Proceedings of the Eleventh (2001) International Offshore and Polar Engineering Conference

Stavanger, Norway, June 17-22, 2001

Copyright 2001 by The International Society of Offshore and Polar Engineers
ISBN 1-880653-51-6 (Set); ISBN 1-880653-55-9 (VoL IV); 1SSN 1098-6189 (Set)

Deepwater Production System Risks

E.G. Ward, Texas A & M University, College Station, TX, USA
Robert B. Gilbert, University o f Texas at Austin, Austin, TX, USA
JihadJaber, GeoSytec Consultant, Atlanta, GA, U S A
Andrew J. gZolford, EQE International, Houston, TX, U S A

interface that facilitated the discussion and resolution of complex

issues from the perspectives of both the MMS and the industry. This
collaboration contributed greatly to the success of this study.

ABSTRACT
A comprehensive study of risks associated with deepwater
production systems has been completed. The Offshore Technology
Research Center (OTRC) undertook the study for the Minerals
Management Service (MMS) to compare the risks of FPSO's with
exiting deepwater production systems (now operating in the Gulf of
Mexico (TLP's, Spars, and Fixed Platforms serving as transportation
hubs for deepwater production.). This comparison was needed to
assist the MMS decision making and poliey development processes
regarding the future permitting of FPSO's in the Gulf of Mexico.
FPSO risks were found to be similar to other existing deepwater
systems. The OTRC's unique attributes and relationships with both
the MMS and the industry contributed greatly to the success of this

DESCRIPTIONS OF DEEPWATER PRODUCTION SYSTEMS

FOR THIS STUDY
The conceptual designs for each of the generic FPSO, TLP, Spar,
and Hub/Host systems studied included both the physical and
operational characteristics of the systems, and were developed to
ensure the following:
1. The TLP, Spar and Hub/Host Jacket systems should represent
existing systems and technologies that are currently being used
in the Gulf of Mexico.
2. The FPSO system should be comparable to that already
developed for the base case in the Environmental Impact
Statement (EIS) study (Minerals Management Service, 2000).
3. The study systems should be as functionally and operationally as
comparable and consistent as possible to one another as to ensure
that differences in risks reflect realistic differences in the
systems and are not an unintended result of design assumptions.
The objective of this study was to evaluate risks during all
aspects of offshore production including oil and gas production and
processing offshore; drilling and well intervention during production;
export of the oil and gas to shore; and transport of personnel to and
from shore. The "lifetime" for each system was defined to start at
first production and end when all production ceased. This study did
not address the construction, installation, commissioning,
decommissioning and removal phases in the life of the systems.
The overall systems included production facility, the pipelines
and shuttle tankers used to transport oil to a shore terminal, and the
supply vessels and helicopters used to support the production
operations, as indicated in Figure 1 and Table 1.

study.
INTRODUCTION
FPSO's are a potentially attractive system for some deepwater
Gulf of Mexico oil and gas developments. WhileFPSO's have been

successfully used in many offshore areas worldwide, none have been

used to date in the Gulf. The Minerals Management Service (MMS)
is the government regulatory authority for offshore oil and gas
development in the United States. The MMS asked the Offshore
Technology Research Center (OTRC) to complete a study to
compare the risks of an FPSO with risks typical for existing
deepwater development systems now operating successfully in the
Gulf. Results from this study plus other information will be used by
the MMS as a basis for policies and decisions regarding the use of
FPSO's in the Gulf.
FPSO risks were compared to those of other existing deepwater
production systems that are now successfully operating in the Gulf of
Mexico. The existing systems considered were TLP's, Spars, and
Fixed Platforms serving as transportation hubs for deepwater
production. Risks were compared for similarly sized systems
throughout a prescribed 20-year operational lifetime. Risk measures
emphasized safety to personnel and the environment. The risks for
all four systems were found to be comparable.
The study was a unique collaboration between regulatory
agencies, the industry, and academia. The OTRC was able to utilize
its relationships with industry and the MMS to provide an effective

RISK MEASURES
1.
2.

654

Risk measures for the study systems were developed to:

Provide relevant and useful input to MMS in their decision
making process;
Be tractable and quantifiable;

nature and expected values, standard deviations, and confidence limits

are used to characterize the risks.

3.

Reflect measures that are currently tracked and recorded to allow

available historical data to be used to develop and support the
results of this risk analysis and to provide a basis for
understandingthe future performance of actual systems.
From these criteria, the risk measures listed in Table 2 were adopted
for this study. The total number of fatalities is a measure the human
safety risks. The total volume of oil released in the lifetime is a
measure chronic environmental risk. The maximum volume of oil
released in a single incident is a measure acute environmental risk.
Each risk measure was treated separately in comparisons and no
attempt was made to combine them into a single measure, such as
equivalent cost.

