NG50-3-200-ENG-RP-AB-83-6804

NIGERIA - OML 130 AKPO
AKPO Field Development Project LOGO
REPORT
Doc reference Rev.
UMBILICALS, FLOWLINES AND RISERS (UFR) NG50-3-200-ENG-RP-AB-83-6804 2
OIL OFFLOADING TERMINAL OVERPRESSURE PROTECTION Status Class Issue date Page
SYSTEM – SUMMARY REPORT
IFC 2 22-Nov-07 2/44
CHANGE RECORD PAGE
Revision Description of revision
A First Issue
0 Issue for CPY Review
1 Issued for construction, incorporating CPY comments.
Re-issued for construction, including additional surge run results for HIPPS
2
committee
WARNING: This document as printed may not be the latest version. Please refer to the electronic file in the MDR tools.
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 3/44
TABLE OF CONTENTS
1. ADDITIONAL SURGE SCENARIOS .............................................................................................................. 5

1.1 Conclusions...................................................................................................................................... 5
1.2 Discussion of additional surge simulations ...................................................................................... 6
1.2.1 Buoy PSHH voting pressure set point and pump start up against closed OLT system –
sensitivity study .......................................................................................................................................... 6
1.2.2 Closure of one tanker manifold valve – pump trip time sensitivity study..................................... 6
1.2.3 Closure of both hose end butterfly valves in 1 second – failure of all pump trip systems........... 7
1.2.4 Closure of MBCs due to load – failure of all pump trip systems................................................. 7
1.2.5 Closure of both hose end butterfly valves in 1 second – complete failure of buoy PSHH .......... 8
1.2.6 Parting of MBCs due to load – complete failure of buoy PSHH .................................................. 8
1.2.7 Closure of both hose end butterfly valves in 1 second with partial FPSO pump tripping............ 9
1.2.8 Closure of both hose end butterfly valves in 1 second - maximum flowrate sensitivity study..... 9
1.2.9 Closure of both hose end butterfly valves in 1 second – MBC parting pressure sensitivity study
10
1.2.10 Closure of both hose end butterfly valves in 15 seconds – oil spillage sensitivity study........... 10
1.2.11 Closure of both hose end butterfly valves in 1 second – complete pump trip failure combined
with staggered MBC closure - sensitivity study........................................................................................ 11
2. GENERAL ..................................................................................................................................................... 12
3. PURPOSE OF THE DOCUMENT ................................................................................................................. 12
4. REFERENCE DOCUMENTS ........................................................................................................................ 13
5. GLOSSARY................................................................................................................................................... 13
6. OLT SYSTEM DESCRIPTION AND OVERPRESSURE PROTECTION PHILOSOPHY............................. 14
6.1 OLT System Overview ................................................................................................................... 14
6.2 OLT Overpressure Protection Philosophy ..................................................................................... 16
7. CONCLUSIONS ............................................................................................................................................ 17
7.1 System Parameters........................................................................................................................ 17
7.2 Frequency Screening ..................................................................................................................... 18
7.3 Risk Acceptability ........................................................................................................................... 20
7.4 Recommendations ......................................................................................................................... 22
8. OFFLOADING SCENARIOS......................................................................................................................... 25
8.1 Introduction .................................................................................................................................... 25
8.2 Normal offloading conditions.......................................................................................................... 25
8.3 Abnormal shut down scenarios ...................................................................................................... 26
8.3.1 SDV 89106 (buoy side) closure................................................................................................ 26
8.3.2 Hose end / tanker side valve closure......................................................................................... 26
8.3.2.1 With full pressure protection system operation................................................................. 26
8.3.2.2 With partial pressure protection system operation............................................................ 27
8.3.2.3 Without pressure protection system operation ................................................................. 28
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 4/44
8.3.3 Both MBCs (3-LB-89024/5) parting due to excessive load. ...................................................... 29

