Faculty of Science and Technology

MASTER’S THESIS

Study program/Specialization:
Spring semester, 2017
Risk Management

Writer:
Ihuaku Nneoma Kelechi Unegbu …………………………………………
(Writer’s signature)
Faculty supervisor:

Prof. Ove Tobias Gudmestad (University of Stavanger, Stavanger Norway)

Thesis title:

Evaluation of Ballast Failures during operations of Semi-submersible rigs

Credits (ECTS): 30

Key words:
Ballast failures, buoyancy loss, stability Pages: 115

+ Appendix /enclosure:

Stavanger,June /2017
ABSTRACT
Offshore drilling is an operation performed to explore for and extract hydrocarbon beneath the seabed. The
drilling operation is a very sensitive and extremely risky task and can be carried out from a floating vessel,
semi-submersible and so on. Because of the high risk involved in drilling operations, the structural integrity
and stability of the platform on which the drilling operation is performed are of uttermost importance to the
success of the operation. In recent times, drilling operations are performed on mobile platforms most espe-
cially on semi-submersibles, thus the stability of this platform as well as the risk involved are worth given
careful considerations and evaluations.

In the past couple of years, the PSA has focused on hazards relating to floating installations and thus requested
that more attention should be made by the industry on hazards relating to buoyancy loss and stability. Ballast
systems play a very vital role to ensure vessel stability. The main function of the ballast system is to maintain
stability and sufficient draft, and also to retain the sheer forces and bending moments within required limits.
The ballast system comprises ballast tanks, different network of pipes, pumps and valve, hydraulic power
system, electric power system and ballast control system. Failure to properly ballast may lead to accidents
which could lead to loss of vessel, death of personnel and environmental disasters as in the case of Ocean
Ranger accident in 1982, and Petrobras P-34 FPSO in 2002 (Sobena, 2007).

This thesis is aimed at evaluating the risks involved in ballast operations, by identifying the various failure
modes of semi-submersible ballast systems and we will consider possible barriers and consequences due to the
ballast system failure during drilling operation. The thesis focuses primarily on the failure mode effect and
criticality analysis (FMECA) of the main components of the semi-submersible’s ballast system by determining
the failure causes and failure modes that could influence each components performance, and thus identifying
the most critical component(s). Also the Structured What-If Technique (SWIFT) is used to compensate for
hazard identification for the unidentified hazards (i.e., human errors), in the FMECA. By studying the most
critical system components, a qualitative risk analysis is conducted to model accidental sequences by using the
fault tree method to establish the chain of failure events.

In addition to this, a stability analysis of a typical semi-submersible based on ballast system is performed to
assess the criticality of different ballast failure conditions such as damage condition, and ballast failure under
different environmental conditions such as under harsh environment, polar low occurrence. In achieving these
objectives, both qualitative risk analysis and evaluation methods are adopted.

NNEOMA, 2017 Page II

ACKNOWLEDGEMENTS
I would like to express my sincere appreciation to my supervisor, Prof. Ove Tobias Gudmestad, whose
knowledge guidance and encouragement made every time I spent on this thesis extremely meaningful.
I am exceedingly grateful for the contributions of my classmate and colleague, Akinyemi Akinsanya for
making this thesis a success. To Adekunle Orimolade for your helpful contributions and unwavering
support in the execution of this work.

I would like to thank my family for their unconditional love and support. To my forever proud late
parents Prof and Mrs R.M Aguta, thank you for molding me to be the lady I am today. To my brothers
and sister, thank you for always being a call away irrespective of your schedules. Finally, to my daughter
and husband, Zinachika and Tobenna, for your motivation and sacrifices

Ihuaku Nneoma Kelechi Unegbu

Stavanger, June 15, 2017

1
TABLE OF CONTENTS
ABSTRACT ............................................................................................................................. II
ACKNOWLEDGEMENTS ..................................................................................................... 1
LIST OF FIGURES ................................................................................................................. 4
LIST OF TABLES ................................................................................................................... 5
ABBREVIATIONS .................................................................................................................. 6
1. INTRODUCTION .......................................................................................................... 7
1.1 BACKGROUND ..................................................................................................................................7
1.2 PROBLEM DEFINITION ..................................................................................................................8
1.3 OBJECTIVES ......................................................................................................................................8
1.4 SCOPE ..................................................................................................................................................8
1.5 ORGANISATION OF THE THESIS .................................................................................................8
2. LITERATURE SURVEY ............................................................................................ 10
2.1 DEVELOPMENTS OF THE SEMI-SUBMERSIBLE ...................................................................10
2.2 DESCRIPTION OF THE SEMI-SUBMERSIBLE RIG ................................................................12
2.3 RISK ASSESSMENT ........................................................................................................................13
2.3.1 Previous studies of ballast system failure .............................................................13
2.4 Regulations .........................................................................................................................................16
3. METHODOLOGY ....................................................................................................... 18
4. BALLAST SYSTEM FAILURE ................................................................................. 20
4.1 BALLAST SYSTEM AND FUNCTIONS ........................................................................................20
4.2
DESCRIPTION OF SOME PAST INCIDENTS AND ACCIDENTS CAUSED BY BALLAST
FAILURE .........................................................................................................................................................23
4.2.1 Henrik Ibsen ............................................................................................23
4.2.2 Ocean Ranger ..........................................................................................24
4.2.3 Petrobras P-36 ..........................................................................................25
4.2.4 BP Thunder Horse .....................................................................................26
4.2.5 Aban Pearl ..............................................................................................27
4.2.6 Scarabeo 8 ..............................................................................................27
4.2.7 Floatel Superior ........................................................................................28
4.2.8 Island Innovator ........................................................................................29
4.2.9 Ocean Developer .......................................................................................30
5. STABILITY OF SEMI-SUBMERSIBLE PLATFORMS ........................................ 32
5.1 FREEBOARD OF FLOATING STRUCTURES ............................................................................32
5.2 STABILITY CALCULATIONS .......................................................................................................35
5.3 COMMENTS ON RESULTS OF CALCULTIONS .......................................................................41
6. RISK ANALYSIS AND ASSESSMENT OF BALLAST FAILURES .................... 45
6.1 HAZARD IDENTIFICATION .........................................................................................................45
6.2 FAULT TREE ANALYSIS ...............................................................................................................49
6.3 RISK REDUCING MEASURE (BARRIER ANALYSIS) .............................................................50
6.3.1 Terminology used in barrier analysis .................................................................50
6.3.2 Barrier performance of some notable accidents/incidents ...........................................52
7. DISCUSSION ............................................................................................................... 54

2
8. CONCLUSIONS........................................................................................................... 58
REFERENCE ......................................................................................................................... 59
APPENDIX A ......................................................................................................................... 66
APPENDIX B.......................................................................................................................... 69
APPENDIX C ......................................................................................................................... 74
APPENDIX D – ................................................... FEIL! BOKMERKE ER IKKE DEFINERT.

3
LIST OF FIGURES

Figure 2-1: A semi-submersible rig. Source: ABB, n.d........................................................................ 12

Figure 2-2: Failurefrequency assessment approach based on gross errors. Source; Lotsberg et al.
(2004); Vinnem (2013) .......................................................................................................................... 15
Figure 2-3: Analytical process for marine systems. Source; Vinnem (2013)....................................... 16
Figure 4-1: Typical schematic of piping in a ballast system. Source; (Hock and Balaban, 1984) ....... 21
Figure 4-2: Typical schematic of a hydraulic ballast valve system. Source; (Hock and Balaban,
1984)...................................................................................................................................................... 22
Figure 4-3: The drilling rig Henrik Ibsen. Source; Teknisk Ukeblad (n.d) .......................................... 23
Figure 4-4: The drilling rig Ocean Ranger. Source; Moan, (2005) ...................................................... 24
Figure 4-5: The drilling rig Petrobras P-36. Source; NASA, (2008) .................................................... 25
Figure 4-6: The drilling rig BP Thunderhorse. Source; Lyall, (2010) .................................................. 26
Figure 4-7: The drilling rig Aban Pearl. Source; Tinmannsvik, (2011) ............................................... 27
Figure 4-8: The drilling rig Scarabeo 8. Source; OFFSHOREENERGYTODAY, (2012b) ................ 28
Figure 4-9: The drilling rig Floatel Superior. Source; OFFSHOREENERGYTODAY, (2012b ........ 29
Figure 4-10:The drilling rig Island Innovator. Source; Offshoreenergytoday, (2013) ......................... 30
Figure 5-1: Equilibrium of a floating body. Source: SNAME, (1988). .............................................. 32
Figure 5-2: Plan view of the semi-submersible .................................................................................... 34
Figure 5-3:Important stability properties. Source: Tupper, (2004)...................................................... 35
Figure 5-4: The waterline area of the semi-submersible ...................................................................... 37
Figure 5-5:Parameters used in determining the centre of gravity, 𝐾𝐾𝐺𝐺.................................................. 38
Figure 5-6:. Stability of a semi-submersible at larger angles of inclination. Source: Gudmestad,
(2015) .................................................................................................................................................... 38
Figure 5-7: Static heeling angle caused by the asymmetric load of ballast .......................................... 39
Figure 5-8: KG formula before the presence of heeling moment ......................................................... 41
Figure 5-9:Variation of draft with change in percentage of ballast water ............................................ 42
Figure 5-10: Variation of freeboard with change in percentage of ballast water ................................. 42
Figure 5-11:Variation of metacentric height for different percentages of ballast water ....................... 43
Figure 5-12:Variation of ballast water with the heeling angle ............................................................. 43
Figure 6-1: The process of risk assessment in ISO31000. Source; PSA, (2013) .................................. 45
Figure 6-2: Barrier classification. Source; Sklet, (2005) ...................................................................... 50
Figure 6-3;Relationship between barrier function, elements and RIFs. Source; PSA, 2013 ................ 51
Figure 6-4: Categorizing performance requirements for technical, operational and organisational
barrier elements. Source (PSA, 2013) ................................................................................................... 52
Figure 6-5: Barrier diagram .................................................................................................................. 52
Figure 7-1: Distribution of causes of stability failures......................................................................... 55
Figure 7-2; Established approach of risk reduction .............................................................................. 57

4
LIST OF TABLES

Table 4-1: Generation of semi-submersibles. Source: Chakrabarti, (2005), Kaiser et al., (2013) ........ 10
Table 4-1Principal dimensions, Henrik Ibsen: Source; Naess et al., (1982) ......................................... 24
Table 4-2;Principal dimensions, Ocean Ranger: Source; USCG, (1982), Songa Offshore, (n.d) ........ 25
Table 4-3: Principal dimensions Petrobras P-36: Mace, (n.d)............................................................... 26
Table 4-4: Principal dimensions, BP Thunderhorse: Source: ABS (n.d); BP (n.d) .............................. 26
Table 4-5: Principal dimensions, Aban Pearl: Source: Aban (n.d) ....................................................... 27
Table 4-6: Principal dimensions, Scarabeo 8: Source; Saipem, (n.d) ................................................... 28
Table 4-7: Principal dimensions, Floatel Superior: Source: ABS (n.d); DNV (n.d) ............................. 29
Table 4-8: Principal dimensions, Island Innovator: Source: Islanddrilling (n.d) .................................. 30
Table 4-9: Summary of initiating causes of the above incidents due to ballast failure ......................... 31
Table 5-1: Semi-submersible stability requirement (DNV, 2013) ........................................................ 35
Table 5-2:: Summary of stability results ............................................................................................... 44
Table 6-1:: Generic checklist and hazard brainstorming process of the ballast system ........................ 46
Table 6-2:Hazard identification based on SWIFT. Source; HSE, (2001) ............................................. 46
Table 6-3:Analysed components by FMECA technique ....................................................................... 48
Table 6-4: Symbols and interpretations of a fault tree. Source; Rausand and Høyland, (2004) ........... 49
Table 6-5: Overview of the analysed accidents. ................................................................................... 53
Table 6-6: Barrier performance summary ............................................................................................. 53
Table 7-1: Scenario with 70% of ballast water in tank 2....................................................................... 56

5
ABBREVIATIONS

ALARP As Low as Reasonably Practicable

BOP Blowout Preventer
BP British Petroleum
DFU Defined Hazard and accident conditions
DNV Det Norske Veritas
EDT Emergency Drain Tank
ETA Event Tree Analysis
FMEA Failure Mode and Effect Analysis
FMECA Failure Mode Effect and Criticality Analysis
FPSO Floating Production Storage and Offloading
FTA Failure Tree Analysis
HAZID Hazard Identification
HSE Health Safety and Environment
HMI Human Machine Interfernce
MCT Multiple Cable Transits
MODU Mobil Offshore Drilling Unit
NMA Norwegian Maritime Authority
ODECO Ocean Drilling Exploration Company
OREDA Offshore Reliability Data
OTC Offshore Technology Conference
PDQ Production and Drilling facility with Quarters
PSA Petroleum Safety Authority
QRA Quantitative Risk Assessment
RABL Risk Assessment of Buoyancy Loss
RIF Risk Influencing Factor
RNNP Annual Trends in risk level report
RPN Risk Priority Number
SINTEF Stiftelsen for Industriel og Teknisk Forskning, Trondh
SIS Safety Instrumented System
SNAME Society of Naval Architecture and Marine Engineers
SWIFT Structured What-If Technique
UPS Uninterrupted Power Supply Database
VGC Versatile Gas Component

6
1. INTRODUCTION
This chapter is aimed to introduce the background and objective of this thesis. This will include infor-
mation on types of ballast failures, scope of work and also a description of the organization of the report.

1.1 BACKGROUND
Offshore drilling is an operation performed to explore and extract hydrocarbon from beneath the seabed.
Recently the construction of offshore rigs is subject to advance in deep waters hence, safety is a major
concern in the area of offshore field development. Accidents have occurred in the past, leading to loss
of properties, human lives and also in some cases, ocean pollution (Vinnem, 2013). Due to the high risk
involved in drilling operations, the structural integrity and stability of the platform on which the drilling
operation is performed are of uttermost importance to the success of the operation.

In recent times, drilling operations are performed on mobile platforms, most especially on semi-sub-
mersibles. Therefore, the stability of this type of platform with the accompanying risk involved are
worth given careful considerations and evaluations. Semi-submersible rigs are regarded as the most
versatile drilling platforms in the marine industry (HSE, 2006). This is because they can be used for
both deep (i.e., water too deep for fixed platforms) and shallow water. The semi-submersible is also
preferred because of its, large riser holding space, good seakeeping capability, large topside space and
easy offshore installation (Park et al., 2015). The first semi-submersible rig was developed in 1961 by
the Blue Water Drilling Company. The unit had four columns and was used by Shell for drilling in the
Gulf of Mexico. In 1971, it became rapidly accepted by the oil and gas industry after the construction
of the first self-propelled semi-submersible by ODECO (Ismail et al., 2014).

The Norwegian Petroleum Safety Authority, PSA has focused on hazards relating to floating installa-
tions in the past couple of years and requested that more attention should be made by the industry on
hazards relating to buoyancy loss and stability (Vinnem, 2013). Ballast systems play a very vital role to
ensure vessel stability. The main function of the ballast system is to maintain stability and sufficient
draft, and also to retain the sheer forces and bending moments within required limits. The ballast system
comprises of; ballast tanks, different network of pipes, pumps and valve, hydraulic power system, elec-
tric power system and ballast control system.

A failure can be disastrous in nature. It also has tendencies to lead to other unwanted consequences even
if it is not catastrophic. For instance, it could cause production loss in the event of downtime and pro-
longing of delivery deadlines. This therefore, affects projects in the sense of additional costs and wastage
of resources hence, leading to the possibility of losing customer goodwill (Kumar et al., 2007). Failure
to properly ballast may lead to accidents, which could potentially lead to loss of vessel, death of person-
nel and environmental disasters (Sobena, 2007). According to a research carried out by Østby et al.,
(1987) on risk assessment of buoyancy loss (RABL), after vessel collision, the second main contributor
to risk in terms of buoyancy loss and stability for offshore mobile drilling units is ballast system failure
(HSE, 2003)

A typical initiating event due to ballast and equipment failure include: inadvertent flooding (e.g., Aban
Pearl, Ocean Alliance, Diamond M Epoch and other incidents); human error during operation of the
ballast control (e.g., Ocean Ranger, Scarabeo 8, Island Innovator, Ocean Developer, Petrobras P-36,
etc.) (HSE, 2006).

7
 Notwithstanding the potential of recognizing ballast failure related accidents, as a major accident, they
are still not subjected to strict regulations by the maritime authorities. However, this may change because
the regulation initiatives have included ballast systems under the performance-based section of the off-
shore regulations (OLF070, 2004).

1.2 PROBLEM DEFINITION

In the past, there has been a lot of incidents related to ballast failures. Based on major worldwide inci-
dents and accidents discussed by Vinnem et al., 2006a, notable causes of ballast failures include; Ballast
water pump, valve, firewater ingress and seawater ingress. It has been observed that valve failures are
the major cause category for incidents and accidents. It is also observed that about 58% of all recorded
incidents, accidents and minor problems are related to technical issues of which human error is usually
the common cause

As drilling operation is a critical activity in the marine business, it is therefore very important to evaluate
ballast failures during operation of semi-submersibles.

1.3 OBJECTIVES
The purpose of this thesis is therefore to evaluate the failure of ballast system’s components during
drilling operation. These evaluations include: Identification of the most critical components of the bal-
last system; Identification of ways the systems, components, or processes fail to realise their design
purpose; Identification and analysis and factors and conditions that cause to the occurrence of an unde-
sirable event; Identification of safety barriers that aims to prevent, control and mitigate effects of a
hazardous event

1.4 SCOPE
In order to achieve the objectives mentioned above, the following scope is covered:

1. Conduct a literature survey on similar models used in relation to the problem statement so as to
determine the present research limit.
2. Conduct a failure mode effect and criticality analysis (FMECA) of the main components of the
semi-submersible’s ballast system
3. Model accident sequences by using fault tree to establish the failure frequencies of issues not
corrected and/or caused by ballasting
4. Determine the barrier functions, barrier system and elements and risk influencing factors of past
incidents
5. Use a case study to show the effects of ballast systems failure on semi-submersibles stability
6. Suggest risk reduction measures

1.5 ORGANISATION OF THE THESIS

Evaluations have been made on the most effective structure for introducing and analysing this thesis.
This structure aims to allow the reader understand the purpose for the research. Therefore, the structure
is divided into the following sections:

• Chapter 1: Provides the background and objective of this thesis

8
• Chapter 2: Presents an overview of this thesis

• Chapter 3: Presents the methodology used in writing this thesis

• Chapter 4: Discusses some past incidents on ballast system failure

• Chapter 5: Presents stability calculations of semi-submersibles

• Chapter 6: Establishes a risk assessment approach for identifying, analysing and mitigating
ballast failures of semi-sumbersibles

• Chapter 7: Evaluates ballast failure of semi-submersibles

• Chapter 8: Concludes this thesis, and suggests recommendations for further research.

9
2. LITERATURE SURVEY
There has been an increase in demand of floating type offshore units, as a result of oil and gas explora-
tion in deep seas. The semi-submersible type unit is widely preferred due to its, large riser holding space,
good seakeeping capability, large topside space and easy offshore installation (Park et al., 2015). Pres-
ently, there has been very little research within the field of ballast systems during operations of semi-
submersibles.

This chapter is divided into four sections. Section 2.1 describes the developments of the semi-submers-
ible, section 2.2 presents an overview of the semi-submersible. Section 2.3 discusses past risk assess-
ments that has been carried out in the field of ballast failure of semi-submersibles during operations.
Section 2.4 discusses regulation requirements relating to vulnerability and reliability analysis and risk
related to loss of buoyancy and stability

2.1 DEVELOPMENTS OF THE SEMI-SUBMERSIBLE

The evolution of semi-submersibles originated from the submersibles, which operated in relative shal-
low waters (Chakrabarti, 2005). The submersibles provided a deck above the highest projected wave.
The rig transited between locations afloat on pontoons, requiring “stability columns to safely submerge
to a bottom founded mode of operation” (Chakrabarti, 2005). Blue Water Drilling and Shell decided that
the submersibles could operate in deeper water and developed the marine riser and refurbished the moor-
ings, which allowed drilling in floating mode. This accidentally brought about the first semi-submersi-
ble, “Bluewater”

A significant progression on the development of semi-submersible rigs have been documented. John
Filson in Chakrabarti, (2005 p.464), extensively researched on rigs from the 1st to the 4th generations. In
addition, documentations from 5th and 6th generations can be seen in Kaiser et al., (2013). Generally,
classifications of semi-submersibles into generations are based on the construction year, technology of
equipment, variable deck load, environmental specification and water depth capacity (Kaiser et al.,
2013). Table 2.1 lists the generations and characteristics of the semi-submersible platforms.

Table 2-1: Generation of semi-submersibles. Source: Chakrabarti, (2005), Kaiser et al., (2013)
Generation Year of con- Water depth Drilling Displacement Variable load
struction [m] depth [m] [mT] [tons]
1st 1962-1969 180 - 250 < 10 000 7 000-10 1 000 - 1 200
000
2nd 1971-1980 300 - 450 16 000 - 24 17 000 - 25 2 300 - 3 300
000 000
3rd 1981 -1984 460 - 770 25 000 - 30 25 000 - 30 3 800 - 4 500
000 000
4th 1984 -1998 1070 - 2200 30 000 - 53 30 000 - 40 3 800 - 5 000
000 000
5th 1999 -2005 2290 -3050 35 000 - 53 35 000 - 40 5 000 - 8 000
000 000
6th 2006 - 3050 - 3600 40 000 - 60 45 000 - 55 7 000 - 8 500
000 000

10
First Generation rigs (1960’s)
According to Chakrabarti, (2005) semi-submersibles consists of a wide variety of configurations. They
were developed all through the 1960s and were limited to water depths less than 250 metres. (Kaiser et
al., 2013). The first rig of this kind (Bluewater 1) was used in 1961 by Shell Oil Company. Notable
designs include the SEDCO 135 designs and the ODECO designs. The first generation submersibles
became non-competitive as a result of lack of technology exchange of its designs, and lack of under-
standing of the vital principles of its designs (Chakrabarti, 2005). An example of this type of semi-
submersible can be seen in Appendix A-1.