Table 2. Risk Measures

Risk
Human Safety
Environmental
- Chronic
Environmental

Oas

Flan.ge ~vc.---.~

O"

Gas

' "'
Spar

~ Shuttle

Figure 1. Layout for Systems

Table 1. Attributes of Systems

WaterDepth (ft)
Peak Production
Oil (bopd)
Gas (scfpd)
Export
Oil (bopd)
Gas (scfpd)
Wells
Pre-Drill (MODU)
Platform
Subsea (MODU)
Manning
Production
Marine
Drilling(Platform)
Drilling(MODU)

TLP

4,000

4,000

Hub/Host
Jacket
600

FPSO
5,000

150,000
200,000

150,000
200,000

75,000
50,000

150,000
200,000

150,000
200,000

150,000
200,000

275,000
550,000

150,000
200,000

30-45
6
65
65

30-45
6
65
65

30-45
0
50
65

30-45
10
0
65

Unit

Total Fatalities over

Production Lifetime
Total Volume of Oil
Spilled over Production
Lifetime
Maximum Single Spill
Volume in Production
Lifetime

Number of
Fatalities
Bbl of Oil
bbl of Oil

The quantitative risk assessments were developed through a

process of identifying the hazards, developing preliminary risk
assessments and then refining those assessments using the input of the
technical experts in a workshop process as shown in Figure 2.
The participation of technical experts from industry was
coordinated and facilitated through the DeepStar industry consortium.
Over 100 experienced engineers representing all segments of the
industry (oil companies, consultants, contractors) plus representatives
from the regulatory agencies (MMS and US Coast Guard) actively
participated and contributed to this study. They brought a detailed
understanding of the risks as well as practical design and operational
knowledge and options to manage these risks.
These engineers
served on teams formed to study the four production systems (FPSO,
TLP, Spar, and Hub/Host) and provided detailed information on
hazards and risks. The practical experience and perspective that these
engineers brought to the study was a critical factor to the success of
the study.
The general process for the quantitative risk assessment is
described below. Details on the methodology and the data used for
this study are published elsewhere (Gilbert, Ward, and Wolford,
2001a; Gilbert, Ward, and Wolford, 2001b; Gilbert and Ward, 2000).
Hazard Identification. Hazards and resulting consequences for
the various subsystems (platform and subsea wells, topsides, risers,
flowlines, pipelines, FPSO cargo tanks, shuttle tankers) and
operations (drilling, production, well intervention,oil and gas
transportation, supply, personnel transfer) were evaluated for each of
the four systems, i.e. the FPSO, TLP Spar, Hub/Host Platform.
Considerable effort and care went into the hazard identification, as
this would then become the basis for the risk analyses. There were
numerous meetings with industry experts in each of the subsystems
and operations. Care was taken to understand the similarities and
differences between each subsystem and operation for the four
systems to ensure that the comparative risk analysis would reflect
meaningful similarities and differences. The relationships between the
various subsystems and operations and the risk measures are shown in
Table 3. The hazard identification was reviewed and refined by the
technical experts in Workshop #2.
PreliminaryRisk Assessments Preliminary quantitative risk
analyses were developed prior to workshops #3 and #4. These
preliminary analyses were then used as a basis to elicit quantitative
information from the technical experts during these workshops and
maximize the value of the information obtained during the
workshops.

FP $0

Spar

Acute

Measure of Risk

QUANTITATIVE RISK ASSESSMENT

The objective of the quantitative risk assessment was to
quantitatively evaluate and compare the risk measures listed in Table
2 for the four systems.
Since there is an extremely limited
experience base in the Gulf of Mexico for the types of production
systems being evaluated in this study, it is not possible to obtain
average values directly from historical data. Thus values for averages
these risks had to be predicted for hypothetical systems operated in
the future in the Gulf of Mexico. Such predictions are statistical in

655

Draft System
Descriptions

Workshop #1 System Definition

Develop System Descriptions

from other offshore areas where they have been used, data on tanker
activity in the Gulf and elsewhere and lightering operations in the
Gulf (NRC, 1998; Ward and Scoggins, 1999) were used to
characterize FPSO risks.
The methodology used to develop the preliminary risk
assessments is summarized as follows. Data sets were first divided
into the sub-system and operational categories shown in Table 3.
Fatality data were then summarized as the total number of fatalities in
the data record for each sub-system. The data for oil spills were
further sub-divided into categories by the size of the spill, and the
number of incidents for each spill-size category was compiled. The
data for oil spills were divided into categories because the range of
spill volumes per incident covered five to six orders of magnitude.
Exposure factors were identified for each subsystems and
operation based upon the characteristics of the subsystem or operation
and the type of information that was available in the historical data
records. The exposure factor is a measure of the rate at which opportunities for a hazard or risk can occur. For example, some of
the exposures used in this study were:

Port calls as a measure of shuttle tanker trips

Mile-years as a measure of the transportation ofoil by pipelines

Man-hours as a measure of crew activities during drilling,

production, well intervention, etc.