8.3.3.1 With full pressure protection system operation................................................................. 29
8.3.3.2 Without pressure protection system operation ................................................................. 30
8.3.4 One MBC (3-LB-89024) parting due to excessive load............................................................. 30
8.3.5 Offloading shut down ................................................................................................................. 31
8.3.6 Pigging loop bypass valve closure (16” 3-LB-89008),............................................................... 31
8.3.7 Butterfly valve closure, (24” 3-LB-89023), ................................................................................. 32
8.3.8 Sensitivity studies ...................................................................................................................... 32
8.3.8.1 Pump trip delay time ......................................................................................................... 32
8.3.8.2 MBC parting pressure ....................................................................................................... 33
8.3.8.3 System valve CV............................................................................................................... 34
ANNEX A INCIDENT FREQUENCY REVIEW .......................................................................35
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 5/44
1. ADDITIONAL SURGE SCENARIOS
At the request of COMPANY, and as detailed in Revision 3 of the Oil Offloading Terminal Pressure
Surge Study (NG50-3-200-ENG-RP-AB-83-6805), a series of additional surge cases were simulated
by HAL (Hydraulic Analysis Limited) to assess the reaction of the OLT overpressure protection system
to a variety of trip failures. Sensitivity studies were also carried out relating to the set points of the
system components.
This section of the summary report reviews these additional surge scenarios and the main
conclusions that can be drawn from them.
1.1 Conclusions
As required by the COMPANY HIPPS Committee a series of additional surge simulations were
run considering the consequences of safety system failures and assessing the impact of
varying system set points.
A particular case, as presented in Section 1.2.7, considers the results of a surge event that has
caused the MBCs to part and start closing. Due to a failure within the ICSS/ESD system on the
FPSO, an offloading pump (or more) continues to operate. This scenario can lead to the
equipment MASP being exceeded in parts of the OLT. UFR CONTRACTOR can not quantify
the likelihood of such a scenario as the architecture and likely reliability of the FPSO systems
are not known. It is recommended that the scenario is further quantified (if this has not already
been done in a COMPANY led reliability study) and/or mitigation is put in place to protect
against such a scenario.
Section 1.2.11 simulates a system configuration that would allow the scenario described above
to be mitigated. Using staggered MBC closure times of 25 seconds and 35 seconds allows the
surge pressures to be relieved while the buoy SDV is closing over a 30 second period. Once
this SDV is completely closed it then protects all downstream equipment from damaging surge
pressures.
While this measure prevents pump trip failure from damaging the OLT, it does have a negative
3
impact on oil release size. HAL predict an oil release from the MBCs of 41 m , an increase of
over 20% compared to the configuration with both MBCs closing in 25 seconds. Note however
that this does not change the gravity of the scenario versus the risk matrix shown in Figure 2,
as it remains C3 (significant) within the 100 to 1000 barrel criteria.
It is logical to conclude that if the staggered MBC closure is adopted in the design, all the
original surge scenarios analysed in Revision 2 of Ref. 1 would show similar percentage
increases in oil release to the environment for those cases where the MBCs part. However, as
in the case above, this would not change the gravity of the scenarios versus the risk matrix
shown in Figure 2.
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 6/44
1.2 Discussion of additional surge simulations
1.2.1 Buoy PSHH voting pressure set point and pump start up against closed OLT
system – sensitivity study
See Cases 101 and 104 of Ref. 1.
In accordance with a request to investigate the effects of a higher buoy 2oo3 PSHH
voting system set point (13 barg set instead of 12 barg normal) on the surge scenarios,
the FPSO offloading pumps start against closed buoy 24” butterfly valve 3-LB-89023.
The buoy PSHH trips, closing SDV89106 over 30 seconds and sending a trip signal to
the pumps.
Case 101 conservatively assumes that all pumps are started simultaneously, resulting in
pipework MASPs being exceeded at the cargo pump discharges and upstream of the oil
offloading pumps. Case 104 is more a realistic scenario with staggered starting of the
pumps – this allows the buoy PSHH to intervene to trip the pumps before excessive
surge pressures are achieved.
Taking case 104 as the more representative then, the scenario has no surge
consequences for the system and the system MASP are not exceeded. As the 24” valve
is normally locked open and is of a fail-open design with regards to complete failure of
the internals, such an event could only occur due to human error post-maintenance.
1.2.2 Closure of one tanker manifold valve – pump trip time sensitivity study
See Cases 201, 202, 203, 206 and 207 of Ref. 1.
In accordance with a request to investigate the effect of a single tanker valve closure with
varying pump trip times, a set of sensitivity cases were run assuming that the buoy 2oo3
voting system, the telemetry and the FPSO PSHH are all working correctly.
Cases 201, 202 and 203 consider respectively different buoy to pump trip time delays:
2.25, 4.5, 6.75 seconds and an FPSO PSHH set at 38 barg.
Case 206 considers a maximum buoy to pump trip time delays of 6.75 seconds and an
FPSO PSHH higher set point of 39 barg; this has a negligible impact.
In case 207, an additional pump trip time delay of 3 seconds is included with respect to
case 201; this has a negligible impact.
As can be seen from the results, the peaks of pressure are within acceptable values for
all cases. It can be noted that buoy to pump trip times higher than 4.5 seconds have no
adverse effect on the peaks of pressure as the FPSO PSHH take the priority and
performs the pump trip.
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 7/44
1.2.3 Closure of both hose end butterfly valves in 1 second – failure of all pump trip
systems
See Case 301 of Ref. 1 – NOT DESIGN DIMENSIONING
This event corresponds to the hose end or tanker header valve(s) closure due to failure
of the valve internals, hence a very rapid closure of 1 second is considered in the
simulations. The high pressure wave travels upstream through the system, causing the
MBCs to part due to pressure at 25 barg. Then the three pressure sensors located on the
buoy vote activation of the pressure protection system. The shutdown valve on the buoy,
SDV 89106, starts to close immediately; it takes 30 seconds to completely close.
However, both the buoy to pump trip and the FPSO pump trip due to PSHH fail to
operate, so the offloading pumps continue to pump crude into the OLT.
As can be seen from the results table for additional surge cases for HIPPS committee (in
Rev. 3 of Ref. 1), the parting of the MBC and the buoy SDV closure are not sufficient to
protect the OLT system and to keep surge pressures tolerable. The MASP is exceeded
within the buoy piping, downstream of the swivel, and in the floating hoses. The resultant
