See

discussions, stats, and author profiles for this publication at: https://www.researchgate.net/publication/222522815

A conceptual offshore oil and gas process

accident model

Article in Journal of Loss Prevention in the Process Industries · March 2010

DOI: 10.1016/j.jlp.2009.12.003

CITATIONS READS

24 555

3 authors, including:

Faisal Khan
Memorial University of Newfoundland
404 PUBLICATIONS 5,327 CITATIONS

SEE PROFILE

All content following this page was uploaded by Faisal Khan on 28 January 2015.

The user has requested enhancement of the downloaded file. All in-text references underlined in blue are added to the original document
and are linked to publications on ResearchGate, letting you access and read them immediately.
 Journal of Loss Prevention in the Process Industries 23 (2010) 323e330

Contents lists available at ScienceDirect

Journal of Loss Prevention in the Process Industries

journal homepage: www.elsevier.com/locate/jlp

A conceptual offshore oil and gas process accident model

M.F. Kujath a, *, P.R. Amyotte a, F.I. Khan b
a
Department of Process Engineering & Applied Science, Dalhousie University, Halifax, NS, Canada B3J 2X4
b
Faculty of Engineering & Applied Science, Memorial University, St. John's, NL, Canada A1B 3X5

a r t i c l e i n f o a b s t r a c t

Article history: The purpose of this paper is to present and discuss an accident prevention model for offshore oil and gas
Received 30 June 2009 processing environments. The accidents that are considered in this work relate specifically to hydro-
Accepted 16 December 2009 carbon release scenarios and any escalating events that follow. Using reported industry data, the
elements to prevent an accident scenario are identified and placed within a conceptual model to depict
Keywords: the accident progression. The proposed accident model elements are represented as safety barriers
Accident model
designed to prevent the accident scenario from developing. The accident model is intended to be a tool
Sequential model
for highlighting vulnerabilities of oil and gas processing operations and to provide guidance on how to
Offshore safety
minimize their hazards. These vulnerabilities are discussed by applying the 1988 Piper Alpha and the
2005 BP Texas City disaster scenarios to the model.
Ó 2009 Elsevier Ltd. All rights reserved.

1. Introduction progression of an accident. These barriers are currently conceptual

There can be various formats for accident models depending on
the background of the individual or team performing the analysis.
For example, when a human-factors expert models an accident,
they typically use a cognitive approach that involves parameters
such as human ability, preparedness to perform a task, and skill.
The engineering method being utilized in the current work uses
a systematic approach, in which each cause of an accident is
considered as a mechanism that can be represented either in logic
form or as a sequence.
The starting point for this work is a review of past accidents in
the offshore oil and gas processing industry. A key objective is to
learn how accidental releases of hydrocarbons occur, the different
stages of accident occurrence, immediate and root causes, and how
the events escalate out of control.
There are a number of sources of information on offshore oil and
gas process accidents: research papers, government and industry
reports, newspaper articles and accident data bases. Some of the
available offshore oil and gas accident data bases are WOAD
(Det Norske Veritas), ORION (UK HSE Offshore Safety Department),
MAIB (UK DFT) and BLOWOUT (SINTEF of Norway). WOAD (World
Offshore Accident Database) is being used here to provide credible
accident scenarios for the proposed accident model.
Undertaking a systematic approach with the proposed accident
model, the elements of the model are represented as barriers to the
* Corresponding author.
E-mail address: mattkujath@hotmail.com (M.F. Kujath).
in that they represent the most important elements necessary to
control an accidental hydrocarbon release offshore. Exhaustive
searching of public domain literature confirms that there is a scar-
city of information on the subject of offshore oil and gas process
accident modeling. The available literature concentrates primarily
on occupational accidents. There is also a great deal of information
in the literature on the effects of oil and gas releases and subse-
quent fires. Information is lacking, however, in both the concepts of
identifying root causes of process accidents and how the incidents
escalate. The current research aims to create a technique to identify,
model, and prevent the occurrence of accidental releases in
offshore process facilities. The proposed model is developed to
enable an organization to use its own accident data to evaluate
their risk of a release and to prevent such an occurrence.
2. Available accident modeling approaches
The elements associated with the critical components of an
accident sequence, as related to people working, were introduced by
James Reason (Reason,1990). Subsequent application of this method
(along with previous work by Bird & Germain, 1996) has led to the
development of the Loss Causation Model illustrated in Fig. 1.
This technique establishes a hierarchal organization of the
events and precursor conditions of an accident in an industrial
environment. The analysis begins with the loss or harm to an
individual or a process and steps back through the chain of events
and conditions that contributed to the loss. This form of feedback
leads to the upper management of an operation and facilitates