Passenger-trips as a measure of helicopter travel

The exposure factor allows the risk estimates to be applied to each
system based on the exposure to the risk for that system.
Estimates for the frequency of occurrence for hazards or
incidents for each subsystem or operation relative to its exposure
factor were developed statistically and described by their expected
value and standard deviation.
The risk measures (fatalities and barrels of oil spilled) for each
system's subsystems and operations were then estimated from the
exposures and frequencies of hazards, and were characterized by the
expected value and standard deviation.
The component subsystem and operational risks were then
combined to develop the total or overall risk for each system. These
total risks were also described by the expected value and standard
deviation. Note that this component approach provided a means of
(1) identifying the relative contributions to the total system risk from
each subsystem or operation and (2) comparing the relative individual
component risks between the four systems.
Final Risk Assessments. The preliminary risk assessments were
then refined through the workshops to develop final risk assessments.
Refinements included:

Evaluating and refining data sets to ensure that the data

ultimately used to predict future system performance was based
on historical data that was relevant and characteristic of current
and future practices. For example, the data set for oil spills from
tankers in the Gulf of Mexico was limited to years after 1990 to
account for the effects that the Oil Protection Act of 1990
(OPA90) will have on future performance.

Modify estimates and extrapolations of future performance that

were based strictly on historical data to better reflect current and
future conditions and thUS more accurately characterize future
performance. For example, the frequencies for small spills from
subsea well systems were increased from the data-based
extrapolations to account for differences between subsea well
systems and the platform well systems that dominate the data set.

Modify estimates and extrapolations of future performance that

were based strictly on historical data to better reflect physical
reality and thus more accurately characterize future performance.
For example, the sizes of large pipeline oil spills were limited by
physical constraints

Develop Preliminary Event/Outcome Tables

Workshop #2 Hazard Identification

Elicit Event/Outcome Information

Conduct Preliminary QRA

Workshop #3 Quantitative Risk Analysis

Elicit Frequency/Consequence Input

Refine QRA & Perform Additional Studies

Workshop #4 - Review
Review QRA

Figure 2. Flowchart for Quantitative Risk Analysis Process and

Workshops

Table 3. Subsystem and Operational Categories Used in Risk

Assessment
Risk
Sub-System Categories
Measure

Fatalities

Oil Spills

Production
Drilling
Supply Vessels
Helicopter Transport
Tanker Operations
Major Accident
Well Systems - Platform (or
Surface)
Well Systems - Subsea
Dry Tree (or Production) Risers
Production
Flowlines
Import Flowline Risers (Floating
System
Production Systems)
Topsides
Supply Vessels
Drillin[~and Intervention
Pipelines
Export Pipeline Risers (Floating
Transportation
Production Systems)
Shuttle Tanker (Offloading in
System
Field and at Port)
FPSO Cargo Tank

The philosophy adopted in developing the preliminary risk

assessments was to extrapolate directly from publicly available
historical data in the Gulf of Mexico to predict future performance.
Since there is no experience and data on FPSO operations in the Gulf
nor is there a comprehensive public database on FPSO operations

656

FPSO risks includes fatalities due to shuttle tanker operation, which

are naturally not relevant for the other systems.
The magnitudes of these rates are comparable to those reported
for typical industrial activities (e.g., AIChE 1989).

Account for all sources of uncertainty in the estimates, including

the following:

the limited quality and quantity of relevant data records,

especially for rare events;

the sometimes sketchy information available on the

exposures corresponding to the data sets; and

the extrapolation of future performance from historical

performance.

