Next Article in Journal
A Very Large Spawning Aggregation of a Deep-Sea Eel: Magnitude and Status
Previous Article in Journal
In-Situ Seawater Gamma Spectrometry with LaBr3 Detector at a Nuclear Power Plant Outlet
Font Type:
Arial Georgia Verdana
Font Size:
Aa Aa Aa
Line Spacing:
Column Width:

Safety Barrier Management: Risk-Based Approach for the Oil and Gas Sector

Behnaz Hosseinnia Davatgar
Nicola Paltrinieri
1 and
Roberto Bubbico
Department of Mechanical and Industrial Engineering, Norwegian University of Science and Technology, 7491 Trondheim, Norway
Department of Chemical, Materials and Environmental Engineering, “Sapienza” University, 00184 Rome, Italy
Author to whom correspondence should be addressed.
J. Mar. Sci. Eng. 2021, 9(7), 722;
Submission received: 25 May 2021 / Revised: 21 June 2021 / Accepted: 25 June 2021 / Published: 30 June 2021
(This article belongs to the Section Coastal Engineering)


In the Oil and Gas sector, risk assessment and management have always been critical due to the possibility of significant accidents associated with the presence of large amounts of flammable hydrocarbons. Methods to provide accurate and reliable risk analysis for an oil platform usually focus on critical equipment and identify causes and consequences of loss of containment. Safety barriers are important elements of such accident scenarios, aiming to reduce the frequency of unwanted events. Estimating the performance of safety barriers is essential for the prevention of major accidents. This work first focuses on the application of risk-based analysis on the process area equipment of the floating platform Goliat. Such an approach is secondly extended to the most relevant safety systems to prevent fires and explosions and consequent catastrophic domino effects. An additional challenge resides in the fact that safety barriers cannot always be classified as equipment, as they are often composed of operational and organizational elements. Through the application of the ARAMIS Project (Accidental Risk Assessment Methodology for Industries in the Context of the Seveso II Directive) results, the frequency modification methodology based on TEC2O (TEChnical Operational and Organizational factors) and the REWI (Resilience-based Early Warning Indicators) method, it is possible to quantify the safety barrier performance, to reduce the frequency of unwanted events. While conducting this study, the importance of the management factor in combination with technical and technological aspects of safety barrier performance was analyzed. Starting from the initial project conditions, applying worsening technical factors, and simulating n organizational management for the safety systems, it is possible to quantify the performance of the safety barriers, highlighting the importance of management factors in terms of prevention of major accidents, and to assess the dynamic risk for the overall plant.

1. Introduction

In the process industry, the application of techniques for risk assessment aims not only to identify possible accident scenarios but also to consider and implement appropriate safety devices and operations to prevent or mitigate them [1]. Various terms are used to indicate such safety devices and operations, such as countermeasure [2], layer of protection [3], and the most used, safety barrier. These terms all refer to a physical and/or non-physical means planned to prevent, control, or mitigate undesired events or accidents [4]. The importance of monitoring the performance of such safety barriers is constantly increasing. Technical barrier components may degrade over time and/or have random failures, for example, as a result of scour-induced collapse [5] or fatigue-induced collapse [6]; therefore, their performance is not constant and needs frequent testing and inspection. Similar to technical barriers, operational and organizational barrier elements’ performance and competence change over time and need to be verified according to the requirements by regulations [7].
This is demonstrated by the introduction of references to safety performance indicators in the European Council Directive on the control of major accident hazards involving dangerous substances [8] and guidelines on safety barrier management by national safety authorities [7]. For this reason, a number of studies on risk analysis are shifting their focus towards performance assessment of safety barriers and how this performance could decrease with time due to various degradation factors, from corrosion to improper maintenance [9,10]. An example of these studies is represented by the frequency modification methodology based on technical, operational, and organizational factors (TEC2O) developed by Landucci and Paltrinieri [11] to evaluate expected release frequencies specific for the facilities of the Oil and Gas upstream sector. The methodology aims at determining modification factors able to dynamically update the frequency values and support dynamic risk assessment studies.
On the other hand, it must be pointed out that continuous monitoring of equipment performance and degradation does not represent a novel perspective for safety-critical industries. Standards and guidelines for risk-based inspection provide the tools for risk estimation over time based on material degradation and allow the definition of appropriate inspection (and, in turn, maintenance) programmes on equipment. The American Petroleum Institute has defined the standards API 580 on risk-based inspection [12] and API 581 on risk-based inspection methodology [13], while DNV-GL has produced the recommended practices for risk-based inspection of offshore top-side static mechanical equipment [14].
From the Santa Barbara blowout in 1969 to the Macondo blowout in 2010, inadequate barrier risk management has been one of the main causes of many major accidents in the offshore Oil and Gas industry that caused hundreds of life losses, critical environmental damages, and substantial financial losses [15,16]. While quantitative risk analyses are performed in companies, they lack establishing performance requirements for barriers and use default fatality-based risk metrics and generic failure data, which is insensitive information for barrier functions during the operational phase [17]. To bridge this gap to create a close connection between real situations and their analysis, safety barriers’ performance needs to be actively followed up during operation. Therefore, their maintenance and inspection will be an essential activity for failure control and functional restoration.
The barrier maintenance and monitoring can be planned similar to the RBI approach, based on ranking and prioritizing barrier importance to risk control. By developing a method that is understandable and capable of developing comprehensive indicators to monitor safety barriers over time, it will be possible to quantitatively evaluate and communicate how the frequency of potential major accidents changes. The higher risk affecting some barriers would be classified as a higher priority for maintenance with respect to other barriers. The RBI approach can provide better safety at a lower cost than current barrier management processes [18]. However, the particular challenge in establishing risk-based inspection that also includes safety barriers during the operational phase is how to provide an easily applicable framework for performance assessment of not only the technical barriers but also the operational and organizational aspects.
One of the novelties of this work is the adaptation and improvement of the existing risk-based methods to monitor safety barriers and, at the same time, comply with acceptance criteria on the frequency of dangerous events. In fact, the method suggested by this work will have a twofold aim: assessing the performance of safety barriers and, at the same time, supporting their inspection and maintenance. A tool such as the software Synergi Plant RBI by DNV-GL is considered the starting point for the method development. This approach is integrated with techniques for monitoring management performance through appropriate indicators [11,19] in order to provide a complete overview on safety barriers, which are not composed only by technical elements, but also operational and organizational ones.
In the next section, the risk-based inspection role and its general approach within the Oil and Gas sector is explored. In Section 3, the performance assessment of safety barriers is explained, and the methodological approach for considering technical and management modification factors is presented. The Norwegian Oil and Gas platform on the Goliat field was chosen as a case study in Section 4 to demonstrate the method’s effectiveness. Since this platform is located in a sensitive area in terms of safety and environment (the subarctic region of the Barents Sea), the case acquires further value for safety-barrier management [20]. Furthermore, the results from the case study are demonstrated in Section 5. Based on the findings from the case study, the risk-based approach for safety barrier management is discussed in Section 6 for an effective and efficient inspection and maintenance plan, and Section 7 concludes this study.