oil release to the environment is 34.0 m³, i.e. 213 barrels which classifies the scenario as
C3 on the criticality matrix shown in Figure 3. Note that no rupture of the system is
envisaged, though component inspection and/or replacement may be required.
For the purposes of quantification this scenario corresponds to Case 5 in section 2.1 of
Ref. 3, which combines simulation of rapid valve closure with MBC parting. The event is
stated by Ref. 3 to have “a very low level of occurrence and one such occurrence over
the field life is deemed conservative”. Combined with failure of the telemetry system then
the frequency of occurrence would be reduced by a factor of 1000, as per GS EP SAF
-2
260 that proposes a probability of failure on demand for a SIL2 system of between 10
-3
and 10 (lower bound taken to avoid excessive combination of conservatism). In addition
the FPSO PSHH protection system fails to operate on demand; treating this latter system
as a SIL1 system, the probability of failure on demand proposed by GS EP SAF 260 is
-1 -2
between 10 and 10 . This would give a probability of such a scenario occurring during
-4 -5
the lifecycle of the installation of at most 5 x 10 , i.e. an annual frequency of 2.5 x 10 , a
level considered non-dimensioning. Note that this quantification places the scenario in
Zone III of the risk matrix shown in Figure 3.
1.2.4 Closure of MBCs due to load – failure of all pump trip systems
See Case 302 of Ref. 1 – NOT DESIGN DIMENSIONING.
This event corresponds to the two MBCs parting due to tanker pull after loading hawser
failure. The pressure waves from the closing MBCs travel back to the buoy, tripping the
buoy pressure protection system and causing SDV closure. However, both the buoy to
pump trip and the FPSO pump trip due to PSHH fail to operate, so the offloading pumps
continue to pump crude into the OLT against the closing SDV and MBCs.
As can be seen from the results table for additional surge cases for HIPPS committee, in
Rev. 3 of Ref. 1, the closure of the buoy SDV is not sufficient to protect and to keep the
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 8/44
system surge pressures tolerable: MASP is exceeded within buoy piping, downstream of
the swivel, and in the floating hoses. The resultant oil release to the environment from
the MBCs is 34.0 m³, i.e. 213 barrels which classifies the scenario as C3 on the criticality
matrix shown in Figure 3.
For the purposes of quantification the same reasoning applies as that given in the last
paragraph of Section 1.2.3.
1.2.5 Closure of both hose end butterfly valves in 1 second – complete failure of buoy
PSHH
This event corresponds to the same scenario as in Section 1.2.3 but telemetry and SDV
system on the buoy are not working. Therefore the offloading pumps are stopped only by
the FPSO voting system on PSHH at 39 barg in the event of a pressure surge. As can be
seen from the results table for additional surge cases for HIPPS committee, in Rev. 3 of
Ref. 1, the parting of the MBCs combined with the FPSO PSHH trip of the pumps are
sufficient to protect and to keep the system surge pressures tolerable. The resultant oil
release to the environment is 24.0 m³, i.e. 150 barrels which classifies the scenario as C3
on the criticality matrix shown in Figure 3.
For the purposes of quantification this scenario corresponds to Case 5 in section 2.1 of
Ref. 3, which combines simulation of rapid valve closure with MBC parting. The event is
stated by Ref. 3 to have “a very low level of occurrence and one such occurrence over
the field life is deemed conservative”. Combined with failure of the buoy pressure
protection system, the frequency of occurrence would be reduced by a factor of 1000, as
per GS EP SAF 260 that proposes a probability of failure on demand for a SIL2 system
-2 -3
of between 10 and 10 (lower bound taken to avoid excessive combination of
conservatism). This would give a probability of such a scenario occurring during the
-3 -5
lifecycle of the installation of at most 1 x 10 , i.e. an annual frequency of 5 x 10 , a level
considered non-dimensioning for the system design as the consequences are not judged
to be in the ‘major’ or ‘catastrophic’ categories. Note also that this quantification places
the scenario in Zone III of the risk matrix shown in Figure 3.
1.2.6 Parting of MBCs due to load – complete failure of buoy PSHH
This event corresponds to the scenario presented in section 1.2.4 above, but buoy
telemetry and buoy voting system are not working. Therefore the offloading pumps are
stopped by the FPSO PSHH voting system on detection of the pressure surge at 39
barg. The buoy SDV fails to close.
As can be seen from the results table for additional surge cases for HIPPS committee, in
Rev. 3 of Ref. 1, the trip of the pumps generated by the FPSO protection system is not
sufficient to keep the system surge pressures tolerable. The piping MASP is exceeded
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 9/44
downstream of the buoy swivel and in the floating hoses. The resultant oil release to the
environment from the MBCs is 34.0 m³, i.e. 213 barrels which classifies the scenario as
C3 on the criticality matrix shown in Figure 3.
For the purposes of quantification the same reasoning applies as that given in the last
paragraph of Section 1.2.5.
1.2.7 Closure of both hose end butterfly valves in 1 second with partial FPSO pump
tripping
See Cases 501, 502, 503 and 504 of Ref. 1 – POTENTIALLY DESIGN DIMENSIONING.
– FURTHER REVIEW REQUIRED BY COMPANY.
This event corresponds to the same scenario as in Section 1.2.3, but not all the FPSO
offloading pumps are stopped. For the purposes of this simulation, the buoy pressure
protection system is assumed to work normally, so the failure of the pump(s) trip results
from a problem with the FPSO control/ESD systems.
As it can be seen from the results table relevant to additional cases run for HIPPS
committee in Rev. 3 of Ref. 1, the combined failed trip of one offloading pump and cargo
pump is sufficient to exceed the offloading hose MASP. The surge pressure is,
nevertheless, well within the 75 barg burst pressure of the hoses. The resultant oil
release to the environment from the MBCs depends on the number of pumps that fail to
3
trip, so is between 13.6 m³, i.e. 113 barrels and 30.8 m (256 barrels) which classifies the
scenario as C3 on the criticality matrix shown in Figure 3.
The likelihood of this scenario must be reviewed against the reliability of the selected
pump trip system. Effectively the base event frequency for this scenario corresponds to
Case 5 in section 2.1 of Ref. 3, which combines simulation of rapid valve closure with
MBC parting. The event is stated by Ref. 3 to have “a very low level of occurrence and
one such occurrence over the field life is deemed conservative”. However, UFR
CONTRACTOR does not have the details of the pump trip architecture onboard the
FPSO to further quantify the likelihood of failure to trip. Depending on the SIL level of the
pump trip system onboard the FPSO this scenario may therefore be design
dimensioning. It is recommended in Section 1.1 that this case be considered for further
review.
Note however that physical mitigation measures are available in the OLT design, by
specifying a slower MBC closure time for one of the MBCs such that the buoy SDV can
isolate the downstream systems before potentially damaging pressure peaks occur. This
configuration has been simulated in Case 901 that is discussed in Section 1.2.11.
1.2.8 Closure of both hose end butterfly valves in 1 second - maximum flowrate
sensitivity study
See Cases 601 & 602 of Ref. 1.
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 10/44
In accordance with a request to investigate the effect of a maximum flowrate of 7200