Spar/TL.P

El~/llh~ and
Iatex~gion

[] Suppb, Vessels

RESULTS

Hel;optcrTratlspod

Results for the final quantitative risk assessments for fatalities

and oil spills are discussed below. Expected values, standard
deviations, and confidence limits are used to characterize the risk
results. The expected value represents the predicted value for the
actual average, while the standard deviation represents the magnitude
of uncertainty in the prediction. The expected value and standard
deviation were used to calculate confidence intervals for the predicted
risks for this study. The 90-percent confidence intervals are used to
describe the results; there is a ninety-percent chance that the expected
value will be within the indicated intervals.
Fatality Risks. Results for the average total number of fatalities
during the 20-year lifetime are shown in Figure 3 for each system.
The total fatality risks are very similar for the four study systems.
The expected contributions to the total fatality risk are shown on
Figure 4. Production and drilling and well intervention activities
dominate the total fatality risks for all four systems, because the bulk
of the man-hours or exposure during the 20-year lifetime are devoted
to these activities. The risk components for the TLP, Spar, and the
Hub/Host are similar.

la Ta_l
"l~r Opcrafionz
==l~'~jo:,Ae~qdnt

Hub/HostJacket

2.0

"~ ,E 1.o

Figure 4. Contributions to Fatality Risks

Oil Spill Risks. The annual frequencies of oil spills for various spill
volumes are shown in Figure 5. The frequencies decrease and the
magnitude of the uncertainty increases with increasing spill volumes.
This is natural outcome of the fact that large spills are rare events
such that there are few occurrences from which to estimate the
frequencies (and volumes) of large spills.
Spills of up to 1,000 barrels are generally dominated by
production related activities. The frequencies are generally the same
for the TLP, Spar, and FPSO. The frequencies are slightly smaller
for the Hub/Host because of the lower production rate for this system.
Spills greater than 1,000 barrels are generally dominated by
transportation related activities. The transportation systems for the
TLP, Spar, and Hub/Host are all pipelines. The exposure factor for
pipeline spill risks is mile-years. Spill frequencies for the TLP and
Spar are indistinguishable due to design and operational similarities in
the pipeline portions of the systems. Spill frequencies for the
Hub/Host are slightly smaller due to the shorter length of the pipeline
to shore.
Shuttle tankers are the transportation system for the FPSO, and
the exposure factor for oil spills is the number of port calls or trips.
For spills between 1,000 and 100,000, the spill frequencies for the
FPSO shuttle tanker system are lower than that for pipelines. This is
in part due to the fact that the potential for pipeline spills remains
constant as long as there is oil in the pipeline regardless of the natural
decline in production rate during the system lifetime. The potential
for shuttle tanker spills decreases with decreasing production as fewer
trips or port calls are required.
Large spills exceeding 100,000 barrels are possible although rare
for the FPSO system. A spill in the 100,000 - 500,000 barrel
category represents a major loss from a collision or explosion
involving a shuttle tanker. A spill larger than 500,000 barrels
represents a major loss from a collision or explosion involving the
FPSO. Large spills exceeding 100,000 barrels are not considered

IIII
90% confidence intervals

>
<

o.o

I
Spar

Hub/Host
TLP Jacket

FPSO

:::::::::::::::::::::::::

3.0

5
.
"6

B P~od~lctiea

FPSO

System

Figure 3. Fatality Risks

Note that the contribution of drilling and intervention activities
to the total fatality risk for the FPSO is smaller than for the other
systems. Since all FPSO wells are subsea wells and it was assumed
that well intervention would be less frequent due to well design, and
difficulty and cost of intervention, the man-hours (exposure) drilling
and intervention activities for fatalities is lower. Also note that the

657

4,500 years. Most of the risk for the TLP and Spar systems resulted
from spill sizes of 10,000-100,000 barrels, which are expect to occur
once in 600 years. Thus the larger but rarer FPSO spills and the
smaller but more frequent pipeline spills results in comparable risks
for the TLP, Spar and FPSO. One effect of the spill risk being
dominated by rare, high consequence events is that the confidence
intervals in the average oil spill volumes in Figure 6 range over nearly
an order of magnitude. This uncertainty reflects the typically limited
quantity and quality of historical data available to estimate
frequencies for rare events. The risk for the Hub/Host is slightly
smaller than the other systems because it has a smaller production rate
and a shorter transportation distance to the shore.
The relative contributions to the total oil spill risk from different
sub-systems are shown in Figure 7. Transportation activities, which
dominate the larger spill sizes, are the main contributors to the total
oil spill risk. Production related activities, which tend to dominate the
smaller spill sizes, do not contribute substantially to the total risk.

possible for the pipeline systems due to operational practices and

safety systems that would shut in a failed pipeline and physical
constraints that limit the volume that would leak out after shut-in.
Results for the average total volume of oil spilled during the 20year system lifetime are shown on Figure 6 for each system. The total
oil spill risks are very similar for the four systems.
Spar

1.0E+01

TLP
Hub/Host Jacket
#

1.0E+00
"E"
~>,

& FPSO
1.0E-01
1.0E-02

~'
0)

W.lr,
..