2. Risk-Based Inspection in the Oil and Gas Sector

Risk-based inspection (RBI) is well established and used in the Oil and Gas and Chemical industries. This approach, along with risk-based maintenance, is described by API RP 581 [12], originally developed for application in the refining industry. The standard represents a correlation between maintenance activities and main events in the industries [21]. RBI is also adapted and applied in many other sectors and inspection activities, allowing for the identification of failure mechanisms and rates based on equipment status.
RBI is focused on maintaining the mechanical integrity of pressure equipment items and minimizing the risk of loss of containment due to deterioration, and it is not a substitute for PHA (Process Hazard Analysis) or hazard and operability assessment (HAZOP). RBI is also complementary to RCM (Reliability Centred Maintenance) programs, as both are focused on understanding failure modes, addressing the modes, and therefore improving the reliability of equipment and process facilities [13]. Standards such as API 581, DNV G-101 [14], and EN 16991:2018 [22] developed an on-stream inspection philosophy that led to a series of benefits, such as the ranking and prioritization of inspection and maintenance activities, substantial cost savings, and contributing to reducing operational risks while providing a database of past inspections and future inspection scheduling, updating and controlling risk over time [23]. In accordance with those standards, the Petroleum Safety Authority (PSA) constantly updates the regulations for onshore and offshore facilities, suggesting the use of a risk-based methodology on process safety systems and functions [24], evidencing the importance of RBI methodology not only on process equipment but shifting the point of view to safety-barrier management.

Risk-Based Inspection Planning

DNV-GL provides a tool for RBI planning, named Synergi Plant RBI. The software’s main aim is plant integrity management, and it is designed to offer a detailed plan–do–check–adjust approach for managing risk quantitatively for operating upstream and downstream process plants and offshore platforms [25].
Synergi Plant RBI follows the mentioned industry standards and recommended practices (API 581 [12] and DNV GL RP-G101 [14]) for RBI. The software is designed using the definition of risk given by API 581 [12]:
R t   =   P o F t   ·   C o F
where the risk (R) is a function of time (t) and is the result of the probability of failures (PoF) in function of time (t) multiplied by the consequence of such failures (CoF) expressed in terms of consequence area (CA). Figure 1 provides a brief overview of how CoF is analyzed based on API 581. The details of calculations and formulas are explained in part 3 of the standard [12].
The probability of failure (PoF) is determined as the product of a generic failure frequency (gff), a damage factor (Df) in function of time (t), and a management systems factor (FMS).
P o F t   =   g f f   ·   D f t   ·   F M S
The generic failure frequencies are defined as failures per year and tabulated in API 581 [12], as a function of statistical analysis of historical data on failures in the equipment, the component type, and the hole size (small, medium, large, rupture) based on its operating condition, material, and fluid properties, and wall thickness.
The management factor affects all plant equipment evenly and does not alter the inspection priority order, while it can increase the absolute risk if management systems are below average.
Synergi Plant RBI allows considering inspection target values at the production unit level, based on production cost data such as equipment cost per unit area, population density, injury cost per person, outage cost per day, and worst case scenarios such as fatalities. The software suggests inspection plans based on risk analysis of a series of damage mechanisms of the plant equipment. The software results include a summary sheet with input data, active damage mechanisms, inspection history, and the proposed inspection program for every piece of equipment.

3. Performance Assessment of Safety Barriers

Safety barriers may include a range of single technical units and human action to complex socio-technical systems [26]. Furthermore, a combination of safety barriers may define a safety function performing a specific action. The terms avoid, prevent, control and, protect suggested in the ARAMIS (Accidental Risk Assessment Methodology for Industries in the Context of the Seveso II Directive) Project [1,27] to describe generic functions (Figure 2). A safety function is a technical or organizational action to avoid or prevent an event, or to control or to limit the occurrence of the event. This action will be performed by one or more safety barriers. Safety functions may decrease the frequency of an event or reduce the frequencies and the consequences of dangerous phenomena [1].
ARAMIS describes four main categories of safety barriers: active barriers, passive barriers, human actions, and symbolic barriers (Figure 2). However, the performance of the symbolic barriers cannot be assessed, as they depend on personnel interpretation and are not evaluated in the ARAMIS methodology [1].
The performance of a safety barrier is defined by ARAMIS according to its Level of Confidence (LC), which is associated with the Probability of Failure on Demand (PFD) to perform a required safety function properly, according to a given effectiveness and response time. The notion is similar to the notion of SIL (Safety Integrity Level) defined in IEC 61511 [28] for Safety Instrumented Systems, but in this case, it applies to all types of safety barriers. The response time is the duration between the straining of the safety barrier and the complete achievement of the safety function performed by the safety barrier. This study assumes a constant response time, despite the fact that its definition requires data from suppliers, experience from the industrial sector, testing, and datasheets.
An overall LC is estimated for the safety function by considering the LCs of the involved barrier systems. A safety function LC is equal to the smallest LC among the involved safety barriers [1]. If the safety barrier is further composed of subsystems, the barrier LC is, in turn, given by the smallest LC among the subsystems.
Such aggregation of LCs depends on the complexity of the safety function and the type of safety barriers. In fact, safety barriers are classified as follows [29]:
Type A: the failure modes of all components are thoroughly defined, failure data from field experience exist, and the behaviour under fault conditions can be determined (example: mechanical devices);
Type B: the failure modes are not thoroughly defined for each component, the behaviour under fault conditions cannot be determined a priori, and failure data exist, but not for all the sub-components (complex systems such as processors).
LC can be associated with a PFD range based on the ARAMIS guidelines [29] (Table 1). Therefore, in order to obtain a PFD discrete value, the mean value of a negatively skewed (i.e., conservative) distribution within the indicated range was considered.

3.1. Bow-Tie Analysis

The bow-tie analysis is a risk analysis technique ideally suited for the initial evaluation of an existing process or application during the intermediate stages of process design [30]. The bow-tie technique in its visual form makes the analysis easy to understand and shows the safety barriers or safety functions (depending on the level of detail of the diagram) protecting against particular causes and consequences of an accident scenario [30]. The analysis combines fault tree and event tree analyses, which are merged to share a common element called Critical Event (CE, Table 2). Table 2 recalls the general definitions of the basic bow-tie elements [1]. The development of bow-ties can be performed following conventional guidelines, such as those outlined by the Centre for Chemical Process Safety [30]. As an alternative, the ARAMIS guidelines can be applied [1].

3.2. Technical, Operational, and Organizational Factors

As the purpose of this work is to develop a method to assess the performance of safety functions over time, a relevant technique for the tailorization of leak frequency values was considered as a starting point. This method, named TEC2O (Frequency modification methodology based on TEChnical Operational and Organizational factors) is based on periodic revision and updates of indicators whose contribution can modify the expected leak frequency [9]. Indicators are quantitative parameters that can be monitored, modified, and updated over time [31]. The authors developed the method to assess risk in a dynamic way and validated it by means of a benchmark with similar approaches, such as API 581 [13], ARAMIS Project [1], and CCPS [32]. To support periodic QRA (Quantitative Risk Assessment) updates, dynamic frequency evaluation is conducted for equipment failures and leaks.
The methodology designed in this work is specific for safety systems and their management. The LC of the safety functions designed by ARAMIS is adjusted by a Level of Confidence Modification Factor (LCMF) defined as follows:
L C M F   =   f T M F ,   M M F
T M F is the Technical Modification Factor, associated with safety function complexity, aging, construction, and process.   M M F is the Management Modification Factor linked with the evaluation of safety management systems addressing both operational and organizational aspects.
TEC2O [11] is the starting point, but the indicators used to assess the modification factors are adapted to the ARAMIS definition of technical factors [1] and the Resilience-based Early Warning Indicator (REWI) definition of management factors [19]. Technical indicators are integrated with information from API 581 [13] and the ARAMIS Project [1], taking in account the lifecycle of safety functions, their complexity, response time and external factors. Operational and organizational indicators are redesigned based on the REWI method [19].

