2001-2-865
Bejarano, A.C., Michel, J., 2016. Oil spills and their impacts on sand beach invertebrate
communities : A literature review. Environ. Pollut. doi:10.1016/j.envpol.2016.07.065
Bercha, F., Brooks, C., Leafloor, F., 2003. Human performance in arctic offshore escape, evacuation
and rescue, in: Proceedings of the Thirteenth International Offshore and Polar Engineering
Conference, Honolulu, Hawaii, USA. International Society of Offshore and Polar Engineers
(ISOPE), Cupertino, Ca, USA, pp. 2755–2762.
Bird, K.J., Charpentier, R.R., Gautier, D.L., Houseknecht, D.W., Klett, T.R., Pitman, J.K., Moore,
25
 T.E., Schenk, C.J., Tennyson, M.E., Wandrey, C.J., 2008. Circum-Arctic Resource Appraisal:
Estimates of Undiscovered Oil and Gas North of the Arctic Circle. USGS Fact Sheet 2008-3049.
doi:USGS Fact Sheet 2008-3049
Bjornbom, E., 2011. Goliat – Leak detection and monitoring from template to satellite Goliat
development project.
BP, 2010. Deepwater Horizon Accident Investigation Report, Internal BP Report.
CCPS - Center of Chemical Process Safety, 2000. Guidelines for chemical process quantitative risk
analysis. American Institute of Chemical Engineers - Center of Chemical Process Safety, New
York.
Cheng, Y., Li, X., Xu, Q., Garcia-Pineda, O., Andersen, O.B., Pichel, W.G., 2011. SAR observation
and model tracking of an oil spill event in coastal waters. Mar. Pollut. Bull. 62, 350–363.
doi:10.1016/j.marpolbul.2010.10.005
Chiacchio, F., D’Urso, D., Manno, G., Compagno, L., 2016. Stochastic hybrid automaton model of a
multi-state system with aging: Reliability assessment and design consequences. Reliab. Eng.
Syst. Saf. 149, 1–13.
Crawley, F.K., 1999. The change in safety management for offshore oil and gas production systems.
Process Saf. Environ. Prot. 77, 143–148.
Crawley, F.K., Grant, M.M., 1997. Concept risk assessment of offshore hydrocarbon production
installations. Process Saf. Environ. Prot. 75, 157–163.
Das, B., Samuel, R., 2014. Reliability informed drilling: Analysis for a dual-gradient drilling system,
in: Proceedings - SPE Annual Technical Conference and Exhibition. pp. 3215–3232.
Deepwater Horizon Study Group, 2011. Final Report on the Investigation of the Macondo Well
Blowout Deepwater Horizon Study Group.
Dugan, J.B., Bavuso, S.J., Boyd, M.A., 1992. Dynamic fault-tree models for fault-tolerant computer
systems. IEEE Trans. Reliab. 41, 363–377.
Duke, N.C., 2016. Oil spill impacts on mangroves : Recommendations for operational planning and
action based on a global review. Mar. Pollut. Bull. 109, 700–715.
doi:10.1016/j.marpolbul.2016.06.082
Eni Norge, 2016. Goliat - Eni Norge [WWW Document]. URL www.eninorge.com/en/field-
development/goliat/ (accessed 4.11.16).
Eni Norge, 2015a. Goliat Blend [WWW Document]. URL
www.eninorge.com/en/FrontPageTabs/Goliat-news/Crude/ (accessed 11.4.16).
Eni Norge, 2015b. Goliat field trip. Hammerfest, p. 32.
EPA, 1998. Guidelines for ecological risk assessment. EPA/630/R095/002F. U.S. Environmental
protection agency, Risk Assessment Forum, Washington, DC.
European Commission, 2012. European Parliament and Council Directive 2012/18/EU of 4 July 2012
on control of major-accident hazards involving dangerous substances, amending and
subsequently repealing council directive 96/82/EC. Off. J. Eur. Communities L197, 1–37.
Evans, D.L., Lautenbacher, C.C., Davidson, M.A., 2002. Trajectory Analysis Handbook.
Falck, A., Flage, R., Aven, T., 2015. Risk assessment of oil and gas facilities during operational
phase, in: Safety and Reliability of Complex Engineered Systems - Proceedings of the 25th
European Safety and Reliability Conference, ESREL 2015. pp. 373–380.
Falck, A., Skramstad, E., Berg, M., 2000. Use of {QRA} for decision support in the design of an
offshore oil production installation. J. Hazard. Mater. 71, 179–192.