Second Generation (1971-1980)

The second-generation semi-submersibles have more technology exchange than the first (i.e., better
mooring and subsea equipment). As drill ships became a major competitor, designers sorted out ways
to make the semi-submersible more attractive. A major characteristic of the second-generation rig is
the twin pontoon configuration, which enhances mobility (Chakrabarti, 2005). It was built for deep wa-
ter up to 450m depth. Popular designs of the second-generation rig include; SEDCO 700, Aker H-3.0
and Friede and Goldman Pacesetter class (Kaiser et al., 2013). A typical example of this rig generation
is the Essar Wildcat, Aker H-3.0 rig shown in figure A-2.

Third Generation (1981 -1984)

The third generation semi-submersibles was developed in the early 1980s. The platform operates on
waters up to 770 m deep. There was a major paradigm shift in the design of semi-submersibles because
of the Alexander Kielland and Ocean Ranger accidents (Chakrabarti, 2005). Emphasis were made on
higher standards of structural redundancy and payload. Generally, the main characteristics of the third
generation semi-submersibles include: increase in rig size, use of hull type structure, twin pontoon form
continuation, and properly designed brace connection. An example of this generation rig is the Ocean
Patriot, built in 1983 (See figure A-3)

Fourth Generation (1984 -1998)

There were few fourth generation semi-submersibles built in this period. This was because of the re-
duced demand for drilling driven by very low price in oil (Kaiser et al., 2013). Notable designs include;
the GVA 4500s, Zane Barnes and the Henry Goodrich. The fourth generation rigs are able to operate in
harsh environmental conditions and waters up to 2200m. Its main characteristics are the elimination of
bracings and reliance of its hull-type superstructure. With the elimination of the bracings, accompanying
problems that comes with bracings were also eliminated. This include; fatigue potential and maintenance
problems (Chakrabarti, 2005).

Fifth Generation (1999 -2005)

The fifth generation semi-submersibles were constructed because of the demand of deeper water explo-
rations. Although, its displacement is approximately the same as the fourth generation rigs there are
some significant improvements on the unit’s capability to go into deeper water and drill deeper as shown
in table 1. This is due to its dynamic positioning (Kaiser et al., 2013). Significant performance was
achieved as the drill floor systems, vessel management, power management, BOP controls and dynamic
positioning, are not only integrated but also computer controlled. Fifth generation units typically have
redundant dynamic positioning, automated pipe handling and powerful mud systems (Kaiser et al.,
2013). An example of this generation rig is the Leiv Eiriksson (See figure A-5)

Sixth Generation (2006)

Rigs of this generation are rigs developed after 2005. As oil prices increased, demands to explore in new
locations and also drill in deeper wells increased (Kaiser et al., 2013). The sixth generation have the

11
 capacity to operate in deep waters of more than 3000m. The rigs are also capable of operating in harsh
environments including the Barents Sea, North Atlantic and calmer areas (e.g., West Africa) (Haug et
al., 2009). The rig is winterized with heat tracing and cladded derrick in its base and can operate in
warmer climate by means of chilled water units and an air-conditioned system. A typical example is the
Transocean Spitsbergen, Aker H-6e design as shown in figure A-6.

2.2 DESCRIPTION OF THE SEMI-SUBMERSIBLE RIG

As stated earlier, there has been an increase in demand for floating type offshore units, as a result of oil
and gas exploration in deep seas. The semi-submersible type unit is widely preferred because of its,
large riser holding space, good seakeeping capability, large topside space and easy offshore installation
(Park et al., 2015)

Figure 2-1: A semi-submersible rig. Source: ABB, n.d

Figure 2-1 presents a semi-submersible rig consisting of several systems. The topside is situated above
the columns and is made up of living quarters, drilling derrick, drilling deck and operation equipment.
The columns are usually made up of four or eight legs. These columns support the top side and provides
adequate air gap between the deck and the water. Also, the columns are used for ballasting, as well as
store bulk loads including fuel and drilling mud. The number of legs the column has is dependent on the
required variable deck load capacity and stability. The units are usually designed with either a ring
pontoon or two pontoons, which connects the columns. The pontoon provides the rig with the required
buoyancy (Sharma et al., 2010). The hull is used for storing fuel, mud and ballast water. A brace is
usually used to fortify the columns and pontoons to enhance the unit’s structural integrity.

Generally, when designing the semi-submersible rig, the following must considered. This includes
(Chakrabarti, 2005);
• Intact and damage stability
• Weights and central of gravities
• Tank capacities
• Current Forces
• Wind Forces (i.e., mooring and stability loads)

12
 • Performance of Ballast system
• Motions (i.e., drift and low frequency mooring loads)
• Fatigue
• Global Strength

It is also important to note that three configurations must be considered when designing the draft. These
include; the operational, survival and transit draft. The draft is at the maximum magnitude during oper-
ation. This ensures that the pontoons are subjected to low pressure variation, hence favorable motions
required during operations is achieved. In the case of extreme weather, the rig will stop operation and
deballast. This will increase the air gap from the water surface to the rig thereby, preventing the waves
from slamming into the deck. In addition, the water plane area will provide the rig with the necessary
stability during transit.
Generally, for floating production installations and mobile units, stability loss is caused either by a single
failure or by a combination of different causes. Vinnem, (2013) listed some of these causes, they include;
• Operational failure of ballast systems.
• Failure of ballast system components, including valves and pumps
• Human error by filling of buoyance volumes, water filling of volumes on the deck or malopera-
tion of internal water sources, including fire water and water tanks
• Filling of buoyancy volumes due to the ingress of water caused by collision impact
• Filling of buoyancy volumes due to errors in design or construction
• Large weight displacement on deck
• Loss of weights as a result of anchor line failure or failures in the anchor line brake

2.3 RISK ASSESSMENT

2.3.1 Previous studies of ballast system failure
Generally, the ballast system is essential in performing tasks relating to operability and survivability of
a rig. The design of the ballast system commenced with just a few pumps, few tanks and a simple man-
ifold system (Sname, 1989). The deeper semi-submersibles were used in offshore operations, the more
complex its system became. This meant that the platforms required additional buoyancy to be able to
take more variable loads and moorings and different geometries for improved motion characteristics
(Sname, 1989). Therefore, there was a downsize of compartmentation so as to meet the criteria for
damage stability. The amount of ballast pumps stayed the same, which increased the complexity of the
manifolds.

Very little research has been carried out within Risk assessments of Buoyancy loss (RABL). The RABL
programme was initiated as a collaborative industry project, with the purpose of developing a procedure
to define and analyse accidental conditions relating to loss of buoyancy for mobile drilling rigs (HSE,
2003). One of the projects that were looked into involved ballast systems. Following the capsize of the
semi-submersible rig, Ocean Ranger in 1982, Østby et al, (1987) carried out an RABL research. It was
primarily based on raising awareness on the assessment of the reliability of ballast system on mobile
rigs. The programme involved the development of an approach for analysing ballast system failures by
using fault trees and event trees. The project also supported the use of failure mode and effect analysis
(FMEA) in the event where hazards are identified (HSE, 2003). Generally, the RABL methodology
was overall considered to be sensitive and robust. It was recommended to be used in the assessment of

13
safety levels when designing new platforms or already built platforms subject to changes during opera-
tions (HSE, 2003)

Problems associated with risk assessment of buoyancy loss for semi-submersibles was brought further
into limelight following the accident of the P-36 semi-submersible platform on the Roncador Field in
2001. This led to the establishment of the Excellency Operational Program by the Brazilian oil company,
Petrobras (Rocha et al., 2010). The objective of the program is to establish series of tasks aimed to
improve operational reliability and safety of its rigs (Rocha et al., 2010). This resulted to a qualitative
risk assessment approach for reliability and risk analysis of the interaction between components of the
ballast systems (i.e., hydraulic and electric power systems, ballast system, and control systems) on the
platform. In 2005, the methodology became compulsory for new floating platform projects. Rocha et al.
(2010) performed a quantitative reliability study based on the qualitative studies (i.e., fault tree analysis
and FMECA). They recommended that the control system, which has components with the least relia-
bility, should be subjected to safety integrity level analysis as seen in IEC 61511 standard (norskeoljeog-
gass, 2004).

Nilsen (2005), surveyed on the recent Quantitative Risk Assessment (QRA) studies in the Norwegian
continental shelf relating to stability of floating production and mobile units. He concluded that, the
recent studies are unsuitable to identify possible risk reducing measures and are not suitable to quantify
how such measures affects the risk levels. Other deficiencies in the QRA studies include (Vinnem,
2013): Lack of modelling of accident scenarios; Some failure mechanisms such as operator error during
ballasting, are not considered; As opposed to PSA regulations, assumptions simplifications and premises
are not addressed; and presentation results are usually not traceable hence worthless in terms of trans-
parency. This is so because it fails to completely document the underlying assumptions and limitations.

Lotsberg et al., (2004) adopted an alternative to approach the QRA. This approach presented in figure
2-2 was used in the Kristin field. Comparing to the traditional QRA approaches, this approach is some-
what of an improvement (Vinnem, 2013). It involves using historical data to establish probability of
failure of platforms, establishing risk influencing parameters and calculating a weighted grade on the
operating parameters of the platform. However, the drawback of this approach is its inability to identify
risk reducing measures and the associating risk of the risk reducing measures (Vinnem, 2013).

Vinnem et al., (2006) proposed an analytical approach as an alternative to the traditional QRA adapted
from Haugen (2005). This approach was aimed to make up for the lapses in the both the traditional QRA
methodologies and the failure frequency assessment approach. The studies addressed possible occur-
rence of some conditions during, for example, inspection and maintenance when opening manholes or
when systems are deactivated (Vinnem, 2013). Figure 2-3 presents an analytical schematic of this ap-
proach. The analysis starts with collection of experience data and is followed up with hazard identifica-
tion (HAZID). Hazard identification is carried out to identify scenarios that have the tendency

14
 Figure 2-2: Failurefrequency assessment approach based on gross errors. Source; Lotsberg et al.
(2004); Vinnem (2013)

to lead to critical consequences with respect to failures and effects of operational error (Vinnem, 2013).
After the hazard identification process is established, a detailed analysis is carried out. The starting point
of the detailed analysis could involve a Failure Mode effect and Critical Analysis (FMECA), fault trees
and event trees. In the case of ballast related issues, Vinnem, (2013) suggested that a detailed analysis
should involve critical scenarios limited to or influenced by marine systems.

Another important reason the analytical approach is recommended is because it reduces risk level by
providing detailed information on the identification of the system modification and operational changes
(Vinnem, 2013). This is a vital requirement in the management regulations (PSA, 2011b). Risk reducing
measures is also an important step in the ALARP (As Low as Reasonably Practicable) process, which
is used in the UK and Norwegian regulation. The ALARP principle states that “a risk reducing measure
must be implemented; unless it can be shown that the cost is grossly disproportionate to the benefits”
(Aven, 2008). Vinnem, (2013) concluded that, in addition to the described RABL approach, the follow-
ing approach should be implemented;
• Fault tree analysis should be performed for the most critical nodes in the event tree
• Fault tree analysis should contain human and organizational errors where relevant
• Common mode failures and dependencies should be included in the fault tree analysis

15
 Figure 2-3: Analytical process for marine systems. Source; Vinnem (2013)

2.4 REGULATIONS
Regulatory requirements discussed in this section are requirements relating to vulnerability and reliabil-
ity analysis and also risk related to loss of buoyancy and stability. Standards and requirements are avail-
able for design of floating units and ballast systems. The requirements for risk analysis of these systems
is not straightforward (Vinnem, 2013).

Stability of floating facilities and ballast systems are regulated in two ways, the Norwegian Maritime
Authority (NMA) and the Petroleum Safety Authority (PSA). NMA is a Norwegian government agency
whose main job is to ensure that Norwegian shipping companies and ships meet required safety and
required standards (Sjøfartsdirektoratet, n.d). The NMA also ensures that personnel have required qual-
ifications and also work and live in good conditions. The NMA works hand in hand with the PSA to
assist on issues concerning petroleum activities (PSA, 2011b). Petroleum Safety Authority (PSA) is the
regulatory authority responsible for operational and technical safety in the Norwegian Continental Shelf
(PSA, 2011b). This means that all floating facilities that carries out any kind of petroleum activity must
comply to the PSA’s regulation.

16
The PSA’s Regulations on stability and ballast systems can be found in section 39 and section 62 in
PSA (2011b). It also refers to the regulation and requirements issued by the (NMA). The PSA classifies
ballast function on a floating facility as a safety function. The following are the main stability and
ballast systems’ regulations by the PSA and NMA.

NMA REGULATIONS
The main NMA regulations regarding stability and ballast systems include (Sjøfartsdirektoratet, n.d);
• Regulation 20 December 1991 No. 878 concerning stability, watertight subdivision and water-
tight/weathertight closing means on mobile offshore units
This regulation is presented under the PSA regulation Section 62 (Stability)
• Regulation 20 December 1991 No. 879 concerning ballast systems on mobile offshore units

This regulation is presented under the PSA regulation Section 39 (Ballast system)

PSA Regulations

For floating facilities, PSA regulates ballast systems and stability in section 39 and 62. (PSA, 2011a).

Section 39 Ballast system

Floating facilities shall be equipped with a system that can ballast any ballast tank under normal oper-
ational conditions. In the event of unintended flooding of any space adjacent to the sea, it shall never-
theless be possible to ballast. Ballast systems shall be in accordance with Section 2 and Sections 7
through 22 of the Norwegian Maritime Directorate’s Regulations relating to ballast systems on mobile
facilities

Section 62 Stability
Floating facilities shall be in accordance with the requirements in Sections 8 through 51 of the Norwe-
gian Maritime Directorate’s Regulations relating to stability, watertight subdivision and water-
tight/weathertight closing mechanisms on mobile offshore facilities (in Norwegian only). There shall be
weight control systems on floating facilities, which ensure that the weight, weight distribution and centre
of gravity are within the design specifications. Equipment and structure sections shall be secured
against displacement that can influence stability.

The unit`s survivability is included in the “main support structure” phrase under the facility regulation
(Vinnem, 2013). Section 8 is defined as the safety function, relating to the unit`s performance require-
ment.

Section 8 Safety functions

Facilities shall be equipped with necessary safety functions that can at all times (a) detect abnormal
conditions, (b) prevent abnormal conditions from developing into hazard and accident situations, (c)
limit the damage caused by accidents. Requirements shall be stipulated for the performance of safety
functions. The status of safety functions shall be available in the central control room.

17
3. METHODOLOGY
This chapter aims to describe methods used in achieving the objective of the thesis. A similar approach
to the analytical method recommended by Vinnem (2013) was adopted. However, the main difference
is that, the basis of this thesis is on qualitative risk assessment and not on quantitative risk assessment.

Hazard identification was carried out by using both failure mode and effect analysis, FMECA and the
standard what-if analysis, SWIFT. The FMECA was adopted to systematically analyse all possible fail-
ure modes and its direct reflection on the performance of the ballast system. In addition, the SWIFT was
used to compensate for the unidentified hazards in the FMECA (i.e., human related errors). The proce-
dure used to understand the failure, modes and criticality of the ballast system include;
• The ballast system was defined by its system boundaries, functions and, environmental and
operational conditions
• Information about the description of the ballast system was acquired mainly from (Hock and
Balaban, 1984) and (Hancock 1996)
• Available information was collected from data sources including; RABL datasheet, OREDA
and RNNP
• A brainstorming section was carried out by me and some friends in the engineering department
to identify failure modes of the components (FMECA) as well as risk that involves human error
(SWIFT)
• A generic checklist from HSE (2001) was used to determine identify possible hazard in the
SWIFT
• The risk relating to the failure modes were presented by an alternative to the risk matrix that is
the Risk priority number (RPN). The RPN was determined by multiplying together the severity
(S), occurrence (O) and detectability (D) of the failure modes. Numbers were subjectively as-
signed to the S, O, D based on my degree of knowledge of the components.

A fault tree was used to determine failure causes of the most critical component (i.e., from the FMECA)
of the ballast system as well scenarios that lead to failure. The relationship between the causes and
effects of the top event identified.

A barrier analysis was carried out to determine how to prevent, control and mitigate the effects of ballast
failure. Five selected past incidents were selected and were subjected to a comprehensive barrier analy-
sis. Two out of the five incidents led to accidents. Information about the cases was retrieved by reading
academic papers, books and relevant internet sources. The barriers were divided into; barrier functions,
Barrier elements, risk influencing factors of the barriers and their performance requirements. Analysis
was then made on the similarities and differences of the events.

Finally, calculations were made on a semi-submersible platform. This was carried out to determine how
variations in ballast water could affect the intact stability of a semi-submersible. This illustrates further
the impact of ballast failure, for instance in a case where there is pump failure and water cannot be
pumped in or out of the tanks or when there are leakages due to structural damage. Numbers were
assigned on the dimensions and geometry of the rig. Throughout the calculations, some assumptions
and simplifications were made. The main assumptions are as follows;
• The semi-submersible is under operation
• There are usually some differences in layout and structural arrangement between the columns.
• In order to simplify the problem, there are four columns and all the columns are assumed to be
identical and circular in cross section.

18
• The reference semi-submersible has two perimeter pontoons
• Pontoons are below the water line during operation
• The pontoons are rectangular in cross-sections
• The pontoons are filled with 90 % of ballast water

19
4. BALLAST SYSTEM FAILURE
The draft and heel trim of the vessel is designed to be controlled by the ballast system. In a semi-sub-
mersible unit, the lower section of the hull (pontoons) and the lower section of the columns can be filled
with sea water and also emptied so as to be able to submerge the vessel (Hancox, 1996). Typically, there
should be a consistent change in trim monitoring and motion of the ballast water, due to the change in
loading conditions in terms of consumables, materials and liquids.
This chapter describes the ballast system, based on its main components and functions that are important
during operations. There is also a description of nine past incidents of semi-submersible rigs. These
incidents were because of improper handling and/or failure of the ballast system.

4.1 BALLAST SYSTEM AND FUNCTIONS

As mentioned already, controlling the drift and trim of the semi-submersible is the primary function of
the ballast system. In the semi-submersibles, the small water plane area makes it sensitive when there is
added weight (Chakrabarti, 2005).
Tinmannsvik et al. (2011), points out that, a 2% mass increase of a semi-submersible will cause about
1m submersion. It is important to note that the semi-submersible stability is also influenced by few other
related systems. These systems include, sprinkler/deluge systems, water machinery cooling water, bilge
water handling, and fresh water and fuel supply from lower hull storage to upper deck tanks that are
ready to use. All these systems affect the stability of the semi-submersible (Hancox 1996). The ballast
control room is where these systems are controlled. The ballast control operators are also charged with
the supervision of these systems (Hancox 1996).
The subsystems of the ballast system include (Moen, 2012):

• Ballast Tank Configuration

• Pumps, Pipes and Valves
• Electric Power Systems
• Hydraulic Power Systems
• Ballast Control Systems

The Ballast Tanks

Typically, the ballast tanks are placed in the lower columns and hull, and is placed symmetrically within
each of the hulls (Hancox, 1996). Even load distribution remains the reason for the symmetric place-
ment. The distribution is done to avoid build-up of bending moments and to avoid shear forces, and also
to evenly trim the vessel. The tanks are usually segmented into small volumes, instead of large and less
complex designs, to prevent the free surface effect. Risks from a damaged perspective are also mini-
mized by smaller tanks. In the case of accidental flooding, subdividing the tanks minimizes trimming
and heeling of levers. (Hancox, 1996).
Pipes
A ballast tank is connected to the piping manifold by a tank line, which serves to empty or fill that tank
(Hock and Balaban, 1984). The pipe and valve systems connects the ballast tanks to the pumps. Figure
4-1 presents a typical schematic of piping in a ballast system.

20
 Figure 4-1: Typical schematic of piping in a ballast system. Source; (Hock and Balaban, 1984)

The manifold connects the sea chest by the use of remotely operated valves. The system is also fitted
with a crossover pipe and valve in order to allow ballast water to be taken or discharged from the sea
chests. Regulations demand that there should be separate connections for the sea chests’ fire and cooling
water system and that of the ballast system (Hock and Balaban, 1984). During design of the piping
system, the designer must consider net positive suction head (NPSH) of pumps and to make allowances
to recover the rig from a 15 degree inclination (Hock and Balaban, 1984).

Pumps
The manifold is connected to the ballast system sea chest and the pumps. The ballast pumps are used by
the piping system to ballast and cool water and also to ballast and run the emergency bilge. These pumps
are usually large centrifugal pumps. They use both supplementary instruments and controls, to allow
their functions and performance to be controlled and monitored in the control room (Hock and Balaban,
1984)

Valves
The valves operated remotely in the ballast piping system include butterfly valves, sea chest valves etc.
The valves are powered by either hydraulic, electric or pneumatic means. Irrespective of the type of
power used, some of the valves needs to incorporate failsafe operation to the valve system (Hock and
Balaban, 1984). Energy could be stored in the hydraulic accumulators to move valves to its failsafe
positions in the event there is loss of control signal to the valve. Figure 4-2 presents a typical schematic
of a hydraulic ballast valve system.

21
Figure 4-2: Typical schematic of a hydraulic ballast valve system. Source; (Hock and Balaban, 1984)

Multiple accumulators and check valves divide the valve system. This is done to avoid that a failure in
one part of the system would affect the failsafe operation in other parts. When designing Ballast valves
the designer must also consider the valves to be manually operable. Crewmembers are able to operate
valves manually by the use of lever arms or by a de-elutchable gearbox. This means that the valve stem
must always be visible at the valve during remote and manual operations (Hock and Balaban, 1984).
Therefore, positioning of the valve stem is very important.