3
m /h against a single tanker valve closure, a set of sensitivities cases were run.
Case 601 considers the scenario that the buoy and the FPSO PSHHs do not operate.
Therefore the MBCs close in 25 seconds against the pumps running at the maximum
flowrate. The resultant surge pressures exceed the MASP at the OOL inlet, downstream
3
of the buoy swivel and in the floating hoses. An oil release of 37 m from the MBCs is
calculated. This scenario is the same in quantification as the scenario presented in
Section 1.2.3, requiring the combination of a low frequency event with simultaneous
failure of both the buoy and the FPSO pressure protection systems.
Case 602 again simulates closure of the hose end butterfly valves during maximum flow
conditions, but the buoy PSHH operates correctly, closing the SDV and tripping the
pumps via the telemetry link. Again the FPSO PSHH is assumed not to function. It is
concluded that the impact of the extra flow is quite negligible as maximum surge
pressure in the hoses increase from 31.9 barg to 32.2 barg, very marginally exceeding
3 3
the MASP. Oil spillage from the MBCs is increased from 20.3 m to 25.3 m , which
classifies the scenario as C3 on the criticality matrix shown in Figure 3.
Though this is a sensitivity study and as such not normally considered in terms of likely
frequency of occurrence, it is worth noting that it is potentially design dimensioning in that
the safety systems operate correctly. However, it is not known if there is a real operating
intent to regularly increase the OLT flowrate above the design maximum of 6,600
3
m /hour.
1.2.9 Closure of both hose end butterfly valves in 1 second – MBC parting pressure
sensitivity study
See Case 701 of Ref. 1.
This event is identical to that presented in Section 1.2.5 but with a reduced MBC parting
pressure of 20 barg. The objective was to investigate whether the FPSO PSHH is able to
detect overpressure and stop the pumps for such a scenario. Simulation shows that this
is the case: overpressures are within acceptable limits and oil spillage from the MBCs
3
slightly increased (24.4 m – 153 bbl).
1.2.10 Closure of both hose end butterfly valves in 15 seconds – oil spillage sensitivity
study
This additional sensitivity study was run considering 15 second hose end butterfly valve
closure time to assess the magnitude of the resultant oil spillage. Results show surge
3
pressures remain tolerable throughout the system and that an oil release of 23.4 m (147
bbl) can be expected.
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 11/44
1.2.11 Closure of both hose end butterfly valves in 1 second – complete pump trip failure
combined with staggered MBC closure - sensitivity study
The scenario of slam shut failure of the hose-end butterfly valves was used for the
purposes of the MBC differential closure time sensitivity study. Following the sudden
valve closures, the high pressure wave travels upstream through the system, causing the
MBCs to part due to pressure. Then the three pressure sensors located on the buoy vote
activation of the pressure protection system. The shutdown valve on the buoy, SDV
89106, starts to close immediately; it takes 30 seconds to close completely. Pumps
onboard the FPSO are not tripped as a failure of the telemetry and the FPSO PSHH are
supposed.
MBC parting pressure set points of 25 barg have been used for this case. Increase in
closure time of one MBC from 25 to 35 seconds resulted in a decrease in the oil surge
pressures within the OLT system, so the pressures remained tolerable even though the
3
pumps continued running. However, oil spill volumes were increased up to 41.4 m (260
barrels).
NOTE: All following sections of this report are identical to those already issued in Rev. 1
of this document. The only changes are to the section numbers.
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 12/44
2. GENERAL
The AKPO Field lies Offshore Nigeria within OML 130, some 200Km South of Port Harcourt, in water
depths ranging from 1250 m to 1 480 m.
TOTAL UPSTREAM NIGERIA LIMITED a company organized and existing under the laws of Nigeria,
as operator of the Oil mining Lease (OML) 130 with a 24% share, and its partners NIGERIAN
NATIONAL PETROLEUM CORPORATION (50%), BRASOIL OIL SERVICES COMPANY NIGERIA
(16%) and SOUTH ATLANTIC PETROLEUM LIMITED (10%), are developing the AKPO Field,
estimated to contain reserves of 1 billion barrels of oil and 4 trillion cubic feet of natural gas.
Saibos s.a.s. has been awarded the UFR (Umbilicals, Flowlines and Risers) package of the AKPO
Field Development Project, divided into five systems which are:
• System F: Flowlines, Risers, Spools, Jumpers and Manifolds
• System U: Umbilicals and Flying Leads
• System G: Gas Export Pipeline and Risers
• System O: Oil Loading Terminal
• System M: Mooring System of the FPSO
This report addresses System O, presenting a synopsis of the overpressure protection system for the
Oil Loading Terminal (OLT) and the engineering work used in designing it.
3. PURPOSE OF THE DOCUMENT
The purpose of the document is to demonstrate that the OLT overpressure protection system and the
set points specified for its various components have been optimised, resulting in a fit for purpose
system.
Therefore, this report presents the overpressure protection philosophy used in the design of the
offloading system and a summary of the surge cases run in the Oil Offloading Terminal Pressure
Surge Study [Ref. 1].
The abnormal shutdown scenarios simulated by the external consultants (HAL) have been reviewed
versus their perceived likelihoods of occurrence. This has allowed the scenarios judged to be
excessively onerous to be identified and where appropriate rejected, leaving only those considered
credible. These have then been used during the detailed engineering as design-dimensioning events.
The consequences of the surge cases retained for design have also been summarized, outlining the
sequence of events, the assessed magnitude of the pressure waves and, where relevant, the
predicted sizes of the resultant oil spills to the environment.
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 13/44
This revision of the report incorporates COMPANY comments and takes into account further surge
analysis work and resultant design changes. In particular, the additional work investigated the
consequences in terms of system surge pressures of manufacturer supplied tolerances in the MBC
parting pressure and closing time.
Note that the event frequencies ascribed to the various surge related scenarios have been further
assessed to validate the data used from Ref. 3. This discussion is included in Annex A.
4. REFERENCE DOCUMENTS
[1] OIL OFFLOADING TERMINAL PRESSURE SURGE STUDY

