Decision-Making Model for Offshore Offloading Operations Based on Probabilistic Risk Assessment

Abstract

To explore offshore oil fields in deepwater, the use of a floating production storage and offloading (FPSO) unit coupled to a shuttle tanker is economically and technically feasible. Shuttle tankers like system for oil transportation are increasingly being accepted as a preferred transportation method for remote and deepwater offshore developments. The offloading operation is considered one of the riskiest operations in offshore environment. The chapter presents a risk-based analysis method aiming at defining the risk profile associated with an offloading operation. For offloading operations, the risk profile is usually evaluated considering that the offloading operation has an approximate duration of 24 hours. The method follows three basic steps: identification of hazard, definition of failure scenarios and their probability of occurrence, and evaluation of failure consequences. The decision-making theory is used to evaluate the possibility of emergency disconnection during the operation. The method is applied to evaluate the risk profile of an offloading operation in Campos Basin, Brazil, considering a FPSO moored with Differentiated Complacent Anchoring System (DICAS). The method is used to model the risk scenario associated with shuttle tanker main engine failure as initiating event. The changes in environmental conditions have great influence in risk profile and increase the probability of disconnection.

1. Introduction

The occurrence of accidents in complex systems, such as offshore and onshore oil and gas processing plants, power plants, and chemical process industries, is financially expensive because the accidents can cease plant operations and even can cause harm to people, property, and environment. For this reason, to identify vulnerable factors that become unacceptable operating scenarios is a challenge in the risk assessment of complex systems. The risk assessment seeks to minimize undesirable event probability and their impact both for the environment and for the people involved in the operations. The impact in the operation can be measured as economic consequences based on the extension of equipment damage and on reduction of plant performance.

The search for oil fields no longer occurs exclusively onshore, but includes the oceans of the world. This fact has contributed to the development of rigs for drilling and production offshore in deepwater.

The current method for crude oil export in deepwater is using floating production storage and offloading (FPSO). The FPSO is a floating vessel, in that it is equipped with internal or external turret, and equipment to refine crude oil, and storage capacity. Therefore, FPSO have an offloading system to transfer the crude oil to shuttle tankers. As you can see in [1, 2], the shuttle tankers are increasingly being accepted as a preferred transportation method for remote and deepwater offshore developments, for example, according to ONIP (Programa Nacional de Mobilização da Indústria Nacional do Petróleo e Gás Natural) in 2002, Brazil had 46.0% of the total oil production of Petrobras located in deepwater (400–1000 m) and 29.9% in ultra-deepwater, with water depth greater than 1000 m [3]. More recently, shuttle tankers have become the main way to distribute the crude oil produced offshore on Brazilian fields [4]. The options for methods of offloading from a FPSO and shuttle tanker include remote single point mooring, tandem offloading, and alongside configuration.

The tandem offloading operation is frequently a complex and difficult marine operation. FPSO may rotate due to waves and wind actions, and this rotates according to the weather that generates linear motions of a ship (surge, sway, and yaw). To stay connected for loading and at the same time maintain a safe separation distance, shuttle tanker must position itself aligned with the FPSO position. As we show in [5], the situation is dramatically changed in the tandem offloading operation in terms of positioning complexity and damage potential [5], due to the significant amount of mass involved (e.g., a 150,000-dwt shuttle tanker) in close distance to an installation (FPSO) for a long period of time.

To analyze the nature of the incidents in maritime operations, it is necessary to define a complex relationship among design procedures, equipment, environmental conditions, and operational procedures. To gain a full understanding and comprehensive awareness of safety in each situation, it is necessary to use a systemic approach to consider all the aspects that may lead to hazardous events and to consider different uncertainty sources [6]. In complex system safety assessment, a systemic approach means to consider all functional entities that constitute the system, exploring patterns and inter-relationships within subsystems and seeing undesired events as the products of the working of the system.

In the 1980s and 1990s, the most risk analysts have been trained in the “classical” approach to risk analysis, where probability exists as a quantity characterizing the failure of the system being studied and independent of the analyst. This concept of probability is frequency based, and the results of the risk analyses provide estimates of these “true” probabilities. For operations involving complex nonlinearities and multicomponent system, especially, new techniques for risk analysis upon of abnormal event are needed. The quantification of risk cannot be handled with traditional statistical methods since it requires the quantification of the probability of accidental events that in most cases are rare [7].

