Mixed Application of CREAM & FTA to Evaluate the Non-Technological Barriers Against the Formation of Explosive Atmospheres in FPSO Cargo Tanks

Although is often in the oil and gas industry, the use of barriers, based on safety instrumented systems, sometimes there is a need to complement it using operational/human barriers. This is the case of the offloading operations procedures of FPSO cargo tanks, which under certain circumstances could favor the occurrence of explosive atmosphere formation scenarios.

FPSO cargo tanks can be situated in the hull system in a center position or sideways on port and starboard and can have typical operating volumes between 150,000 to 230,000 bbl @ 98% and 3,135 to 4,720 bbl of vapor space in each tank. Such volumes suggest that an eventual explosion in these tanks could have catastrophic consequences. However, it is worth noting that, although there are some records of explosions in cargo tanks from on tankers vessels, and despite the indisputable potential for such an event in FPSOs, in the worldwide, there are no records of explosions in oil cargo tanks, in FPSO specifically. Also be remembered that although it was not exactly in the cargo tanks, the fatal explosion in the pump room of the Brazilian FPSO CDSM in 2015 illustrates the potential for damage from major accidents in this type of production facility.

The starting point for this study was the detailed analysis of the human actions contained in the macro-activities considered as critical for the execution of the standard about Offloading Operation of the cargo tanks of an FPSO-type platform. These human actions were analyzed and prioritized by expert professionals in Risk Analysis and Human Reliability, with full-time support from the operators of the same oil and gas production unit, for consistency verification and validation. In a later stage, these human actions were sequentially, discretized and analyzed using the Cognitive Reliability and Error Analysis Method - CREAM and finally inserted into a topological model of a Fault Tree (FTA) that allowed the establishment of precedence relationships and combination of effects and estimation of probability of occurrence through a fault tree.

The macro activities evaluated were: “Verification of critical items”; “Pump of water for back-flushing”; “Line offset”; “Oil transfer (Start of Offloading)”; “Starting inert gas system”. All these macro-activities are related to the deviation/hazard: “formation of an explosive atmosphere inside the FPSO cargo tanks”, which is one of the priority scenarios of the Preliminary Risk Analysis study carried out previously for the feasibility of FPSO operations in question.

The possibility of the formation of an explosive atmosphere inside the cargo tanks of an FPSO was analyzed in the light of human actions indicated by the operators, which were interpreted in terms of each of the fifteen cognitive activities listed in the CREAM technique.

Sequentially, the associated cognitive functions were obtained directly through the Matrix representing the relationship between activities and cognitive functions in agreement to Hollnagel (1998). Based on the procedure selected for the Offloading Operation, the actions were interpreted in Cognitive Activities and Cognitive Functions. The discretization of each of the fifteen work activities can be broken down into a combination that can vary from one to three different cognitive functions, among the four possibilities, namely: Observation, Interpretation, Planning and Execution.

The most likely failures for each of the four possibilities of cognitive functions, mentioned above, were identified, considering the opinion of the operators about possible errors that could occur during the execution of the procedure, and comparing with the description of the categories of failures that appear in CREAM and, to ensure the accuracy of the records, were accompanied by a brief description of the failure pointed out in the operator's own words.

The common performance conditions were evaluated according to the description contained in the CREAM method, and the justifications and references considered for the attribution of each grade evaluated by the operators of the unit under study were explained. From the attribution of the levels of common performance conditions, the score of effects on human reliability (improvement, reduction or non-significance) was subsequently calculated. Following, from the matrix that correlates the control modes (disordered, opportunistic, tactical and strategic) with the score value of the effects of the previous step, it was obtained as a result that the control mode currently in progress. This one is the tactical level, which refers to the probability of human error in the reference interval of 1.0 E-3 < p < 1.0 E-1.

Continuing the study, the Dependency Assessment between Common Performance Conditions (CPC) was established. For adjustment, the following rule was applied: If the evaluated CPC does not generate a significant primary effect for performance reliability, but N-1 factors on which it depends have an effect in the same sense of reducing or increasing reliability, this impact is considered predominant and must be attributed to the evaluated CPC, rectifying its non-significance effect to improve or reduce reliability. It is important to mention that in the case of the team collaboration quality CPC, the impact was only adjusted if the 2 factors it depends on had the same effect. And it is anticipated that in the current study it was not necessary to rectify the effect of CPCs.

Each one of the operational procedure activities, which was discretized in terms of cognitive functions, was associated with a nominal value of probability of cognitive function failures, as originally established in the CREAM method, and this basic value was corrected by applying a weighting factor. The global weighting factor for each of the four cognitive functions was calculated using the combined use of the individual weighting factors contained in the CREAM method and the ratings assigned by operators to each one influencing factor. Thus, the adjusted probability values were obtained for each one of the activities of the procedure.

With the purpose of enabling a mathematical treatment, that would make it possible to estimate the probability of formation of an explosive atmosphere inside a cargo tank of the FPSO under study, it was decided to model through a Fault Tree Analysis, where the top event is the formation of explosive atmosphere inside an FPSO cargo tank. The basic events in the FTA are each one of the cognitive function failures in which the activities of the FPSO cargo tank offloading operational procedure were discretized.

In doing so, a Fault Tree modeling was conceived, containing 15 independent basic events, associated with “AND” and “OR” logic gates according to the logical nature of the events represented.

The graphic representation of the FTA proved to be rational and logically linked, indicating that the top event “Formation of Explosive Atmosphere in FPSO Cargo Tanks Due to Human Error” is coherently represented.

Another finding is that no minimum cuts of first or second order were identified, nor minimum cuts of order greater than or equal to five, having been identified six minimum cuts of third order and eighteen minimum cuts of fourth order, which from a qualitative point of view suggests a naturally rare event.

In all six third-order minimum cuts of the Fault Tree, the basic event identified in this study under code B12 is present, that is, “Failed to check pre-alignment of oil valves”. This one suggests that, if it were possible to prevent this event from developing, based on some strategy, all possible paths that lead to the top event and that depend on its occurrence would prove to be unfeasible, that is, in favor to process safety, as are wished.

In addition, in the fourth order minimum cuts, the event most frequently observed, in 66.67% of its different compositions, is the event B07, that is, “Failed to reduce the pump rotation”, which is present in twelve of these minimal cuts. This also indicates that, if it were possible to prevent this event from developing, supported by some strategy, a very significant amount of the possible paths that lead to the top event and that depend on its occurrence would also prove to be unfeasible, again in favor to process safety.

Similarly, effectively blocking the basic event B13, i.e., “Failed to verify that the inert gas system is operational” or, alternatively, of event B14, i.e., “Failure to interpret trend analyses”, would complement the strategies to prevent the formation of an explosive atmosphere in the FPSO cargo tanks due to human error, which also improve the process safety conditions.

Numerically, the probability of the studied top event resulted in the value of: Q(Top)=0.00043% or 4.3x10^-6 for each time the offloading operations are performed. Although an estimated value has been reached, the main contribution of this study, in the authors' opinion, is the formulation of a set of systemic recommendations with the purpose of strengthening the correct application of the critical procedure, whose failures in the execution, may more prominently favor the undesirable scenario modeled in the study. The scope of this study to all critical procedures can contribute to the consolidation of an even higher level of process safety in FPSO units.