NG50-3-200-ENG-RP-AB-83-6805 Rev. 2
[2] OIL LOADING TERMINAL – DESIGN DATA AND FUNCTIONAL SPECIFICATIONS

NG50-3-BE-OFF-PS-AB-000-261 Rev. 4
[3] PRESSURE & TEMPERATURE CYCLE EVENTS

(Basic engineering document, addendum 2 to flexible-joint specification)
NG50-3-BE-PLR-PS-AB-000-230
[4] SAFETY RISK MANAGEMENT SYSTEM

NG50-3-200-ADM-PR-AA-00-0700 Rev. 2
[5] AKPO OFFLOADING TERMIONAL SURGE PROTECTION: EXP COMMENTS

Email 18/07/2006 from COMPANY to CONTRACTOR.
5. GLOSSARY
CO Crude Oil
ESD Emergency ShutDown
FPSO Floating Production, Storage & Offloading vessel
HAL Hydraulic Analysis Ltd
HH High/high
HIPS High Integrity Protection System
MASP Maximum Allowable Surge Pressure
MBC Marine Breakaway Coupling
OLT Oil Loading Terminal
OOL Oil Offloading Line
SDV ShutDown Valve
SIL Safety Integrity Level
SPM Single Point Mooring
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 14/44
6. OLT SYSTEM DESCRIPTION AND OVERPRESSURE PROTECTION PHILOSOPHY
6.1 OLT System Overview
In accordance with the document Design Data and Functional Specifications [Ref. 2], the oil
offloading system is designed to allow the export of 1.0 million barrels of stabilised crude oil
from the AKPO Floating Production, Storage and Offloading vessel (FPSO) to an export tanker
in approximately 30 hours. This requires that the OLT be capable of offloading crude oil at
3
6,600 m /hour. The offtake frequency is estimated at once every 5.6 days during the design life
of the installation.
The following description is best understood referring to Figure 1, the simplified schematic of
the offloading system used by HAL for their analysis. The crude oil is pumped from the hull of
the FPSO by 10 cargo pumps to the discharge header. From here the oil passes through the
CO Fiscal Metering (5 UA 8320) on the FPSO topsides before passing through the Crude
Offloading Pumps (5 GX 8310A/B/C/D, three operating, one standby). During offloading, the
pressure control valve downstream of the offloading pumps (PDV 83101) is fully open and the
speed of the pumps is regulated to provide the required discharge pressure to offload at a
flowrate of 6600 m3/hr, typically 33.7 barg at FPSO side. The crude oil then passes through two
mid-water, 16” steel Oil Offloading Lines, 2650m (upper line) and 2750m (lower line) in length,
from the FPSO deck edge (CONTRACTOR battery limit) to the offloading buoy around 2 km
from the FPSO. From the buoy the oil is loaded to the export tanker through a main 24” floating
hose (350m in length) with two 16” tail offloading hoses fitted with marine breakaway couplings
near to the tanker. The operating pressure at the export tanker manifold deck level (ship rail
pressure) is 2.0 barg.
The offloading buoy is equipped with an instrumentation and control system linked to the FPSO
by telemetry. The redundant telemetry link allows essential process parameters aboard the
buoy to be monitored at the FPSO, and also enables operators aboard the FPSO to shut in the
SDV valve on the buoy. Similarly the shut down sequence can be activated from a portable unit
carried by the offloading master on board the tanker. The telemetry link is monitored
periodically by the FPSO systems and on loss of signal the offloading pumps are tripped.
Upstream of the buoy SDV valve there are three pressure transducers. These form part of a
SIL2 HIPS system that, on 2 out of 3 voting pressure HH, close the SDV valve and send a trip
signal to the offloading pumps aboard the FPSO.
The buoy SDV valve is powered from a standalone HPU composed of stored hydraulic energy
provided by a rack of hydraulic accumulators (Ref. RFD-3-200-ENG-0073). These are designed
to be recharged by maintenance personnel from a workboat. Note that, as a protection against
loss of motive power, on detection of low HPU pressure the SDV valve is closed automatically
by the control system.
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 15/44
FIGURE 1 – Schematic of OLT
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 16/44
6.2 OLT Overpressure Protection Philosophy
The offloading system availability is essential to the operation of the FPSO [Note that
continuous downtime of the OLT shall be limited to 3 days and 2% cumulative per year
throughout the 20-year lifetime of the system – Ref. 5]. Though tandem offloading is available
as a back-up means of offloading, it has significant SIMOPS implications and in general will be
used as little as possible during the life cycle of the installation. In this context, the primary
objectives of the OLT overpressure protection philosophy are:
A. to protect the offloading system from overpressure under normal operating conditions
and shutdown (Telemetry with back-up from the SDV).
B. to protect the offloading system against damage caused by the surge pressure waves
that would result from credible operational or technical upsets (Telemetry & MBCs).
C. to prevent environmental impact due to incidents during offloading, by eliminating or
reducing the magnitude of oil releases as far as possible (Telemetry, MBCs & SDV).
The means of protecting against overpressure in the OLT piping are as follows:
1. Specifying appropriate pressure ratings for all piping and process elements
downstream of the oil offloading pumps versus the maximum pump discharge pressure.
This approach can be extended as far as the spec-break with the offloading hoses.
2. Provision of a high integrity control/process safety interface (redundant telemetry)
allowing the export pumps on the FPSO to be tripped remotely by the buoy PLC and
the buoy SDV to be closed automatically on HH pressure detection at the buoy. This
system shall ensure that the level of pressure in the OLT is limited, so that surge
pressures which can add to this are themselves maintained at a lower level and
therefore do not initiate other overpressure protection devices, i.e. the MBCs, with
associated environmental implications.
3. Sizing of all OLT steel piping for the maximum surge pressure (as per Ref. 2)
4. Limiting the buoy 24” SDV closure time to the minimum that can be tolerated by the
upstream piping when considering the resultant surge pressures. It should be noted
that the faster the SDV closes the higher the surge pressure created but the lower the
size of the release to the environment that could result from a downstream event.
5. Specifying the two 16” MBCs to part at the highest pressure that is found to be
compatible with the protection of the buoy hoses and piping. Maximising the parting
pressure of the MBCs should theoretically minimise the number of MBC parting
incidents through the life of the installation, minimising thereby the associated amount
of oil released to the environment.
6. Specifying the two 16” MBCs to close as quickly as is found to be compatible with the
surge protection of the buoy hoses and piping. It should be noted that the faster the
MBCs close the higher the surge pressure created but the lower the size of the release
to the environment due to the MBCs parting.
7. In case of telemetry failure, the export pumps on the FPSO trip and the buoy SDV
closes, preventing any further export taking place via the system.
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 17/44
7. CONCLUSIONS
It is considered that the surge study has demonstrated that the objectives of the OLT overpressure
protection philosophy can be met. Both normal operation and credible technical upsets have been
reviewed and the responses of the offloading system assessed.
7.1 System Parameters
The potential for and magnitude of any releases to the environment have been minimised through the
selection of appropriate offloading system parameters that make the best use of the pressure ratings
of the OLT components. The proposed values of the variable parameters within the OLT are
summarised in Table 1 below.
Table 1 – OLT variable parameters & proposed values
Parameter Proposed Discussion Ref.