Farzingohar, M., Ibrahim, Z.Z., Yasemi, M., 2011. Oil spill modeling of diesel and gasoline with
GNOME around Rajaee port of Bandar Abbas, Iran. Iran. J. Fish. Sci. 10, 35–46.
Gao, X., Barabady, J., Markeset, T., 2010. An approach for prediction of petroleum production
facility performance considering Arctic influence factors. Reliab. Eng. Syst. Saf. 95, 837–846.
Goerlandt, F., Khakzad, N., Reniers, G., 2017. Validity and validation of safety-related quantitative
risk analysis : A review. Saf. Sci. 99, 127–139. doi:10.1016/j.ssci.2016.08.023
Griffin, M.A., Hodkiewicz, M.R., Dunster, J., Kanse, L., Parkes, K.R., Finnerty, D., Cordery, J.L.,
26
 Unsworth, K.L., 2014. A conceptual framework and practical guide for assessing fitness-to-
operate in the offshore oil and gas industry. Accid. Anal. Prev. 68, 156–171.
doi:10.1016/j.aap.2013.12.005
Guo, W., 2017. Development of a statistical oil spill model for risk assessment. Environ. Pollut. 230,
945–953.
Hall, P.L., Strutt, J.E., 2003. Probabilistic physics-of-failure models for component reliabilities using
Monte Carlo simulation and Weibull analysis: A parametric study. Reliab. Eng. Syst. Saf. 80,
233–242.
Hasle, J.R., Kjellén, U., Haugerud, O., 2009. Decision on oil and gas exploration in an Arctic area:
Case study from the Norwegian Barents Sea. Saf. Sci. 47, 832–842.
Hauge, S., Okstad, E., Paltrinieri, N., Edwin, N., Vatn, J., Borsberg, L., 2015. SINTEF F27045:
Handbook for monitoring of barrier status and associated risk in the operational phase - The risk
barometer approach.
Holand, E.D., 2012. The Goliat Oil Field and Oil Spill Response, Workshop on Emergency
Preparedness Prevention and Response.
Howard, R.A., 1971. Dynamic Probabilistic Systems. John Wiley & Sons, New York, NY.
HSE, 2006. Guidance on Risk Assessment for Offshore Installations. HSE Inf. sheet 7–31.
I, Y.P., Shu, C.M., Chong, C.H., 2009. Applications of 3D QRA technique to the fire/explosion
simulation and hazard mitigation within a naphtha-cracking plant. J. Loss Prev. Process Ind. 22,
506–515.
IAEA- International Atomic Energy Agency, 1996. Defence in Depth in Nuclear Safety. IAEA-
International Atomic Energy Agency, Vienna.
Internationa Electrotechnical Commission, 2003. IEC 61511. Functional Safety: Safety Instrumented
Systems for the process industry sector.
IPIECA, IOGP, 2013. Oil spill risk assessment and response planning for offshore installations.
London, UK.
ISO, 2002. Petroleum and Natural Gas industries - Offshore production installations - Guidelines on
tools and techniques for hazard identification and risk assessment. ISO 17776:2002. ISO 2000.
ISO-International standardization organization, 2009. ISO/FDIS 31000:2009: Risk Management -
Principles and Guidelines. International Standardization Organization, Geneva, Switzerland.
ITOPF, 2016. The International Tanker Owners Pollution Federation Limited Handbook.
ITOPF, 2013. Effects of Oil Pollution on the Marine Environment. Tech. Inf. Pap. 13.
Ivshina, I.B., Kuyukina, M.S., Krivoruchko, A. V, Elkin, A.A., Makarov, S.O., Cunningham, C.J.,
Peshkur, T.A., Atlas, M., 2015. Environmental Science Processes & Impacts Oil spill problems
and sustainable response strategies through new technologies. Environ. Sci. Process. Impacts
17, 1201–1219. doi:10.1039/C5EM00070J
Johansen, I.L., Rausand, M., 2014. Foundations and choice of risk metrics. Saf. Sci. 62, 386–399.
doi:10.1016/j.ssci.2013.09.011
Kalantarnia, M., Khan, F., Hawboldt, K., 2009. Dynamic risk assessment using failure assessment
and Bayesian theory. J. Loss Prev. Process Ind. 22, 600–606. doi:10.1016/j.jlp.2009.04.006
Khakzad, N., Khan, F., Amyotte, P., 2013. Quantitative risk analysis of offshore drilling operations:
A Bayesian approach. Saf. Sci. 57, 108–117. doi:10.1016/j.ssci.2013.01.022
Khakzad, N., Khan, F., Amyotte, P., 2013. Risk-based design of process systems using discrete-time
Bayesian networks. Reliab. Eng. Syst. Saf. 109, 5–17. doi:10.1016/j.ress.2012.07.009
Khakzad, N., Khan, F., Amyotte, P., 2012. Dynamic risk analysis using bow-tie approach. Reliab.