The incidents in maritime operations often involve the analysis of low-probability events for which few data are available. Classical statistical methods are inefficient in these cases. Bayesian techniques are useful because of their ability to deal with sparse data and to incorporate a wide variety of information gained based on expert judgment. A further practical advantage of the subjective probability framework in risk assessment applications is that propagation of uncertainties through complex models is relatively simple.

In the last few decades, has been several studies examined trends about Bayesian techniques in risk assessment [7, 8, 9, 10, 11, 12, 13], such as those presented by Avan and Kvaloy [7] discussing some of the practical challenges of implementing Bayesian thinking and methods in risk analysis, emphasizing the introduction of probability models and parameters and associated uncertainty assessments. Siu and Kelly [8] present a tutorial on Bayesian parameter estimation especially relevant to probability risk assessment. Jun et al. [9] divide the system failure mode based on the criticality analysis using multistage event tree. They predict failure rates and the time to failures and consequently can predict the system reliability. Eleye-Datubo et al. [10] show in a marine evacuation scenario and that of authorized vessels to floating, production, storage, and offloading collision, based on a commercial computer tool. Meel and Seider [11] developed Bayesian model to predict the number of abnormal events in the next time interval utilizing information from previous intervals and determine fuzzy memberships to various critical zones to indicate the proximity of abnormal events to incipient faults, near misses, incidents, and accidents. Kalantarnia et al. [12], for example, use Bayesian theory to update the likelihood of the event occurrence and failure probability of the safety system and hence develop a dynamic failure assessment for a process. Yun et al. [13] use Bayesian estimation for insufficient LNG system failure data; the risk values estimated with these insufficient data may not show statistical stability or represent specific conditions of an LNG facility.

The quantification of risk requires the quantification of the likelihood of rare accidental events, which normally cannot be done without employing engineering judgment. In this paper the relationship between characteristics and causes of accidents and system components involved in hazardous offloading is analyzed about one type of consequence associated with the incident. This chapter presents a quantitative risk analysis based on Bayesian techniques; the relation between the probability of occurrence of each hazardous event and its consequence could be found; we have developed these concepts in [14]. The objective this approach is providing safety for offloading operations in deepwater oil fields. We consider both FPSO and shuttle as one integrated system. We present the application of risk-based analysis techniques to evaluate offloading operations between a FPSO and a shuttle tanker that could be used to develop actions and procedures to minimize the consequences of an accident for the operation. The methodology presented can provide a model in which reasoning is justified, while it enables a powerful marine decision-support solution that is simple to use, flexible, and appropriate for the risk assessment task. The methodology with Bayesian approach as for decision support is presented in Section 2; we presented the initials theoretically developed in [14], but we include it here again, for the sake of clarity. In Section 3, the application example is presented, and finally, in Section 4 the results and final comments are presented.

2. Dynamic risk assessment methodology

Risk can be represented by Eq. (1) which relates the undesired event’s occurrence probability and the consequences:

$$\mathit{\text{Risk}}=\left(p_i,c_i\right)\text{Risk}=\left({\mathrm{p}}_{\mathrm{i}},{\mathrm{c}}_{\mathrm{i}}\right)$$ E1

where p_i is the ith event occurrence probability and c_i is the effect of the ith event occurrence [14].

For complex systems, the possibility that an unexpected scenario shows up is related to an initial event or failure which happens in a specific component. For each one of the system’s or subsystems’ components, it is necessary to know the probabilities that the unexpected condition (failure) shows up, and its consequences and states must be evaluated.

In this context, another important decision-making aspect in complex systems is the need for creating a model which can consider dynamic characteristics of system. In the case under analysis, these characteristics are given by the transition between states corresponding to safe operating zones [15].

Hence, let ST be a variable that represents a state of system, and let K be a scenario. The probability that K be true given the system is in the state ST can be represented by Eq. (2) [5]:

$$P\left(\left.K\right|\mathit{ST}\right)=\frac{P\left(\left.\mathit{ST}\right|K\right)\bullet P\left(K\right)}{P\left(\mathit{ST}\right)}$$ E2

where P(ST|K) is the probability that the system was in the ST state given a scenario K, P(K) is the probability that a scenario K be true, and P(ST) is the probability that the system is in the state ST.

The method is based on probability risk assessment and Markovian process to aid decision-making (see Figure 1). To calculate the probability of accident scenario, the Bayesian approach is presented in detail in [5]. It is used to estimate the probabilities that the system is in each state stochastic model are applied. This methodology allows, quantitatively, to assess the consequences of the events of broad impact and to see relationship between the environment changes and those impacts. The methodology can be summarized in four steps: accident modeling, failure probability assessment with Bayesian techniques, evaluation of consequences, and Markovian process to aid decision-making.