0950-4230/$ e see front matter Ó 2009 Elsevier Ltd. All rights reserved.
doi:10.1016/j.jlp.2009.12.003
324 M.F. Kujath et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 323e330
Fig. 1. Loss causation model adapted from Bird and Germain (1996).
decision making on options to stop the reoccurrence at any level in
the chain. A failure at any level in this model can result in the
progression to a loss.
Fig. 2 shows a similar accident modeling technique commonly
known as the Swiss Cheese Model (of James Reason). This technique
is currently being used in the aviation industry to prevent human
error (Shappell & Wiegmann, 2000). It is titled the Swiss Cheese
Model because it uses a concept of latent or precursive failures
represented as holes in slices of Swiss cheese. It is also a sequential
loss causation model in that it operates on the principle that there
are successive safety barriers (figurative slices), which, when they
fail, provide a hole through to the next slice. If all the slices fail, then
all the figurative holes line up, providing a path for an accident to
occur. The concept is that a loss is never the absolute responsibility of
the final person in the chain of decisions and events leading to an
accident. What is theorized is that there needs to be a convergence of
events and conditions which permit an accident to occur. The Swiss
Cheese Model representation for an accident has been applied
predominantly to occupational accidents.
The accident model developed in the current work adopts the
concept that an accident is never the sole responsibility of a single
person, but a culmination of circumstances that in combination
produce an accident. In the proposed model, both previously
described techniques (Figs. 1 and 2) are merged to formulate an
integrated approach to process accident modeling. The develop-
ment of the methodology is further guided by past accident
data that are available in the public domain literature. The sequence
of elements representing the different stages of a hydrocarbon
release accident have been developed from these reported data, as
described in the following sections.
3. Reported hydrocarbon release data review
There are numerous accident data bases worldwide for various
types of safety considerations. For the offshore oil and gas industry,
Fig. 2. Swiss cheese model adapted from Shappell and Wiegmann (2000).
as previously mentioned there are a few available data bases:
ORION, MAIB, BLOWOUT, and WOAD. WOAD has been used here to
collect data on offshore oil and gas process accidents to compile
a listing of hazards and to evaluate the ensuing risk. In reviewing
the WOAD records, drilling blow-outs and navigational mishaps
such as towing accidents were omitted from the analysis.
From our comprehensive review of WOAD, the predominant
reported reasons for hydrocarbon releases are: loose bolts on
flanges, loose flanges, damaged flange seals, incorrect welds, loose
fittings, faulty valves, switching generator fuels, overfilling of
tanks, open access/vent/valve, safety instrumented system failures,
damaged hoses, equipment start up, seal failures, and pump over-
pressure. The reported sources of ignition are: turbine gas leak, hot
manifold, short circuit due to water ingress in electrical panel,
welding and grinding, and bearing overheating.
Other possible causes of accidental hydrocarbon releases are:
vibration, corrosion and release of inert nitrogen from within a tank.
Other sources of ignition are: vibrations and static electricity.
However, these other release scenarios and potential ignition sour-
ces did not feature prominently in the WOAD records sampled.
The above results from WOAD are supported by the work of
Sklet (2006a,2006b), who presented similar findings collected from
published release statistics covering the British sector of the North
Sea, data from the Petroleum Safety Board covering the Norwegian
Continental Shelf, and various Det Norske Veritas release reports.
The additional hydrocarbon release concerns reported by Sklet
(2006a,2006b) are: lack of water in water locks, internal corrosion,
external corrosion, erosion, overpressure, external impact/load, and
design error.
The organization within a novel accident model of all these
reported reasons for hydrocarbon releases and escalating events is
presented in the next section.
4. Proposed accident prevention model
The proposed model (Fig. 3) integrates the Loss Causation Model
(Fig. 1) along with the Swiss Cheese Model (Fig. 2) to depict an
accident scenario for the offshore oil and gas process industry.
These available models work from the potential loss element
backwards through to identifying potential management failures,
with intermediate steps of causation in between. They effectively
model how to scrutinize occupational behaviour to avoid a loss.
This is achieved by placing importance on an organization as
a whole to reduce the responsibility of an individual and to show
management's responsibility for shortfalls when they occur.
The proposed accident model starts at reducing the risk of
a hydrocarbon release and applying successive safety (prevention)
barriers to minimize the escalation of events as shown in Fig. 3.
Each safety barrier is further branched to highlight applicable
safety barrier sub-elements. These sub-elements are organized
using fault trees as detailed in Fig. 4. The sub-elements pertain
specifically to offshore oil and gas processing as discussed in the
previous section outlining the WOAD review results.
 M.F. Kujath et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 323e330 325