Eng. Syst. Saf. 104, 36–44.
Khakzad, N., Yu, H., Paltrinieri, N., Khan, F., 2016. Chapter 5 - Reactive Approaches of Probability
Update Based on Bayesian Methods, in: Dynamic Risk Analysis in the Chemical and Petroleum
Industry. Butterworth-Heinemann, pp. 51–61. doi:http://dx.doi.org/10.1016/B978-0-12-
803765-2.00005-6
Khan, F.I., Sadiq, R., Husain, T., 2002. Risk-based process safety assessment and control measures
27
 design for offshore process facilities. J. Hazard. Mater. 94, 1–36. doi:10.1016/S0304-
3894(02)00004-3
Khan, F., Ahmed, S., Yang, M., Hashemi, S.J., Caines, S., Rathnayaka, S., Oldford, D., 2015a. Safety
Challenges in Harsh Environments: Lesson Learned. Process Saf. Prog. 34, 191–195.
doi:10.1002/prs.11704
Khan, F., Ahmed, S., Yang, M., Hashemi, S.J., Caines, S., Rathnayaka, S., Oldford, D., 2015b. Safety
challenges in harsh environments: Lessons learned. Process Saf. Prog. 34, 191–195.
Kyaw, K., Paltrinieri, N., 2015. The cost of reputational damage when a major accident occurs. Safety
and Reliability of Complex Engineered Systems - Proceedings of the 25th European Safety and
Reliability Conference, ESREL 2015.
Landucci, G., Bonvicini, S., Cozzani, V., 2017. A methodology for the analysis of domino and
cascading events in Oil & Gas facilities operating in harsh environments. Saf. Sci. 95, 182–197.
doi:10.1016/j.ssci.2016.12.019
Landucci, G., Paltrinieri, N., 2016. A methodology for frequency tailorization dedicated to the Oil
&aGas sector. Process Saf. Environ. Prot. 104, 123–141.
Landucci, G., Paltrinieri, N., 2015. TEC2O - Frequency modification methodology based on
TEChnical Operational and Organizational factors. SINTEF Technology and Society, Center for
Integrated Operations in the Petroleum Industry, Trondheim, Norway.
Larsen, T., Nagoda, D., Andersen, J.R., 2004. The Barents Sea ecoregion: A biodiversity assessment.
WWF’s Barents Sea Ecoregion Programme.
Lees, F.P., 1996. Loss prevention in the process industries, 2nd ed. Butterworth - Heinemann, Oxford.
Li, P., Cai, Q., Lin, W., Chen, B., Zhang, B., 2016. Offshore oil spill response practices and emerging
challenges 110, 6–27. doi:10.1016/j.marpolbul.2016.06.020
Limnios, N., Oprisan, G., 2001. Semi-Markov Processes and Reliability. Birkhauser, Boston, USA.
Manno, G., Chiacchio, F., Compagno, L., D’Urso, D., Trapani, N., 2012. MatCarloRe: An integrated
FT and Monte Carlo Simulink tool for the reliability assessment of dynamic fault tree. Expert
Syst. Appl. 39, 10334–10342.
Marta-Almeida, M., Ruiz-Villarreal, M., Pereira, J., Otero, P., Cirano, M., Zhang, X., Hetland, R.D.,
2013. Efficient tools for marine operational forecast and oil spill tracking. Mar. Pollut. Bull. 71,
139–151. doi:10.1016/j.marpolbul.2013.03.022
McCoy, M.A., Salerno, J.A., 2010. Assessing the effects of the Gulf of Mexico oil spill on human
health. A summary of the June 2010 workshop. Natl. Acad. Press.
Merle, G., Roussel, J.-M., Lesage, J.-J., Perchet, V., Vayatis, N., 2016. Quantitative Analysis of
Dynamic Fault Trees Based on the Coupling of Structure Functions and Monte Carlo Simulation.
Qual. Reliab. Eng. Int. 32, 7–18.