Figure 1.

Probabilistic risk assessment methodology.

2.1. Accident modeling

The first step identifies the objective of the risk assessment and to identify and to select the undesirable consequences of interest. These consequences may include items like degrees of harm to environment or degrees of loss of operation. This step covers relevant design and operational information including operating emergency procedures.

In this same step, the hazard identification is based on techniques that allow, qualitatively, to assess the consequences of the events of broad impact and to see the effects on the environment, personnel, and facilities. It requires the identification of the hazard event that is one or more physical conditions with the potential to cause damaged. Aiming this stage is to depict the consequences and to determine their causes, because the procedure is based on the selection of hazard events [16].

To determine the hazard events, “brainstorming” technique is used involving experienced personnel as well as the procedures used for the practice of routine operations using a question-answer technique based on preliminary hazard analysis (PHA) concepts. Apart from human factors, failures of components installed in complex system are systematically considered by applying the methodology of failure modes and effect analysis, which usually starts from identifying failure modes of each item composing the whole system. Based on information about the system, interviews, and expert opinions, many hazards affecting the system are identified [15].

The accident modeling is finished with scenario modeling based on the use of the event tree. An event tree is used to identify the various paths that the system could take, starting with the initiating event and studying the failure progress as a series of successes or failures of intermediate events called hazard events, until an end state is reached. That sequence of events is named failure scenario for which the consequences are estimated.

2.2. Failure probability assessment

In this step the failure probability of occurrence of a failure scenario is calculated combining two conventional reliability analysis methods: fault tree analysis (FTA) and event tree.

The probability of each failure scenario is determined by summing the probability of each set of events which lead to this outcome. Each sequence probability is obtained by simply multiplying the probabilities of the events represented in each branch of the event tree in the case of independence case; if there is dependence between events, the Bayesian methods are used. The probabilities of the hazard event are obtained by solution of fault trees associated with each hazard event. Fault tree analysis is a systematic, deductive, and probabilistic risk assessment tool which clarifies the causal relations leading to a given undesired event. A fault tree is quantified considering that its basic events tend to follow a probability distribution. The failure probability of basic events is calculated using Bayesian methods.

2.2.1. Bayesian ideas and data analysis

The Bayesian techniques are appropriate for use in offshore offloading operation analysis because the Bayesian statistical analysis involves the explicit use of subjective information provided by the expert judgment, since initial uncertainty about unknown parameters of failure distribution of basic events must be modeled from a priori expert opinion or based on insufficient data and evidence collected. Bayes’ theorem has been proven to be a powerful coherent method for probabilistically processing new data, as they become available over time, so that the current posterior distribution can then be used as the prior distribution when the next set of data becomes available.

The Bayesian method starts identifying the parameter to be estimated. This involves the consideration of the form of the likelihood function appropriate to the evidence that will be collected. The second step is development of prior probabilities to describe the system current state of knowledge. The next step incorporates information through the collection of evidence and construction of the likelihood function selected in the stage one. The final step results in new probabilities using Bayes’ theorem, called posterior distribution, to describe your state of knowledge after combining the prior probabilities with the evidence [17].

The selection of an appropriate likelihood function requires engineering knowledge specific to the process being modeled, as well as the way the new data or evidences are generated. When modeling the number of failures associated with a given piece of equipment, the Poisson distribution is the proper likelihood function. While when modeling the number of failures on system demands, the binomial distribution is the proper likelihood function. For data in form of expert judgment, lognormal distribution is a proper likelihood function. For continuous data, for instance, time to failure, the exponential distribution is the proper likelihood [8]. However, situations can arise where more complicated likelihood functions need to be constructed. Given a process model, general approaches for developing functions of random variables can be used to develop likelihood functions [18].

Prior distributions can be specified in different forms depending on the type and source of information as well as the nature of the random variable of interest. The prior distributions can be informative prior distributions when it is one that reflects the analyst’s beliefs concerning an unknown parameter or noninformative prior distributions when large amounts of data are available and when the analyst’s prior beliefs are relatively vague. This paper deals with informative prior distributions deals. When it is assumed that the prior is a member of some parametric family of distributions, the form can be parametric and numerical. Among the parametric form are the gamma or lognormal for rates of events and beta for event probabilities per demand. Bayesian statistics combines knowledge about the parameter, which is reflected by the prior distribution, and information from the data, which is contained in the likelihood function. Using Bayes’ theorem in its continuous form, the prior probability distribution of a continuous unknown quantity, P₀(x), can be updated to incorporate new evidence E, as shown in Eq. (3):

$$P\left(\left.x\right|E\right)=\frac{L\left(\left.E\right|x\right)\bullet P_0\left(x\right)}{\int L\left(\left.E\right|x\right)\bullet P_0\left(x\right)\bullet \mathit{dx}}$$ E3

where P(x|E) is the posterior probability distribution of the unknown quantity x given evidence E and L(E|x) is the likelihood function.