Electric Power System

The electric power is used to power the ballast system. The electric power system is made up of the
uninterrupted power supply (UPS), the main power supply and the emergency backup generator (Moen,
2012). The UPS consists of batteries that are stored charged from the electrical system, an inverter to
convert the battery and an electronic switching system that switches from normal to battery power in
the case of electric power loss (Hock and Balaban, 1984).
Hydraulic Power Systems
This system consists of a hydraulic accumulator and a hydraulic power unit. In the ballast system, hy-
draulic power is used to operate the valves (Hock and Balaban, 1984). During operations, the hydraulic
power system is continuously pressurized by use of electrical power or hydraulic power generator, so
as to ensure that there is consistent pressure. However, in the event of power failure, the hydraulic ac-
cumulator automatically provides the required pressure for operation of the ballast valves (Hock and
Balaban, 1984)

Ballast Control System

The ballast control system is usually located in the main control room area or in the bridge. The system
can be operated both automatically and manually. The automated operation of the ballast system in-
volves the use of computers to operate and monitor the stability of the system (Hancox, 1996). Instru-
ments that indicated the tank levels, pump inlet and discharge pressure, hydraulic system pressure and

22
 vessel draft are included in the ballast control panel (Hock and Balaban, 1984). Close supervision of the
ballast control system is required to monitor both the ballast level and weight distribution when there is
a necessity of manual intervention.
4.2 DESCRIPTION OF SOME PAST INCIDENTS AND ACCIDENTS CAUSED BY BALLAST
FAILURE
To prevent near misses and accidents in the future, it is important to acquire information of past events
for studies. Such information could be found in journals, investigation reports, newspapers etc. Some
loss of stability incidents and accidents are not reported, or lack full information about events leading
to the accidents (PSA, 2011c). An example of this issue can be seen in the case of Ocean Developer
incident which was under tow from Port Gentil, Gabon to Cape Town when it sank. Detailed information
about this incident is difficult to find. The downside to this problem is that detailed studies cannot be
carried out to know how and why it happened, especially for peculiar cases. This may be the reason why
damage frequency on vessels have not improved over the years (Kvitrud, 2013).

This section contains a description of some accidents that relates to loss of stability and buoyancy of
semi-submersibles, with the purpose to give insight on the causes of the accidents. The incidents and
accidents are a basis for the establishment of barrier analysis in Appendix B. These accidents are con-
sidered to fall into the DFU8 (i.e., incidents that relates to damage to platform structure, stability, an-
choring and positioning fault) category in the RNNP (2015), report. However other Defined Situation
of Hazard (DFU) categories that are important indicators for loss of stability such as DFU7 (Collision
with field-related vessel/facility/shuttle tanker) are not considered for this thesis.

4.2.1 Henrik Ibsen

Brief Description of the rig: Henrik Ibsen a sister rig to Alexander Kielland was owned by Stavanger
drilling company. Its main purpose was to serve as a living quarters at Ekofisk field, accommodating
about 200 workers (Kulturminne-Ekofisk, n.d). The rig owner A. Gowart-Olsen leased the unit to Philips
Petroleum Company. In 1979, they decided to convert the unit into a 600 bed accommodation unit. On
March 26, 1980, the rig was towed to Tananger to switch place with Alexander Kielland which was due
for major reconstruction and maintenance.

Figure 4-3: The drilling rig Henrik Ibsen. Source; Teknisk Ukeblad (n.d)

23
 Although there is little information on Henrik Ibsen, however it is assumed to have the same dimen-
sions as the Alexander Kielland (i.e., its sister rig, The ledger, 1980).

Table 4-1; Principal dimensions, Henrik Ibsen: Source; Naess et al., (1982)
Length 103m
Width 99m
Height 40.5 m to main deck
Available Deck Area: 3 X 20m x 17m (1020 m2) decks and 200 m2 additional area
Pontoons 5 x 22m diameter pontoons
Columns: 5 x 8.5m diameter columns
Weight 10105 t

Brief Description of Accident: On April, exactly 10 days after Alexander Kielland accident, Henrik
Ibsen developed a 20 degrees list. The cause of the initiating event was attributed to human error.
Maintenance work was carried on the rig’s bracings. It was difficult for the workers to reach the lower
bracings and they asked if one of the columns could be trimmed. Ballast water was then pumped into
one column. A communication gap led to opened hatches in the column that was pumped with water,
hence an ingress of water into the platform (Kulturminne-Ekofisk, 2014). All 57 crewmembers were
evacuated.

4.2.2 Ocean Ranger

Brief Description of the rig: The Ocean Ranger was a semi-submersible Mobil Offshore Drilling Unit
(MODU) (Sobena, 2007). The unit was designed by the Ocean Drilling Exploration Company (ODECO
Coporation), and built by Mitsubishi Heavy Industries in Hiroshima (Sobena, 2007). As at the time the
vessel was built, it received a lot of attention because it was the largest available MODU. It had the
capacity to operate beneath waters of 1,500 ft and drill as deep as 25,000 ft (Newyork Times, 1982).

Figure 4-4: The drilling rig Ocean Ranger. Source; Moan, (2005)

24
 Table 4-2;Principal dimensions, Ocean Ranger: Source; USCG, (1982), Songa Offshore, (n.d)

Length 122m
Width 80m
Height 41 m to main deck
Available Deck Area: 3 x 20m x 17m (1020 m2) pipe decks and 200 m2 additional lay down
area
Pontoons 2 x 122m pontoons
Columns: 4 x 6 m diameter and 4 stabilizing columns of 5.2 m diameter
Operating Displacement 43,521 mt

Brief Description of Accident: On 15 February 1982, while drilling an exploration well off Newfound-
land in Canadian waters, the unit capsized (Vinnem, 2013). All 84 crew members on board when it sank
all died (PTIL, 2003). The initiating cause was as a result of two portholes that were broken in the ballast
control room, caused by wave impact during a storm (Sobena, 2007). The ballasting of the unit was
achieved by a number of components in the ballast control system located in a column, 8.5 metres above
the mean water line (Sobena, 2007). The control room comprised of an auxiliary manual control board
and electrical control board. Gauges were in place to monitor structure movements in water and also
portholes to enable the operator to see shifts in depth (Sobena, 2007).

4.2.3 Petrobras P-36

Brief Description of the rig: Petrobras p-36 was a floating production platform operating on the
Roncador Field 125 km off the coast of Brazil (Sobena, 2007). Prior to that, In 1995, the 33,000 tonnes
vessel was built at Fincantieri Italy as a semi-submersible drilling rig (Mogensen, 2006). It was later
converted into a floating production platform from 1997 to 1999. At that time, it was the world’s largest
oil production unit (Sobena, 2007). It had the capacity to operate in deep water up to 1360m (Mogensen,
2006).

Figure 4-5: The drilling rig Petrobras P-36. Source; NASA, (2008)

25
 Table 4-3: Principal dimensions Petrobras P-36: Mace, (n.d)

Length: 112.8m
Width: 77m
Height: 119.1m
Operating Displacement: 34,600 tonnes

Brief Description of Accident: On March 20, 2001 Petrobas P-36 capsized and sank after two explo-
sions in the aft starboard column (Sobena, 2007). At the time of the explosions, 175 people were on the
rig and 11 of them died. The unit developed a 16 degrees list, which was enough to allow flooding from
the submerged fairlead boxes (Sobena, 2007). Although the rig’s sinking was attributed to a combination
of several factors however, the initial explosion was as a result of misalignment of the emergency drain
tank to the production heater (Sobena, 2007).

4.2.4 BP Thunder Horse

Brief Description of Rig: The Thunder Horse semi-submersible rig was discovered in July 1999. The
unit is owned and operated by both BP and Exxon Mobil. Thunderhorse is presently one of the largest
deep-water producing fields in the Gulf of Mexico (BP, 2013). The rig consists of Production and Drill-
ing facility with Quarters (PDQ). It has capacity to produce 250,000 barrels of oil per day and 200
mmscfd of gas.
On 11 July 2005, after the event of Hurricane Dennis had subsided, some of the rig’s personnel who
was earlier evacuated returned to the facility and found the rig wit about a 20 degrees list (PTIL, 2006).
The top deck was in the water on the portside.

Figure 4-6: The drilling rig BP Thunderhorse. Source; Lyall, (2010)

Table 4-4: Principal dimensions, BP Thunderhorse: Source: ABS (n.d); BP (n.d)

Length: 110.08m
Width: 104.96m
Height: 57.5m
Available Deck Area: Length: 112 m, Breadth : 136 m
Pontoon: Height: 11.5 m
Columns: 2 @ 22 x 26 m.; 2 @ 22 x 23 m by 36 m. height
Hull Displacement: 129,000 metric tons

26
 Brief Description of Accident: The cause of the incident was as a result of failure associated with the
hydraulic control system and its isolation during the hurricane evacuation (SINTEF, 2011). This resulted
to partial opening of the vessel, hydraulically actuated valves in the ballast and bilge systems (SINTEF,
2011). In addition, there were multiple cable transits (MCTs) failures in the bulkhead that were seen
during assessment of the hull (SINTEF, 2011) Other problems included a bad welding job that left the
underwater pipelines full of cracks (Lyall, 2010).

4.2.5 Aban Pearl

Brief Description of Rig: Aban Pearl is a semi-submersible drilling rig designed by Aker H-3 (Aban,
n.d). It was constructed by Keppel Corporation, Singapore in 1977. The rig unit was bought for US$211
million by the Indian drilling company Aban Offshore (SINTEF, 2011). It could operate in water up to
380 m and drilling depth of about 7620 m.

Figure 4-7: The drilling rig Aban Pearl. Source; Tinmannsvik, (2011)

Table 4-5: Principal dimensions, Aban Pearl: Source: Aban (n.d)

Length: 108 m
Width: 67.36 m
Height: 36.6 m
Operating displacement 36470 tonnes
Brief Description of Accident: On May 2010 an incident occurred. The semi-submersible gas produc-
tion platform sank when drilling at the Dragon 6 gas field off eastern Sucre state, Venezuela. According
to SINTEF (2011), the initiating event was because of an uncontrolled intake of water more that the
ballast pumps could handle. The port pontoon received water in heavy seas of about 3.7 kilometers,
south-west of Point Baline. The rig then lost its stability and sunk. There were no casualties all 95 crew-
members were evacuated.

4.2.6 Scarabeo 8
Brief Description of the rig:
Scarabeo 8 is a 6th generation semi-submersible drilling rig operated and
owned by Saipem (Saipem, n.d). It is designed by Moss Maritime. This unit is capable to operate in

27
 deep water of up to 10,000 ft (3,000 m) and its drilling depth capability is up to Up to 35,000 ft (10,660
m) (Saipem, n.d). In addition, the rig is suitable for harsh environment as it can operate in: minimum air
temperature of - 20°C and maximum of + 45°C; and minimum water temperature of 0°C and maximum
of + 32° (Saipem, n.d).

Figure 4-8: The drilling rig Scarabeo 8. Source; OFFSHOREENERGYTODAY, (2012b)

Table 4-6: Principal dimensions, Scarabeo 8: Source; Saipem, (n.d)

Length: 118.65 m
Width: 72.72m
Height: 57.15 m to drill floor
Available Deck Area: Length: 83.20 m, Breadth : 72.72 m, Draught at operation: 23.50 m
Pontoons: Length: 118.56 m, Breadth : 15.73 m, Depth: 10.15 m
Columns: 4 connected to upper hull
Operating Displacement: 35,304 mt
Brief Description of Accident: On 4 September 2012, the drilling rig was reported to have a list of
seven degrees during drilling (PSA, 2013). Although the seven degrees list was not initially life threat-
ening, it became so because of improper handling of the ballast system (PSA, 2013). However, there
was no casualties related to the incident.

4.2.7 Floatel Superior

Brief Description of rig: Floatel Superior is a semi-submersible drilling rig with living-quarters and
topside storage support (Ptil, 2012). The unit is owned and operated by Floatel International AB of
Gothenburg (Ptil, 2012). It was designed and built by Keppel FELS in Singapore. The rig is suitable for
harsh environments such as the North Sea. It could operate in water of about 360 m to 420 deep (PSA,
2015).

28
 Figure 4-9: The drilling rig Floatel Superior. Source;OFFSHOREENERGYTODAY, (2012b

Table 4-7: Principal dimensions, Floatel Superior: Source: ABS (n.d); DNV (n.d)

Length: 94m
Width: 91m
Height: 57.5
Available Deck Area: Length: 112 m, Breadth : 136 m
Pontoon Length: 90 m, Breadth : 64.4 m

Operating displacement 29 179 Mt

Brief Description of Accident: Based on the incident report by Ptil, (2012), on November 6th and 7th,
Floatel Superior was damaged in its hull from an unsecured anchor. This led to the entrance of water
into two tanks and causing about a 5.8 degrees list. As at the time of the incident, the rig was lying on
the Njord field in the North Sea. The Petroleum Safety Authority Norway (PSA) concluded that the
damage, which led to the unsecured anchor, had developed over some couple of months. There were
several warning signs, which were unattended. During the time of the incident, 374 people where on-
board. No casualties were reported as 334 people were evacuated to other nearby installations by a
helicopter.

4.2.8 Island Innovator

Brief Description of rig: Island Innovator is a semi-submersible drilling rig owned by Maracc ASA
(Islanddrilling, n.d). Presently, Odfjell Drilling provides drilling services and project management un-
der an agreement with Maracc ASA. This unit is capable to operate in water of up to 600 m and drill-
ing depth of about 8000 m) (Islanddrilling, n.d). In addition, the rig is suitable for harsh environment
as it can operate at minimum air temperature of - 20°C and maximum of + 35°C

29
 Figure 4-10:The drilling rig Island Innovator. Source; Offshoreenergytoday, (2013)

Table 4-8: Principal dimensions, Island Innovator: Source: Islanddrilling (n.d)

Length: 104.5 m
Width: 65 m
Height: 57.5
Available Deck Area: Length: 81 m, Breadth : 65 m
Pontoon: 13 m x 9,75 m (h) (1,3 m radius)

Columns 4 of 13 m x 13 m (1,3 m radius)

Operating displacement 38 040 t

Brief Description of Accident: An incident occurred in May 2013. The rig was docked at Hanøytangen
yard outskirts of Bergen where it was undergoing some operational modifications (Offshoreenergyto-
day, 2013). There was an inflow of water and the rig began to tilt. The leak was because of seawater
inlet to a pump room in a pontoon, which was supposed to flow to the ballast tanks (Offshoreenergyto-
day, 2013). An incident report by Maracc (n.d) state that “the leakage seems to be due to failure on
equipment used by sub-contractors, and not related to the rig itself “. As at the time of the incident, out
of the 100 personnel who were on-board the unit, one worker was slightly injured (Maracc n.d)

4.2.9 Ocean Developer

Brief Description of Accident: It is important to note that, there is generally lack of information for
this accident. On 14 August 1995 the ocean developer was under tow from Port Gentil, Gabon to Cape
Town when it sank (Vinnem et al, 2006). It sank at about 3600 metres deep off West Africa, close to
Cabinda in Northern Angola (Vinnem, 2006).
All 24 crewmembers during the time of the accident survived. The initiating event was assumed to be
operation of the ballast system by an inexperienced personnel (Vinnem, 2006)

30
Table 4-9: Summary of initiating causes of the above incidents due to ballast failure

Rig, Year Initiating events

Henrik Ibsen, The cause of the initiating event was attributed to human error. Mainte-
1980 nance work was carried on the rig’s bracings. A communication gap led
to opened hatches in the column that was pumped with water, hence an
ingress of water into the platform (Kulturminne-Ekofisk, 2014)
Ocean Ranger, The initiating event was as a result of two portholes that were broken out
1982 in the ballast control room. This was caused by wave impact during a
storm (Vinnem, 2006)
Ocean Developer, The cause of the initiating event was due to operation of the ballast system
1995 by an inexperienced person. The operator was said to have “pushed the
wrong button” which led to series of events that resulted to the rig sinking
P-36, 2001 A ruptured emergency drain tank in a column initiated an explosion that
damaged a fire water pipe and caused water ingress into the watertight
compartments, thruster rooms, pump rooms and killed 11 personnel (Vin-
nem, 2013)
Thunder Horse, The cause of the incident was as a result of failure associated with the
2005 hydraulic control system and its isolation during the hurricane evacuation
(SINTEF, 2011). This caused the ballast and bilge system to open, hence
ingress of water.
Aban Pearl, 2010 The initiating event was as a result of an uncontrolled intake of water
more that the ballast pumps could handle. The port pontoon received
water in heavy seas of about 3.7 kilometers, south-west of Point Baline.
Scarabeo 8, 2012 The initiating event was due to operator error. The inexperienced duty
control room operator (COOP) unintentionally opened the aft sea chest
valve and ballast tank valve, which allowed ingress of water to the bal-
last tanks.
Floatel Superior, According to Ptil, (2012b) the damage, which led to an unsecured an-
2012 chor, had developed over some couple of months. There were several
warning signs, which were unattended. The unsecured anchor created
hole in the hull, which permitted ingress of water into the two tanks.
Island Innovator, The rig developed a leak. This was as a result of seawater ingress to a
2013 pump room in a pontoon, which was supposed to flow to the ballast
tanks. This led to the rig developing a 4 degrees list (Offshoreenergyto-
day, 2013).

31
5. STABILITY OF SEMI-SUBMERSIBLE PLATFORMS
Semi-submersibles are susceptible to loss of buoyancy and stability in several ways. They include col-
lisions, asymmetric load of ballast, explosions, falling objects, fire and explosion, extreme environmen-
tal loads, inadequate strength and accidental moveable weight (HSE, 2003). However, this thesis is
limited to ballast failures.

Ballasting has significant impact on the stability of a vessel and therefore it is important to consider
ballast operations in the stability calculations. This chapter is divided into three sections. The first sec-
tion discusses freeboard and draft of a semi-submersible rig the second section describes the methodol-
ogy of stability calculations carried out in appendix B. In section 5.3, involves analysis on the results of
the calculation

5.1 FREEBOARD OF FLOATING STRUCTURES

This section entails equations used in the calculation of freeboard for a semi-submersible unit. Assump-
tions made include four circular columns and two pontoons that provides ballast capacity to the unit; the
pontoons are fully submerged (i.e., in operational condition)

A rigid body is considered to be in equilibrium when the resultants of forces and moments acting on it
are equal to zero (Gudmestad 2015). For a floating body, the main forces acting on it are its weight and
its buoyancy. Buoyancy can be said to be the upward force exerted by the fluid that opposes the weight
of an immersed body in water When the two forces are equal, and the centre of gravity, G, and buoyance
B, are in the same vertical line, there will be equilibrium as illustrated in Figure 5-1

Figure 5-1: Equilibrium of a floating body. Source: SNAME, (1988).

For a floating body the distance from the waterline to the deck is known as the freeboard. The freeboard
is important in determining the operability of a vessel. The formula for the freeboard could be written
as;

𝑓𝑓 = ℎ − 𝑑𝑑 (5.1-1)

Where

𝐹𝐹 The freeboard of the vessel (m)

32
ℎ The height of the vessel (m)

𝑑𝑑 The draft of the vessel (m)

In order to determine the draft of the vessel, the Archimedes principle can be adopted.

𝐹𝐹𝐵𝐵 = 𝐹𝐹𝐺𝐺 (5.1-2)

Where

𝐹𝐹𝐵𝐵 Buoyance force (N)

𝐹𝐹𝐺𝐺 Gravitational force (N)

Let ∇ be the submerged volume of the semi-submersible

𝐹𝐹𝐵𝐵 = 𝜌𝜌𝑤𝑤 ∙ ∇ ∙ 𝑔𝑔

𝐹𝐹𝐺𝐺 = 𝑚𝑚 ∙ 𝑔𝑔
Therefore,
𝜌𝜌𝑤𝑤 ∙ ∇ ∙ 𝑔𝑔 = 𝑚𝑚 ∙ 𝑔𝑔

𝑚𝑚
∇= (5.1-3)
𝜌𝜌𝑤𝑤

Where

∇ Submerged volume of the semi-submersible (𝑚𝑚 3 )

𝑚𝑚 Weight of the semi-submersible (𝑘𝑘𝑘𝑘)

𝑔𝑔 Gravitational acceleration (𝑚𝑚/𝑠𝑠 2 )

𝜌𝜌𝑤𝑤 Density of saltwater

Freeboard of the Semi-submersible

For this design, the hull structure of the semisubmersible consists of four circular columns, and two
pontoons.

In operating condition, all four columns and two pontoons are considered when calculating the draft of
the semi-submersible.

The formula for determining the total submerged part of the platform can be written as,

𝛻𝛻𝑠𝑠𝑠𝑠𝑠𝑠𝑠𝑠 = 𝛻𝛻𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 + 𝛻𝛻𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐 (5.1-4)

Where
𝛻𝛻𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 = 2(𝑙𝑙𝑝𝑝 ∙ 𝑏𝑏𝑝𝑝 ∙ ℎ𝑝𝑝 )

33
 𝜋𝜋
𝛻𝛻𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐 = 4( ∙ 𝑑𝑑𝑐𝑐2 ) hs
4

Where 𝛻𝛻𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 is the submerged volume of the pontoons, 𝛻𝛻𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐 is the submerged volume of the
circular columns, 𝑑𝑑𝑐𝑐 is the diameter of the column, 𝑙𝑙𝑝𝑝 is the length of pontoon, 𝑏𝑏𝑝𝑝 is the width of pon-
toon, ℎ𝑝𝑝 is the height of pontoon. hs is the submerged height of the columns that is, the height from the
top of the pontoons to the waterline.

Figure 5-2: Plan view of the semi-submersible

Assuming that 𝑏𝑏𝑝𝑝 = 𝑑𝑑𝑐𝑐 the formula for determining the draft of the semi-submersible ds is calculated
by inserting equation (1.1-4) to equation (1.1-3).

𝜋𝜋 𝑚𝑚
𝛻𝛻𝑠𝑠𝑠𝑠𝑠𝑠𝑠𝑠 = 2(𝑙𝑙𝑝𝑝 ∙ 𝑏𝑏𝑝𝑝 ∙ ℎ𝑝𝑝 ) + 4( ∙ 𝑑𝑑𝑐𝑐2 )ℎ𝑠𝑠 =
4 𝜌𝜌𝑤𝑤
𝑚𝑚
−(2 ∙𝑙𝑙𝑝𝑝 ∙ 𝑏𝑏𝑝𝑝 ) ℎ𝑝𝑝
ℎ𝑠𝑠 = 𝜌𝜌𝑤𝑤 (5.1-5)
𝜋𝜋∙ 𝑑𝑑𝑐𝑐2

𝑑𝑑𝑠𝑠 = ℎ𝑠𝑠 + ℎ𝑝𝑝 (5.1-6)

Therefore, the freeboard can be calculated by

34
 𝑚𝑚
−(2 ∙𝑙𝑙𝑝𝑝 ∙ 𝑏𝑏𝑝𝑝 ) ℎ𝑝𝑝
𝜌𝜌𝑤𝑤
𝐹𝐹𝐹𝐹𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒 = ℎ − 𝜋𝜋∙ 𝑑𝑑𝑐𝑐2
− ℎ𝑝𝑝 (5.1-7)

Where ℎ is the summation of height of pontoon, height of column and height of deck

5.2 STABILITY CALCULATIONS

Stability requirements for semi-submersibles
Although there are several criteria used in relation to stability of semi-submersibles all over the world,
however this thesis considers those set by the Det Norske Veritas (DNV, 2013). Typically, requirements
are vital to determine if the semi-submersible is in a safe condition or not. Table 5.1 presents the intact
and damaged stability requirements and also requirements for freeboard for metacentric height for col-
umn stabilised units such as semi-submersibles).