set point
Buoy SDV 30 secs. This SDV should be closed as quickly as the upstream surge pressures allow. It Section
(89106) does not help in the control of the OLT system surge pressures, rather it serves to 8.3.1
closure time. minimise the size of any potential release to the environment.
The HAL analysis included a sensitivity study on closure time, considering 24
seconds and 30 seconds without export pump shutdown. Though the former value
did not actually result in damaging surge pressures, the surge pressures came close
to the MASP of sections of the upstream piping. For this reason it was judged best
to allow a greater safety margin and adopt the 30 seconds closure time.
Marine 22.5 barg The pressure at which the MBCs part should be set as high as is consistent with the Section
breakaway acceptability of the resultant surge pressures in the offloading hoses. This is 8.3.8.2
couplings (3- because the set point of the parting pressure also determines the applied load that
LB-89006/7) the MBCs can take before parting. In principle a higher parting load should reduce
parting the number of MBC parting incidents throughout the lifetime of the installation.
pressure. The HAL analysis included a sensitivity study on MBC parting pressures for 15, 20
and 25 barg. Increasing parting pressure resulted in increased upstream surge
pressures and decreased the resultant oil release. A 25 barg setting was adopted as
acceptable in terms of surge and consistent with the MBC manufacturer’s standard
settings of around 28 barg. However, incorporating the manufacturer supplied
tolerance of actual MBC parting pressures versus set point of ±10% resulted in the
selection of a set point of 22.5 barg to ensure that even at maximum variance, 25
barg would not be exceeded.
This additional safety margin was implemented to ensure that the 32 barg MASP of
the offloading hoses would not be exceeded by the maximum potential surge
pressures resulting from parting and closing of the MBCs. This extremely
conservative measure takes no credit for the 75 barg burst pressure of the hoses
and will theoretically increase the number of MBC parting events throughout the unit
lifetime.
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 18/44
Marine 25 secs. The time in which the MBCs close should be set as low as is consistent with the Section
breakaway acceptability of the resultant upstream surge pressures. The faster the MBCs close, 8.3.3.1
couplings (3- the smaller the size of any release to the environment.
LB-89006/7) The HAL analysis included a sensitivity study on MBC closure times for 20 and 25
closing time. seconds. The 20 second closure resulted in surge pressures in the offloading hoses
of over 39 barg, well in excess of the 30 barg MASP. A 25 seconds closure time
reduced the surge pressure to 28 barg and was thus adopted. Note that the
manufacturer supplied tolerance for this parameter of the MBCs is ±1 second.
Pump trip time 2.25 secs. Implicitly the faster the pumps are shut down, the less line packing that will occur in Section
delay. a shutdown scenario and similarly, the smaller the resultant surge pressures or 8.3.8.1
release to the environment.
The HAL sensitivity study on pump trip times used 2.25, 3.25 and 4.25 seconds.
Slight increases in surge pressure and spillage size were found with the increased
shutdown times, hence the adoption of the shorter period. However, this is
assessed to be the worst case delay, based on a maximum of 1.5 seconds required
buoy PSHH detection time and telemetry transfer to FPSO plus a 0.75 second delay
required by FPSO systems to trip the pumps.
Buoy pressure 12 barg Once tripped, the buoy pressure protection system shuts the SDV and sends a trip -
protection signal to the pumps on the FPSO. The lower the set point then the quicker that the
system trip system will intervene, reducing line packing, the surge pressures and the potential
point. size of any release to the environment. However, too low a set point will increase
the risk of spurious trips and operational upsets during offloading. Given that the
normal pressure within the buoy during offloading is around 8 barg, a 50% margin
on this was judged to give an optimal balance between good system reactivity and
providing a sufficient margin to prevent spurious trips.
7.2 Frequency Screening
Section 8.3 of this report reviews the various technical upset scenarios that have been
modelled during offloading, evaluating their consequences and likely frequencies of occurrence.
This screening exercise is summarised in the risk matrix shown in Figure 3 and has allowed the
non-credible scenarios to be identified and rejected for the purposes of the design. Table 2
below summarises the results of the review, listing the scenarios retained as design
dimensioning events, their characteristics, consequences and estimated frequency of
occurrence. References are given to the relevant sections of this report and the case numbers
from Ref. 1.
Table 2 – OLT design dimensioning operating scenarios and consequence summary
Peak MBC Total oil Number of Reference,