For some combinations of likelihood functions and prior distributions, Eq. (3) must be evaluated numerically. For a given model, there is a family of distributions where if the prior distribution is a member of this family, then the posterior distribution will be a member of the same family. These families of distribution are called conjugate distribution [19]. The conjugate likelihood and prior are most commonly used in probability risk assessment as well as the form of the resulting posterior distributions. These combinations are shown in Table 1.

Prior P0(x)	Likelihood L(E|x)	Posterior P(x|E)
Beta (α,β); $\frac{\mathrm{\Gamma }\left(\alpha +\beta \right)}{\mathrm{\Gamma }\left(\alpha \right)\bullet \mathrm{\Gamma }\left(\beta \right)}\bullet x^{\alpha -1}\bullet {\left(1-x\right)}^{\beta -1}$	Binomial (r, n); $\frac{\mathrm{n}!}{\mathrm{r}!\left(\mathrm{n}-\mathrm{r}\right)!}{\mathrm{x}}^{\mathrm{r}}{\left(1-\mathrm{x}\right)}^{\mathrm{n}-\mathrm{r}}$	Beta (α,β); $\frac{\mathrm{\Gamma }\left(\alpha +\beta \right)}{\mathrm{\Gamma }\left(\alpha \right)\bullet \mathrm{\Gamma }\left(\alpha \right)}\bullet x^{\alpha -1}\bullet {\left(1-x\right)}^{\beta -1}$
Gamma (α,β); $\frac{x^{\alpha -1}}{\mathrm{\Gamma }\left(\alpha \right)}{e}^{-\beta \bullet x}$	Poisson (x); $\frac{{\left(x\bullet t\right)}^r}{r!}{e}^{-x\bullet t}$	Gamma (α’ = α + r, β’ = β + t); $\frac{x^{{\alpha }^{\prime }-1}}{\mathrm{\Gamma }\left({\alpha }^{\prime }\right)}{e}^{-{\beta }^{\prime }\bullet x}$
Lognormal (μ,σ); $\frac{1}{\sqrt{2\bullet \pi }\bullet \sigma \bullet x}{e}^{-\frac{1}{2}\left(\frac{\text{ln}x-\mu }{\sigma }\right)}$	Poisson (x); $\frac{{\left(x\bullet t\right)}^r}{r!}{e}^{-x\bullet t}$	Numerical

Table 1.

Typical prior and likelihood functions [19].

2.3. Evaluation of consequences and making decision

The effects on the system attributable to hazardous event are defined, and Markovian process is used to model the probability of changes during offloading operation that could cause changes in the risk profile developed in step 2. The decision-making theory is used to evaluate the possibility of emergency disconnection during the operation given the result of Markovian process.

Consequences of hazardous events or abnormal incidents on the shuttle tanker and offloading operation are described and explained. A severity numerical scale is defined for hazardous event classification. This scale was defined for three sets—safety of personal, facilities, and environment—the first is related to the damages or the lesions that can be caused to the employees and others, the second refers to damages in equipment or installations in shuttle tanker or FPSO, and the third is associated with the damages on fauna, flora, and ecosystem. That classification is presented in Table 2.

Description		Set
		Personal	Facilities	Environment
Insignificant	I	No significant harm to people, without removal of staff in the interior of the installation	No significant harm to installation	No significant harm to installation, contamination of environment in minimum concentration
Minor	II	Slight harm to people in installation, no significant harm to people outside installation	Minor damage or degradation of the installation, with repair at low cost	Contamination of environment below maximum concentration, though concentration between minimum and medium
Major	III	Serious harm to people in installation and/or slight harm to people outside installation	Major damage or degradation of the installation, with possible repair	Contamination of environment below maximum concentration, though concentration between medium and maximum
Catastrophic	IV	Single fatality or multiple severe harm to people inside and outside of installation	Damage or degradation without possible repair or repair take a long time to do	Contamination of environment above maximum concentration

Table 2.

Relative severity criteria for hazardous event classification [15].

The risk is the combination between the failure probability and the severity magnitudes [20]. The decision-making part is related with accepting a certain risk scenario. The decision-making theory is used to evaluate the possibility of emergency disconnection during the operation. The risk is associated with an uncertain event or condition that, if it occurs, has a negative effect on system operational condition.