Musharraf, M., Khan, F., Veitch, B., Mackinnon, S., Imtiaz, S., 2013. Human factor risk assessment
during emergency condition in harsh environment, in: Proceedings of the ASME 2013 32nd
International Conference on Ocean, Offshore and Arctic Engineering (OMAE 2013), June 9-14,
2013, Nantes, France. American Society of Mechanical Engineers, New York, NY, pp. 1–9.
doi:DOI: 10.1115/OMAE2013-10867
Noh, Y., Chang, K., Seo, Y., Chang, D., 2014. Risk-based determination of design pressure of LNG
fuel storage tanks based on dynamic process simulation combined with Monte Carlo method.
Reliab. Eng. Syst. Saf. 129, 76–82.
Norheim, H.M., 2010. Strategies for oil and gas development in the Arctic, in: Arctic - Changing
Realities Conference. Copenhagen.
Norsok, 2008. NORSOK STANDARD Technical safety.
NORSOK-standards, 2001. Standard z-013 Risk and emergency preparedness analysis. Norwegian
Technology Centre, Oslo, Norway.
Olson, D.M., Dinerstein, E., 2002. The Global 200: Priority Ecoregions for Global Conservation.
Missouri Bot. Gard. Press 89, 199–224. doi:10.2307/3298564
Paltrinieri, N., Hauge, S., Dionisio, M., Nelson, W.R., 2014. Towards a dynamic risk and barrier
28
 assessment in an IO context, in: Safety, Reliability and Risk Analysis: Beyond the Horizon -
Proceedings of the European Safety and Reliability Conference, ESREL 2013. pp. 1915–1923.
Paltrinieri, N., Hokstad, P., 2015. Dynamic risk assessment: Development of a basic structure. Saf.
Reliab. Methodol. Appl. - Proc. Eur. Saf. Reliab. Conf. ESREL 2014 1385–1392.
doi:10.1201/b17399-191
Paltrinieri, N., Khan, F., 2016. Dynamic Risk Analysis in the Chemical and Petroleum Industry, 1st
ed.
Paltrinieri, N., Landucci, G., Nelson, W.R., Hauge, S., 2016. Chapter 6 - Proactive Approaches of
Dynamic Risk Assessment Based on Indicators, in: Dynamic Risk Analysis in the Chemical and
Petroleum Industry. Butterworth-Heinemann, pp. 63–73. doi:http://dx.doi.org/10.1016/B978-0-
12-803765-2.00006-8
Pasman, H., Reniers, G., 2014. Past, present and future of Quantitative Risk Assessment (QRA) and
the incentive it obtained from Land-Use Planning (LUP). J. Loss Prev. Process Ind. 28, 2–9.
doi:10.1016/j.jlp.2013.03.004
Pearson, J., 1992. Emergency shut down systems in onshore and offshore process operations. IChemE
Symp. Ser. 130, 671–677.
Pitblado, R., Bain, B., Falck, A., Litland, K., Spitzenberger, C., 2011. Frequency data and
modification factors used in QRA studies. J. Loss Prev. Process Ind. 24, 249–258.
doi:10.1016/j.jlp.2010.09.009
Pitblado, R.M., Williams, J.C., Slater, D.H., 1990. Quantitative assessment of process safety
programs. Plant/Operations Prog. 9, 169–175.
PSA, 2017. En oppsummering av de viktigste funnene i utviklingen av risikonivået i norsk
petroleumsvirksomhet i 2016.
PSA, 2015. Report of the investigation into an unplanned emergency shutdown and acute oil spill to
the sea on the Eldfisk complex in the period 6-8 August 2016.
PSA, 2013a. Principles for barrier management in the petroleum industry.
PSA, 2013b. Principles for barrier management in the petroleum industry. Stavanger, Norway,
Petroleum Safety Authority Norway.
Rausand, M., 2011. Risk Assessment. Theory, Methods and Applications. Wiley.
Rekdal, O., Hansen, H.N., 2015. Goliat Barrier Management - ERSA Norge. March 25, 2015 [WWW
Document]. URL http://www.eninorge.com (accessed 4.1.16).
Savage, G.J., Seecharan, T.S., Kap Son, Y., 2013. Probability-based prediction of degrading dynamic
systems. J. Mech. Des. Trans. ASME 135.
Scarponi, G.E., Paltrinieri, N., 2016. Chapter 8 - Comparison and Complementary between Reactive
and Proactive Approaches, in: Dynamic Risk Analysis in the Chemical and Petroleum Industry.