3.2.1. Technical Modification Factor

The technical modification factor (TMF) is divided into four subfactors, each of them considering different technical aspects related to safety barriers:
Aging subfactor (A): aging of the safety barriers related to the safety function, due to corrosion phenomena and inspection quality;
Environmental subfactor (U): whether conditions and features of the plant in which the safety barriers work;
Construction subfactor (M): design complexity, total response time, and lifecycle of the safety barriers considered; and
Process subfactor (P): process stability factor and mode of operation of safety barriers, considering the possible deterioration.
Each subfactor is associated with indicators based on a defined scale. Indicators are mathematically combined (potential penalties are also considered) and converted into a subfactor value, which is converted into a score, from 1 to 6, where 1 is the best performance condition and 6 the worst. The combination of the scores of each subfactor leads to the technical modification factor TMF score. Once the evaluation of the four subfactors (A, U, M, P) and their associated score (score of aging subfactor SA, score of environmental subfactor SU, score of construction subfactor SM, score of process subfactor SP) is completed, the next step is to carry out a weighted sum to obtain the score for the technical modification factor (STMF):
S T M F = w S A · S A + w S U · S U + w S M · S M + w S P · S P
Weights are to be adapted based on the expert judgment of the technical subfactors. However, this study considers equally distributed weights for the subfactors, assuming that each subfactor has the same importance.

3.2.2. Management Modification Factor

Management aspects are related to safety procedures, training and competencies of the operator, safety culture, frequency of maintenance operations, and communication at different levels of an organization. All these elements are linked to the likelihood of an accident, but their quantification is challenging [11]. The REWI methodology [19] proposes the use of indicators to convert these aspects into quantitative parameters based on the concept of resilience (“the capability of recognizing, adapting to and coping with the unexpected” [33]). The TEC2O method [11] provides already a selection of relevant REWI indicators, grouped into two subfactors:
Operational subfactor (OPE), about personnel training, skills and experience; and
Organizational subfactor (ORG), which concerns safety culture and procedures.
The indicators defined in this method are to be monitored for all the lifecycle of a plant, leading to quantitative parameters that change over time. These indicators come from the managerial sections of an organization; thus, it is important to collect data from the interested sections of the organization, considering the reliability and accuracy of the surveys to reduce the uncertainty related to the use and collection of management indicators. Indicators have a score ranging from 1 to 6. In the absence of quantitative data for an indicator, the following scores are applied:
High performance = 2
Medium performance = 4
Low performance = 6
An intrinsic penalty given to the highest performance assures conservatism and highlights the uncertainty of a qualitative indicator.
The operational subfactor (OPE) is designed to highlight wrong operational procedures. The qualitative score of the operational subfactor (SOPE) is evaluated as follows:
S O P E = i = 1 6 w i · S O P E , i
The organizational subfactor refers to wrong communication, company safety culture and formation, and information of personnel. The qualitative score of the organizational subfactor (SORG) is defined as follows:
S O R G = i = 1 7 w i · S O R G , i
SOPE,i and SORG,i in Equations (6) and (7), are the scores for each of the indicators adopted for the specific analysis.
In the design version of this method, the weight for each operational and organizational indicator is the same. It is now possible to evaluate the score of the management modification factor (SMMF) as a combination of operational and organizational scores:
S M M F = w S O P E · S O P E + w S O R G · S O R G
Weights are to be adapted based on the expert judgment of the operational and organizational subfactors. However, this study considers equally distributed weights for the subfactors, assuming that each subfactor has the same importance.

3.3. Level of Confidence Modification Factor Evaluation and Use

After the evaluation of STMF and SMMF, it is possible to calculate LCMF for the safety function considered:
L C M F = w S T M F · S T M F + w S M M F · S M M F
In this case, the weights for the technical score and the management score do not have the same value. Zipf’s law [34] was used to assess the weights (w) based on a ranking (j) of the modification factors.
w = 1 j n = 1 N 1 j n
The technical factor was ranked first and given a weight of 0.75, as its indicators may be characterized by relatively higher objectivity. The management factor was ranked second and given a weight of 0.25, as its indicators may be characterized by a relatively higher uncertainty and subjectivity. Equation (8) is modified as follows:
L C M F = 0.75 · S T M F + 0.25 · S M M F
The LCMF is a number ranging from 1 to 6 and can modify the design level of confidence of a safety function as indicated in Table 3. The design LC is the level of confidence evaluated based on design conditions and ARAMIS indications. If LCMF is between 3 and 4, LC will not change. If LCMF is between 1 and 3, LC will increase by one unit. If LCMF is between 4 and 6, LC will decrease by one unit.

4. Goliat Floating, Production, Storage, and Offloading Unit

The oil and gas (O&G) industry is constantly exploring new regions. These explorations have also focused on arctic and subarctic regions driven by promising resources [35,36,37,38,39]. However, many challenges are to be faced. Climate and ocean-wave loads have an obvious influence on the choice of design, operations, and maintenance [35,40]. Operations may be delayed by harsh weather, and maintenance has to focus on components that are quickly deteriorating [35,37,41]. In addition, rich and important ecosystems can be found in these regions [35,37], which, in some cases, such as the Barents Sea, are considered World Wildlife Fund (WWF) marine ecoregions for global conservation [42] and high-priority areas for biodiversity maintenance [43].
Within this context, the platform on the Goliat field in the Barents Sea started production in 2016. The production license is owned by ENI Norge, with 65%, and by Statoil, with 35%. The platform is a circular floating production, storage, and offloading unit (FPSO), specifically designed by the offshore oil and gas sector to ensure safe and reliable production of hydrocarbons in extreme conditions in the Barents Sea. In fact, in such a sensitive area, monitoring technical and operational performance of safety barriers on Oil and Gas facilities acquires further importance [44,45,46,47,48]. For this reason, the Goliat platform was considered for the study.
The diameter of the Goliat FPSO is approximately 100 m, with a spread mooring to avoid rotation and a winterization wall in its perimeter to protect personnel and equipment from weather and allow natural ventilation to the area [49]. Goliat arrived in Hammerfest (Norway) in April 2015 from South Korea, after a 63-day voyage. Goliat covers two separate main reservoirs: the Kobbe and the Realgrunnen. The Goliat FPSO has a complete onboard processing plant. The stabilized crude oil stored in the loading tanks is unloaded directly from the FPSO to the tankers via an unloading system. This work focuses on the process area, which consists of two areas equipped with fire protection: the main process area and the offloading process area. These two fire protection areas are separated from each other by a firewall and a blast wall.

4.1. Process Description

The fluid from the wells is routed to the FPSO for separation, oil stabilization, and gas compression. Stabilized crude oil is stored on the FPSO for subsequent offloading to shuttle tankers. The fluid is preheated in an inlet heater to facilitate free water removal in the downstream inlet separator. The inlet separator is a three-phase separator, separating gas, oil, and water. The gas is sent to high-pressure compression, while the water is sent to water treatment. The oil is heated by the inter-stage heater to achieve the specifications in the downstream low-pressure separator. This latter separator is also a three-phase separator for gas, oil, and water. The gas is sent to low-pressure compression, the water to water treatment, and the oil is pumped to an electrostatic coalescer. The electrostatic coalescer operates as a two-phase separator splitting the feed stream into oil and water phases under the influence of an electrostatic field. Water is sent to treatment while the oil is cooled down and sent to storage tanks in the hull. The FPSO process is illustrated by a block diagram in Figure 3.

4.2. Safety Barriers

Goliat safety barriers were identified, and their Level of Confidence (LC) was obtained according to the platform records and was classified following the ARAMIS guidelines [50] (Table 4).
The combination of the safety barriers in Table 4allows defining a series of related safety functions (Table 5).
Two safety function management scenarios are arbitrarily assumed for testing the defined methodology to analyze the case study and described by the following Management Modification Factor (MMF) scores:
Management Modification Factor Score: High = 1.5
Management Modification Factor Score: Low = 5.5
The two scores respectively refer to high and low management performance of safety functions.