Fig. 3. Accident model.

The Release Prevention Barrier is the first element from the left
in the model as represented in Fig. 4. This barrier identifies the sub-
elements necessary to reduce the risk of a hydrocarbon release
from process equipment. The Ignition Prevention Barrier identifies
the necessary sub-elements to prevent the ignition of a potential
release. The Escalation Prevention Barrier includes sub-elements
for preventing an escalation of the events beyond the initial
release/ignition scenario. The Harm Prevention Barrier contains
sub-elements to prevent harm to people during an evacuation after
a release has escalated out of control. DiMattia, Khan, and Amyotte
(2005) describe how a team of expert judges from the offshore oil
and gas industry were asked to identify and rank the most impor-
tant variables to a safe muster and evacuation of an offshore plat-
form. The results were: stress, complexity of evacuation tasks,
training, muster experience, event factors and atmospheric factors.
These variables have been adopted here as the basis for the sub-
elements for the Harm Prevention Barrier. The final element of the
model is the Loss Prevention Barrier. The principles of inherent

Fig. 4. Accident model sub-element fault trees.

326 M.F. Kujath et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 323e330
safety (e.g. Khan & Amyotte, 2003) can be applied at this barrier to
mitigate the potential losses. It should be noted that application of
the principles of inherent safety can also have significant benefits in
preventing hydrocarbon releases in the first instance.
The logic in the proposed model depicted in Fig. 4 is achieved
through an OR gate between the parent prevention barrier and its
sub-elements. Each prevention barrier is similarly constructed so
that if there is a high probability of failure of any of the sub-element
safety barriers, then the parent prevention barrier is highlighted as
having a similarly high probability of failure. The next prevention
barrier is then analysed until a prevention barrier succeeds or an
accident ultimately escalates as shown in Fig. 5.
To apply the proposed model to an accident or a platform study,
one would start at the Release Prevention Barrier sub-element
concerned with a particular deviation and work to the right
assessing the vulnerability of the scenario to a release escalation as
represented in Fig. 5. The vulnerability of the scenario would be
assessed using fault tree analysis applied to the sub-elements of the
model depicted in Fig. 4.
A deviation for a scenario analysis would be an event that
resulted in a release of hydrocarbons. The first barrier to encounter
the deviation would be the Release Prevention Barrier. If, when
analysed using a fault tree, the sub-elements illustrated in Fig. 4
highlight that there is concern of failure to these safety barriers,
then the deviation continues on to the next safety barrier in the
model, the Ignition Prevention Barrier. If there is no concern of
failure of any of the Release Prevention Barrier sub-elements, then
the deviation would return to a safe state. This would require that
all of the sub-elements had a sufficiently low probability of incur-
ring a failure. If there are highlighted failures during the fault tree
analysis, then the deviation can continue ultimately to an escalated
accident where losses are incurred to people, property, production
and the environment, as represented in Fig. 5. This approach is
applied to case study accident scenarios in the following section.
It is well-understood by the current authors that the safety
barrier elements of the present model are conceptual. The
elements are, however, scientifically rigorous in that they have
been developed by means of a comprehensive search of public
domain literature pertinent to the offshore oil and gas industry
Fig. 5. Accident model event tree.
Table 1
Process accident rates reported from 1986 to 2003, WOAD (2008).
HC release scenario HC release Incident Percentage per Percentage
count from 1000 HC release per accident
reviewed records scenario record
Loose Flange/Fitting 38 17% 4%
Open Valve 37 17% 4%
Various 145 66% 15%
(in particular the World Offshore Accident Database, WOAD). To
evaluate the model elements in terms of probability of failure, an
organization would need to collect data as identified by the safety
barrier analysis embodied in the model. These data are presum-