Table 5-1: Semi-submersible stability requirement (DNV, 2013)

Generally, the stability of a vessel is dependent on its weight distribution and outer geometry. When a
vessel is exposed to the wave forces and currents, a heeling moment is created (Gudmestad, 2015). The
ability of the body to return to its initial position after the removal of the external forces (i.e., resisting
the overturning forces) is termed to be “stability” (Gudmestad, 2015). These forces may be as a result
of weather conditions including, waves and wind; passengers, tow lines, shifting of cargo, or flooding
due to damage (Gudmestad, 2015). Stability is usually achieved in large vessels by moving water around
in the ballast tanks (Gudmestad, 2015). This ensures that the vessel remains upright and does not lean
to one side in the case it is subjected to asymmetrical load or if fuel/mud is taken from the tank on one
side of the hull.
Initial stability is the ability of a vessel to resist the initial heel from an upright equilibrium position.
���� will help the vessel retain its original position for small
Figure 5-3 illustrates that the righting arm 𝐺𝐺𝐺𝐺
angles 𝜑𝜑 of heel.

Figure 5-3:Important stability properties. Source: Tupper, (2004)

35
����
𝐺𝐺𝐺𝐺 is given as,

����
𝐺𝐺𝐺𝐺 ≈ �����
𝐺𝐺𝐺𝐺 ∙ sin 𝛿𝛿𝛿𝛿 (5.2-1)

����� (the metacentric height) is the primary measure for the initial stability of a floating body
Where, 𝐺𝐺𝐺𝐺
(Tupper, 2004). It is important to note that in the case of large angles of heel, the righting arm and the
metacenter cannot be related with the above equation, as the buoyancy vector no longer passes through
the metacenter
From geometry, the metacentric height, is given as;

����� = �����
𝐺𝐺𝐺𝐺 𝐵𝐵𝐵𝐵 + ���� ����
𝐾𝐾𝐾𝐾 − 𝐾𝐾𝐾𝐾 (5.2-2)

Where

����
𝐾𝐾𝐾𝐾 The vertical center of buoyancy

�����
𝐵𝐵𝐵𝐵 The metacentric radius

����
𝐾𝐾𝐾𝐾 The center of gravity

Intact Stability of the Semi-submersible

���� of the semi-submersible can be calculated as
The 𝐾𝐾𝐾𝐾

���� = 2∙ ∇𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 ∙
𝐾𝐾𝐾𝐾
y𝑝𝑝 + 4 ∙ ∇𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐 ∙ 𝑦𝑦𝑠𝑠𝑠𝑠𝑠𝑠𝑠𝑠
(5.3-1)
2∙∇𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 + 4∙∇𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐

Where
ℎ𝑝𝑝
𝑦𝑦𝑝𝑝 =
2
ℎ𝑠𝑠
𝑦𝑦𝑠𝑠𝑠𝑠𝑠𝑠𝑠𝑠 = ℎ𝑝𝑝 +
2

𝑦𝑦𝑝𝑝 Vertical gravity height of the pontoons

𝑦𝑦𝑠𝑠𝑠𝑠𝑠𝑠𝑠𝑠 Vertical gravity height of the submerged part

The formula for the metacentric radius 𝐵𝐵𝑀𝑀, can be calculated by

����� = 𝐼𝐼𝑠𝑠𝑠𝑠𝑠𝑠𝑠𝑠
𝐵𝐵𝐵𝐵 (5.3-2)
∇ 𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆

Where, 𝐼𝐼𝑠𝑠𝑠𝑠𝑠𝑠𝑠𝑠 is the second moment of inertia of the semi-submersible at waterline that can be calculated
using the Steiner's formula, see equation (5.3-3).

2
𝐼𝐼𝑠𝑠𝑠𝑠𝑠𝑠𝑠𝑠 = 4 ∙ [𝐼𝐼𝑐𝑐𝑐𝑐 + 𝑥𝑥𝑐𝑐𝑐𝑐 ∙ 𝐴𝐴𝑐𝑐𝑐𝑐 ] (5.3-3)

𝜋𝜋 ∙ 𝑑𝑑𝑐𝑐4 2
𝜋𝜋 ∙ 𝑑𝑑𝑐𝑐2
𝐼𝐼𝑠𝑠𝑠𝑠𝑠𝑠𝑠𝑠 = �4 � � + 𝑥𝑥𝑐𝑐𝑐𝑐 ∙ �
64 4
And
𝜋𝜋 ∙ 𝑑𝑑𝑐𝑐4
𝐼𝐼𝑐𝑐𝑐𝑐 =
64

36
 𝐼𝐼𝑐𝑐𝑐𝑐
𝑥𝑥𝑐𝑐𝑐𝑐 =
2

Where 𝐼𝐼𝑐𝑐𝑐𝑐 is the moment of inertia for a circle and 𝐴𝐴𝑐𝑐𝑐𝑐 the area of the column, 𝑥𝑥𝑐𝑐𝑐𝑐 is the horizontal
distance from the center of the circular column to the x-axis as shown in figure 5-4

Therefore,

𝐼𝐼𝑠𝑠𝑠𝑠𝑠𝑠𝑠𝑠
����� =
𝐵𝐵𝐵𝐵
∇𝑝𝑝 +∇𝑐𝑐

Figure 5-4: The waterline area of the semi-submersible

���� , of the rig can be written as,

The center of gravity 𝐾𝐾𝐾𝐾

���� = 2∙𝑀𝑀𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 ∙𝑦𝑦𝑝𝑝 +4∙ 𝑀𝑀𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐 ∙𝑦𝑦𝑎𝑎𝑎𝑎𝑎𝑎 + 𝑀𝑀𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑 ∙𝑦𝑦𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑

𝐾𝐾𝐾𝐾 (5.3-5)
2∙𝑀𝑀 +4∙ 𝑀𝑀
𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 +𝑀𝑀
𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐 𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑

where
𝑚𝑚𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 = (𝑏𝑏𝑝𝑝 ∙ ℎ𝑝𝑝 − 𝑏𝑏𝑝𝑝_𝑖𝑖𝑖𝑖𝑖𝑖𝑖𝑖𝑖𝑖𝑖𝑖𝑖𝑖𝑖𝑖 ∙ ℎ𝑝𝑝_𝑖𝑖𝑖𝑖𝑖𝑖𝑖𝑖𝑖𝑖𝑖𝑖𝑖𝑖𝑖𝑖 ) ∙ 𝑙𝑙𝑝𝑝 ∙ 𝜌𝜌𝑠𝑠

𝜋𝜋 2
𝑚𝑚𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐 = ∙ (𝑑𝑑𝑐𝑐2 − 𝑑𝑑𝑐𝑐_ 𝑖𝑖𝑖𝑖𝑡𝑡𝑡𝑡𝑡𝑡𝑡𝑡𝑡𝑡𝑡𝑡
) ∙ ℎ𝑐𝑐 ∙ 𝜌𝜌𝑠𝑠
4

𝑚𝑚𝑠𝑠𝑠𝑠𝑠𝑠𝑠𝑠 = 𝑚𝑚𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 + 𝑚𝑚𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐 + 𝑚𝑚𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑

And
ℎ𝑐𝑐
𝑦𝑦𝑎𝑎𝑎𝑎𝑎𝑎 = ℎ𝑝𝑝 +
2

𝑦𝑦𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑 = ℎ𝑐𝑐 + ℎ𝑝𝑝 + ℎ𝑑𝑑

where
𝑀𝑀𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 Mass of one pontoon (Kg)

𝑀𝑀𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐 Mass of one column (Kg)

𝑀𝑀𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑 Mass of the deck (Kg)

37
ℎ𝑐𝑐 Overall height of columns

𝑦𝑦𝑎𝑎𝑎𝑎𝑎𝑎 Distance from the pontoon’s top to the middle of the columns (m)

𝑦𝑦𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑 Distance from the keel to the centre of gravity (m)

Figure 5-5:Parameters used in determining the centre of gravity, 𝐾𝐾𝐺𝐺

In order to determine the formula for the intact stability of the semi-submersible, equation (5.3-1),
(5.3-4) and (5.3-5) into equation (5.2-2).
Therefore,

����� = 2∙ ∇𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 ∙
𝐺𝐺𝐺𝐺
y𝑝𝑝 + 4 ∙ ∇𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐 ∙ 𝑦𝑦𝑠𝑠𝑠𝑠𝑠𝑠𝑠𝑠 𝐼𝐼
+𝑉𝑉𝑠𝑠𝑠𝑠𝑠𝑠𝑠𝑠 −
2∙𝑀𝑀𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 ∙𝑦𝑦𝑝𝑝 +4∙ 𝑀𝑀𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐 ∙𝑦𝑦𝑎𝑎𝑎𝑎𝑎𝑎 + 𝑀𝑀𝑑𝑑𝑑𝑑𝑑𝑑𝑘𝑘 ∙ 𝑦𝑦𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑
2∙∇ 𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 + 4∙∇𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐 𝑝𝑝 +𝑉𝑉
𝑐𝑐 2∙𝑀𝑀𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 +4∙ 𝑀𝑀𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐 +𝑀𝑀𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑

Intact stability at large angle of heel

�����. These angles are

For small heeling angles the stability is dominated by the metacentric height ,𝐺𝐺𝐺𝐺
usually in ranges between 0 – 5 ° (Tupper, 2004). However, in cases where the heeling angle is more
than 5 °, the rig’s stability is dominated by both the righting arm and the righting moment (Tupper,
2004).

Figure 5-6:. Stability of a semi-submersible at larger angles of inclination. Source: Gudmestad, (2015)

38
The value of the righting moment is as a result of heeling of the rig caused by many phenomena such
as; wind, roll due to waves and skew ballast (Gudmestad, 2015). The heeling angle is denoted as φ, and
is shown in figure 5-6 above.

The equation for a vessel’s righting moment is given as;

𝑀𝑀𝑅𝑅 = ����
𝐺𝐺𝐺𝐺 ∙ 𝜌𝜌𝑤𝑤 ∙ 𝑔𝑔 ∙ ∇ (5.4-1)

For small angles

𝑀𝑀𝑅𝑅 = �����
𝐺𝐺𝐺𝐺 ∙ Δ ∙ 𝑠𝑠𝑠𝑠𝑠𝑠 𝜑𝜑 (5.4-2)

Where
Δ = m ∙ 𝑔𝑔

Where Δ is the displacement mass. The righting arm equation could be written as (Gudmestad, 2015);
1
���� = �����
𝐺𝐺𝐺𝐺 𝐺𝐺𝐺𝐺 ∙ 𝑠𝑠𝑠𝑠𝑠𝑠 𝜑𝜑 + ∙ �����
𝐵𝐵𝐵𝐵 ∙ 𝑡𝑡𝑡𝑡𝑡𝑡2 𝜑𝜑 ∙ 𝑠𝑠𝑠𝑠𝑠𝑠 𝜑𝜑 (5.4-3)
2

Or
1
����
𝐺𝐺𝐺𝐺 = �����
𝐺𝐺𝐺𝐺 ∙ 𝑠𝑠𝑠𝑠𝑠𝑠 𝜑𝜑 + ∙ ����
𝑀𝑀𝑀𝑀 (5.4-4)
2

Static Heel Angle of a Vessel Due to additional ballast load

When a semi-submersible platform is subjected to asymmetric load of ballast on one side, it will un-
dergo a heeling angle, ϕ. This is presented in figure 5-7.

The heeling angle can therefore be calculated by using the following formula presented by Tupper
(2004)

GG1
tanφ = GM (5.5-1)
ballast

𝐺𝐺𝐺𝐺1 = 𝐾𝐾𝐾𝐾𝑜𝑜𝑜𝑜𝑜𝑜 − 𝐾𝐾𝐾𝐾𝑛𝑛𝑛𝑛𝑛𝑛 (5.5-2)

Figure 5-7: Static heeling angle caused by the asymmetric load of ballast

39
Where GG1 represents the horizontal difference of KG due to the varying ballast.

𝑀𝑀𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 (𝑥𝑥𝑝𝑝1 +𝑥𝑥𝑝𝑝2 )+2∙ 𝑀𝑀𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐 (𝑥𝑥𝑐𝑐1 +𝑥𝑥𝑐𝑐2 ) +(𝑀𝑀𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑 ∙ 𝑥𝑥𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑 )

𝐾𝐾𝐾𝐾𝑜𝑜𝑜𝑜𝑜𝑜 = 2∙𝑀𝑀𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 +4∙ 𝑀𝑀𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐 +𝑀𝑀𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑
(5.5-3)

The different parameters 𝑥𝑥𝑝𝑝1 , 𝑥𝑥𝑝𝑝2 , 𝑥𝑥𝑐𝑐1 , 𝑥𝑥𝑐𝑐2 , 𝑥𝑥𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑, 𝑥𝑥𝑏𝑏𝑏𝑏𝑏𝑏1, 𝑥𝑥𝑏𝑏𝑏𝑏𝑏𝑏2 in equations (5.5-3) and (5.5-4) are shown
in figure 5-8

𝑀𝑀𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 (𝑥𝑥𝑝𝑝1 +𝑥𝑥𝑝𝑝2 )+2∙ 𝑀𝑀𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐 (𝑥𝑥𝑐𝑐1 +𝑥𝑥𝑐𝑐2 ) + (𝑀𝑀𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑 ∙ 𝑥𝑥𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑 )+𝑉𝑉𝑏𝑏𝑏𝑏𝑏𝑏1 ∙𝑥𝑥𝑏𝑏𝑏𝑏𝑏𝑏1 𝑥𝑥+𝑉𝑉𝑏𝑏𝑏𝑏𝑏𝑏2 ∙𝑥𝑥𝑏𝑏𝑏𝑏𝑏𝑏2
𝐾𝐾𝐾𝐾𝑛𝑛𝑛𝑛𝑛𝑛 = 2∙𝑀𝑀𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 +4∙ 𝑀𝑀𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐 +𝑀𝑀𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑 +𝑉𝑉𝑏𝑏𝑏𝑏𝑏𝑏1 +𝑉𝑉𝑏𝑏𝑏𝑏𝑏𝑏2
(5.5-4)

Where
𝑑𝑑𝑐𝑐
𝑥𝑥𝑝𝑝1 =
2
𝑑𝑑𝑐𝑐
𝑥𝑥𝑝𝑝2 = 𝑙𝑙𝑝𝑝 −
2
ℎ𝑐𝑐
𝑥𝑥𝑐𝑐1 =
2
𝑑𝑑𝑐𝑐
𝑥𝑥𝑐𝑐2 = 𝑙𝑙𝑝𝑝 −
2
𝑙𝑙𝑑𝑑
𝑥𝑥𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑 =
2
𝑑𝑑𝑐𝑐
𝑥𝑥𝑏𝑏𝑏𝑏𝑏𝑏1 =
2
𝑑𝑑𝑐𝑐
𝑥𝑥𝑏𝑏𝑏𝑏𝑏𝑏2 = 𝑙𝑙𝑝𝑝 −
2

𝑥𝑥𝑝𝑝1 Horizontal distance from the middle of column 1 to the reference point (m)

𝑥𝑥𝑝𝑝2 Horizontal distance from the middle of the column 2 to the reference point (m)

𝑥𝑥𝑐𝑐1 Horizontal distance from the middle of the column 1 to the reference point (m)

𝑥𝑥𝑐𝑐2 Horizontal distance from the middle of the column 2 to the reference point (m)

𝑥𝑥𝑏𝑏𝑏𝑏𝑏𝑏1 Horizontal distance from the middle of the column 1 to the reference point (m)

𝑥𝑥𝑏𝑏𝑏𝑏𝑏𝑏2 Horizontal distance from the middle of the column 2 to the reference point (m)

𝑥𝑥𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑 Horizontal distance from the middle of the deck to the reference point (m)

40
 Figure 5-8: KG formula before the presence of heeling moment

5.3 COMMENTS ON RESULTS OF CALCULTIONS

This section presents results of the stability study of a semi-submersible. The results are calculations of
freeboard, intact stability and static heeling angle with added ballast. The starboard was filled up with
90% ballast water and the portside with varying percentages (i.e., 80%, 70%, 60%, 50%, 40%, and 30%)
of ballast water.

Various important observations were made. There were significant changes when the mass of ballast
water in the portside was varied. These changes could be observed in the draft, freeboard, metacentric
height and heeling angle.

Draft
Figure 5-9 presents the relationship between the draft and varying ballast water of a semi-submersible
during operations. Decrease in the mass of ballast water in the portside means that there will be decrease
in draft. The initial draft when the two pontoons were filled with 90% of ballast water was 34.5m. When
the ballast water was reduced to 60 %, the draft also reduced to 31 m

Freeboard
Figure 5-10 presents the relationship between freeboard and varying ballast water of a semi-submersible
during operations. The initial freeboard when the two pontoons were filled with 90% of ballast water
was 13.2 m. However, when there was further 10% reduction on one of the pontoons the freeboard
changed from 13.2m to 14.46m. In the case where the ballast water was reduced to about half of its
mass, there is 3.725 m increase of freeboard. This is expected, as there is a reduction in weight. It is
important to note that the freeboard discussed here, is the freeboard at the middle of the semi-submers-
ible. The minimum freeboard criteria for a semi-submersible is 1.50 (DNV, 2013). This means that the
freeboard of the semi-submersible is met in all cases of ballast water variation.

41
 Figure 5-9:Variation of draft with change in percentage of ballast water

Figure 5-10: Variation of freeboard with change in percentage of ballast water

Intact Stability

The intact stability was 2.95 m when both pontoons were filled with 90% ballast water. However, when
there was further 10% (i.e., 80% ballast water) reduction on one pontoons, the intact stability reduced
to 2.59m, which is about a 0.51 m reduction. This is presented in figure 5-11. According to regulations,
the minimum allowable metacentric height is 1m. This means that in all scenarios where water ballast
is varied, the criteria for the metacentric height is met, but for reduced mass of 30%.

42
Figure 5-11:Variation of metacentric height for different percentages of ballast water

As the rig is subjected to asymmetric load of ballast on one side, it will undergo heeling. In the calcula-
tions, the initial heeling angle was 0 when both tanks where filled with ballast water. However, there
was a large difference of 11° after one of the tanks had a 10% deduction of ballast water. This is because
the volume of a pontoon is 22.500 m3; therefore, a filling grade of 10% less or more represents a reduc-
tion/additional water ballast of 2.250 tonnes. 2.250 tonnes is considerably a large amount of ballast
water. Figure 5-12 shows the variation of ballast water with the heeling angle.

According to DNV (2013), in the case of heeling due to steady wind, the maximum heeling angle should
not be greater than 17°. This means that a 20 % (i.e., 26°) reduction of ballast water will not meet the
requirements. Therefore, for this semi-submersible to meet the requirements, the percentage reduction
must not be more than about 15%. Table 5.2 presents the summary of stability calculations.

0
heeling angle of semi-submersible

− 20

− 40
θ heel

− 60

− 80

− 100
6 7 7 7
0 5×10 1×10 1.5×10 2×10
t

Figure 5-12:Variation of ballast water with the heeling angle

43
 Table 5-2:: Summary of stability results

Change in percentage of ballast water

90 % 80 % 70 % 60 % 50 % 40 % 30 %

Freeboard (m) 13.22 14.46 15.70 16.95 18.19 19.43 20.67

Draft
(m) 4.78 33.54 32.30 31.05 29.81 27.33 26.10

GM
(m) 2.95 2.59 2.21 1.86 1.44 1.02 0.59

Heeling angle (de-

grees) 0 11.56 26.05 42.23 57.73 70.65 80.58

44
6. RISK ANALYSIS AND ASSESSMENT OF BALLAST FAILURES
The main purpose of risk assessment is to establish and decide on risk reducing measures (Vinnem,
2013). The decision on the risk reducing measures must be of a structured, systematic and a well docu-
mented process. In recent years, focus has been made on models used for risk assessment in the offshore
oil and gas industry. The ISO31000 standard: Risk management, principles and guidelines on imple-
mentation (ISO 2009; Vinnem, 2013) is commonly used. This approach has been adopted by the PSA
and NORSOK Z-013 standard: Risk and emergency preparedness analysis (Standard Norway 2010;
Vinnem, 2013 ). Figure 6-1 presents the main elements of the model. Risk assessment (i.e., Hazard
identification, risk analysis and risk evaluation) is the core of the process.

Figure 6-1: The process of risk assessment in ISO31000. Source; PSA, (2013)

Although risk assessment has been a common practice over the years. However, with the addition of the
new elements (i.e., establishing the context, monitoring and review, and communication and consulta-
tion), the established context can be monitored, with regards to its validity about the decision made
(Vinnem, 2013).

This chapter aims to evaluate risks involved in ballast operations, by identifying the various hazards
causes and consequences. A failure mode effects and criticality analysis (FMECA) is carried out to
determine the ability of components in the ballast system to perform its required function. Also, a Struc-
tured what-if-checklist (SWIFT) is used to cover issues relating to human errors that the FMECA fails
to identify. Section 6.2 presents a fault tree analysis. The fault tree aims to represent the relationship
between events and the component failures that may combine to cause an undesirable event. The main
component of study is the most critical component identified in the FMECA.
6.1 HAZARD IDENTIFICATION
Hazard identification (HAZID) involves a thorough and comprehensive identification and documenta-
tion of hazards. It is very important to thoroughly carry out a comprehensive identification and recording
of hazards because failure to identify any hazard at this stage might be detrimental, as it would not be
considered in further assessment (Vinnem, 2013). Therefore, a comprehensive and well-planned hazard
identification is a critical basis for other elements in risk assessment.