5. Results

5.1. Synergi Plant Risk-Based Inspection Results

The software Synergi Plant RBI was applied to the system, and its main results for this study focus on an executive summary stating the risk distribution (Figure 4) and the active damage mechanisms per equipment type (Figure 5) as they support the following bow-tie analysis.
Figure 4 shows the average risk in terms of Euros per year, highlighting that the storage tank and the pipelines are the two most critical pieces of equipment for RBI planning. This confirms the choice of selecting as Bow-Tie Critical Event and Major Event, respectively, the loss of containment from a pipe, a potential domino effect leading to a tank explosion. The latter is particularly critical in such a confined space as the Goliat FPSO process area.
Figure 5 shows the active damage mechanisms for the different pieces of equipment, demonstrating that the internal Stress Corrosion Cracking (SCC) is an important issue for most of the equipment. Its Damage Factor (DF) is above 10 for all the equipment. The damage mechanisms, identified as a combination of the substance and the operating conditions of the different equipment, should be controlled by a specific inspection plan suggested by the software Synergi Plant RBI, in order to ensure safety and compliance with relevant standards such as NORSOK S-100 [51] and ISO 31000 [52].

5.2. Bow-Tie Diagram

The hazardous substance considered for the bow-tie analysis is crude oil, a liquid mixture of various hydrocarbons, mainly alkanes, extremely flammable and dangerous for personnel and the environment [53]. Loss of containment (LOC) of crude oil from the pipe network is considered the bow-tie analysis critical event. Safety functions have an important role in the frequency reduction of central events, dangerous phenomena, and major events. After developing the complete bow-tie diagram and defining the safety functions, the Birnbaum-like measure [54] was evaluated for each function. This allowed defining a reduced bow-tie diagram, including only branches with significant safety functions (Figure 6). The significance in terms of risk is demonstrated by the sensitivity analysis performed while assessing the Birnbaum-like measure of the safety function i:
I B i   =   R F P i
R is the total risk, and FP is the safety function failure probability [55,56]. The failure of a redundant safety function that repeats on several branches can be considered relatively more critical than the failure of an individual safety function. In fact, the relative importance of a barrier function increases with the number of unwanted events that it can address. Table 6 reports the considered safety functions and their design Level of Confidence based on ARAMIS guidelines [50] and their redundancy on bow-tie diagram considering Equation (11). Figure 5 shows the defined bow-tie diagram.

5.3. Management Modification Factor Variation

The method developed in this study is applied to the bow-tie analysis to consider low management performance and accordingly modify the Level of Confidence of safety functions. The STMF is evaluated for each safety function. The SMMF is set to 5.5 (low management performance) for the entire plant. The Level of Confidence Modification Factor is calculated by Equation (10) (Table 7).
The method from this study is also applied to consider high management performance and accordingly modify the Level of Confidence of safety functions. The SMMF is set to 1.5 (high management performance) for the entire plant (Table 8).

5.4. Risk Matrix

The frequencies of the DPs considered in the designed bow-tie are summarised in a risk matrix (Figure 7), presenting the consequence classes on the X-axis and the related frequency on the Y-axis. The risk matrix follows the ARAMIS guidelines [1] and defines the four consequence classes based on the human and environmental targets. The first consequence class considers events with no injury or slight injury with no stoppage of work and no action for the environment deemed necessary. The fourth class addresses irreversible injuries or death outside the site and irreversible effects on the environment outside the site requiring national means. The remaining classes define intermediate consequences between these two limits. Three zones are outlined on the matrix by means of a traffic-light color coding: (i) the lower green zone of negligible effects, (ii) the intermediate yellow zone of medium effects, and (iii) the upper red zone of high effects.
The frequency of the ME “Domino Effect” leading to tank explosion is not reported in the risk matrix as it is considered as the overall consequence of the DPs. Its frequency is estimated as follows:
Design conditions: 1.2 × 10 9 events/year;
Low management performance: 1.24 × 10 7 events/year; and
High management performance: 2.13 × 10 11 events/year.
A relatively more detailed assessment of domino effects may also be performed by following ad hoc methods [57,58,59].

6. Discussion

The application of Synergi Plant RBI to the piping system of Goliat FPSO identified the driving damage mechanism of Stress Corrosion Cracking (SCC) [60]. However, the inspection plan resulting from Synergi Plant RBI is realized without considering the management modification factor because it is not mandatory for the API 581 recommended practice [13]. This factor may affect all the plant pieces of equipment as it can either improve or worsen their performance. The management factor may be instead considered while assessing the performance of the safety functions and safety barriers. This is an important topic in the Oil and Gas sector since the current regulations [7] focus their attention not only on the integrity of the equipment but also on the performance of all the safety barriers in a system.
Current safety practices rely on engineered barriers. Passive systems, such as firewalls or blast walls, do not require external activation but need to be maintained effectively to avoid deterioration. Active systems, such as emergency shutdown and water deluge systems, may support the management and control of escalation scenarios by their integration with passive measures. Since safety barriers have a significant mitigation potential in controlling the risk induced by domino scenarios, the specific assessment of their quantitative performance in risk mitigation and control is necessary [58].
The bow-tie analysis carried out in this work following the ARAMIS Project instructions [1] is set as the baseline for the study. However, it does not consider technical and management factors that can modify the probability of failure of safety functions. On the one hand, its results show negligible and medium effects of the accident scenarios identified (Figure 7). On the other hand, the dangerous phenomena identified are critical for any FPSO, due to their potential of escalation [61]. An ignited leak in the top-side process area considered in the case study could lead to a domino effect, impacting the cargo tank and leading to an explosion due to the flammable gas volume. Fires in the process area and escalating tank explosions could lead to the impairment of evacuation means for the personnel and a loss of the main load-bearing [62].
Several safety barriers are considered by the bow-tie analysis to avoid escalation scenarios. Their probability of failure on demand may not be constant in time, as it is susceptible to potential degradation associated with technical factors. The method suggested in this work is inspired by concepts of dynamicity of risk analysis [63], evaluating changes in the failure probability of safety barriers based on indicators of technical and managerial factors.
Management factors are, instead, characterized by a relative uncertainty, as they can be defined through surveys and qualitative approaches. For this reason, this work associates a lower weight to these factors. However, the analysis showed that they are crucial, and they can sensibly modify the level of confidence of some safety functions, as shown by Figure 8.
This result shows that a safety function, even if it is mainly composed of technical safety barriers, is likely to improve its performance with appropriate management. The safety functions 1, 6, and 25 (respectively, prevent overfilling, prevent internal overpressure, limit pool formation and prevent escalation to other areas) are examples of such behavior. Instead, relatively more complex safety functions, composed of active and passive barriers and characterized by human interactions, are tendentially sensitive to poor management. Despite the exception of safety function 28 (prevent escalation to other areas), examples of the latter behavior are the safety functions 14, 24, 26, and 31 (respectively, prevent escalation to other equipment, limit hydrocarbon leak, limit gas dispersion, and limit fire in process area). Furthermore, some safety functions show a negligible influence from management performance changes.
The study demonstrates that improving general management performance leads to a decrease in the frequency of dangerous phenomena (Figure 7). This change allows obtaining an overall acceptable risk level, as all the phenomena, except the jet fire, result in the risk matrix area of negligible effects. The occurrence frequency of the jet-fire scenario lowers sensibly but remains in the yellow zone of medium effects, highlighting the criticality of this phenomenon in a FPSO.
As shown by Bubbico et al. [20], the jet fire may lead to potential accident escalation. In offshore-platform installations, protection against escalation is usually achieved by adopting multiple safety levels that may include: a basic process control system, instrumented safety systems, passive and active systems, safety shutdown systems, protection systems (post-release actions), and emergency response plans [64]. Attention should be given to safety functions that prevent domino effects and to the indicators to describe the resilience of the safety barriers.