ably available internally in companies engaged in offshore oil and
gas activities. However, this detailed information is lacking in
current accident data bases such as WOAD.
What WOAD has provided to the current work is a level of detail
sufficient for conceptual model development, as illustrated by the
following example. A sample of 1000 out of an available 5162
offshore oil and gas accident records from WOAD are shown in
Table 1. The timeframe for the reporting of all accidents is from
1970 through 2005. The first 1000 records reviewed and being
reported here are from a timeframe of 1986 through 2003.
Offshore oil and gas operations are a mix of activities related to
surveying, drilling, refining and transporting. Most accidents seem
to be related to navigational errors and adverse weather. The
primary indication of release of hydrocarbons during offshore oil
and gas processing is 17% from loose bolts on flanges or similar
components and 17% for valves being left inadvertently open or
closed (Table 1). These are currently the most credible reported
reasons for offshore oil and gas process accidental releases indicated
by WOAD. This result significantly highlights the Fitting of Flanges
and Valve Position Labelling sub-elements in the proposed model's
Release Prevention Barrier. The various other reasons for hydro-
carbon releases had lower frequencies of occurrence compared to
loose flanges, loose fittings and open valves. Again, the quantitative
evaluation of what constitutes a high degree of concern of failure for
a safety barrier on a given installation requires facility-specific data
(which is beyond the capabilities of data bases such as WOAD).
 M.F. Kujath et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 323e330
5. Case study application of proposed model
The proposed model can be applied to an existing operation or
a past accident to identify concerns in safety regarding hydrocarbon
releases. Using the details of the Piper Alpha disaster, one can see
how the reported incident fits within the model and highlights the
accident progression.
On the day of the Piper Alpha accident, a backup hydrocarbon
pump was put out of service to recertify the pump's relief valve.
Subsequently, this pump was left out of service after a shift change
because the maintenance work was not completed. The pump was
later required to backup the primary pump that had tripped, but the
backup pump did not have a functioning relief system. The backup
pump was rushed into service, resulting in a release. Once ignited,
the release lead to a fire and a series of explosions (Cullen, 1990).
Using the current model as a guide, the aspects of the scenario in
terms of safety barriers that are important in understanding the
accident are depicted in Fig. 6. The sub-elements of the barriers that
are highlighted are considered to be those having a high risk of
failure.
Under the Release Prevention Barrier, first the Equipment Cali-
bration Schedules sub-element is highlighted because the task of
recertifying the relief valve was not completed. In terms of the
Fig. 6. Piper alpha accident model fault trees.
327
model, this deviation alone would result in a progression to the
Ignition Prevention Barrier. However, the other relevant high-
lighted safety barriers require further discussion. The Verification
of Work Permits barrier is highlighted because the work permit for
the backup pump stated that the pump was not in working order.
This document should have been checked but was not found before
putting the backup pump into service. The Fitting of Flanges safety
barrier is highlighted for this scenario, since there was question as
to whether the blind flange that was installed in place of the relief
valve was fitted correctly. If not installed correctly, then the flange
could have contributed to the release. This situation ultimately
leaves the process without a functioning relief system when the
backup pump is in service, highlighting the Relief System barrier.
The lack of a functioning relief valve on the backup pump lead to an
overpressure of the pump and resulted in a release. This situation
highlights the Over-Pressure Monitoring sub-element.
The Ignition Prevention Barrier is analysed next. Analysis of the
ignition of the release for this disaster was inconclusive. It could
have been caused by a hot turbine exhaust surface in an adjacent
area, an electrostatic spark, or from the release jet itself. This
situation highlights the Spark Inhibition and Shielding of Hot