Scenario spillage, m3 events in Comments Section &
pressures parting lifecycle Case No.
& barrels
Normal offloading
None No None 2080 Normal operation Section 8.2
conditions (cycles)
Failure of pressure Section 8.3.1
SDV 89106 (buoy
Within design No None Once protection system, no
side) closure. pump trip. Case 4
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 19/44

& barrels
Pressure protection
Within design, system operates
Hose end/tanker floating hoses correctly, used as
20.3 basis to establish Section 8.3.2
side valves slam- 31.9 barg 2 Once hose hydrotest
versus MASP of 128 Case 1.2
shut closure. pressure. Single MBC
32 barg parting rejected as low
likelihood event.
Hose end/tanker
side valves 44 Operator error
second closure. scenario for which
[Note that previous pressure protection
system operates
scenario of hose end Section 8.3.2
Within design. No None Twice correctly. Note that,
case 1.8.
valve slam shut for conservatism,
gives indication of MBC parting pressure
consequences of used is set point -
10%.
faster valve shut
times].
Pressure protection
system operates
correctly. Note that,
MBCs (3-LB- 34.9 for conservatism, Section 8.3.3
89006/7) parting for Within design 2 Once MBC parting pressure
219 used is set point Case 3.2
excessive load.
+10% and MBC
closure time is set
point + 1 second.
Pressure protection
system operates
correctly. Mechanism
of single MBC parting
MBC (3-LB-89006) for load not clear,
17.9 hence more Section 8.3.4
parting for excessive Within design 1 Once representative of
113 Case 8
load. spurious parting. Note
that, for conservatism,
MBC parting pressure
used is set point
+10%.
No surge issues.
Offloading shut Impact limited to Section 8.3.5
Within design No None 600 operational delay for
down. Case 5
offloading restart.
Pigging loop bypass

Scenario implies Section 8.3.6
valve, 16” 3-LB-
Within design No None Once normal butterfly valve
89008, slam-shut internal failure. Case 7
closure.
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 20/44