45
 Structured What-If Technique
Structured What-If Technique (SWIFT) is a risk analysis method where a lead question “What if” is
used to systematically identify potential deviations from normal conditions (Aven, 2008). This tech-
nique is team-oriented and uses experienced personnel as team members. The hazard identification is
based on brainstorming by utilising a generic checklist of elements to be reviewed. It is flexible for the
use of any type of operations at any given lifecycle stage (HSE, 2001). Although the SWIFT analysis is
rarely used to identify hazards in the offshore oil and gas, it is used here to compensate for unidentified
hazards in the FMECA (i.e., Human related errors).

Table 6-1:: Generic checklist and hazard brainstorming process of the ballast system

GENERIC CHECKLIST HAZARD BRAINSTORMING

1. Faulty ballast system design

 Human factors (incl, Operating errors
2. Vessel monitoring system failure
 Maintenance
3. Pump Failure
 Malfunction of equipment
4. Valve failure
 Utility failure
5. Pipe failure
 Measurement errors
6. Remote System operation failure
 Emergency operation
7. Tank overpressure or under pressure
 Integrity failure
8. Power failure
 External factors
9. Valve control system failure
10. Maloperation of valves
11. Poor maintenance
12. Inadequate training
13. Inadequate personnel selection process
14. Tank over filling or under-filling
15. Miscalculations

Table 6-2:Hazard identification based on SWIFT. Source; HSE, (2001)

Ref. Hazard Definition Faulty ballast system design

1 Causes Lack of regulation. Lack of experienced designer. Poor quality

checking process. Financial constraints
2 Consequences Failure to ballast efficiently. Low pump system capacity.
3 Safeguards Approval process plan. Ballast tank capacity (Class/rules)
4 Recommendations Design criteria must be considered.

Ref. Hazard Definition Ballast system Failure

1 Causes Failure or/and damage to pumps, pipes, valves etc. Suction

46
 Blockage. Insufficient/inefficient backup system.
2 Consequences Inability to ballast. Inability regulate heeling. Unfavourable mass
distribution
3 Safeguards Design. Maintenance. Limited redundancy
4 Recommendations Adequate predictive maintenance strategy. Inspection. Perfor-
mance testing and monitoring of ballast system

Ref. Hazard Definition Maloperation of ballast system

1 Causes Failure to properly describe ballast procedure. Failure to follow

ballast plan. Wrong sequence of closing/opening valve.
Maloperation of valve. Time pressure. Complacency Communi-
cation gap. Lack of knowledge of the system
2 Consequences Ballast system failure, Unfavourable heel or draft, unfavourable
distribution of mass, Insufficient stability
3 Safeguards Operating procedures. Monitoring. Training. Planning
4 Recommendations Inclusion of performance monitoring in the ballast system proce-
dures.

Ref Hazard Definition Inadequate planning of ballast operation

1 Causes Lack of knowledge about the system. Missing description and

training. Insufficient availability of personnel. Complacency.
Failure to read accurate weather forecast.
2 Consequences Ballast system failure, List, Structural damage Loss of buoyance
and stability
3 Safeguards Training procedures, operational practice
4 Recommendations Emphasis should be made on hazards regarding ballasting during
training. Planning on competence availability of personnel

Ref Hazard Definition Loss of buoyancy/ insufficient stability

1 Causes Flooding. structural failure. Power failure, ballast system failure,

large heel angle, loss of weather/water tight integrity. VCG move-
ment and mass, free surface effects
2 Consequences Failure of ballast system. Loss of platform. Power failure. Failure
of ballast system to operate. Inability to launch live saving sys-
tem.
3 Safeguards Recognition of margins and regulations for stability
4 Recommendations Emphasis should be made on hazards regarding ballasting during
training. Planning on competence availability of personnel

Ref Hazard Definition Excessive heel during ballasting/deballasting

1 Causes Unfavorable mass distribution, Insufficient stability

2 Consequences Failure of ballast system. Loss of platform. Power failure. Failure

47
 of ballast system to operate. Inability to launch live saving system.
3 Safeguards Adequate design of ballast system
4 Recommendation Design of ballast system should ensure adequate buoyance. De-
sign miscalculations. Active response time with regards to effec-
tive intervention of the system

Ref Hazard Definition Loss of watertight integrity

1 Causes Flooding through uncovered manhole, device with open and close
functions
2 Consequences Unwanted mass distribution. Ballast system failure. Insufficient
stability. Total loss. Personnel injury/fatality
3 Safeguards Operational procedures. Inspection
4 Recommendation Procedures watertight integrity loss must be implemented

Failure Mode Effects and Criticality Analysis

A FMECA is carried out to reveal and analyse failure modes, failure causes and failure effects on
the main components of the ballast system. This method systematically analyses all possible failure
modes and its direct reflection on the system’s performance (Rausand, 2011). The FMECA also enables
predictions to be made on the failure effects on the system and how the failures could be avoided. This
can be achieved by ranking the criticality of the failures. By knowing the critical components, improve-
ments are made for reliability and safety purposes. A detailed description of the FMECA can be found
in Rausand (2011). Table 6.3 presents a breakdown of the ballast system analysed in Appendix C, figure
C-2

Table 6-3:Analysed components by FMECA technique

Ballast tank configuration
Ballast tanks
Ballast control system
Ballast valves and pump room valves
Sea chest valves and Discharge valves
Ballast pumps and
Ballast control logic unit
Pipes
Pipes
Electric power system
Main electric power generator
Emergency backup generator
UPS
Hydraulic power system
Main hydraulic power generator
Hydraulic accumulator

Functions of the elements in the ballast systems are considered together with their operational modes.
For each of the functions and operational mode, possible failure modes are identified and listed. The
failure modes are ranked according to its frequency of occurrence (O), severity (S), and the likelihood
that the failure is detected on time (D). It is important to note that the failure modes were assigned

48
 subjectively based on sources including; RABL datasheet, OREDA reports, Riskonivå i petroleumsvirk-
somheten (RNNP) reports, reports on past incidents etc. The ranks are given ranging from 1 (lowest) to
5 (highest). The risk priority number (RPN) is therefore determined by multiplying the occurrence, se-
verity and detectability. During the FMECA some assumptions were made. They include;

• It is assumed that one components fails at a time

• Human error contributions are neglected
• Failure modes analysed are the more frequent failure modes but not the modes analysed com-
prehensive
• The identified failure causes are not a full assessment of all the failure modes of the components
Based on the analysis in Appendix C figure C-2, the component with the highest ranking are the valves,
hence the most critical.

6.2 FAULT TREE ANALYSIS

A fault tree analysis is a logical representation of the relationship between events and component failures
that may combine to cause an undesirable event (e.g., failure of a barrier system and failure of the sys-
tem’s component) (Aven, 2008). The top event of the tree represents an undesirable event and the basic
events represents different component failures, human errors, or failures that results from external load
(e.g, extreme environmental conditions). Symbols are used to show the relationship between basic
events and the state of the system (Aven, 2008). Table 6.4 shows symbols and interpretation, of a fault
tree.

Table 6-4: Symbols and interpretations of a fault tree. Source; Rausand and Høyland, (2004)

The cause of ballast system failure is analysed using fault tree approach by considering the stability
calculations result presented in section 5.2 (detailed calculation in Appendix B). From the stability cal-
culation is observed that the semi-submersible will lose its stability at the following criteria; Freeboard
(15.70m), Draft (32.30m), GM (2.21m) Heeling angle (26.1m), for a percentage difference in the mass
of ballast water between tank 1 and tank 2. Appendix C Figure C-3 shows the fault tree analysis of the
ballast system considering an event where the heeling angle is 26.1 degrees. Thus, the top event is in-
stability of semi due to ballast system failure at 26.1 degrees heeling angle. It should be noted that loss
of ballast water in the ballast tank results to a critical heeling angle. Also based on the results from the
FMECA analysis the ballast valve is considered critical, hence the fault tree is aimed to analyse the

49
 valve.

6.3 RISK REDUCING MEASURE (BARRIER ANALYSIS)

As pointed out earlier, the oil and gas industry is faced with the risk of major accidents. Major accidents
here mean accidents which has major consequences, capable of causing fatalities or/and environmental
hazards. Fortunately, these unwanted accidents have low probability of occurrence due to presence of
multiple layer of protection, otherwise known as barriers (Sintef, 2015). Although there may be possi-
bility of a single failure to occur, it should however not be allowed to lead to catastrophic events. Thus,
the reason why multiple barriers are in place and need to be strategically managed all through the rigs’
lifecycle (Sintef, 2015).
Safety barriers are established and implemented with the aim of preventing, controlling and mitigating
the effects of a hazardous event (Sklet, 2006). Figure 6-2 presents a typical approach for classifying
barriers

Figure 6-2: Barrier classification. Source; Sklet, (2005)

Depending on the scenario the ballast system is used as a safety barrier in order to prevent, control and
mitigate unwanted lists of the vessel by means of ballasting. Barrier management is carried out, with the
purpose of establishing and maintaining barriers to prevent unwanted event or in situations where un-
wanted events occurs, it can be properly handled (PSA, 2013). Barrier management includes systems,
processes solutions and measures that must be readily available to reduce risk by the implementation
and follow–up of barriers (PSA, 2013).

This chapter aims to describe barrier management in terms of barriers that can prevent or reduce effects
of unwanted events during operations of semi-submersibles. Section 6.2.1 defines and describes some
important terms used in barrier management. 6.2.2 presents a detailed barrier analysis of some notable
past accidents /incidents reviewed in appendix D

6.3.1 Terminology used in barrier analysis

A barrier function is defined as the role or purpose of a barrier (DNV-GL, 2014). If the barrier function
is achieved, there should be a significant effect on the hazard and event sequence. A range of personnel,
system structures are needed to realise the barrier functions. These measures include technical, opera-
tional and organisational barrier elements (DNV-GL, 2014).

According to DNV-GL, (2014), technical barrier element includes; Structures, Engineering systems,

50
or other design features that performs barrier functions when required. Technical barriers are of two
types, the functional/active barrier elements and the structural/passive barriers. Active barriers are re-
ferred to technical barriers that are dependent on operator actions, control system and some energy
source to perform its functions. on the other hand, barriers do not need operator actions, control systems
or energy sources as they are measures integrated in the platform design. Example of technical barrier
elements include; Ballasting system, thrusters, position keeping system, hull, watertight, anchor lines,
compartments, valves, etc. Operational barrier element involves tasks carried out by an operator that
realises several barrier functions. Operation barrier element may include; Operate MOB boat, ballasting
operations, emergency and controlled disconnect, weather monitoring, monitor ships etc. The personnel
carrying out the task are referred to as organizational barrier element (DNV-GL, 2014).

Risk Influencing factors (RIFS)

It is vital to know the risk influencing factors (RIF) when carrying out barrier analysis. A RIF otherwise
known as barrier performance influencing factors can be defined as “an aspect of a sys- tem or an ac-
tivity that affects the risk level of the object” (Øien (2001). It is can also be defined as “a relatively stable
condition that influences risk” (Rausand, 2011). Generally, the overall risk is controlled by the control
of changes of the risk-influencing factor (Vinnem, 2013). An example of the application of the risk
influencing factor during operations of semi-submersibles is; if a worker is carrying out a manual in-
spection of the flood detection function in the ballast control room, possible factors that may influence
the personnel’s performance include,

• Manual inspection procedures

• work organization and work patterns
• Training and experience of operators
• Motivation of operators etc.

Appendix D table D.8 presents the groups in which the RIFs are grouped into and the description of
each of the RIFs. It is important to note that what is usually considered to be barriers by some definition
can also be considered to be RIFs (Vinnem, 2013). Figure 6-3 shows the relationship between barrier
factors, barrier elements and RIFs for a valve in a wrong position after maintenance.

Figure 6-3;Relationship between barrier function, elements and RIFs. Source; PSA, 2013

Performance requirements

51
 In the context of safety barriers, performance means properties a barrier must have to ensure that indi-
vidual barrier and its function is effective (PSA, 2013)
“Performance requirements must be set for technical, operational and organisational barrier elements”
(PSA, 2013). It includes aspects such as, reliability, capacity, availability, integrity, ability to withstand
load, mobilization time, robustness, and effectiveness. According to PSA, (2013) Figure 6-4 presents an
approach describe performance requirements in relation to technical, operational and organizational bar-
riers. Performance requirements relates only to the barrier elements whose quality they intend to ensure.
This means that for instance, a specific course could be required to be taken by personnel to acquire the
right job performance needed to realise a barrier function.

Figure 6-4: Categorizing performance requirements for technical, operational and organisational bar-
rier elements. Source (PSA, 2013)

6.3.2 Barrier performance of some notable accidents/incidents

This section describes some notable accidents/near accidents caused by ballast failure on semi-submers-
ible rigs in the past. A generic diagram adopted from COWI, (2003) is used to understand the event
sequence that leads to each of the selected accidents/incident. A detailed barrier analysis is presented in
Appendix D. The tables in Appendix D describes barrier functions (BF), barriers systems/elements (BS)
and risk influencing factors (RIF) of these accidents. The performance of the BFs, BSs, RIFs are also
evaluated.

Barrier analysis of past incidents/accidents

The event sequence is the basis of a barrier diagram. It is represented as rectangular text boxes that are
linked. Adopted from COWI, (2003). Figure 6-5 shows a sample and description of the barrier diagram
used in this thesis to provide an event sequence overview leading to the accident.

Figure 6-5: Barrier diagram

52
Additional causes are presented in the circular box. The shaded or white vertical bars represents the
barriers. The shaded barriers mean the availability of barrier at the time of incident. White broken bar-
riers represent barriers that were not available in the duration of time the incident occurred but were
implemented in regulations. A full shaded barrier means that the barrier worked.
Appendix D presents a detailed barrier analysis of accidents/incidents of five selected rigs. An overview
of the analysed accident is shown in table 6.5.and the barrier performance summary in table 6.6

Table 6-5: Overview of the analysed accidents.

Unit Location Year Main cause

Ocean Ranger Canada 1974 Ballast System, Portlight

Ocean Developer West Africa 1995 Ballast system operation
Petrobras-36, Brazil 2001 Operation of drainage, Hydrocar-
bon explosion, flooding
Thunder horse Gulf of Mexico, US 2005 Hydraulic system operation
Scarabeo 8 Barents Sea, Nor- 2012 Ballast system operation
way

Table 6-6: Barrier performance summary

Barrier Func- Maintain prevent escala- Prevent Prevent fatali-
tion perfor- Structural In- tion loss ties/
mance tegrity and of initiating injuries
Marine Con- failure
trol

Ocean Ranger
accident Failure Failure Failure Failure

Ocean Developer
Failure Lack of Infor- Lack of Infor- Success
mation mation
Petrobras-36
Accident Failure Failure Failure Partial Success
Thunder Horse
Failure Success Partial Success N/A
Scarabeo 8
Incident Failure Success N/A Partial Success

The analysis shows the direct implications of barrier failures in terms of technical operational and or-
ganizational elements. In one way or other human error is significant as it is the main contributor to this
failure. The initiating cause of failure for three of the incidents are directly linked to human involvement
(i.e., Ocean Developer, Thunder Horse and Scarabeo 8). In the case of Ocean Ranger, the series of events
that caused the accident was solely caused by poor design. The Petrobras P-36 series of events occurred
as a combination of fires and explosions and a design that did not allow for operating the ballast system
following the damages in the column.

53
7. DISCUSSION
Notwithstanding the importance of well-functioning ballast systems on semi-submersibles, very few
research has been undertaken within the field of buoyancy loss and stability caused by ballast failure
during operations. The main objective of this thesis is to evaluate the risks involved during ballast
operations of a semi-submersible, and to recommend on ways by which risk can be reduced during
operations of the system.

In order to be able to evaluate risk that involves ballast failure of a semi-submersible during operations,
it is important to understand to an extent the components and subsystem that make up the ballast system.
This is presented in section 4.1. The main subsystems identified include: ballast tank configuration;
Pipe, Pumps and valves; Ballast control system; Hydraulic power system; Electric power system. Cal-
culations are also made to illustrate the effects of asymmetric changes in ballast tank level on the heeling
of semi-submersibles and consequent failure. Chapter 5 describes the methodology of stability calcula-
tions carried out in appendix B. The dimensions used for the calculations are determined from similar
rig dimensions in chapter 4 and suggestions from the thesis supervisor. Throughout the calculations,
some assumptions and simplifications are made. The main assumptions include: Environmental loads
are not considered; The semi-submersible is in an operational mode; There are differences in layout and
structural arrangement between the columns. In order to simplify the problem, there are four columns
and all the columns are assumed to be identical and circular in cross section. The reference semi-sub-
mersible has two rectangular pontoons and the pontoons are below the water line during operation. The
starboard is filled up with 90% ballast water and the portside with varying percentages (i.e., 80%, 70%,
60%, 50%, 40%, and 30%) of ballast water.

Draft
Results shows that a decrease in the mass of ballast water in the portside means that there will be de-
crease in draft. The initial draft when the two pontoons were filled with 90% of ballast water was 34.5m.
When the mass of ballast water reduced to 70 %, the draft also reduced to 32.3 m

Freeboard
The initial freeboard when the two pontoons are filled with 90% of ballast water is 13.2 m. However,
when there is a further 20% reduction on one of the pontoons the freeboard changes from 13.2m to 15.7
m. In the case where the ballast water is reduced to about half of its mass, a 3.725 m additional increase
in freeboard is observed. This is expected, as there is a reduction in weight. It is important to note that
the freeboard discussed here, is the freeboard at the middle of the semi-submersible. The minimum
freeboard criteria for a semi-submersible is 1.50 (DNV, 2013). This means that the freeboard of the
semi-submersible is met in all cases of ballast water variation.

Stability
The intact stability is calculated to be approximately 2.95 m when both pontoons were filled with 90%
ballast water. However, when there is further 30% (i.e., 70% ballast water) reduction on one pontoon,
the intact stability reduced to 2.59m, which is about a 0.51 m reduction. According to regulations, the
minimum allowable metacentric height is 1m. This means that in almost all scenarios where water bal-
last is varied, the criteria for the metacentric height is met, except in the scenario with 30% mass of
ballast water in one pontoon.

Static Heeling Angle

The results show a significant difference on the heeling angle in all scenarios. As the rig is subjected to

54
asymmetric load of ballast on one side, it will undergo heeling. In the calculations, the initial heeling
angle is 0 when both tanks are filled with 90% ballast water. However, there was a large difference of
11° after one of the tanks had a 10% deduction of ballast water. This is because the volume of a pontoon
is 22.500 m3; this means that a filling grade of 10% less or more represents a reduction/additional water
ballast of 2.250 tonnes. 2.250 tonnes is considerably a large amount of ballast water
According to DNV (2013), in the case of heeling due to steady wind, the maximum heeling angle should
not be greater than 17°. This means that a 20 % (i.e., 26°) reduction of ballast water will not meet the
requirements. Therefore, for this semi-submersible to meet the requirements, the percentage reduction
must not be more than about 15%.

Qualitative risk assessment

A considerably amount of information about past events is needed to prevent near misses and accidents
in the future. However, some loss of stability incidents and accidents are not reported, or lack full infor-
mation about events leading to the accidents. The downside to this problem is that detailed studies are
not carried out to know how and why it happened, especially for peculiar cases. This may be the reason
why damage frequency on vessels have not improved over the years. Figure 5-1 presents a distribution
of causes of nine selected past incidents/accidents that led to loss of buoyancy or stability of a semi-
submersible.

6 Distribution of Causes of Stability Failures

5

0
Sea Water Ingres Valve Ballast Pump Unknown Cause

Operational Failure, Incident

Operational Failure, Accident
Technical Fault

Figure 7-1: Distribution of causes of stability failures

A more detailed information about some semi-submersibles and its dimensions is given in chapter 4.
Five out of the nine incidents/accidents, were caused by uncontrolled water ingress. This is in line with
the conclusion by Tinmannsvik et al. (2011) who noted that uncontrolled water ingress is the main
common cause of accidents and incidents. On the other hand, a similar study carried out by Vinnem et
al., (2006) concluded that valve failures are the main cause category for incidents and accidents. This
discrepancy may be due to the fact that in most cases where ballast valve failure is not the initiating
cause of an event, however it seen to be among the casual factors on the incident chain. It is further
observed that seven out of nine incidents/accidents occurred due to human error. These accidents could
have been prevented if the human interface (i.e., designers, operators and organization) had followed

55
the guidelines in PSA (2011a) regulations discussed in section 2.3.2. Therefore, when carrying out haz-
ard analysis on systems such as this, it is important to incorporate human errors.

Risk assessment on ballast systems can be done by adopting either the qualitative approach, quantitative
approach or a combination of both. However, this thesis is limited to qualitative risk assessment of
ballast failures during operations of semi-submersibles. The first step of this assessment method is aimed
at identifying potential hazards that could be detrimental to operations. The techniques adopted are the
SWIFT and FMECA. The FMECA was adopted to systematically analyse all possible failure modes and
its direct reflection on the performance of the ballast system. The SWIFT is used to compensate for
unidentified hazards in the FMECA (i.e., human related errors). The hazard identification is based on
brainstorming by utilising a generic checklist of elements in the ballast system. Table 6.2 shows a com-
prehensive hazard identification based on SWIFT. Hazards here are defined are follows;
• Faulty ballast system design
• Failure of ballast system
• Maloperation of ballast system
• Inadequate planning of ballast operation
• Loss of buoyancy /inefficient stability
• Excessive heel during ballasting /deballasting
• Loss of watertight integrity or weathertight integrity
The causes and consequences for each of the defined hazard are identified. For instance, maloperation
of the ballast system can occur due to failure to properly describe ballast procedure, failure to follow
ballast plan, wrong sequence of closing/opening valve, maloperation of valve, time pressure compla-
cency, communication gap or general lack of knowledge of the system. Controls otherwise known as
safeguards are also identified as a risk-reducing measure. Finally, recommendations are made on how
to achieve the safeguard (Also see table 6.2 for recommendations)

A FMECA is carried out to reveal and analyse failure modes, failure causes and failure effects on
the main components of the ballast system. Information about the failure rates are acquired from the
RABL data sheet, OREDA report and the RNNP report. The risk relating to the failure modes are pre-
sented by an alternative to the risk matrix, (i.e., Risk priority number (RPN). The RPN is determined by
multiplying together the severity (S), occurrence (O) and detectability (D) of the failure modes. Numbers
are subjectively assigned to the S, O, D based on my degree of knowledge of the components. A detailed
FMECA is presented in Appendix C figure C-2. Findings show that failure of valve to “close on de-
mand” with an RPN of 60 is the most critical.