Exhaust Surfaces safety barriers. The Gas Alarm safety barrier is
also highlighted here since alarms sounded before the explosion
328 M.F. Kujath et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 323e330
occurred, though in this scenario there was little time for action and
eventually the release ignited.
The Escalation Prevention Barrier is considered next. The area
where the release occurred, the hydrocarbon pump enclosure, was
protected by fire walls and not by explosion walls since the plat-
form originally was designed only for oil production. If the area had
been outfitted with explosion walls, then the adjacent oil separa-
tion area would likely not have caught fire and the event may not
have escalated further.
In the current model, this consideration highlights the Fire Walls
and Explosion Walls safety barriers. The explosion escalation
caused damage to the Sprinkler System, another highlighted safety
barrier in the model. If blast walls were used, then the sprinklers
could have helped to reduce the severity of the fire. A control room
operator did not activate a shutdown of the process when alarms
were sounding because he felt he had seen this same situation
many times before without adverse results. The eventual scenario
might have been altered if he had realized the imminent danger. An
automatic shutdown of the platform did occur after the platform
was all but lost. These details highlight both the Automatic Shut Off
of HC Process Inflow and Manual Shut Off of HC Process Inflow
safety barriers in the model.
The Harm Prevention Barrier is the next safety barrier to be
analysed. During the initial explosion the platform control room
was destroyed and the relevant personnel to order an evacuation
were killed, so it is difficult to establish the exact details of the
muster sequence. The Personnel Distance to Hazard safety barrier is
highlighted here. People were still evacuating long after the initial
explosion, but in a typical accident the time constraints are
generally much shorter. For the model the Evacuation Time
Constraint sub-element is pertinent. Of 226 personnel onboard the
platform, 165 people died and another two rescue workers were
also lost. If there were blast walls installed on the platform to
protect the control room, accommodations and processes, the
evacuation would likely have happened much quicker. Muster
Training was also called into question (Cullen, 1990), and hence this
sub-element is highlighted.
The last safety barrier to be considered is the Loss Prevention
Barrier. An oil and gas platform operates with a high associated risk
of danger. This danger was realized during the Piper Alpha disaster.
One item that could have been improved with respect to equipment
would have been to substitute the fire walls with blast walls in the
hydrocarbon processing enclosures, highlighting the Substitution of
Inherent HC Hazard safety barrier. The other platforms in the vicinity
of Piper Alpha continued production while the Piper platform fires
and explosions escalated. This production introduced massive
amounts of hydrocarbons to Piper Alpha even though the rig was
shutdown; this further escalated the catastrophe. The inherent
safety principle of minimization of hydrocarbon inflow would have
reduced the severity of the escalated events, highlighting the
Minimization of Inherent HC Hazard barrier.
The Piper Alpha accident as depicted in Fig. 6 shows that all the
parent prevention barriers are highlighted. The fault trees identify
that all prevention barriers have failed and the scenario escalated to
a major loss. This clearly shows that the scenario that progressed
was preventable, since the primary elements of the accident
scenario have been identified. If there was protection provided as
highlighted by the current model, then the scenario may have
developed differently. As always when using case studies to vali-
date (in part) a conceptual model, the current authors recognize the
certainty afforded by hindsight.
The model can also be applied to the BP Texas City disaster as
reported by Mogford (2005). The incident investigation revealed
that a distillation tower for hydrocarbons was not being utilized
according to established procedure. The distillation process was
being started up when the vessel introduced liquid and vapour
through its relief into a separate relief sump, which subsequently
overflowed to atmosphere resulting in fire and explosion and