2.4. Markovian process

The state of a deterministic dynamical system is some variable which fixes the value of all present and future observables. Consequently, the present state determines the state at all future. However, strictly deterministic systems are rather thin on the ground, so a natural generalization is to say that the present state determines the distribution of future states.

The probability of the system on “i state” is calculated as an approximate discrete model, based on that for small steps (Δθ toward zero) with recurrent algorithm. Assumed two states, the basic steps of the procedure are:

1. Declare initial variable counter k = 0, θ_k = 0, andθ _end.

2. Declare probability distribution of the initial state. In this case it is assumed that shuttle tank begins the offloading operation in operative zone: P₁(θ_k = 0) = 1 and P₂(θ_k = 0) = 0.

3. Select time steps (Δθ).

4. Save t_k, P₁(θ_k), P₂(θ_k), and increment counter: k = k + 1.

5. Calculate θ_k= θ_k-1+ Δθ.

6. Calculate state transition rates (p_ijk(θ)) for θ=(θ_k-1 + θ_k)/2.

7. Calculate transition matrix M_k for transition rates of step 4 using Eq. (5).

8. Calculate probability of the system state i at t_k as:

9. $\mathrm{P}\left({\mathrm{\theta }}_{\mathrm{k}}\right)={\mathrm{M}}_{\mathrm{k}}\bullet \mathrm{P}\left({\mathrm{\theta }}_{\mathrm{k}-1}\right)$

3. Return to step 4: The procedure continues until t = tend

The Markovian process shows the probability that the position of shuttle tanker will change from operational zone to alert zone in each environmental condition. That change affects the decision of continuing the offloading operation. The decision-making theory can be used to evaluate the need for disconnection in the case of occurrence of an environmental change coupled to a critical component failure in the shuttle tanker.

4. Application of the methodology

The method is applied on the analysis of the offloading operation, when the crude oil is transported to shore by shuttle tankers through an offloading arrangement with the use of a shuttle tanker with dynamic positioning systems (DP). From the point of view of the shuttle tanker, tandem offloading operation can in principle be summarized into the following five operational stages [15]: (1) approach, tanker approaches FPSO and stops at a predefined distance; (2) connection, messenger line, hawser, and loading hose are connected; (3) loading, oil is transferred from FPSO to tanker; (4) disconnection, manifold is flushed, and loading hose and hawser are disconnected; and (5) departure, tanker reverses away from FPSO while sending back hawser messenger line and finally sails away from oil field. In the first stage, the shuttle tanker approaches FPSO, at a maximum speed of 1.5 knots, and this stage finishes when shuttle tanker stood 50–100 m behind the FPSO; distance is considered appropriate to begin the connection stage. In the second stage, to physically connect shuttle tanker and FPSO, some activities are executed, for example, the messenger line crosses from one ship to the other allowing the mooring hawser and hose to be connected. The tanker may position itself by its own dynamic positioning system so that the hawser is not tensioned. As for safety reasons, a tug boat is also connected to the ship stern acting as a redundant component to control hawser tension. In the third stage, tests are realized, and the valves in vessels are open, and oil is transferred from FPSO to tanker. During this stage, transfer rates are slow initially as the integrity of both vessel systems are checked and gradually increased to a maximum transfer flow. When loading is completed and stopped, the hose is flushed, and the valves are closed. Finally, the hose is dropped and sends to FPSO the hose messenger line and the hawser. The shuttle tanker moves off away FPSO (MCGA [21]).

Patino Rodriguez et al. [15] found 56 hazardous events for shuttle tank. The connection stage is the phase with the highest number of hazardous event. In fact, this stage involves more activities associated with mooring hawser and hose connection, besides the smallest distance between shuttle tanker and FPSO. For all hazardous events, their causes were identified, as well as the activities executed aiming at minimizing the occurrence of these causes (mitigating scenarios). In a similar way, the consequences resulting from the hazardous event are identified. Some of these are characterized as catastrophic. Most of them are related to dynamic positioning system (DPS) failures. Considering that one of the most important aspects in the offloading operation is to keep the position between FPSO and shuttle tanker, the initiating event selected as for risk assessment is “DPS failure.” The considered accident sequence is shown in Figure 2 modeled as an accident progression of four hazard events: (1) auxiliary engine failure, (2) main engine failure, (3) tug failure, and (4) towing cable failure.

Figure 2.

Event sequence diagram of the accident progression for offloading operation.