7. Conclusions

The study shows that the Risk-Based Inspection approach may be feasible also for the management of safety barriers, giving credible results to estimate their performance, focusing attention not only on technical aspects but showing the importance of management aspects, which may be disregarded by industrial practices. Furthermore, this method provides a preliminary assessment for an inspection and maintenance plan for safety barriers that could be implemented in a RBI program.
The application of this method to the Goliat FPSO demonstrates the importance of management performance with respect to safety and safety functions. The results show that with a high management performance, the frequency of major accidents is significantly reduced. On the contrary, low management performance may be critical in terms of expected consequences.
Management factors should be considered along with technical ones. The proposed method allows this, keeping in mind that all the indicators can be calibrated based on the characteristics of a plant. In fact, the method can be treated as an open toolbox, which can be customized for a wide range of requirements for projects in the Oil and Gas industry, and it should also be included in risked-based decision making for similar industries such as offshore wind. Clearly, the management factor may be affected by uncertainty and requires detailed and in-depth knowledge of the entire plant, with the need of financial means to accomplish a well-developed and reliable safety system.

Author Contributions

Conceptualization B.H.D. and N.P.; methodology, B.H.D.; validation, B.H.D., R.B. and N.P.; formal analysis, B.H.D.; investigation, B.H.D. and R.B.; resources, N.P.; data curation, B.H.D.; writing—original draft preparation, B.H.D. and N.P.; writing—review and editing, B.H.D., R.B. and N.P.; visualization, B.H.D. and N.P.; supervision, R.B. and N.P.; All authors have read and agreed to the published version of the manuscript.


This research received no external funding.

Data Availability Statement

MDPI Research Data Policies.


The authors gratefully acknowledge the work by Graziano Iacomini during his master’s degree thesis.

Conflicts of Interest

The authors declare no conflict of interest.