significant loss of life.
Fig. 7 shows how the current conceptual model is used again as
a guide to highlight the aspects of the scenario in terms of safety
barriers that are important to understanding the accident. Again,
the sub-elements of the barriers that are highlighted are consid-
ered to be those having a high risk of failure.
The Release Prevention Barrier is considered first for analysis.
When applying the model to this incident, the Relief System sub-
element is highlighted as a concern of failure; the relief system was
not designed to handle such an upset. A better relief would have
been to flare, where the overpressure contents would have been
burned before accumulating and exploding. There was concern
raised about proper Management of Change being followed at the
facility (the next highlighted safety barrier). The process equipment
had been modified extensively over decades and some process
configurations were novel and undocumented. Therefore, the
equipment configuration in terms of open or closed valves
according to proper procedure was questionable. This highlights
the safety barrier of Valve Position Labelling to insure all valves are
correctly operated.
The Ignition Prevention Barrier is analysed next. The ignition of
the overpressure contents of the distillation tower relief system for
the scenario was inconclusive, though a likely source was hot
engine exhaust from a truck too close to the relief equipment. Using
the model, the Shielding of Hot Exhaust Surfaces safety barrier is
highlighted here as a point of concern. The Gas Alarm safety barrier
is also highlighted because there were no automatic gas alarms to
detect the overpressure scenario and to notify people close to the
relief location. The ignition point may have also been static
discharge to accumulated gas in the nearby sewer, which is covered
by the Spark Inhibition barrier.
The Escalation Prevention Barrier is considered next. Stopping
the input of hydrocarbon feed, and/or increasing off-take and
reducing heat input earlier would possibly have prevented the
incident. This is highlighted by the Manual Shut Off of HC Process
Inflow safety barrier of the model. The Automatic Shut Off of HC
Process Inflow barrier is also relevant here, in that an automatic
shutdown was not initiated by the antiquated processing equip-
ment. The processes were located outdoors so blast wall protection
was not provided for operators or nearby personnel. This is high-
lighted under the Explosion Walls safety barrier of the model.
The Harm Prevention Barrier is analysed next. Before the
explosion there were process alarms that sounded and there were
some that did not. There was no alarm to warn nearby personnel of
impending danger such as the relief system overflow. There was
reported concern over training of all personnel involved. The
procedures were ad hoc from poor management of change of the
equipment and the procedures were also not consistently followed.
There were substantial delays with process protocols as well as
distractions in the control room and the fact that the process start
up was performed over two shifts. The explosion killed 15 people
and injured another 170 persons. This scenario did not occur
offshore and most of the casualties occurred due to the location of
temporary trailers full of personnel next to the process relief.
The most applicable safety barrier for modeling purposes is the
Personnel Distance to Hazard. Simply put, if the distance to the
hazard was increased, then more people would have survived. This
latter observation overlaps with the final parent prevention barrier.
The Loss Prevention Barrier is considered last for analysis.
Management of change studies did not identify the relief system as
a danger to parked trucks and trailers full of people situated next to
the system relief. Utilizing the Moderation of Inherent HC Hazard
 M.F. Kujath et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 323e330
Fig. 7. BP Texas city accident model fault trees.
safety barrier, the fact that people should have been situated
further away from the relief location is highlighted. It would also
have been beneficial to substitute the blow-down relief with a flare.
This point is covered by the Substitution of Inherent HC Hazard
safety barrier.
The fault trees in Fig. 7 show that all of the parent prevention
barriers are highlighted in the proposed accident model. This
identifies that all prevention barriers have failed, with the scenario