The fault tree for the four hazard events that appears in the event tree was developed. For all basic events of the four fault trees, the parameter to be estimated is failure rate, and the Poisson distribution is selected as likelihood function. Poisson distribution is considered as appropriate function given information available in database is the number of failures, r, in each time interval, t, [22, 23]. Analyzing the type and source of information (expert judgment and literature data) as well as the nature of the time to failure that is the random variable of interest, gamma distribution is selected as appropriate “prior distribution.” The conjugate family with respect to the risk model is shown in Table 1. Using Bayes’ theorem (Eq. 2) the posteriori distribution is obtained:

$$P\left(\left.\lambda \right|E\right)=\frac{\left[\frac{{\left(\lambda \bullet t\right)}^r}{r!}\bullet e^{-\lambda \bullet t}\right]\bullet \left[\frac{{\beta }^{\alpha }\bullet {\lambda }^{\alpha -1}}{\mathrm{\Gamma }\left(\alpha \right)}\bullet e^{-\beta \bullet \lambda }\right]}{{\int }_0^{\infty }\left[\frac{{\left(\lambda \bullet t\right)}^r}{r!}\bullet e^{-\lambda \bullet t}\right]\bullet \left[\frac{{\beta }^{\alpha }\bullet {\lambda }^{\alpha -1}}{\mathrm{\Gamma }\left(\alpha \right)}\bullet e^{-\beta \bullet \lambda }\right]\bullet \mathit{d\lambda }}\Rightarrow$$

$$P\left(\left.\lambda \right|E\right)=\left[\frac{{\left(\beta +t\right)}^{\alpha +r}\bullet {\lambda }^{\alpha +r-1}}{\mathrm{\Gamma }\left(\alpha +r\right)}\right]\bullet e^{-\left(\beta +t\right)\bullet \lambda }$$ E4

As an example, the posterior distribution is calculating for fuel system failure (see Figure 3) one component of main engine.

Figure 3.

Fault tree for fuel system failure.

Aiming to obtain the probability that K be true given the system is in the state ST represented by Eq. (2), it is necessary to estimate the posterior mean value of failure rate. To calculate the failure probability of hazard events, we use fault tree analysis. Then for all basic events of the fault trees, the failure probability was determined using Bayesian inference. The posterior distribution is calculated, using the conjugate distribution. By analyzing the type of information availability, the Gamma distribution is selected as appropriate prior distribution, and Poisson distribution is selected as likelihood function. We calculate substituting in Eq. (4) the failure rates for fuel system failure (see Table 3). The prior distribution was estimated using databases that recorded the rate failure to equipment used in offshore industry.

Equipment	E[P0(λ)] [failure/h]	ST[P0(λ)] [failure/h]	P(λ|E) [failure/h]	Equipment	E[P0(λ)] [failure/h]	ST[P0(λ)] [failure/h]	P[λ|E] [failure/h]
Booster pump	1.10E-03	1.10E-03	2.24E-05	Fuel pumps	1.43E-03	1.13E-03	3.55E-05
Bypass valve	2.28E-05	1.50E-05	1.59E-05	Heater	4.54E-05	3.74E-05	1.93E-05
Centrifugal pump	7.36E-04	1.20E-04	3.95E-04	Main tank	2.13E-04	2.13E-04	2.06E-05
Centrifuge	1.69E-05	5.94E-06	1.55E-05	Mixing tank	9.50E-06	9.11E-06	6.87E-06
Check valve	3.60E-07	5.10E-07	3.49E-07	Piping: blockage	3.70E-07	6.18E-07	3.54E-07
Daily service tank	9.50E-06	9.11E-06	6.87E-06	Piping: breakage	4.40E-07	9.57E-07	4.03E-07
Fuel pump control shaft	3.00E-05	3.00E-05	1.30E-05	Pressure regul. Valve	8.81E-06	1.25E-05	4.98E-06
Engine centrif. Pump	1.13E-04	2.81E-05	8.62E-05	Settling	4.37E-04	6.26E-04	1.08E-05
Filter heated	2.00E-06	2.00E-06	1.84E-06	Settling tank	6.26E-05	1.12E-04	6.43E-06
Flow meter	1.32E-05	3.26E-06	1.27E-05	Three-way valve	2.28E-05	1.50E-05	1.59E-05
Fuel injector: blockage	7.24E-06	1.02E-05	4.43E-06	Transfer pump	7.36E-04	1.20E-04	3.95E-04
Fuel injector: breakage	2.00E-07	2.00E-07	1.98E-07	Viscosity regulator	6.39E-06	8.96E-06	4.12E-06
Fuel Pumps	1.43E-03	1.13E-03	3.55E-05	VIT system	2.06E-07	2.06E-07	2.04E-07

Table 3.