  1. Delvosalle, C.; Fievez, C.; Pipart, A. ARAMIS Accidental Risk Assessment Methodology for Industries; Elsevier: Amsterdam, The Netherlands, 2006; pp. 1–60. [Google Scholar]
  2. Paltrinieri, N.; Haskins, C. Dynamic Security Assessment: Benefits and Limitations. In Security Risk Assess; Reniers, G., Khakzad, N., Van Gelder, P., Eds.; Walter de Gruyter GmbH: Berlin/Munich, Germany; Boston, MA, USA, 2017. [Google Scholar] [CrossRef]
  3. CCPS—Center for Chemical Process Safety. Layer of Protection Analysis: Simplified Process Risk Assessment; Wiley: New York, NY, USA, 2001. [Google Scholar]
  4. Sklet, S.; Vinnem, J.E.; Aven, T. Barrier and operational risk analysis of hydrocarbon releases (BORA-Release): Part II: Results from a case study. J. Hazard. Mater. 2006, 137, 692–708. [Google Scholar] [CrossRef] [PubMed]
  5. Fazeres-Ferradosa, T.; Taveira-Pinto, F.; Rosa-Santos, P.; Chambel, J.; Ferradosa, F.; Pinto, T.; Santos, R. Probabilistic Comparison of Static and Dynamic Failure Criteria of Scour Protections. J. Mar. Sci. Eng. 2019, 7, 400. [Google Scholar] [CrossRef] [Green Version]
  6. Mourão, A.; Correia, J.A.F.O.; Ávila, B.V.; De Oliveira, C.C.; Ferradosa, T.; Carvalho, H.; Castro, J.M.; De Jesus, A.M.P. A fatigue damage evaluation using local damage parameters for an offshore structure. Proc. Inst. Civ. Eng. Marit. Eng. 2020, 173, 43–57. [Google Scholar] [CrossRef]
  7. Petroleum Safety Authority. Principles for Barrier Management in the Petroleum Industry; PSA: Stavanger, Norway, 2013. [Google Scholar]
  8. European Council. Directive 2012/18/EU of the European Parliament and of the Council of 4 July 2012 on the Control of Major-Accident Hazards Involving Dangerous Substances, Amending and Subsequently Repealing Council Directive 96/82/EC Text with EEA Relevance; Commission of the European Communities: Brussels, Belgium, 2012; pp. 1–37. [Google Scholar]
  9. Scarponi, G.E.; Paltrinieri, N. Comparison and Complementarity between Reactive and Proactive Approaches. In Dynamic Risk Analysis in the Chemical and Petroleum Industry Evolution and Interaction with Parallel Disciplines in the Perspective of Industrial Application; Butterworth-Heinemann: Oxford, UK, 2016. [Google Scholar] [CrossRef]
  10. Villa, V.; Paltrinieri, N.; Khan, F.; Cozzani, V. Towards dynamic risk analysis: A review of the risk assessment approach and its limitations in the chemical process industry. Saf. Sci. 2016, 89, 77–93. [Google Scholar] [CrossRef]
  11. Landucci, G.; Paltrinieri, N. A methodology for frequency tailorization dedicated to the Oil & Gas sector. Process. Saf. Environ. Prot. 2016, 104, 123–141. [Google Scholar] [CrossRef]
  12. American Petroleum Institute. A.P.I. 580 Risk-Based Inspection, 3rd ed.; API: New York, NY, USA, 2016. [Google Scholar]
  13. American Petroleum Institute. A.P.I. 581, Risk-Based Inspection Methodology, 3rd ed.; API: New York, NY, USA, 2016. [Google Scholar]
  14. Det Norske Veritas. Risk Based Inspection of Offshore Topsides Static Mechanical Equipment DNV RP-G101; DNV: Bærum, Norway, 2010. [Google Scholar]
  15. Paltrinieri, N.; Hauge, S.; Nelson, W.R. Dynamic barrier management: A case of sand erosion integrity. Safety and Reliability of Complex Engineered Systems. In Proceedings of the European Safety and Reliability Conference, ESREL, Zurich, Switzerland, 7–10 September 2015; pp. 523–531. [Google Scholar]
  16. Fazeres-Ferradosa, T.; Rosa-Santos, P.; Taveira-Pinto, F.; Vanem, E.; Carvalho, H.; Correia, J.A.F.D.O. Editorial: Advanced research on offshore structures and foundation design: Part 1. Proc. Inst. Civ. Eng. Marit. Eng. 2019, 172, 118–123. [Google Scholar] [CrossRef]
  17. Vinnem, J.E.; Roed, W. Norwegian Oil and Gas Industry Project to Reduce the Number of Hydrocarbon Leaks with Emphasis on Operational Barriers Improvement. In Proceedings of the European HSE Conference and Exhibition 2013, Society of Petroleum Engineers (SPE), London, UK, 16–18 April 2013. [Google Scholar]
  18. Pitblado, R.; Fisher, M.; Nelson, B.; Fløtaker, H.; Molazemi, K.; Stokke, A. Concepts for dynamic barrier management. J. Loss Prev. Process. Ind. 2016, 43, 741–746. [Google Scholar] [CrossRef]
  19. Øien, K.; Massaiu, S.; Tinmannsvik, R.K. Guideline for Implementing the REWI Method; SINTEF Technology and Society: Trondheim, Norway, 2012. [Google Scholar]
  20. Bubbico, R.; Lee, S.; Moscati, D.; Paltrinieri, N. Dynamic assessment of safety barriers preventing escalation in offshore Oil&Gas. Saf. Sci. 2020, 121, 319–330. [Google Scholar] [CrossRef]
  21. Tan, Z.; Li, J.; Wu, Z.; Zheng, J.; He, W. An evaluation of maintenance strategy using risk based inspection. Saf. Sci. 2011, 49, 852–860. [Google Scholar] [CrossRef]
  22. Norsk Standard. NS-EN 16991, 2018 Risk-Based Inspection Framework; BSI: London, UK, 2018. [Google Scholar]
  23. Topalis, P.; Korneliussen, G.; Hermanrud, J.; Steo, Y. Risk Based Inspection Methodology and Software Applied to Atmospheric Storage Tanks. J. Phys. Conf. Ser. 2012, 364, 012125. [Google Scholar] [CrossRef]
  24. Petroleum Safety Authority Norway. Technical and Operational Regulations; Petroleum Safety Authority Norway: Stavanger, Norway, 2015. [Google Scholar]
  25. Det Norske Veritas. Plant Integrity Management | Plant Maintenance Software | Synergi Plant; DNV: Bærum, Norway, 2014. [Google Scholar]
  26. Sklet, S. Safety barriers: Definition, classification, and performance. J. Loss Prev. Process. Ind. 2006, 19, 494–506. [Google Scholar] [CrossRef]
  27. European Council. Council Directive 96/82/EC of 9 December 1996 on the control of major-accident hazards involving dangerous substances. Off. J. L 1996, 10, 13–33. [Google Scholar]
  28. International Electrotechnical Commission. IEC 61511 Functional Safety—Safety Instrumented Systems for the Process Industry Sector; IEC: Geneva, Switzerland, 2016. [Google Scholar]
  29. Hourtolou, D.; Bernuchon, E. ARAMIS D1C—APPENDIX 9 Assessment of the Performances of Safety Barriers; The European Commission: Brussels, Belgium, 2004; pp. 1–15. [Google Scholar]
  30. CCPS—Center for Chemical Process Safety. Guidelines for Hazard Evaluation Procedures; AIChE: New York, NY, USA, 2008. [Google Scholar]
  31. Paltrinieri, N.; Landucci, G.; Nelson, W.R.; Hauge, S. Proactive Approaches of Dynamic Risk Assessment Based on Indicators. In Dynamic Risk Analysis in the Chemical and Petroleum Industry Evolutive Interaction with Parallel Disciplines Perspective Industrial Applications; Butterworth-Heinemann: Oxford, UK, 2016. [Google Scholar] [CrossRef]
  32. Ahlert, R.C. Guidelines for Consequence Analysis of Chemical Releases; Center for Chemical Process Safety, American Institute of Chemical Engineers (AIChE): New York, NY, USA, 1999; pp. 1–320. [Google Scholar] [CrossRef]
  33. Woods, D. Essential Characteristics of Resilience. In Resilience Engineering: Concepts and Precepts; Leveson, N., Hollnagel, E., Woods, D., Eds.; Ashgate: Aldershot, UK, 2006; pp. 21–34. [Google Scholar]
  34. Zipf, G.K. Human Behavior and the Principle of Least Effort: An Introduction to Human Ecology; Addisn Wesley Press: Boston, MA, USA, 1949. [Google Scholar]
  35. Barabadi, A.; Gudmestad, O.T.; Barabady, J. RAMS data collection under Arctic conditions. Reliab. Eng. Syst. Saf. 2015, 135, 92–99. [Google Scholar] [CrossRef]
  36. Song, G.; Khan, F.; Wang, H.; Leighton, S.; Yuan, Z.; Liu, H. Dynamic occupational risk model for offshore operations in harsh environments. Reliab. Eng. Syst. Saf. 2016, 150, 58–64. [Google Scholar] [CrossRef]
  37. Gao, X.; Barabady, J.; Markeset, T. An approach for prediction of petroleum production facility performance considering Arctic influence factors. Reliab. Eng. Syst. Saf. 2010, 95, 837–846. [Google Scholar] [CrossRef]
  38. Bercha, F.; Brooks, C.; Leafloor, F. Human Performance in Arctic Offshore Escape, Evacuation and Rescue. In Proceedings of the Thirteenth International Offshore and Polar Engineering Conference, Honolulu, HI, USA, 25–30 May 2003; International Society of Offshore and Polar Engineers (ISOPE): Cupertino, CA, USA, 2003; pp. 2755–2762. [Google Scholar]