E ected,alu

'"11

1.0E-03
1.0E-04

interval

tt1,
II |

ii
"~
t-

1.0E-05

Spar/'rLP

1.0E-06

go
~

q,..

go
N
o
o

Spill Size (bbl)

go

go

g
o
g

oo

to

Figure 5. Annual Frequency for Spills from All Sources

versus Spill Size

Hub/Host Jacket

In Well Systems - Rafform

13V~II Systems - Subsea
D Dry Tree Risers
I Row lines
ImportRow line Risers
El Topsides
r-I Export Pipeline Risers
Rpelines
B Shuttle Tanker
FPSOCargo
Supply Vessels
Drilling and Intervention

FPSO

10000

8000
6000
~--~4000
0 I I AveraTtge/a!ol
90% confidence intervals

'Q. ~

/}

~6 ~

Figure 7. Contributors to Oil Spill Risks

CONCLUSIONS

Spar

Hub
st
TLP Jacket

Results of this study indicate that the expected risks associated

with the FPSO are comparable to those of other deepwater production
systems now successfully operating in the Gulf of Mexico, namely
TLP's, Spars, and platforms serving as a Hub/Host to deep-water
production. Specifically, these results show:

There are no significant differences in the fatality risks between

the four systems.

There are no significant differences in the oil-spill risks between

the four systems. The major contribution to the oil spill risks for
all systems is the transportation of oil from the production
facility to the shore terminal. Spill risks for pipelines and shuttle
tankers are comparable even though the frequencies and sizes of
possible spills are different. Rare, large spills rather than
frequent, small spills will dominate the average total volume of
oil spilled during the facility lifetime.

System

Figure 6. Oil Spill Risks

The total risks for all of the deepwater systems (Spar, TLP and
FPSO) are nearly identical even though the frequencies for different
spill sizes are not identical, as discussed above and shown in Figure
5. This results because risk is a measure both of frequency and
consequence (spill size). Analyses showed that most of the risk for
the FPSO resulted from spill sizes ranging from 100,000-500,000
barrels, and that such spills are expected to occur only once every

658

The unique attributes and relationships between the OTRC with

the MMS and the industry provided an effective interface and forum
to discuss complex issues from both the regulatory and industrial
perspectives. This contributed greatly to the success of this study.
This study was performed for deepwater production systems in
the Gulf of Mexico, but the approach and methodology are useful for
other offshore areas and to support other risk-based decisions.
ACKNOWLEDGMENTS
The authors wish to acknowledge the Minerals Management
Service for funding this project. Specific individuals at MMS who
have been instrumental in this study are Paul Martin, Charles Smith
and James Regg. The DeepStar Consortium was instrumental in
coordinating and facilitating the involvement of industry experts i n
this study. Allen Verret, now a Private Consultant, was most
effective in representing DeepStar and its interface with this study.
And finally, the authors gratefully acknowledge the industry experts
whose participation and contributions were vital to the success of this

study.
REFERENCES
AIChE (1989), "Guidelines for Chemical Process Quantitative Risk
Analysis", Center for Chemical Process Safety of the American
Institute of Chemical Engineers, New York.
Gilbert, R.B. and Ward, E.G. (2000), "Planned Approach for
Comparative Risk Analysis of Deepwater Production Systems in the
Gulf of Mexico, ' Proc o f OMAE 2000:19 t~ International Conference
on Offshore Mechanics and Arctic Engineering, New Orleans, LA, in
press.
Gilbert, R.B., Ward, E.G., and Wolford, A.J. (2001a), "Comparative
Risk Analysis for Deepwater Production Systems" final report
prepared by the Offshore Technology Research Center for Minerals
Management Service (available at http://www.mms.gov and
http://otre.tamu.edu).
Gilbert, R.B., Ward, E.G. and Wolford, A.J. (2001b), "Preliminary
Results from Comparative Risk Analysis for Deepwater Production
Systems," International Conference on Safety, Risk, and Reliability Trends in Engineering, IABSE, Malta, in press.
Minerals Management Service (2000), "Proposed Use of Floating
Production, Storage, and Offloading Systems on the Gulf of Mexico
Outer Continental Shelf," Final Environmental Impact Statement
prepared for the Minerals Management Service, Gulf of Mexico OCS
Region (available at http://www.mms.gov).
National Research Council (1988), "Oil Spill Risks from Tank Vessel
Lightering", Washington D.C., National Academy Press
Ward, E.G. and Clark, T. (1999), "Oil Spill Risks from Tanker Vessel
Lightering: A Marine Board Report, Proc. Offshore Technology
Conference, Paper 10706, Houston, May 1999

659