Failure rates and standard deviations of the basic events of fault tree for fuel system failure.

The calculated probabilities for the basic events are used as input to a fault tree to determine the probability of the event hazard: “no fuel flow.” Using probability theory and assuming that the fuel system is operated for t = 43,800 h (time between maintenance), the probability of “no fuel flow” is 8.390E-04. The prior and posterior density of basic event that has more influence on system failure is shown in Figure 4, associated with the failure of the centrifugal pump. A 90% interval estimate for failure rate is found by computing the 5th and 95th percentiles of gamma distribution, and the interval is between 2,96E-04 and 5,08E-04.

Figure 4.

The prior density and posterior density for centrifugal pump failure rate.

The same procedure is used for other subsystems, and the probability of hazard event “main engine failure” is found by solving the fault tree associated with that failure. In the same way, that procedure is applied to find the probability of all hazard events as shown in Table 4.

Hazard event	P(λ|E) [failure/h]	90% interval estimate for rate failure
		5%	95%
Dynamic positioning system (DPS) failure	1.58E-05	3.18E-07	5.29E-05
Auxiliary engine failure	1.97E-04	1.01E-04	3.18E-04
Main engine	4.95E-05	9.70E-06	1.14E-04
Tug failure	2.28E-05	1.17E-06	6.82E-05
Towing cable failure	2.18E-03	0.001837	0.002555

Table 4.

Posterior probabilities for hazard events involved in the offloading operation and a 90% interval estimate for failure rate.

Connected to the hazard event, the operation involves risks related to collisions during the offshore operation as presented in Figure 2. The event tree in Figure 5 is the failure scenario development associated with the failure in DPS, considering the probabilities presented in Table 4.

Figure 5.

Event tree for the offloading operation.

The proposed method for risk assessment seems to be suitable for complex systems analysis, since it not only allows for the identification of critical consequences, but it is also a tool to make decisions, because it enables a quantitative evaluation of accident progression in systems that change their operational condition throughout time.

The sequence of abnormal events is determined, and the consequences are estimated using the event tree. The initiating event selected is the shuttle tanker change from operational zone to alert zone. The accident sequence considered is modeled as an accident progression of five hazard events, and we have four consequence categories. The fault tree for the five hazard events was developed as shown in Figure 5. The shuttle tanker is loss of position in powered condition, and its subsequent collision with the FPSO is the most significant risk.

The failure scenario presented in Figure 5 can occur at any time during offloading operation. The position of the tanker in relation to FPSO during offloading is controlled. In case it reaches the alert zone, as shown in Figure 6, the tanker can be disconnected and the offloading is aborted. So the consequence of the failures considered in the study can be more severe depending of the relative position of the tanker.

Figure 6.

Markov state transition diagram.

It is essential to consider the probability of the change of the shuttle tanker position from operational zone to alert zone, as shown in Figure 6, during offloading. The distribution parameters are estimated using a simulator that reproduces ship motions in a specific operation condition and environmental condition. We used these conditions of waves, wind, and currents.

After finding the failure probability of all hazard events, the failure probability for scenarios is calculated by multiplying hazard events. The probability of each consequence category is calculated by adding the probabilities of the scenarios with the same consequence category. The random variable that corresponds to the angle between the FPSO and shuttle tanker during offloading operation is modeled as Weibull distribution. According to the standards of the offloading operation in Brazil, the angle in the operational zone should not be greater than 45 degrees; as a result of these conditions, the parameter of four consequence categories was estimated, and the equation for transition rate is determined. Let us consider the two states established before: operational zone and alarm zone.

The transition rates between states are not constant; then the stochastic process can be modeled as semi-Markov process which shows the probability of the position of the shuttle tanker changing from operational zone to alert zone in a given environmental condition.

By applying the results obtained from the simulation, Markovian analysis, and event tree, the probability that a K scenario is true is obtained, given the system is in the ST state.

In Eq. (5) we define a K × K state transition probability matrix M_k.

$$M_k=\left[\begin{array}{cc}1-p_{12k}\bullet ∆\theta & p_{21k}\bullet ∆\theta \\ p_{12k}\bullet ∆\theta & 1-p_{21k}\bullet ∆\theta \end{array}\right]$$ E5

where p_ij(θ)Δθ is the probability of the system, which is operational zone at position θ, will come alert zone in the interval (θ, θ+Δθ).