  39. Musharraf, M.; Khan, F.; Veitch, B.; Mackinnon, S.; Imtiaz, S. Human Performance in Arctic Offshore Escape, Evacuation and Rescue. In Proceedings of the Thirteenth International Offshore and Polar Engineering Conference, Honolulu, HI, USA, 25–30 May 2003; American Society of Mechanical Engineers: New York, NY, USA, 2013; pp. 1–9. [Google Scholar] [CrossRef]
  40. Vanem, E.; Fazeres-Ferradosa, T.; Rosa-Santos, P.; Taveira-Pinto, F. Statistical description and modelling of extreme ocean wave conditions. Proc. Inst. Civ. Eng. Marit. Eng. 2019, 172, 124–132. [Google Scholar] [CrossRef]
  41. Landucci, G.; Bonvicini, S.; Cozzani, V. A methodology for the analysis of domino and cascading events in Oil & Gas facilities operating in harsh environments. Saf. Sci. 2017, 95, 182–197. [Google Scholar] [CrossRef]
  42. Olson, D.M.; Dinerstein, E. The Global 200: Priority Ecoregions for Global Conservation. Ann. Mo. Bot. Gard. 2002, 89, 199. [Google Scholar] [CrossRef]
  43. Larsen, T.; Nagoda, D.; Andersen, J.R. The Barents Sea Ecoregion: A Biodiversity Assessment; WWF’s Barents Sea Ecoregion Programme: Oslo, Norway, 2004. [Google Scholar]
  44. Paltrinieri, N.; Grøtan, T.O.; Bucelli, M.; Landucci, G. A case of dynamic risk management in the subarctic region. In Proceedings of the Risk, Reliability and Safety: Innovating Theory and Practice, Reliability Conference ESREL 2016, Glasgow, UK, 25–29 September 2016. [Google Scholar]
  45. Bucelli, M.; Landucci, G.; Haugen, S.; Paltrinieri, N.; Cozzani, V. Assessment of safety barriers for the prevention of cascading events in oil and gas offshore installations operating in harsh environment. Ocean Eng. 2018, 158, 171–185. [Google Scholar] [CrossRef]
  46. Eni Norge, 2015, Eni Norge, Goliat Field Trip. Hammerfest (2015), p. 32. Available online: (accessed on 29 June 2021).
  47. Bucelli, M.; Paltrinieri, N.; Landucci, G.; Cozzani, V. Safety barrier management and risk assessment: Integration for safer operations in the Oil & Gas industry. In Proceedings of the Institution of Chemical Engineers Symposium Series, Birmingham, UK, 7–12 May 2017; Volume 2017. [Google Scholar]
  48. Bucelli, M.; Paltrinieri, N.; Landucci, G. Integrated risk assessment for oil and gas installations in sensitive areas. Ocean Eng. 2018, 150, 377–390. [Google Scholar] [CrossRef]
  49. Bucelli, M.; Utne, I.B.; Salvo Rossi, P.; Paltrinieri, N.; Cozzani, V. A Preliminary Approach to Subsea Risk Management Using Sensor Network Information; ESREL: Trondheim, Norway, 2018. [Google Scholar]
  50. Delvosalle, C.; Fievez, C.; Pipart, A.; Debray, B. ARAMIS project: A comprehensive methodology for the identification of reference accident scenarios in process industries. J. Hazard. Mater. 2006, 130, 200–219. [Google Scholar] [CrossRef] [PubMed]
  51. NORSOK S-001. Technical Safety. In Standards; NORSOK: Oslo, Norway, 2008; pp. 11–61. [Google Scholar]
  52. International Organization for Standardization (ISO). Risk Management; ISO31000; ISO: Geneva, Switzerland, 2018. [Google Scholar]
  53. ConocoPhillips. Crude Oil—Safety Data Sheet; ConocoPhillips: Huston, TX, USA, 2014. [Google Scholar]
  54. Andrews, J.; Beeson, S. Birnbaum’s measure of component importance for noncoherent systems. IEEE Trans. Reliab. 2003, 52, 213–219. [Google Scholar] [CrossRef] [Green Version]
  55. Scarponi, G.E.; Paltrinieri, N.; Khan, F.; Cozzani, V. Reactive and Proactive Approaches. In Dynamic Risk Analysis in the Chemical and Petroleum Industry; Butterworth-Heinemann; Elsevier: Amsterdam, The Netherlands, 2016; pp. 75–92. [Google Scholar] [CrossRef]
  56. Hauge, S.; Okstad, E.; Paltrinieri, N.; Edwin, N.; Vatn, J.; Bodsberg, L. Handbook for Monitoring of Barrier Status and Associated Risk in the Operational Phase; Center for Integrated Operations in the Petroleum Industry: Trondheim, Norway, 2015. [Google Scholar]
  57. Cozzani, V.; Reniers, G. Historical Background and State of the Art on Domino Effect Assessment. In Domino Effects in the Process Industries; Elsevier: Amsterdam, The Netherlands, 2013; pp. 1–10. [Google Scholar]
  58. Landucci, G.; Argenti, F.; Spadoni, G.; Cozzani, V. Domino effect frequency assessment: The role of safety barriers. J. Loss Prev. Process. Ind. 2016, 44, 706–717. [Google Scholar] [CrossRef]
  59. Cozzani, V.; Gubinelli, G.; Antonioni, G.; Spadoni, G.; Zanelli, S. The assessment of risk caused by domino effect in quantitative area risk analysis. J. Hazard. Mater. 2005, 127, 14–30. [Google Scholar] [CrossRef] [PubMed]
  60. Xie, M.; Tian, Z. A review on pipeline integrity management utilizing in-line inspection data. Eng. Fail. Anal. 2018, 92, 222–239. [Google Scholar] [CrossRef]
  61. Wang, M.; Sun, L.; Li, M. Risk Analysis for FPSO Vapor Cloud Explosion Considering Domino Effect. In Volume 3: Structures, Safety, and Reliability; ASME: New York, NY, USA, 2018. [Google Scholar] [CrossRef]
  62. Kang, K.-Y.; Choi, K.-H.; Choi, J.W.; Ryu, Y.H.; Lee, J.-M. Explosion induced dynamic responses of blast wall on FPSO top-side: Blast loading application methods. Int. J. Nav. Arch. Ocean Eng. 2017, 9, 135–148. [Google Scholar] [CrossRef] [Green Version]
  63. Paltrinieri, N.; Khan, F. Dynamic Risk Analysis in the Chemical and Petroleum Industry: Evolution and Interaction with Parallel Disciplines in the Perspective of Industrial Application, 1st ed.; Butterworth-Heinemann: Oxford, UK, 2016. [Google Scholar] [CrossRef]
  64. Landucci, G.; Argenti, F.; Tugnoli, A.; Cozzani, V. Quantitative assessment of safety barrier performance in the prevention of domino scenarios triggered by fire. Reliab. Eng. Syst. Saf. 2015, 143, 30–43. [Google Scholar] [CrossRef]
Figure 1. The Consequence of Failure (CoF) calculations based on API 581.
Figure 1. The Consequence of Failure (CoF) calculations based on API 581.
Jmse 09 00722 g001
Figure 2. Classification of barrier functions and barrier systems.
Figure 2. Classification of barrier functions and barrier systems.
Jmse 09 00722 g002
Figure 3. Block diagram of FPSO process.
Figure 3. Block diagram of FPSO process.
Jmse 09 00722 g003
Figure 4. Risk Distribution for the Oil Production Unit.
Figure 4. Risk Distribution for the Oil Production Unit.
Jmse 09 00722 g004
Figure 5. Active Damage mechanisms per equipment of the Oil Production Unit. DF stands for Damage Factor, and SCC stands for Stress Corrosion Cracking.
Figure 5. Active Damage mechanisms per equipment of the Oil Production Unit. DF stands for Damage Factor, and SCC stands for Stress Corrosion Cracking.
Jmse 09 00722 g005
Figure 6. Bow-tie diagram for the LOC of crude oil from the pipe network. Blue boxes represent unwanted events. Yellow boxes represent safety functions. DDC = detailed direct cause; DC = direct cause; NSC = necessary and sufficient condition; CE = critical event; SCE = secondary critical event; TCE = tertiary critical event; DP = dangerous phenomenon; ME = major event.
Figure 6. Bow-tie diagram for the LOC of crude oil from the pipe network. Blue boxes represent unwanted events. Yellow boxes represent safety functions. DDC = detailed direct cause; DC = direct cause; NSC = necessary and sufficient condition; CE = critical event; SCE = secondary critical event; TCE = tertiary critical event; DP = dangerous phenomenon; ME = major event.
Jmse 09 00722 g006
Figure 7. Risk Matrix for design conditions, high and low performances.
Figure 7. Risk Matrix for design conditions, high and low performances.
Jmse 09 00722 g007
Figure 8. Level of Confidence of Safety Functions: comparison for the different management performance conditions.
Figure 8. Level of Confidence of Safety Functions: comparison for the different management performance conditions.
Jmse 09 00722 g008
Table 1. Quantitative Level of Confidence assessment [29].
Table 1. Quantitative Level of Confidence assessment [29].
Level of Confidence (LC)Probability of Failure on Demand (PFD) RangeProbability of Failure on Demand (PFD) Mean Value
0 10 1   P F D < 1 0.61334
1 10 2   P F D < 10 1 0.06133
2 10 3   P F D < 10 2 0.00613
3 10 4   P F D < 10 3 0.00061
4 10 5   P F D < 10 4 0.00006
Table 2. Definition of bow-tie elements and event levels [1].
Table 2. Definition of bow-tie elements and event levels [1].