The cause of ballast system failure is analysed using fault tree approach by considering the result of
stability calculations presented in in Appendix B. From the stability calculations, it is observed that the
semi-submersible will lose its stability at the following criteria presented in table 7.1, for a percentage
difference in the mass of ballast water between tank 1 and tank 2.

Table 7-1: Scenario with 70% of ballast water in tank 2

Freeboard Draft GM 𝜑𝜑heel
15.70 32.30 2.21 26.05

Thus, it is imperative to evaluate the failure of this semi-submersible. Appendix C Figure C-3, shows
the fault tree analysis of the ballast system considering an event where the heeling angle is 26.1 degrees.
Thus, the top event is “instability of semi due to ballast system failure at 26.1 degrees heeling angle”.

56
It should be noted that loss of ballast water in the ballast tank results to a critical heeling angle. Also
based on the results from the FMECA analysis the ballast valve is considered critical, hence the fault
tree is aimed to analyse the valve. Appendix C Figure C-3 presents a detailed chain of scenarios that
could lead to ballast valve failure.

It is established that the risk related to ballast failure can lead to fatalities or/and loss of platform. In
order to prevent or reduce the consequences in the event the incident occurs, a risk reducing measure
must be in place. The risk reducing measure adopted in this thesis is the barrier management. A detailed
description is presented in section 6.3 and Appendix D presents a detailed barrier analysis of five se-
lected rigs accidents/incidents. The analysis shows the direct implications of barrier failures in terms of
technical operational and organisational elements. Human error is established to be the main contributor
to this failure. The initiating cause of failure for three of the incidents are directly linked to human
involvement (i.e., Ocean Developer, Thunder Horse and Scarabeo 8). In the case of Ocean Ranger, the
series of events that caused the accident was caused by poor design. The Petrobras P-36 series of events
occurred as a combination of fires and explosions and a design that did not allow for operating the ballast
system following the damages in the column.

In order to ensure that barriers are functioning, robust and available, it is important to have a defined
barrier management strategy. Figure 7-2 establishes an approach of barrier risk reduction. This approach
starts with hazard identification of critical paths of the ballast system that may lead to a major accident.
The second step aims to apply solutions that involve technical, operational or organisational aspects.
This could be in the form of design modifications, improvement or changes in procedures and personnel
selection process (i.e., to increase competence in ballast operations). A detection (e.g., sensors) and
ballast control safety barriers must be available in order to detect events with critical deviations. In
addition, mitigation barriers (i.e., reserve buoyancy in the form of buoyancy deck, air injection etc) to
prevent total loss should be established. Finally, performance monitoring must be an ongoing process.
This will aim to continuously monitor the performance of components in the ballast system with the
human interface

Figure 7-2; Established approach of risk reduction

57
8. CONCLUSIONS
The consequences of instability of semi-submersible rigs during operation are considered to be severe.
Hence, this master thesis is focused on integrating operational stability calculations of a semi-submers-
ible rig with risk analysis. The purpose of this thesis is to evaluate the failure modes of ballast system’s
components during drilling operation and suggest mitigation measures. To achieve this objective a qual-
itative risk assessment approach is adopted.

In this thesis, some past incidents and accidents were reviewed in order to identify and understand causes
and chains of accidental events. The reviewed literature included investigation reports on Henrik Ibsen,
Ocean Ranger, Ocean Developer, Petrobras P-36, Aban Peal, Thunder Horse, Floatel Superior, Scarabeo
8 and Island Innovator. Prior to the risk assessment, stability calculations should be carried out to eval-
uate the semi-submersible rig against stability criteria. This intends to show the ability of the rig to
withstand abnormal conditions related to ballast and the effect of variations in the amount of ballast
water on the heeling angle. The results of the stability calculations show that more than approximately
15% reduction of ballast water in one of the tanks (where the other is full) could lead to unacceptable
heeling angle by regulation requirements.

Critical events were identified in the FMECA relating to changes in the amount of ballast water. Also
components in the ballast system were analysed, and based on finding, the failure of valves to “close on
demand” with a Risk Priority Number (RPN) of 60 was established to be the most critical. It is important
to note that the valve regarded here is the valve in the ballast tank configuration. The SWIFT analysis
identified human operational hazards that was not identified in the FMECA. A fault tree was then used
to represent the relationship between events and component failures that may combine to cause an un-
desirable event.

Finally, it was established that, in order to ensure that barriers are functioning, robust and available, it
is important to have a defined barrier management strategy.

RECOMMENDATIONS
The study efforts and other past studies related to risk analysis of the ballast system of a semi-submers-
ible during operations have identified fundamental knowledge about reliability and risk analysis of the
ballast system of a semi-submersible. However, further studies are required to improve the accuracy of
the results of the study efforts and to reveal more efficient methodology for reliability and risk analysis.
Therefore, future studies that might be considered are not limited to the following:
• Detailed quantitative risk and reliability analysis of potential ballast failures during operations
of a semi-submersible
• Investigations that include integration of operational stability calculations of a semi-submersi-
ble rig with risk analysis. This thesis can serve as a foundation to such investigations
• Although this thesis is limited to barrier management for risk reduction, it is recommended to
integrate the risk acceptance criteria and ALARP principle so as to balance cost and safety of
a selected risk reducing measure or strategy.

58
REFERENCE
ABS Records, (2001). [Online]: General Statistics. Available:
http://www.eagle.org/safenet/record/record_vesseldetailsprinparticular?Classno=07113112
[Assessed 4th March 2017]

Aven, T. (2008). Risk analysis: assessing uncertainties beyond expected values and probabilities.
Chichester, England: Wiley.

Baunan, T. (1996). FPSO‘s Fulfilling Shelf Requirements by the Maritime Approach Offshore Tech-
nology Conference (OTC), Houston.

BP, (2013). [Online]: Thunder Horse Field Fact Sheet. Available: http://www.bp.com/content/dam/bp-
country/en_us/PDF/Thunder_Horse_Fact_Sheet_6_14_2013.pdf [Accessed: 23rd February,
2017]

Bsee, (N.D). [Online]: ACCIDENT INVESTIGATION REPORT. Available:

https://www.bsee.gov/sites/bsee.gov/files/reports/safety/050708-pdf.pdf [Accessed: 19th Feb-
ruary, 2017]

Chakrabarti, (2005). Handbook of Offshore Engineering, Vol. 1 & Vol.2. Elsevier Ltd.

Chen, H., Moan, T., and Verhoeven, H. (2007). Safety of dynamic positioning operations onmobile
offshore drilling units. Reliability Engineering and System Safety 93.

COWI (2003). Ageing rigs: Review of major accidents, Causes and barriers, Report no. P-055481-

B32.Avail-
ble:http://www.ptil.no/getfile.php/131893/z%20Konvertert/Health%2C%20safety%20and%20
environment/Safety%20and%20working%20environment/Dokumenter/2003cowiag-
ingrigs_nov03.pdf [Assessed 6th March 2017]

Deepwater, (1991). [Online]: Transocean Richardson. Available:

http://www.deepwater.com/Documents/RigSpecs/Transocean%20Richardson.pdf [Assessed
12th June, 2017]

Deepwater, (2017). [Online]: Transocean Spitsbergen. Available:

http://www.deepwater.com/Documents/RigSpecs/Transocean%20Spitsbergen.pdf [Assessed
12th June, 2017]

DNV.GL, (2013). [Online]: Scarabeo 8. Available: http://vesselregister.dnvgl.com/VesselRegis-

ter/vesseldetails.html?vesselid=26777 [Assessed 4th March 2017]

DNV-GL, (2014). [Online]: Barrier Management in Operation for the Rig Industry; Good Practices.
Availa-
ble:https://www.google.no/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8
&ved=0ahUKEwiYsoXq07zSAhWJ8ywKHTi8AJoQFggu-
MAE&url=https%3A%2F%2Fwww.rederi.no%2Fen%2FDownload-
File%2F%3Ffile%3D12349&usg=AFQjCNGYwhUCTM13NFrxjyjqyaiEIXJxjA [Assessed
4th March 2017]

Floatel, (2017). [Online]: Floatel Superior. Available: http://www.floatel.se/fleet/floatel-superior [As-

sessed 4th March 2017]

59
Gudmestad, (2015). Marine Technology and Operations; WIT-Press, Southampton, UK

Hancox, M. (1996). Oilfield Seamanship Series Volume 7: Stability and Ballast Control. Oilfield Pub-
lications Limited, Ledbury, England. 133

Haug et al, (2009). [Online]: Advances in rig design. Available:

http://www.offshore-mag.com/articles/print/volume-69/issue-7/drilling-__completion/advances-in-rig-
design.html [Assessed 12th June, 2017]

Hock and Balaban, (1984). Fault analysis of a semisubmersible’s ballast control system. Offshore
technology conference Houston, Texas.

HSE, (2001). [Online]: Marine risk assessment. Available:

http://www.hse.gov.uk/research/otopdf/2001/oto01063.pdf [Assessed 12th June, 2017]

HSE, (2003). [Online]: Review of the risk assessment of buoyancy loss (RABL) project.
Available: http://www.hse.gov.uk/research/rrpdf/rr143.pdf [Assessed 12th June, 2017]

Island Innovator, (2017). [Online]: Semi Submersible Drilling Rig. Available:

http://www.islanddrilling.no/bilder/filer/IslandInnovator.pdf [Assessed 4th March 2017]

Ismail, Z., Kuan, K. K., Othman, S. Z., Hing, L. K., Yee, K. S., Chao, O.Z. and Shirazi, S. (2014).
Evaluating accidents in the offshore drilling of petroleum: regional picture and reducing im-
pact. Measurement, vol. 51, p.18-33.

ISO, (2009). ISO/IEC 31000 risk management, principles and guidelines on implementation.
Kaiser, M.J., Snyder, B. and Pulsipher, A.G., (2013). Offshore Drilling Industry and Rig Construction
Market in the Gulf of Mexico. [online]: Louisiana: Bureau of Ocean Energy Management.
Available at: http://www.data.boem.gov/PI/PDFImages/ESPIS/5/5245.pdf [Accessed 10 March
2017]
Kulturminne-Ekofisk, (n.d). [Online]: Hva skjedde med ”Henrik Ibsen”? Available:
http://www.kulturminneekofisk.no/modules/module_123/templates/ekofisk_publisher_temp-
late_category_2.asp?strParams=8%233%23%23857&iCategoryId=405&iInfoId=0&iContent-
MenuRootId=&strMenuRootName=&iSelectedMenuItemId=1266&iMin=685&iMax=686.
[Assessed 14th March, 2017]

Kumar, S., Chattopadhyay, G. and Kumar, U. (2007). Reliability improvement through alternative de-
signs: a case study. Reliability Engineering & System Safety, 92(7), 983-991.

Kvitrud, A, (2013). Modifications of the PSA regulations based on case studies of stability accidents.
32th International Conference on Ocean, Offshore and Arctic Engineering.

Leonhardsen, R. L., Ersdal, G., and Kvitrud, A. (2001). Experience and Risk Assessment of FPSOs
in Use on the Norwegian Continental Shelf: Description of Events. International Offshore and
Polar Engineering Conference, Stavanger.

Lotsberg I, Olufsen O, Solland G, Dalane JI, Haver S (2004) Risk assessment of loss of structural in-
tegrity of a floating production platform due to gross errors. Marine Struct 17:551–573

Lyall S, (2010). [Online]: “In BP’s Record a History of Boldness and Costly Blunders”. New York
Times. Available: http://www.nytimes.com/2010/07/13/business/energy-environ-
ment/13bprisk.html [Accessed 23rd February, 2017]

60
MacDonald, A., Cain, M., Aggarwal, A. K., Vivalda, C., and Lie, O. E. (1999). Collision Risks Asso-
ciatedwith FPSOs in Deep Water Gulf of Mexico. Offshore Technology Conference (OTC),
Houston.

Mace, (n.d). Petrobras Platform P-36 Explosions, Brazil

http://www.mace.manchester.ac.uk/project/research/structures/strucfire/CaseStudy/His-
toricFires/Other/petrobras.htm [Accessed 23rd February, 2017]

Maracc, (2013). [Online]: Incident on the Island Innovator. Available:

http://otc.nfmf.no/public/news/13701.pdf [Assessed 4th March, 2017]

Mogensen, V. (ed.) (2006). Worker Safety under Siege: Labor, Capital, and the Politics of Workplace
Safety in a Deregulated World. Armonk, NY: M.E. Sharpe

Moen, H. F. (2012). [Online]: Reliability Assessment of Safety Instrumented Systems: An Application

Example for A Ballasting System. Master’s thesis, Norwegian University of Science and
Technology. Available:
https://brage.bibsys.no/xmlui/bitstream/han-
dle/11250/240856/629214_FULLTEXT01.pdf?sequence=1&isAllowed=y [Assessed 4th
March, 2017]

Naess, A. A., Haagensen, P. J., Lian, B., Moan, T., & Simonsen, T. (1982). [Online]: Investigation of
the Alexander L. Kielland Failure - Metallurgical and Fracture Analysis. Offshore Technology
Conference Available: https://www.onepetro.org/conference-paper/OTC-4236-MS[Assessed
14th March, 2017]

Nesje, J. D., Aggarwal, R. K., Petrauskas, C., Vinnem, J. E., Keolanui, G. L., Hoffman, J., and Mc-
Donnell, R. (1999). Risk Assessment Technology and its Application to Tanker Based Float-
ing
Production Storage and Offloading (FPSO) Systems. Offshore Technology Conference
(OTC), Houston

NASA, (2008). [Online]: System Failure Case Studies; That Sinking Feeling. Available:
https://sma.nasa.gov/docs/default-source/safety-messages/safetymessage-2008-10-01-los-
sofpetrobrasp36.pdf?sfvrsn=4 [Accessed 23rd February 2017]

NASA, (2011). [Online]: Porthole to Failure: The sinking of the Ocean Ranger. Available:
https://sma.nasa.gov/docs/default-source/safety-messages/safetymessage-2011-12-12-the-
sinkingoftheoceanranger-vits.pdf?sfvrsn=4 [Accessed 23rd February 2017]

New York Times, (1982). [Online]: ”80 feared dead as oil drilling rig reportedly sinks in north Atlan-
tic”. Available: http://www.nytimes.com/1982/02/16/world/84-feared-dead-as-oil-drilling-rig-
reportedly-sinks-in-north-atlantic.html?scp=7&sq=sinks%20in%20Atlantic&st=cse
[Accessed 23rd February 2017]

New York Times, (2010). [Online]: “In BP’s record, A history of Boldness and Costly Blunders”.
Available: http://www.nytimes.com/2010/07/13/business/energy-environment/13bprisk.html
[Accessed 23rd February, 2017]

Nilsen, L.R. (2005). Marine systems in risk analyses for mobile units. M.Sc.thesis, University of Sta-
vanger.

Norsk Olje & Gass (2004) Norwegian Oil and Gas Application of IEC 61508 and IEC 61511 in

61
 the Norwegian Petroleum industry. Availa-
ble:https://www.norskoljeoggass.no/Global/Retningslinjer/HMS/TekniskSikkerhet/070%20-
%20Application%20of%20IEC%2061508%20and%20IEC%2061511.pdf
Assessed 12th June, 2017]

Ocean Rig, (2013). [Online]: Semi Submersible Rigs.

Available: http://www.ocean-rig.com/fleet/semi_submersible_rigs [Accessed 12th June, 2017]

OGP (2006). Guideline for managing marine risks associated with FPSOs. The International Associa-
tion of Oil & Gas Producers (OGP).

Offshore Energy Today, (2012a). [Online]: “Floatel Superior Tilts, Statoil evacuates workers”. Availa-
ble: http://www.offshoreenergytoday.com/floatel-superior-tilts-statoil-evacuates-workers-nor-
way/[Accessed 23rd February 2017]

Offshore Energy Today, (2012b). [Online]: “Scarabeo 8 Tilting: PSA Norway discovers serious
breaches of regulations”. Available: http://www.offshoreenergytoday.com/scarabeo-8-tilting-
psa-norway-discovers-serious-breaches-of-regulations/ [Accessed 23rd February, 2017].

Offshore Energy Today, (2013). [Online]: “Island Innovator Tilts in Hanoytangen. Workers Evacu-
ated”. Available: http://www.offshoreenergytoday.com/island-innovator-tilts-in-bergen-work-
ers-evacuated/ [Accessed 23rd February, 2017]
OREDA, (2009). Offshore reliability data handbook/prepared bySINTEF.5thedition,2009.

OLF070 (2004). Application of IEC 61508 and IEC 61511 in the Norwegian Petroleum Industry.

PSA (2001). [Online]: P-36 Inquiry Commission Final Report. Available:

http://www.psa.no/getfile.php/13148/z%20Konvertert/Health%2C%20safety%20and%20en-
vironment/Safety%20and%20working%20environment/Dokumenter/p_36_petrobas2.pdf [As-
sessed 23rd February, 2017]

PSA (2011a). Guidelines for application for Acknowledgement of Compliance (AOC) for mobile fa-
cilities intended for use in the petroleum activities on the Norwegian Continental Shelf.

PSA, (2011b). Framework regulations. Petroleum Safety Authority, Norwegian Pollution Control Au-
thority and the Norwegian Social and Health Directorate, Stavanger

PSA (2011c). Deepwater Horizon-ulykken: Vurderinger og anbefalinger for norsk petroleumsvirk-

somhet. Petroleum Safety Authority Norway

PSA, (2013). [Online]: Principles for barrier management in the petroleum industry.
Available: http://www.ptil.no/get-
file.php/1319891/PDF/Barrierenotatet%202013%20engelsk%20april.pdf [Assessed 12th June
2017]

PSA, (2015) [Online]: Trends in risk level in the petroleum activity – Summary report 2015, Norwe-
gian Continental shelf: Available: http://www.psa.no/getfile.php/PDF/RNNP%202015/RNNP-
2015%20Summary%20report.pdf [Assessed 4th March 2017]
PSA, (2012). [Online]: Report from the investigation of the listing of Floatel Superior, 7 November
2012 on the Njord field. Petroleum Safety Authority Norway; 2013. Available:
http://www.ptil.no/enforcement-notices/notification-of-or der-after-investigation-of-stability-
incident-on-floatel-superior-7-novem ber-2012-article9284-892.html [Assessed 4th March
2017]

62
PSA, (2013). [Online]: "Causal relationships and measures associated with structural and maritime in-
cidents on the Norwegian Continental Shelf". Available: http://www.psa.no/get-
file.php/PDF/RNNP_2013/12%209%202014%20Causal%20relationships%20and%20measur
es%20associated%20with%20structural%20and%20maritime%20inci-
dents%20on%20the%20NCS.pdf [Assessed 23rd February, 2017]

PSA, (2015). [Online]: Consent to use Floatel Superior as a flotel for the Goliat field. Available:
http://www.psa.no/consents/consent-to-use-of-floatel-superior-as-a-flotel-for-the-goliat-field-
article11338-890.html [Assessed 4th March 2017]

Ptil, (2011). [Online]: Regulations relating to design and outfitting of facilities, etc. in the
petroleum activities (the facilities regulations). Available:
http://www.ptil.no/getfile.php/1319041/Regelverket/Innretningsforskriften-2011_e.pdf
[Accessed: 12th June, 2017]

Ptil, (2012). [Online]: Investigation Report; Report from the investigation of the listing of Floatel Su-
perior, 7 November 2012 on the Njord Field. Available:
http://www.ptil.no/getfile.php/1319801/Tilsyn%20på%20nettet/Gran-
skinger/2012_1727_Granskingsrapport%20Floatel%20Superior%20-%20engelsk.pdf [As-
sessed 23rd February, 2017]

Rausand, M. and Høyland, A. (2004): System Reliability Theory. 2nd ed. John Wiley and Sons Ltd.,
New York, NY.

Rausand, M. (2011). Risk Assessment: Theory, Methods, and Applications. Wiley and Sons Inc.
Hoboken, New Jersey, 1st edition

Rig Aban Pear, (1977). [Online]: Semi-Submersible Drilling Unit. Available:

http://www.aban.com/aol/pdffiles/rigabanpearl.pdf
[Assessed 4th March 2017]

Rocha, G. C., do Amaral Vasconcellos, J. M., and Frutuoso e Melo, P. F. F. (2010). Functional
Reliability Study of the Electrical Power System, Automation System and Ballast system to
Maintain the Balance of a FPSO Platform. Society of Petroleum Engineers (SPE) Conference,
Rio de Janeiro, Brazil.

Saipem, (2013). [Online]: Scarabeo 8. Available: http://www.sai-

pem.com/en_IT/static/documents/1612spm_scara8_web.pdf [Accessed 18th February, 2017]
Sandberg L., Hvidsten J., Folke-Olsen E. L., Ellingsund H. A., Nilssen J., Allegra G. (2012). [Online]:
Event Investigation Report, Ballast Incident Scarabeo 8 http://www.eninorge.com/Docu-
ments/Rapporter/Investigation_report_Scarabeo%208-4%20September.pdf [Assessed 14th
March, 2017]

SINTEF, (2011). [Online] Deepwater Horizon-ulykken: Årsaker, lærepunkter og forbedringstiltak

for norsk sokkel
Available: http://www.ptil.no/getfile.php/1314466/PDF/Deepwater%20Horizon%20-
%20SINTEF%20-%20Vedleggsrapport_mai%202011.pdf [Assessed 14th March, 2017]

SINTEF, (2015). [Online]: Towards a holistic approach for barrier management in the petroleum
industry. Available:
https://www.sintef.no/globalassets/project/pds/reports/sintef-a26845-towards-a-holistic-ap-
proach-for-barrier-management-in-the-petroleum-industry-final.pdf [Assessed 12th June, 2017]

63
Sklet, S. (2006). Safety Barriers: Definition, classification, and performance. Journal of Loss Preven-
tion in the Process Industries.