escalating to a major loss. As in the Piper Alpha scenario, the BP
Texas City explosion was preventable if considerations were made
earlier for the plant shortcomings.
6. Conclusion
For offshore oil and gas process accidents there are limited
sources of useful information for the purposes of understanding an
accident scenario, especially from a technical perspective. Reported
data often do not provide details of release scenarios except for
simply acknowledging the release event itself. Therefore, it
becomes difficult to establish a realistic release and escalation
scenario. In the present work, incident details have been provided
from industry and government reports with some degree of
329
fineness; the vast majority of available information is, however,
lacking in sufficient detail to enable quantification of results.
Extensive use has also been made in this study of the World
Offshore Accident Database (WOAD), which has provided acci-
dental release scenario information for qualitative model devel-
opment. Again, though, WOAD cannot provide quantifiable data for
the purpose of modeling the probability of safety barrier failure.
Thus, the safety barrier sub-elements of the proposed model
must currently be described as conceptual. Some are easily quan-
tifiable with appropriate failure data such as the probability of
failure of Explosion Walls. With the availability of more precise
data, elements such as Shielding of Hot Exhaust Surfaces or
Personnel Distance to Hazard can be evaluated. The model dis-
cussed in this work is meant to highlight the vulnerabilities of an oil
and gas operation to a hydrocarbon release, before events escalate
out of control. Further efforts are being attempted to collect the
necessary data for evaluation of the failure probabilities of indi-
vidual safety barrier sub-elements in the proposed model.
The proposed accident model is directly applicable to offshore
oil and gas processing operations; however, it can also be applied to
other industries that process flammable or otherwise hazardous
chemicals. The data used to develop the accident model were
330 M.F. Kujath et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 323e330
derived specifically from offshore operations, but the model's
varied applicability is shown in its onshore use in the BP Texas City
disaster case study reported in this work.
The construction of an accident model in terms of particular
safety barriers is dictated by the available sources of accident
information. When the proposed model is applied to a particular
platform, the currently identified safety barriers can be substituted
with other appropriate barriers on a facility-specific basis. In other
words, the sequence of prevention barriers can be altered to suit
a specific scenario as necessary. This fact illustrates the versatility of
the proposed approach in addition to the novelty of focussing on
offshore process (as opposed to occupational) incidents.
Acknowledgement
The authors gratefully acknowledge the financial support of the
Natural Sciences and Engineering Research Council of Canada.
View publication stats
References
Bird, F. E., & Germain, G. L. (1996). Practical loss control leadership. Georgia: Det
Norske Veritas (USA).
Cullen, L. (1990). The public inquiry into the piper alpha disaster, vol. 1 and 2. London:
HMSO.
DiMattia, D. G., Khan, F. I., & Amyotte, P. R. (2005). Determination of human error
probabilities for offshore platform musters. Journal of Loss Prevention in the
Process Industries, 18, 488e501.
Khan, F. I., & Amyotte, P. R. (2003). How to make inherent safety practice a reality.
Canadian Journal of Chemical Engineering, 81, 2e16.
Mogford, J. (2005). Fatal accident investigation report, isomerisation unit explosion
final report. BP Texas City: Texas.
Reason, J. (1990). Human error. Cambridge: Cambridge University Press.
Shappell, S. A., & Wiegmann, D. A. (2000). The human factors analysis and classifi-
cation system e HFACS. Virginia: National Technical Information Service.
Sklet, S. (2006a). Hydrocarbon releases on oil and gas production platforms: release
scenarios and safety barriers. Journal of Loss Prevention in the Process Industries,
19, 481e493.
Sklet, S. (2006b). Safety barriers: definition, classification, and performance. Journal
of Loss Prevention in the Process Industries, 19, 494e506.
WOAD. (2008). World offshore accident database. Oslo, Norway: Det Norske Veritas.