Butterworth - Heinemann, pp. 93–101. doi:http://dx.doi.org/10.1016/B978-0-12-803765-
2.00008-1
Scarponi, G.E., Paltrinieri, N., Khan, F., Cozzani, V., 2016. Chapter 7 - Reactive and Proactive
Approaches: Tutorials and Example, in: Dynamic Risk Analysis in the Chemical and Petroleum
Industry. Butterworth - Heinemann, pp. 75–92. doi:http://dx.doi.org/10.1016/B978-0-12-
803765-2.00007-X.
Sklet, S., 2006. Safety barriers: Definition, classification, and performance. J. Loss Prev. Process Ind.
19, 494–506. doi:10.1016/j.jlp.2005.12.004
Song, G., Khan, F., Wang, H., Leighton, S., Yuan, Z., Liu, H., 2016. Dynamic occupational risk
model for offshore operations in harsh environments. Reliab. Eng. Syst. Saf. 150, 58–64.
Spouge, J., 2005. New generic leak frequencies for process equipment. Process Saf. Prog. 24, 249–
257. doi:10.1002/prs.10100
Suokas, J., 1988. The limitations on safety and risk analysis. IChemE Symp. Ser. 110 493–505.
Suokas, J., 1985. On the reliability and validity of safety analysis. Tampere University of Technology,
Tampere, Finland.
Thomas, P., Bratvold, R.B., Bickel, J.E., 2013. The risk of using risk matrices. Proc. - SPE Annu.
29
 Tech. Conf. Exhib. 3, 2314–2329. doi:10.2118/166269-MS
Uijt de Haag, P.A.M., Ale, B.J.M., 2005. Guidelines for Quantitative Risk Assessment (Purple Book).
USGS World Assessment Team, 2000. U.S. Geological Survey world petroleum assessment 2000:
description and results. USGS Digita Data Series DDS60.
Valdor, P.F., Gómez, A.G., Puente, A., 2015. Environmental risk analysis of oil handling facilities in
port areas. Application to Tarragona harbor (NE Spain). Mar. Pollut. Bull. 90, 78–87.
Van Den Bosh, C.J.H., Weterings, R.A.P.M., 2005. Methods for the calculation of physical effects
(Yellow Book), third. ed. Committee for the Prevention of Disasters, the Hague (NL).
Ventikos, N.P., Psaraftis, H.N., 2004. Spill accident modeling: A critical survey of the event-decision
network in the context of IMO’s formal safety assessment. J. Hazard. Mater. 107, 59–66.
Vinnem, J.E., Bye, R., Gran, B.A., Kongsvik, T., Nyheim, O.M., Okstad, E.H., Seljelid, J., Vatn, J.,
2012. Risk modelling of maintenance work on major process equipment on offshore petroleum
installations. J. Loss Prev. Process Ind. 25, 274–292. doi:10.1016/j.jlp.2011.11.001
Walker, A.H., Ducey, D.L., Lacey, S.J., Arrald, J.R., 1994. Implementing effective response
management system: a white paper presented at 1995 International Oil Spill Conference. Am.
Pet. Inst.
Walker, A.H., Kucklick, J.H., Scholz, D.K., Reilly, T., 1995. Chemical treating agents: response
niches and research and development needs., in: International Oil Spill Conference.
Wilhelm, S.I., Robertson, G.J., Ryan, P.C., Schneider, D.C., 2007. Comparing an estimate of seabirds
at risk to a mortality estimate from the November 2004 Terra Nova FPSO oil spill. Mar. Pollut.
Bull. 54, 537–544.
Yevkin, O., 2016. An efficient approximate Markov chain method in dynamic fault tree analysis.
Qual. Reliab. Eng. Int. 32, 1509–1520.
Zelenke, B., C. O’Connor, C. Barker, C.J. Beegle-Krause, and L.E. (Eds. ., 2012. General NOAA
Operational Modeling Environment (GNOME), Technical Documentation. NOAA Tech.
Memo. NOS OR&R 40 105.
Zipf, G.K., 1949. Human Behaviour and the Principles of Least Effort. Addison-Wesley, Cambridge,
MA.
Øien, K., Utne, I.B., Herrera, I.A., 2011a. Building Safety indicators: Part 1 - Theoretical foundation.
Saf. Sci. 49, 148–161. doi:10.1016/j.ssci.2010.05.012
Øien, K., Utne, I.B., Tinmannsvik, R.K., Massaiu, S., 2011b. Building Safety indicators: Part 2 -
Application, practices and results. Saf. Sci. 49, 162–171. doi:10.1016/j.ssci.2010.05.015

30