Detailed Direct CauseDDCThe DDC is either the event that can provoke the direct cause or when the labelling of the direct cause is too generic, the DDC provides a prevision on the exact nature of the direct cause.
Direct CauseDCThe DC is the immediate cause of the necessary and sufficient cause.
Necessary and Sufficient CauseNSCThe NSC designates the immediate cause that can provoke a critical event.
Critical EventCEThe CE is the central element of a bow-tie diagram representing a typology of loss of containment for fluids or loss of physical integrity for solids.
Secondary Critical EventSCEThe SCE is the most direct consequence of the CE (for example ‘pool formation’, ‘jet’, ‘cloud’, etc.).
Tertiary Critical EventTCEThe TCE for flammable substances considers the factor of ignition (for example ‘pool ignited’ or ‘pool not ignited’, ’gas jet ignited’). For non-flammable substances ‘gas dispersion’, ‘dust dispersion’, etc. may be considered.
Dangerous PhenomenonDP12 DPs are defined: Poolfire, Tankfire, Jetfire, VCE, Flashfire, Toxic cloud, Fire, Missiles ejection, Blast wave, Fireball, Major Accident to Environment, Dust explosion, Boilover and resulting poolfire.
Major EventMEThe ME is defined as the significant effect from the identified DP on a target (human being, structure, environment, etc.).
Table 3. Score-based Level of Confidence Modification Factor.
Table 3. Score-based Level of Confidence Modification Factor.
Level of Confidence Modification FactorResult
1 ≤ LCMF < 3LC Upgrade (+1)
3 ≤ LCMF ≤ 4Design LC
4 < LCMF ≤ 6LC Downgrade (−1)
Table 4. Goliat Safety Barriers. Type A = the failure modes of all components are thoroughly defined, failure data from field experience exists, and the behavior under fault conditions can be determined. Type B = the failure modes are not thoroughly defined for each component, the behavior under fault conditions cannot be determined a priori, and failure data exist but not for all the sub-components.
Table 4. Goliat Safety Barriers. Type A = the failure modes of all components are thoroughly defined, failure data from field experience exists, and the behavior under fault conditions can be determined. Type B = the failure modes are not thoroughly defined for each component, the behavior under fault conditions cannot be determined a priori, and failure data exist but not for all the sub-components.
Safety BarrierClassificationTypeLevel of Confidence
Overpressure DetectionActiveB1
High Level DetectionActiveB1
Clogging DetectionActiveB1
Acoustic AlarmActiveA2
Gas DetectionActiveB1
Oil DetectionActiveB1
Oxygen RemoverActiveA1
Ignition Sources IsolationActiveB2
Prevent Gas IngressActiveB2
Under-pressure DetectionActiveB1
Oxygen DetectionActiveB1
Electrical IsolationActiveB2
Emergency PowerActiveA2
Toxic Air ControlActiveA1
Emergency ShutdownActiveB2
Emergency Shutdown SectioningActiveA1
Emergency Shutdown InitiationActiveA1
Process ShutdownActiveB1
Manual AlarmActiveA2
Cooling SystemActiveA1
Pressure ReliefPassiveA2
Explosive Load ProtectionPassiveA2
Fire load ProtectionPassiveA2
Load Bearing StructurePassiveA2
Tank dikePassiveA2
Material linerPassiveA2
Shock and Vibration AbsorberPassiveA2
Operative Procedures (ATEX)Human action/2
Operational ProceduresHuman action/2
Safety Team InterventionHuman action/1
Authority InterventionHuman action/1
Inspection and MaintenanceHuman action/2
Vision aidsSymbolic barrier//
Table 5. Safety Functions from the combination of Safety Barriers.
Table 5. Safety Functions from the combination of Safety Barriers.
Safety FunctionAssociated Safety Barriers
Prevent OverfillingHigh Level Detection, Clogging Detection, Process Shutdown
Limit OverfillingEmergency Shutdown Sectioning, Pressure Relief
Limit OverpressureEmergency Shutdown, Pressure Relief
Prevent Temperature RiseHigh Temperature Detection, Process Shutdown
Prevent Internal OverpressureOverpressure Detection, Process Shutdown, Clogging Detection
Prevent Presence of OxygenOxygen Detection, Oxygen Remover, Process Shutdown
Prevent IgnitionIgnition Source Isolation, Emergency Shutdown Initiation, Electrical Isolation
Detect Pressure/Temperature RiseOverpressure Detection, High Temperature Detection
Prevent Failure of SupportsInspection and Maintenance
Limit OverloadingInspection and Maintenance
Control OverloadingEmergency Shutdown Initiation
Prevent Vibrating Resonance EffectShock and Vibration absorber
Prevent Escalation to otherDeluge, Emergency Shutdown Sectioning, Pressure Relief
EquipmentHigh Temperature Detection, Cooling System
Control TemperatureInspection, Non-Destructive Controls
Detect Erosion/CorrosionMaintenance, Flow Control
Limit ErosionMaterial Liner Maintenance
Prevent CorrosionCorrosion Inhibitors, Maintenance
Control CorrosionShock and Vibration absorber
Prevent Mechanical SolicitationsInspection, Non-Destructive Controls
Detect Crack PropagationInspection and Maintenance
Control FatigueGas Detection, Oil Detection, Overpressure Detection, Emergency Shutdown Sectioning, Pressure Relief
Limit hydrocarbon leakDike, Acoustic Alarm, Emergency Shutdown
Limit Pool FormationDeluge, Acoustic Alarm, Emergency Shutdown
Limit Gas DispersionDike, Safety Team Intervention, Authority Intervention
Limit Pool DispersionExplosive Load Protection, Fire Load Protection
Prevent Escalation to other AreasEmergency Power, Order Escape Program, Vision Aids, Toxic Air Control, Safety Team
Prevent Fatalities during EscapeIntervention, Authority Intervention
Prevent Loss of Structural IntegrityLoad Bearing Structure
Limit Fire in Process AreaDeluge, Acoustic Alarm, Emergency Shutdown, Safety Team Intervention, Authority
Table 6. Relevant Safety Functions for sensitivity analysis.
Table 6. Relevant Safety Functions for sensitivity analysis.
ID.Safety FunctionDesign Level of Confidence (LC)Probability of Failure on Demand (PFD)Safety Function Redundancy on Bow-Tie
SF1Prevent overfilling10.061335
SF2Limit overfilling10.061335
SF4Limit overpressure20.006137
SF6Prevent internal overpressure10.061337
SF14Prevent escalation to other equipment20.006133
SF24Limit hydrocarbon leak10.061331
SF25Limit pool formation20.006131
SF26Limit gas dispersion20.006132
SF28Prevent escalation to other areas20.006135
SF31Limit fire in process area20.006134
Table 7. Modified Level of Confidence (LC) for a Management Modification Factor (MMF) indicating low management performance, i.e., Score of the Management Modification Factor (SMMF) = 5.5.
Table 7. Modified Level of Confidence (LC) for a Management Modification Factor (MMF) indicating low management performance, i.e., Score of the Management Modification Factor (SMMF) = 5.5.
Safety Function ID.Level of Confidence Modification Factor (LCMF)Modified Level of ConfidenceModified Probability of Failure on Demand (PFD)
Table 8. Modified Level of Confidence (LC) for a Management Modification Factor (MMF) indicating high management performance, i.e., Score of the Management Modification Factor (SMMF) = 1.5.
Table 8. Modified Level of Confidence (LC) for a Management Modification Factor (MMF) indicating high management performance, i.e., Score of the Management Modification Factor (SMMF) = 1.5.
Safety Function ID.Level of Confidence Modification Factor (LCMF)Modified Level of ConfidenceModified Probability of Failure on Demand (PFD)
Publisher’s Note: MDPI stays neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Share and Cite

MDPI and ACS Style

Hosseinnia Davatgar, B.; Paltrinieri, N.; Bubbico, R. Safety Barrier Management: Risk-Based Approach for the Oil and Gas Sector. J. Mar. Sci. Eng. 2021, 9, 722.

AMA Style

Hosseinnia Davatgar B, Paltrinieri N, Bubbico R. Safety Barrier Management: Risk-Based Approach for the Oil and Gas Sector. Journal of Marine Science and Engineering. 2021; 9(7):722.

Chicago/Turabian Style

Hosseinnia Davatgar, Behnaz, Nicola Paltrinieri, and Roberto Bubbico. 2021. "Safety Barrier Management: Risk-Based Approach for the Oil and Gas Sector" Journal of Marine Science and Engineering 9, no. 7: 722.

Note that from the first issue of 2016, this journal uses article numbers instead of page numbers. See further details here.

Article Metrics

Back to TopTop