The state transition rates correspond to the following event rates: the shuttle tanker gets out of the operational zone, and the shuttle tank gets into the operational zone. In each state (ST) there are a number of possible events that can cause a transition. A ship dynamics simulator that determines ship maneuvering characteristics was used to calculate the transition. The simulator can accurately reproduce ship motion in the presence of waves, wind, and currents. Table 5 shows typical environmental conditions in the fall and in the spring for Campos Basin (Brazil). Hence, with the program outputs, it was possible to calculate the angle between FPSO and shuttle tanker at any moment during the offloading operation.

Current [m/s]	Wind [m/s]	Wave [m]
0.71 S	11.16 SE	2.9 SE

Table 5.

Environmental conditions.

According to the standards of the offloading operation in Brazil, this angle within the operational zone should not be greater than 45 degrees. Weibull probability functions were found as proper distributions to represent the angle between FPSO and shuttle tanker during the offloading operation both inside and outside the operational zone. The parameters and transition rate equation are shown in Table 6.

State	Parameter Weibull distribution				Transition rate equation
	Consequence category
	0	C	B	A
Inside the operational zone	β = 1.641; η = 12.97	β = 1.596; η = 13.05	β = 1.473; η = 12.01	β = 1.691; η = 14.34	$\frac{\beta }{\eta }\bullet {\left(\frac{{\theta }_k}{\eta }\right)}^{\beta -1}$
Outside the operational zone	β = 10.99; η = 30.07	β = 8.604; η = 60.51	β = 8.499; η = 60.40	β = 7.259; η = 63.21

Table 6.

Parameters and transition rate for offloading operation.

Then, using the recurrent algorithm shown in the section of Markovian process, the probability (P(ST)) that the shuttle tanker is inside the operational zone, without any failure, is 0.7918. In the same way, inducing the hazard events in ship dynamics simulator is possible to simulate the consequence categories and to determine the probability that the system was in the ST state given a scenario K as shown in Table 7.

State	Consequence category
	P(ST)	P(K = C)	P(K = B)	P(K = A)
Inside the operational zone	0.7918	0.19546	0.039312	0.03528
Outside the operational zone	0.2082	0.80454	0.96069	0.96472

Table 7.

Probabilities that the tanker is inside a given location each for each consequence category.

Applying Eq. (2) the probability that a scenario K is true given the system is in the state ST is obtained. For instance, the probability that shuttle tanker is without main propulsion, making possible the collision between the shuttle tanker and the FPSO, given that shuttle tanker is in the inside the operational zone is

$$\mathrm{P}\left(\left.\mathrm{K}=\mathrm{C}\right|\mathrm{ST}=1\right)=\frac{\left(0.1954\right)\bullet \left(0.43\right)}{0.7918}=0.1059$$

5. Conclusion

The tandem offloading operation is a complex and difficult marine operation. It may range from once every 3 to 5 days, depending on the production rate, storage capacity of FPSO, and shuttle tanker size. The duration of the operation takes about 24 hours based on FPSO storage capacity and oil transfer rate. Meanwhile, a suitable environmental condition is required. Shuttle tanker loss of position in powered condition and subsequently collision with FPSO is the most significant risk.

The proposed method for risk assessment seems to be suitable for complex systems since it allows not only the identification of critical consequences to analyze this kind system but also is a tool to make decision because it allows a quantitative evaluation of accident progression in system that change its operational condition during the time.

The development of the fault tree and event tree is important for the understanding of the functional relation between system components and the relationship with accident progression. Based on the modeling of each accident scenario, the Bayesian analysis is performed considering the evidence of database and knowledge of offloading operation. The objective of Bayesian estimation was to develop a posterior distribution for a set of uncertain parameters allowing estimating a probability for several consequence categories as an integral part of current theories on decision-making under uncertainty.

Based on results of a ship dynamics simulator, the method allows to carry out the probability that the shuttle tanker was in a given position, indicating the variation of the position of the tanker in relation to the FPSO due to environmental conditions.

For the case under analysis, which considered the position between FPSO and shuttle tanker during offloading operation, defined by two operational states, the probability that a failure scenario is true given the system is in a specific operational state is obtained. Both states have the distribution of positions represented by a Weibull probability function.

The method is a proactive methodology to prevent accidents through risk assessment aiming at identifying and depicting a system, to reduce failures and to minimize consequences of the hazardous events. The results of the analysis support the development of mitigating scenarios for the causes of hazardous events and contingency scenarios for the consequences of hazardous events.