Sklet, S., Aven, T., Vinnem, J. E. (2006). Barrier and operational risk analysis of hydrocarbon releases
(BORA-Release) Part I. Method description. Journal of Hazardous Materials , 137(2):681–691

Sobena, (2007). [Online]: Marine Systems and Ocean Technology. Available: http://www.so-
bena.org.br/msot/downloads/MS&OT_v3_n1_jun2007.pdf [Assessed 23rd February, 2017]
Songa Offshore, (2014). [Online]: Songa Delta; Modified Ocean Ranger design Column Stabilized
Semi-Submersible Rig and Equipment Overview. Available:
http://www.songaoffshore.com/Documents/Songa_Delta_-_Exec_Sum__Oct_2014_.pdf [As-
sessed 4th March 2017]

Standard Norway, (2010). Risk and emergency preparedness analysis, NORSOK Standard Z-013

Teknisk Ukeblad, (n.d). [Online] Riggulykker Available:

https://www.tu.no/artikler/disse-riggene-gikk-det-galt-med/236201
[Assessed 14th March, 2017]

The Ledger, (1980). [Online] 57 evacuated from tilted oil rig. Available:
https://news.google.com/newspapers?id=LIQwAAAAIBAJ&sjid=4PoDAAAAI-
BAJ&pg=6900%2C2180631[Assessed 14th March, 2017]

Tinmannsvik, R., Albrechtsen, E., Bråtveit, M., Carlsen, I., Fylling, I., Hauge, S., Haugen, S., Hynne,
H., Lundteigen, M., Moen, B., Okstad, E., Onshus, T., Sandvik, P., and /Oien, K. (2011). [On-
line]: Deepwater Horizon-ulykken: Årsaker, lærepunkter og forbedringstiltak for norsk sokkel.
SIN- TEF Report. Available: https://www.sintef.no/globalassets/upload/konsern/media/deep-
water-horizon---sintef---vedleggsrapport_mai-2011.pdf [Assessed 23rd February, 2017]
Tronstad, L. (2009). The Use of Risk Analysis in Design: Safety Aspects Related to the Design and
Operation of a FPSO. Society of Petroleum Engineers (SPE) Conference, Stavanger.

Tupper, E. C. (2004). Introduction to Naval Architecture: Naval architecture, Jordan

Hill, GBR, Butterworth-Heinemann, 464 p.

Uscg, (1982). [Online]: Marine Casualty Report; MODU Ocean Ranger O.N. 615641, ‘Capsizing and
Sinking in the Atlantic Ocean, on 15 February 1982 with Multiple Loss of Life’. Available:
https://www.uscg.mil/hq/cg5/cg545/docs/boards/oceanranger.pdf [Assessed 4th March, 2017]

Vinnem JE, Haugen S (1987) Risk assessment of buoyancy loss—introduction to analytical approach,
Paper to City University. In: International conference on mobile units, London, 14–17 Sept 1987

Vinnem, J. E. (2000). Offshore Technology Report. Operational safety of FPSOs: Initial Summary
Report. HSE Health & Safety Executive.

Vinnem J.E, Kvitrud A. and Nilsen L.R., (2006) [Online]: Stabilitetssvikt av innretninger på norsk sok-
kel - Metodikk for risikoanalyse Available: http://www.ptil.no/getfile.php/131246/z%20Kon-
vertert/Helse%2C%20miljø%20og%20sikkerhet/Hm3s-Aktuelt/Dokumenter/2006stabilitets-
sviktforinnretningerpånorsksokkel.pdf [Accessed: 23rd February, 2017]

Øien, K, (2001). Risk indicators as a tool for risk control. Reliability Engineering and System
Safety, 74. 129–145.

Østby, E., Berg, M., and Festøy, B. (1987). Ballast System Failures And Other Faulty Weight Condi-
tions. RABL Risk Assessment of Buoyancy Loss and Other Faulty Weight Conditions.
PPS3:Ballast System

64
65
APPENDIX A
CHAPTER 1 FIGURES

Figure A- 1; SEDCO 135 1st generation rig type built in 1967. Source; Kaiser et al., (2013)

Figure A- 2; Essar Wildcat. A 2nd generation Aker H-3 submersible developed in 1977. Source; Kai-
ser et al., (2013)

66
Figure A- 3; Ocean Patriot, a 3rd generation Bingo 3000 semisubmersible, built in 1983. Source; Kai-
ser et al., (2013)

Figure A- 4; Transocean Richardson, a 4th generation semi-submersible, built in 1988/1991. Source;

Deepwater, (n.d ,a)

67
Figure A- 5; Leiv Eirikssen, a 5th generation semisubmersible, built in 2001. Source; Ocean Rig (n.d)

Figure A- 6; Transocean Spitsbergen a 6th generation semisubmersible Aker H-6e Semi-submersible ,

built in 2009. Source; Deepwater, (n.d ,b)

68
APPENDIX B
STABILITY CALCULATIONS

69
70
71
72
73
APPENDIX C
FAILURE MODE AND EFFECT ANALYSIS & FAULT TREE ANALYSIS

Figure C-1 Failure rates of ballast system components Source; Østby,., and Festøy, . (1987)

74
 Table C- 1: Severity rate

Table C- 2:Occurrence rate

Table C-3: Detection rate

75
Table C- 2: Failure Mode

76
Attachment 7.1 - FMEA Sheet Page 1 of 2

B C D E F G H I J K L N O P Q R

5 APENDIX C-2 - Failure Modes Effects Analysis (FMEA)

6 Product Name: Ballast system FMEA Workshop Participants: Prepared by: Rev. 00

Owner: UIS MASTER THESIS Ihuaku Nneoma Kelechi Unegbu FMEA Date (Orig):
7
8
S O D R
Potential Failure
Main Functions Local Failure Effects Global Failure effects SEV (S) Potential Causes OCCURENCE (O) Current Controls DETECTION (D) RPN Actions Recommended Actions Taken E C E P
Mode
9 V C T N

What are the existing controls

What is the impact of the function failure on How well can you Note the actions taken.
In what ways can the What is the impact of the function failure on How Severe is the What causes the function to How often does cause and procedures that prevent What are the actions for reducing the occurrence of the cause, or improving
What are the functions? system, related system, process, product, detect the Cause or the S*O*D Include dates of
function fail? system element/function under consideration effect? fail? or FM occur? either the Cause or the Failure detection?
service, costumer or regulation Failure? completion.
Mode?
10

BALLAST TANK COMPARTMENT

11
Low pumping output due to leakage of the utilities
1.Ballast tanks are in general placed in the platform ballasting failure 4 2 2 16 4 2 2 16
13 tools such as valve Periodic Checking before operation for being free by
lower hull and columns, and symmetrical within ELU Cavitation/corrosion
failure due to pressure and parameter deviation of turning shaft
each hull. The reason for the symmetric platform deballasting failure 4 2 2 16 4 2 2 16
14 other ballast tanks components
distribution is to be able to distribute loads The operation and Client
evenly, to avoid shear forces and bending maintenance procedure
excessive reduction ballast in the tanks High heeling of the platform 3 4 contained in the 5 60 Regular checking of the components, before 3 4 5 60
15 moments to build up, and also to be able to
INL material Failure ballasting/deballasting manual operation, Operates based on the manual, Regular
trim the vessel evenly. A ballast tank is a should be strictly adhere to. cleaning
Flooding of adjacent tanks platform instability 3 3 5 45 3 3 5 45
16
compartment within the semi floating structure Daily inspection should be
that holds water,it is used as ballast to provide performed
stability for a vessel. Fatique damage of ballast compactments Global structural failure of the platform 5 sloshing of ballast, material 1 3 15 5 1 3 15
17
STD failure and corrosion of periodic structural check and regular maintenance
Failure of plates connection of ballast tanks Global structural failure of the platform 5 connection 3 15 5 1 3 15
18 1

PIPES
19

No/low flow ballast movement due to leakage reduced ballasting/deballasting operation 4 2 1 8 Regular checking of the components, before 4 2 1 8
20
ELP burst/corrosion of pipe operation, Operates based on the manual, Regular
- make redundant other related system 4 2 1 8 cleaning 4 2 1 8
21

No/low flow ballast movement due to leakage reduced ballasting/deballasting operation 4 1 1 4 Regular checking of the components, before 4 1 1 4
22 The operation and Client
SER Leakage/erosion operation, Operates based on the manual, Regular
Cause overheating of some parts seals due to under ultilization of related system and maintenance procedure cleaning
2.PIPING it’s a metallic tubular pipe 4 1 contained in the 1 4 4 1 1 4
23 inappropriate flow proscess
system(suction or delivery) used for conducting ballasting/deballasting manual
or transferring of fluid like water, oil and fuel. No transportation of fluid due to structural failure reduced ballasting/deballasting operation 4 2 should be strictly adhere to. 4 32 4 2 4 32
24 Daily inspection should be
VIB Fatigue performed adequate structural support provided and vibration damping components installed
make redundant other system elements make redundant other related system 4 2 5 40 4 2 5 40
25

Fatique damage to other attached system elements No ballasting/deballasting operation 4 2 2 16 4 2 2 16

26 Erosion/excessive
STD periodic structural check and regular maintenance
deformation/excessive vibration
Vibration of other connected components attached damage to other related components 4 4 32 2 4 4 32
27 2

ELECTRIC POWER SYSTEM

28
Generator Failure and main electric supply loss of main electric power supply to the
BRD ballasting/deballastion control system Generator Failure 4 24 regular inspection and maintenace 3 2 4 24
unavailable
29 operation 3 2
Damage to components that utilises electricity due
halting of ballast operation 2 4 32 4 2 4 32
30
to flunctuating power supply 4
ERO Faulty Generator regular inspection and maintenace
Damage to ballast control system components Delay in ballasting operation 2 4 24 3 2 4 24
31 3
3.Main Power Supply Generator; Electric
loss of main electric power supply during
power is mainly used for ballast control system, Unavailability of main electric power supply
ballasting and deballastion operation The operation and Client
5 10 2 1 5 10
32 pumps and hydraulic units. A power supply is 2 1 Regular checking of the components, before
UST Generator Control Failure maintenance procedure operation, Operates based on the manual
an electronic device that supplies electric Damage to ballast control system components Delay in ballasting and deballasting operation contained in the 3 12 4 1 3 12
33 energy to an electrical load. The primary 4 1 ballasting/deballasting manual
function of a power supply is to convert one should be strictly adhere to.
excessive main power supply and damage to loss of main electric power supply during Daily inspection should be Regular checking of the components, before
form of electrical energy to and, as a result, HIO Faulty Generator 2 4 24 3 2 4 24
ballast control system ballasting and deballastion operation performed operation, Operates based on the manual
34 power supplies are sometimes referred to as 3
electric power converters
Inadequate main power supply and damage to Regular checking of the components, before
LOO halting of ballast/deballasting operation Faulty Generator 3 12 2 2 3 12
ballast control system operation, Operates based on the manual.
35 2 2

Unavailability of main electric power supply Delay in ballasting/deballasting operation 2 4 16 2 2 4 16

36 2 Regular checking of the components, before
FTS Generator Control Failure
downtime for the ballasting/deballasting operation, Operates based on the manual
- 2 5 20 2 2 5 20
37
operation 2
Generator Failure and main electric supply loss of backup electric power supply during application of suitable oil should be encouraged and
BRD 5 backup generator failure 1 5 25 5 1 5 25
38
unavailable ballasting/deballastion operation Regular maintenance of cooling system

Damage to components that utilises electrical fauire

halting of ballast operation 5 1 2 10 5 1 2 10
39
due to flunctuating power supply application of suitable oil should be encouraged and
ERO Faulty backup generator
Regular maintenance of cooling system
4.Emergency Backup Generator An Backup generator control Failure Delay in ballasting operation 5 1 2 10 5 1 2 10
40
emergency power system is an independent
loss of main electric power supply during
source of electrical power that supports Unavailability of main electric power supply 5 1 The operation and Client 5 25 5 1 5 25
41
ballasting and deballastion operation application of suitable oil should be encouraged and
important electrical systems on loss of normal UST Backup generator Control Failure maintenance procedure
Regular maintenance of cooling system
power supply. A standby generator is a back- Damage to utility Components in the event of failure
Delay in ballasting and deballasting operation 4 1 contained in the 5 20 4 1 5 20
42 up electrical system that operates of main power supply ballasting/deballasting manual
automatically.[1] Within seconds of a utility should be strictly adhere to.
Damage to utility Components in the event of failure loss of main electric power supply during Daily inspection should be Regular checking of the components, before
outage an automatic transfer switch senses the HIO 4 Faulty backup generator 1 2 8 4 1 2 8
of main power supply ballasting and deballastion operation performed operation, Operates based on the manual
power loss, commands the generator to start
43
and then transfers the electrical load to the
generator no electric power supply backup for Regular checking of the components, before
LOO Inadequate backup electric power supply Faulty backup generator 1 4 16 4 1 4 16
ballasting/deballasting operation operation, Operates based on the manual
44 4

Delay in ballasting operation in the event of Regular checking of the components, before
FTS Unavailability of backup electric power supply Backup generator control failure 1 4 20 5 1 4 20
failure of main electric power supply operation, Operates based on the manual
45 5

No backup electrical power supply for Regular checking of the components, before
BRD unavailability of temporary backup power supply 5 UPS failure 2 5 50 5 2 5 50
ballast/deballasting control system The operation and Client operation, Operates based on the manual
46 5.Uninterrupted Power Supply (UPS) The maintenance procedure
UPS is intended to supply electricity in the contained in the
mean time in the occasion where the main No backup electrical power supply for ballasting/deballasting manual Regular checking of the components, before
ERO Unreliable temporary backup power supply 4 UPS failure 1 5 20 4 1 5 20
ballast/deballasting control system should be strictly adhere to. operation, Operates based on the manual
power does not supply electricity, until the
47 Daily inspection should be
backup generator is running
performed
No backup electrical power supply for Regular checking of the components, before
FTS unavailability of temporary backup power supply 5 UPS failure 1 5 25 5 1 5 25
ballast/deballasting control system operation, Operates based on the manual
48
Attachment 7.1 - FMEA Sheet Page 2 of 2

B C D E F G H I J K L N O P Q R

HYDRAULIC POWER SYSTEM

49
The operation and Client
halting ballasting and deballasting operation maintenance procedure Regular checking of the components, before
BRD loss of main hydraulic pressure function Hydraulic pump failure 1 5 25 5 1 5 25
due to loss of hydraulic power contained in the operation, Operates based on the manual
50 5 ballasting/deballasting manual
temporary unavailability of main hydraulic power halting ballasting and deballasting operation should be strictly adhere to. Regular checking of the components, before
DOP High pressure distance 2 Daily inspection should be 4 16 2 2 4 16
fuction due to loss of hydraulic power operation, Operates based on the manual
51 2 performed
6.Main Hydraulic Power Generator The
MHPG provides hydraulic pressurre required Regular checking of the components, before
ELP loss of hydraulic pressure reduced ballasting/deballasting operation hydraulic fluid failure 1 5 10 2 1 5 10
by the ballast system. it transforms the operation, Operates based on the manual
52 hydraulic power of a working system into high 2
quality electricity with great efficiency. It also No ballasting/deballasting operation due to Regular checking of the components, before
eliminates dependency on wires across FTF loss of hydraulic accumulator function control Signal Failure 1 5 15 3 1 5 15
loss of hydraulic function operation, Operates based on the manual
53 troublesome areas such as electric swivels, 3
repetitive bend joints, and lengthy wire runs
halting ballasting and deballasting operation Regular checking of the components, before
UST Unavailability of hydraulic function control Signal Failure 3 5 30 2 3 5 30
due to loss of hydraulic power operation, Operates based on the manual
54 2

Damage to other components due to uncontrol Regular checking of the components, before
STP uncontrol ballast and deballasting operation 5 control Signal Failure 2 4 40 5 2 4 40
hydraulic function operation, Operates based on the manual
55

halting ballasting and deballasting operation Regular checking of the components, before
BRD loss of accumulator function accumulator Failure 1 3 15 5 1 3 15
due to loss of hydraulic power operation, Operates based on the manual
7.Hydraulic Accumulators A hydraulic accumulator
56 5
is a pressure storage reservoir in which a non-
temporary unavailability of hydraulic accumulator halting ballasting and deballasting operation The operation and Client
compressible hydraulic fluid is held under pressure 1 5 25 5 1 5 25
fuction due to loss of hydraulic power maintenance procedure
57 that is applied by an external source. The external 5 contained in the application of suitable oil should be encouraged and
source can be a spring, a raised weight, or a ELP structural damage
ballasting/deballasting manual Regular maintenance of cooling system
compressed gas. Accumulators can increase loss of hydraulic pressure reduced ballasting/deballasting operation 1 5 25 5 1 5 25
should be strictly adhere to.
58 efficiency, provide smoother, more reliable operation, 5
Daily inspection should be
and store emergency power in case of electrical No ballasting/deballasting due to loss of
Unavailability of hydraulic backup power 1 performed 5 25 5 1 5 25
failure. It is a simple hydraulic device which stores backup hydraulic function
59 5 application of suitable oil should be encouraged and
energy in the form of fluid pressure FTF accumulator Failure
halting ballasting and deballasting operation Regular maintenance of cooling system
Unavailability of hydraulic function 1 5 25 5 1 5 25
due to loss of hydraulic power 5
60

BALLAST CONTROL SYSTEM

61
Flooding or no ballasting/deballasting
No ballast valve function 4 2 5 40 4 2 5 40
operation Periodic Checking before operation for being free by
62
BRD Value failure/breakage
No ballasting/deballasting due to mechanical turning shaft
4 2 5 40 4 2 5 40
breakdown
63
application of suitable oil should be encouraged and
DOP temporary unavailability of Valve fuction Delayed ballasting and deballasting operations 3 Faulty feedback from valve 3 3 27 3 3 3 27
Regular maintenance of cooling system
64 8.Ballast Valves Hydraulic power is used to operate
ballast valves. An electrically driven pump unit called
FTO ballast tank is closed No ballasting/deballasting operation 5 Actuator Failure 2 The operation and Client 3 30 application of suitable oil should be encouraged and 5 2 3 30
a hydraulic power unit (HPU) provides pressure to the
65 maintenance procedure
control console that provides pressure to each
contained in the
actuator/valve in the system (Hancox, 1996). For Routine filter cleaning and regular inspection should
FTC ballast tank is opened uncontrolled ballasting/deballasting operation 5 Actuator Failure 3 ballasting/deballasting manual 4 60 5 3 4 60
emergency situations where the HPU does not be performed
66 should be strictly adhere to.
function, hand pumps can be connected into the
Daily inspection should be Routine filter cleaning and regular inspection should
pressure side of the system to man- ually control INL bidirectional ballast leakage uncontrolled ballasting/deballasting operation 4 Valve erosion/corrosion 2 3 24 4 2 3 24
performed be performed
67 valves. Valves include; Sea chest valves, pump room
valves, discharge valves and ballast tank valves Damage to other system components as a result of
No production output 5 4 2 40 5 4 2 40
unregulated pressure Periodic Checking before operation for being free by
68
STD valve component failure
turning shaft
No ballast valve function No/low/high production due to improper valve 5 2 3 30 5 2 3 30
69

UST No ballast valve function halting of ballasting/deballasting operation 5 Selenoid Failure 1 5 25 Regular and periodic maintenance and inspection based operation manual 5 1 5 25
70
Damage to other system elements due to Low/High production due to mechanical
4 1 5 20 4 1 5 20
unregulated flow. breakdown
71
BRD Pump Motor Failure Regular and periodic maintenance and inspection based operation manual
No ballasting/deballasting due to loss of
No pumping 5 2 5 50 5 2 5 50
pumping function
72
Routine inspection and maintenance, Routine
DOP temporary unavailability of pump fuction Delayed ballasting and deballasting operations 5 No Control Signal 2 2 20 5 2 2 20
cleaning, Scale & corrosion inhibitor, coating
73
Cause overheating or mechanical damage to
pumping stop 5 1 5 25 5 1 5 25
some parts like bearings due to no/low flow application of suitable oil should be encouraged and
74
FTR No Control Signal The operation and Client
Damage to other components due to variation in Regular maintenance of cooling system
uncontroled ballast and deballasting operation 3 1 maintenance procedure 5 15 3 1 5 15
9.Ballast Pump Ballast pump is used to empty or fill flow input or output contained in the
75
the heeling tank. It is designed to efficiently transfer ballasting/deballasting manual
Damage to other components due to uncontrol flow Routine inspection and maintenance, Routine
vast amount of sea water into the marine vessels STP uncontroled ballast and deballasting operation 3 Pump Motor Failure 2 should be strictly adhere to. 5 30 3 2 5 30
such as valve cleaning, Scale & corrosion inhibitor, coating
76 Daily inspection should be
Damage to other system components as a result of performed
Delay in ballasting and deballasting operation 4 1 1 4 4 1 1 4
unregulated pressure
77
STD Pump Motor Failure Regular and periodic maintenance and inspection based operation manual
Loss of pump functions No/low/high production due to improper valve 4 2 5 40 4 2 5 40
78

delay in ballasting and deballasting operation,

Unavailability of pump function 2 Faulty pump motor 5 5 50 Regular and periodic maintenance and inspection based operation manual 5 50
thus semi rig stability problematics
79 FTS
unwarranted damage to other system elements due Routine inspection and maintenance, Routine
loss of ballasting and deballasting operation 5 Pump Motor Failure 1 4 20 5 1 4 20
to false stop cleaning, Scale & corrosion inhibitor, coating
80

Loss of Control Valves and pump functions Loss of valve and pump control 5 1 2 10 5 1 2 10
81 Faulty feedback from valve and Routine inspection and maintenance, Routine
AIR
pump cleaning, Scale & corrosion inhibitor, coating
Low/high pumping due to false/real high/low signal Improper ballasting and deballasting operation 4 1 1 4 4 1 1 4
82

Loss of Control Valves and pump functions Delay in ballasting and deballasting operation 5 1 1 5 5 1 1 5
83 application of suitable oil should be encouraged and
BRD control Logic Failure
Inaccurate ballasting and deballasting Regular maintenance of cooling system
Unavailability of control signal 5 1 1 5 5 1 1 5
Operation
84 The operation and Client
10.Ballast Control Logic unit this system provides Damage to other components due to parameter maintenance procedure
electrical control signal, it controls the ballasting and Delay in ballasting and deballasting operation 5 1 contained in the 1 5 5 1 1 5
deviation Faulty feedback from valve and Routine inspection and maintenance, Routine
85
de-ballasting operation by responding to commands PDE ballasting/deballasting manual
Cause improper operation for some members like pump cleaning, Scale & corrosion inhibitor, coating
from the operator and it also acts on its own to 5 2 should be strictly adhere to. 1 10 5 2 1 10
valves due to false readings Daily inspection should be
86 perform automated tasks.
performed
unwarranted damage to other system elements due
UST halting of ballast and deballasting operation 5 control Logic Failure 2 1 10 Regular and periodic maintenance and inspection based operation manual 5 2 1 10
to false stop
87

Loss of Control Valves and pump functions Loss of valve and pump control 4 1 1 4 4 1 1 4
88 Faulty feedback from valve and Routine calibration of pressure transmitter, Routine
FTI
pump inspection and maintenance
Uncontroled Value and pump operation Improper ballasting and deballasting operation 5 1 2 10 5 1 2 10
89

FTR Uncontroled Value and pump operation Improper ballasting and deballasting operation 4 control Logic Failure 1 2 8 Regular and periodic maintenance and inspection based operation manual 4 1 2 8
90
Figure C- 3; Fault Tree analysis

79
APPENDIX D-1

BARRIER DIAGRAMS AND BARRIER ANALYSIS

80
Figure D- 1; description of the nodes in the barrier diagram

81
Figure D- 2: Ocean ranger (1982)

82
Figure D- 3; Ocean ranger (1982) (Contd.)

83
 Performance colour codes Glossary
Red = Barrier failure HMI = Human Machine Interference
Yellow = Partial barrier failure PTW = Permit to work system
N/A = Not Applicable
Green = Barrier success

Table D- 3: Ocean Ranger accident barrier performance table. Source; COWI, (2003); Vinnem (2013)

Barrier func- Barrier System Barrier Element Risk Influencing Barrier Performance
tions Factors

Technical Operational Organisational

FAILURE OF BARRIER
A. Maintain 1. Ballast Control -Ballast control room - Monitor system - Operator -Response time
Structural System -Remote system - Alarm response - Decision making The control room was vulnera-
-Control panel training ble to bad weather due to its lo-
Integrity
- deadlights -Competence cation. It was close to the mean
and Marine -Alarms - HMI water level (i.e., in a column.
Control This caused a portlight to break
as a large wave appeared.

2. Operations and -Maintenance standards -Maintenance manual -Shift workers - Safety culture The remote system was not in
Maintenance - Shift manager -Inspection place to read the draft of the
-Supervisor - Quality procedures rig, resulting to open deadlights
- supervision
3. Design Safety
- Industrial standards -Testing Insufficiently robust design of
and weathertight
- Doors -Quality audits - Design team -Safety critical ex- the components in the control
integrity - Hatchways panel. They were not designed
-Position definition pertise
- Machinery space - Safety culture to be protected against sea wa-
openings -Design procedure ter
- Ventilators -Technical condition
- Air pipes -Industrial standard The management did not make
- Inlets and discharges conformance training programs and opera-
- Freeing ports tional manuals available to the

84
 personnel. This is therefore the
reason why the two operators
on duty lacked familiarity and
expertise to close the deadlights
during the storm

FAILURE OF BARRIER
- Communication
B. prevent es- - Ballast control con- -Emergency detectors -Respond to detectors -Operator - Condition of tech.
sole -Alarms - Swift response to -Platform Man- systems The ballast control console was
calation of
-Detect leakage alarms ager - Operating proce- susceptible to common faults
initiating - ballast valve actuators dures and confusing information.
failure -Sensor tube -Experience This was due to the intercon-
-Work practice nection between the electrical
- Weather circuits used for control and
-Communication sys- - Pumping and drain- -Response time monitoring aspects
-Pumping and drain- tems ing drills -Operator -Action criteria
ing system -Pumps -Design robustness There was imprecision in the
-Emergency drain tanks tank level gauge as a result of
-Emergency re- location of the sensors
sponse training
The forward tanks were not
-Emergency detectors -Respond to detectors functioning as needed due to
-Alarms - Swift response to -Emergency sup- low capacity of the pumps
- Emergency Shut- -Emergency cut off elec- alarms port vessel crew
down system tricity and air supplies to -Platform Man-
ballast system ager

85
 FAILURE OF BARRIER
C. prevent to-
tal loss 1. Additional bal- - ballast valve actuators - Monitor sensors - Operator - Safety culture There was no available in-
last back up sys- -Backup sensors -Control valves -Platform Man- -Design procedure stalled alarm system in place to
tem -Control panel ager -Technical condition alert the crew of the impending
-Pump room valves -Response time flooding of the chain lockers
-Ballast valves -Action criteria
-Sea chest valves The pumps were inefficient as
-Discharge valves they were not able to move wa-
-Ballast pumps ter around when the rig was
-Alarms subjected to a 6 degrees list
-Chain Lockers -Design robustness
Design procedure
Although the regulation re-
-Operator quired certain integrity and
2. Water tight in- -Watertight doors -Condition monitor- -Platform Man- buoyancy of the upper hull
tegrity -Bulkhead valves ing ager structure, it was not imple-
-Bilge system mented in the design

The Chain lockers were suscep-

tible to flooding through its
pipe and wire trunk openings
on top of the corner columns.
this resulted to loss of buoy-
ance, hence the capsize of the
platform.

FAILURE OF BARRIER
D. Prevent fa-
talities 1. Evacuation sys- - Evacuation routes -Alarm response by - Emergency - Leadership Some of the safety boats were
tem - Safety devices personnel response team - safety equipment unavailable because of pres-
- Muster area - Rescue operations - Rescue teams accessibility ence of trim. This was due to
- Evacuation vessel - Platform - Competence the fact that procedure was in
contact manager - Evacuation training place for standby boats during
- Response timing the storm.
- Reporting
- Decision making
ability

86
 - Communication The SAR rescue helicopters
- Weather were vulnerable to bad weather
hence, not able to be deployed
Communication was ineffec-
- Operator -Communication tive hence, complications in the
- Internal commu- - Platform channels search and rescue preparedness
2. Communication - Alarm nication - Instruction clarity
manager
system - Public address sys- - External commu- -Response timing
tem nication
- other communica-
tion channels

87
Figure D- 4; Ocean Developer (1995)

88
 Performance colour codes Glossary/Acronyms
Red = Barrier failure HMI = Human Machine Interference
Yellow = Partial barrier failure EDT = Emergency drain tank
Green = Barrier success N/A = Not Applicable
FUP =Sole Petroleum Workers Federation
Table D- 4; Possible barrier performance table for Ocean Developer Source; COWI, (2003). Vinnem, (2006)
Barrier functions Barrier System Barrier Element Risk Influencing Factors Barrier Performance

Technical Operational Organisational

FAILURE OF BARRIER
1. Ballast Control -Ballast control room - Monitor system - Operators -Response time
A. Maintain System -Remote system - Alarm response - Decision making train- The overall ballast system
Structural In- -Control panel ing was complex, hence vulner-
- deadlights -Competence able to human error. This re-
tegrity and
-Alarms - (HMI) sulted to someone pushing
Marine Con- the wrong button
trol - Design team
2. Design Safety - Industrial standards -Design Team -Safety critical expertise
-Quality audits - Safety culture
-Design procedure
-Technical condition
-Industrial standard con-
formance

Lack of Information Lack of Information

B. Prevent escala- Lack of Information Lack of Information Lack of Infor- Lack of Information
tion of initiating mation
failure

89
 Lack of Information
C. Prevent total Lack of Information Lack of Information Lack of Infor- Lack of Infor- Lack of Information
loss mation mation

SUCCESS OF BARRIER
D. Prevent fatal-
ities 1 Evacuation system - Evacuation - Alarm response - Emergency re- - Leadership
routes by personnel sponse team - safety equipment acces- The emergency evacuation
- Safety devices - Rescue opera- - Rescue teams sibility team was functional and ef-
- Muster area tions - Platform manager - Competence fective as they made towing
- Evacuation - Evacuation training vessels (emergency tug
vessel contact - Response timing boat) readily available to
- Reporting save 24 crew members be-
- Decision making ability fore the rig capsized
- Weather

2 Communication
- Alarm - Internal com- - Operator -Communication channels
system munication - Platform manager - Instruction clarity
- Public address
system - External com- -Response timing
- other communi- munication
cation channels

90
Figure D- 5: PETROBRAS P-36 (1982)

91
Figure D- 6; PETROBRAS P-36 (1982) (Contd.)

92
 Performance colour codes Glossary/Acronyms

Red = Barrier failure HMI = Human Machine Interference

Yellow = Partial barrier failure EDT = Emergency drain tank
Green = Barrier success N/A = Not Applicable
FUP =Sole Petroleum Workers Federation

Table D- 5; Petrobras p-36 performance table. Source; COWI, (2003); Sobena, (2007); NASA, (2008)
Barrier func- Barrier System Barrier Element Risk Influencing Barrier Performance
tions Factors

Technical Operational Organisational

FAILURE OF BARRIER
A. Maintain 1 Ballast Con- -Ballast control room - Operator - Monitor system -Response time
Structural trol System -Remote system - Alarm response - Decision making The right side starboard EDT
-Emergency drain tanks training was removed for repair. How-
Integrity
-Control panel -Competence ever, the port left side EDT
and Marine - deadlights - HMI was left for operation which
Control -Alarms when activated allowed
buildup of water, oil and gas in
3. Operations and pipes connecting both EDTs
Maintenance -Maintenance standards -Maintenance man- -Shift workers - Safety culture
ual - Shift manager -Inspection The Valve was leaking and al-
-Supervisor - Quality proce- lowed a mixture of fluids and
dures vapour into the starboard EDT
- supervision which made tank vulnerable to
- According to the Sole Petro-
leum Workers Federation
(FUP), the decision to reduce
workforce was an underlying
cause of the disaster. Over a
decade earlier, workers were

93
 reduced and outsourced to
subcontractors with little or no
training

FAILURE OF BARRIER
- Communication
B. Prevent es- 1 Ballast control Emergency detectors -Respond to detec- -Operator - Condition of tech. Lack of expertise in the part of
console -Alarms tors -Platform Manager systems - Operating operators was highlighted as
calation of
-Detect leakage - Swift response to procedures they failed to follow proce-
initiating - ballast valve actuators alarms - Experience dures to prevent flooding after
failure -Sensor tube - Work practice they opened the stability box
and ballast tank for inspection.
-Response time The ballast control console was
-Action criteria vulnerable to confusing infor-
2 Pumping and -Communication sys- - Pumping and drain- -Operator -Design robustness mation and faults. This was due
draining system tems ing drills to interconnection between the
-Pumps -Design robustness electrical circuits. The electri-
-Emergency drain tanks cal circuits were used for mon-
itoring and control aspects
-Emergency re- Ventilation damper’s actuators
3. Water tight in- Watertight doors -Condition monitor- sponse training failed due to poor mainte-
tegrity -Bulkhead valves ing -Operator nance. The fire brigade actions
-Blast protection doors -Communication and ventilation ducts which
channels opened the water tight doors
- Instruction clarity allowed the flow of gas to an
4. Emergency -Emergency detectors -Response timing ignition source thereby caus-
Shutdown sys- -Alarms -Respond to detec- -Emergency sup- ing an explosion. This led to
tem -Emergency cut off tors port vessel crew the death of 11 personnel
electricity and air sup- - Swift response to -Platform Manager
plies to ballast system alarms Failure to prioritize alarm en-
tries. About 1,723 alarms rang
in the space of 17 minutes be-
-Alarm -Operator tween the EDT rupture and the
5. Communication - Public address system - Internal communi- -Platform manager explosion. This could have
system - other communication cation been overwhelming to the op-
channels erators thereby subjecting them
-External communi- under stress.
cation

94
 The public address system
failed to function. This resulted
to a communication gap be-
tween operators and the public
address team , as they were not
informed about a ruptured pipe
flooding into the column

FAILURE OF BARRIER
C. prevent to-
tal loss 1. Flood control - Ballast valve actuators - Operator - Operator - Safety culture Failure by design engineer to
system (Re- -Sensor tube -Platform Manager -Platform Manager -Design procedure implementation the design of
serve buoy- -Control panel -Technical condi- integrity and buoyancy for up-
ancy) -Pump room valves tion per hull structures as required
-Ballast valves Response time by regulations
-Sea chest valves -Action criteria
-Discharge valves -Cost cutting The sensor tube’s location for
-Ballast pumps tank level gauges were not
-Buoyance reserve precise in tilted condition. This
made it difficult to read hence
losing its functionality
-Watertight doors -Condition monitor- -Operator -Design robustness
2. Water tight in- -Bulkhead valves ing -Platform Manager - Cost cutting Failure to isolate leaking valve
tegrity -Bilge system which allowed a mixture of
fluids and vapour into the star-
board EDT. Also closeness of
the EDT to the seawater fire-
fighting service pipes and
placement in the columns sig-
nificantly contributed to the
disaster. This design error was
influenced by cost reduction.
After the explosion, the EDT
firefighting system was dam-
aged and the rig began to sink

Efforts to stabilize the unit

failed as operators pumped

95
 water into the opposite col-
umn. Unfortunately, the flood
speed into one side of the col-
umn was too much to handle

Reserve buoyancy in the form

of air injection was available
and functioned for evacuation
purposes

PARTIAL FAILURE
D. Prevent fa-
talities 1. Operation and - Ventilation damping - Maintenance - Shift manager - Quality Procedure Ventilation damper’s actuators
maintenance actuators standards -Supervisor - Safety culture failed to function due to poor
-Inspection maintenance. The fire brigade
- Quality proce- actions and ventilation ducts
dures that open watertight doors al-
- supervision lowed the flow of gas to an ig-
nition source thereby causing
- Emergency re- - Leadership an explosion. The explosion
2. Evacuation sys- - Evacuation routes - Alarm response sponse team - safety equipment led to the death of 11 person-
tem - Safety devices by personnel - Rescue teams accessibility nel
- Muster area - Rescue opera- - Platform man- - Competence
tions ager - Evacuation train- Reserve buoyancy functioned
- Evacuation ves- ing for evacuation of 138 person-
sel contact - Response timing nel. 138 personnel that were
- Reporting not involved in the emergency
- Decision making operations were safely evacu-
ability ated by crane and personnel
- Communication transfer basket.

- Alarm - Internal com- -Communication

3. Communication - Operator munication channels
system - Public address
- Platform man- - External com- - Instruction clarity
system ager munication -Response timing
- other communica-
tion channels

96
Figure D- 7: THUNDER HORSE (2005)

97
Figure D- 8: THUNDER HORSE (2005) (Contd.)

98
 Performance colour codes Glossary

Red = Barrier failure HMI = Human Machine Interference

Yellow = Partial barrier failure HPU = Hydraulic Power Unit
Green = Barrier success MCT = Multiple Cable Transit
N/A = Not Applica-
ble

Table D- 6;Thunder Horse accident barrier performance table. Source; Bsee, (n.d)
Barrier functions Barrier System Barrier Element Risk Influencing Barrier Performance
Factors

Technical Operational Organisational

FAILURE OF BARRIER
A. Maintain 1. Hydraulic Control - Control room - Monitor system - Operator -Response time
Structural System and Isola- -Remote system - Alarm response - Decision making Failure of BP to establish
tion -Control panel training operating procedures for
Integrity and
- HPU controls -Competence the Hydraulic Power Unit
Marine Con- -HPU back-up system - Human-machine (HPU) that controls the
trol -Alarms interface (HMI) bilge and ballast systems.
This caused the rig to be
vulnerable to extreme
2 Operations and -Maintenance stand- -Permit to Work -Operator - Safety culture weather.
Maintenance ards and guides System - Platform manager -Inspection
-Maintenance man- -Supervisor - Quality proce- The crew lacked expertise
ual dures to successfully isolate the
- supervision HPU. This caused the
valves to make several
3 Design Safety - Industrial standards -Quality audits - Design team -Safety critical ex- movements, thereby allow-
pertise ing water ingress in the
- Safety culture unit.
-Design procedure
Failure of BP to conduct a

99
 -Technical condi- hazard and operability
tion (HAZOP) study of the
-Industrial standard HPU so as to identify po-
conformance tential hazards that could
occur during operation of
the HPU system.

The remote system was

unavailable when needed
for draft reading thereby,
resulting to open deadlights

Insufficient robust design

of the components in the
control panel. They were
not designed to be pro-
tected against sea water

Lack of training programs

and operational manuals.
This reflected in the deci-
sion making of two opera-
tors, as they did not close
the deadlights during the
storm.

FAILURE OF BARRIER
- Communication
B. Prevent Es- 1. Ballast control Emergency detectors -Respond to detec- -Operator - Condition of tech. Lack of expertise by the
calation of console -Alarms tors -Platform Manager systems - Operating MCT Brattberg personnel.
-Detect leakage - Swift response to procedures They failed to properly in-
Initiating
- ballast valve actua- alarms - Experience stall the right configuration
Failure tors - Work practice for the MCTs. This led to
-Sensor tube -Weather spaces in the bulkhead to
-Response time be filled with blank blocks
-Action criteria
2. Pumping and -Communication sys- - Pumping and -Operator -Design robustness Failure of operator to in-
draining system tems draining drills spect the installation of the
-Pumps MCTs

100
 -Emergency drain - Safety culture
tanks -Inspection Faulty installation of check
- Quality proce- valves in the bilge system
3. Operations and - Maintenance stand- -Maintenance man- -Operator dures by the operator. This led to
maintenance ards and guides ual - Platform manager - supervision the migration of ballast wa-
-Inspection -Supervisor ter into manned spaces in
the hull
The forward tanks did not
function as expected (i.e.,
emptying function) due to
low capacity of the pumps
FAILURE OF BARRIER
C. Prevent To-
tal Loss 1. Flood control sys- -Chain lockers - Inspection - Operator - Safety culture Failure to inspect all possi-
tem (Reserve - Underwater manifold -Platform Manager -Design procedure ble downflooding places
buoyancy) - Ballast valve actua- -Technical condi- and water/weather tight
tors tion barriers. After the incident,
-Sensor tube Response time the repair personnel found
-Control panel -Action criteria out that there was crack in
-Ballast valves the underwater manifold.
-Sea chest valves This was due to failure to
-Discharge valves weld pipes properly.
-Check valves -Response time
-Ballast pumps -Familiarization
-Buoyancy reserve The rig’s reserve buoyance
functioned (buoyant deck).
-Design robustness This made it possible to
2. Equipment pro- -Sensors -Monitor system -Operators -Design procedure avoid of total loss of the
tection system -Control valve -Operate valves rig, hence righted six
weeks later

3. Water/weather
tight integrity -Water tight doors -Condition monitor- - Operator
-Bulkheads ing -Platform Manager
Industrial standards
- Hatchways - Ma-
chinery space open-
ings
- Ventilators

101
 - Air pipes
- Inlets and dis-
charges
- Freeing ports

D. Prevent fa- N/A N/A N/A N/A N/A N/A

talities

102
Figure D- 9: SCARABEO 8 (2012)

103
 Glossary
Performance colour codes
Red = Barrier failure HMI = Human Machine Interference
Yellow = Partial barrier failure DSV = ENI Drilling Supervisor
Green = Barrier success N/A = Not Applicable
COOP = Control room operator

Table D- 7;: Scarabeo 8 accident barrier performance table Source; Sandberg et al., (2012)

Barrier func- Barrier System Barrier Element Risk Influencing Barrier Performance
tions Factors

Technical Operational Organisational

FAILURE OF BARRIER
1 Ballast Control -Ballast control room - Monitor system - Operator -Response time
A. Maintain System -Remote system -Operate valves -Shift workers - Decision making Lack of competence on the
Structural -Control panel - Shift manager training bridge incident, because the on
- Ballast valves -Supervisor -Competence duty COOP was not sufficiently
Integrity
-Alarms - HMI trained for ballast control tasks.
and Marine -Bridge handover Valves were opened to compen-
Control sate for the 7 degrees list by the
on duty control room operator.
This led to the flow of water
into the 1189 m3 tank

The HMI on the Ballast Control

System and the bridge was not
optimal. This made the identifi-
cation of the opened aft sea chest
valve difficult.

104
 SUCCESS OF BARRIER

B. Prevent es- 1 Ballast control -Emergency detectors -Respond to detec- -Operator - Communication The general alarm and public
console -Alarms tors -Platform Manager - Condition of tech. address system functioned
calation of
-Public address - Swift response to systems properly and crew members
initiating system alarms - Operating proce- were ordered to muster at the
failure - ballast valve actua- dures temporary refuge
tors -Experience
-Sensor tube - Work practice Expertise and mobilization time
-Response time was attained as there was deci-
-Action criteria sive intervention by the OIM
-Design robustness and experienced Eni DSV in
controlling the situation

2 Emergency -Emergency detectors -Respond to detec- -Emergency sup- -Emergency re- The “close all valves” function
Shutdown sys- -Alarms tors port vessel crew sponse training in the Ballast control system
tem -Emergency cut off - Swift response to -Platform Manager functioned when activated.
electricity and air sup- alarms
plies to ballast system

C. Prevent to- N/A N/A N/A N/A N/A N/A

tal loss

PARTIAL FAILURE
D. Prevent fa-
talities 1. Evacuation sys- - Evacuation - Alarm response - Emergency re- - Leadership As at the time of the initial
tem routes by personnel sponse team - safety equipment alarm, control of personnel was
- Safety devices - Rescue opera- - Rescue teams accessibility not attained at the acceptable
- Muster area tions - Platform man- - Competence time frame. This made the dam-
- Evacuation ves- ager - Evacuation train- age control procedure to be par-
sel contact ing tially ineffective. Some workers
- Response timing in the damage control team went
- Reporting to the life boats instead of re-
- Decision making porting to the muster area. They
ability

105
 claimed they heard the “aban-
don rig” alarm

- Alarm - Internal commu- - Operator -Communication

2. Communication nication - Platform man- channels
- Public address
system - External com- ager - Instruction clarity
system
munication -Response timing
- other communi-
cation channels

106
Table D- 8; Description of Risk Influencing Factors. Source Sklet et el., 2006

107
108