& barrels
Oil release due to

Butterfly valve 24” OLT damage
Uncontrolled unknown. Scenario Section 8.3.7
(3-LB-89023), slam- Above design No
release
Once requires mitigation, Case 6
shut closure. i.e. fail open butterfly
valve design.
The basis for the screening of the technical upset scenarios according to their frequencies of
occurrence was the final frequency resulting from the cumulative failures. Essentially, the
figures indicate that the simultaneous failure of two independent safety systems within the OLT
design can be neglected within the lifetime of the installation, particularly in the context of the
low demand rate. Similarly, the low frequencies of occurrence (e.g. once or twice during the
lifetime of the installation) ascribed to the technical upset scenarios by Ref. 3 cannot
realistically be combined with failure on demand of safety systems that have been well-
maintained and periodically tested. For example, the buoy pressure protection system will be a
-2 -3
SIL2 design, with a probability of failure on demand of between 10 and 10 (GS SAF 260).
The scenario frequencies in Ref. 3 imply that this system may only be solicited by real technical
upsets four times during the lifetime of the installation, yielding a probability of failure on
-2
demand of at most 4 x 10 , or 1 in 25 for the entire 20 years of operation.
Similarly the marine breakaway couplings have an enviable record of reliability, with no
spurious partings and 160 successful partings on demand. It is reported that no failures are
known of in the industry to date. This information is quoted from the principle MBC
manufacturer (Gall-Thomson), “We have experienced more than 160 successful activations of
our device during both tanker breakout and extreme pressure surge incidents, preventing
untold system damage and pollution. There has never been a premature failure of our device
due to faulty design or workmanship and of the very few incidents where a parting appeared to
be suspect, testing of the breakstuds at an independent test house proved without doubt that
the device had experienced the full design parting load and, therefore, verified the integrity of
the couplings.” So pessimistically assuming that the next time that an MBC is solicited it fails to
function, the probability of failure on demand will become 1/161. The scenario frequencies in
Ref. 3 imply that the MBCs may only be solicited by real technical upsets four times during the
-2
lifetime of the installation, yielding a probability of failure on demand of at most 2.5 x 10 , or 1
in 40 for the entire 20 years of operation.
It is concluded that, given these figures for the reliability of the OLT safety systems, combining
any low likelihood scenario with failure on demand of the safety systems yields overall scenario
frequencies judged too low to be considered as realistic design dimensioning events.
7.3 Risk Acceptability
The Safety Risk Management System [Ref. 4] presents the frequency/consequence matrix
used in the assessment of risk acceptability. The frequency & consequence categories used to
classify the risks and the matrix are shown in Figure 2. The scenarios assessed during the
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 21/44
surge study, with the exception of the sensitivity studies, are shown placed within the risk matrix
in Figure 3.
Reviewing the listing of credible OLT technical upsets scenarios in Table 2, it is concluded that
none of them lead to consequences relating to personnel or major financial criteria. Similarly,
with regard to the material damage/loss criterion, none of the retained scenarios lead to
damage as the protective systems intervene to prevent this. Note that this is now the case
because a recommendation of the previous revision of this study concerning fail safe design of
the 24” valves has since been implemented Thus the only material damage category that would
be relevant would be C1, i.e. negligible impact.
However, the environmental criteria are relevant to the OLT. The largest release found during
3
the surge simulations is 34.9 m , or around 220 barrels (C3 significant impact), resulting from
both MBCs parting under load applied by the tanker. However, both this and the ‘single MBC
parting under load’ scenarios are only considered to be credible in the event of a complete
procedural failure, i.e. offloading continued despite increasing environmental conditions right up
to the point where the tanker suffers connection failure under load. Given the practice of having
an offloading master onboard the tanker equipped with a remote control console connected to
the buoy systems, the offloading operation should always be stopped well before such an event
occurs.
The remaining release scenario relates to slam-shut failure of the hose-end valves or the tanker
side valves, resulting from failure of the butterfly valve internals. Simultaneous failure of two
parallel valves is obviously extremely unlikely, but it is not known whether the entire offloading
flow passes through a single valve within the tanker manifold. If for the purposes of this
assessment this is assumed to be the case then this scenario is a credible one and the release
3
figure of 20.3 m (around 130 barrels) must also be taken into account. Note however that it is
generally understood from previous work on tanker related surge events that the most likely
event where flow could be interrupted by the failure of a single valve would be when only one
valve is open in a ground line at the start or end of a tanker loading operation. Typically
offloading rates from the terminal discharging to the tanker are reduced at start-up or final or
phase of the offloading operation.
The frequency given for this scenario is estimated conservatively at once during the lifecycle of
-2
the installation, i.e. 5 x 10 events per year. This would classify the release as F5, i.e. event
may occur once on a given installation or project. However, the frequency ascribed to this
scenario as a source of pollution can be reduced significantly if the location of leakage is
considered.
Ref. 6 includes a table of 11 surge incidents compiled by COMPANY. It is significant that of the
4 events that resulted from closure of valves on the tanker, 2 of them lead to ruptures in the
tanker pipework within the pump rooms, i.e. no release to the environment. It is the nature of
MBCs that they can not protect the tanker downstream from the peak surge pressures
generated by events originating onboard. Given that tanker manifolds are generally rated at 19
barg, with the under deck piping rated at around half that, it is not surprising that if they are the
source of a surge event they are often the recipients of the resultant spillage. Hence it is
-2
considered reasonable to halve the frequency of occurrence down to 2.5 x 10 events per year,
though this remains in the frequency band F5.
The combination of F5 and C3 places the release scenario in “Zone II”, classed medium in the
Saibos system and “target for improvement (ALARP)” in the Total matrix. As the event
frequency can not be reduced to move this scenario into the ‘tolerable risk’ zone, realistically
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 22/44
the only way to improve on this is to review means of reducing the release size. However,
embarking on a design upgrade process to try to reduce a 130 barrel release scenario by 25%
to get below the 100 barrel threshold might be considered unjustified, and certainly the costs of
doing so would have to be reviewed against the real benefits assessed to derive from any
design or specification changes such as increasing equipment maximum pressure ratings.
On this basis it is believed that a mitigation approach of release containment and clean up
intervention procedures is the most appropriate strategy to be considered in addressing this
issue. This facility would also benefit all the other release cases considered.
7.4 Recommendations
Following this review of the HAL surge study for the offloading system, further
recommendations for the design and simulations have been identified:
1. The surge analysis has shown that the scenario of slam-shut closure of the 24” butterfly
valve (3-LB-89008) on the buoy due to failure of the valve internals may well lead to
damage to the OLT. Given that such damage could result from a single failure, this is
clearly not acceptable. It is recommended that potential solutions to this scenario be
investigated, e.g. remove the valve from the design and use a spade for maintenance
tasks, or use an offset spindle valve design that can only fail open. [Action closed –
this is being implemented.]
2. The buoy is unmanned during offloading, so the possibility of valve operator error is
limited to the tanker. An operator error leading to closure of a tanker valve against the
full flow during offloading has been simulated. It is recommended that the closure of
this valve is minimum 44 seconds, as this would then result in safe system shutdown
on pressure high-high, without MBCs parting and no consequences for the
environment. While it is recognised that design changes can not be made to valve
actuation systems on tankers, it is important that the offloading procedures stress this
limitation and that the loading system operators on the tanker are aware of it. The risk
of equipment damage associated with such a scenario is most significant for the tanker
pipework that the OLT surge mitigation devices can do nothing to protect.
3. For the purposes of finalising the review of technical failure scenarios and their
environmental impacts, it needs to be established whether the entire offloading flow into
the tanker ever passes through a single valve within the tanker manifold. [Action
closed – stated to be the case by COMPANY, though CONTRACTOR’s understanding
is that this normally only possible during start up and ramp down of offloading
operations when flow rates are reduced and only one valve is open in a ground line. At
full offloading flow the crude is normally manifolded down several down-pipes, reducing
the potential for a full flow surge event due to a single valve closure.]
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 23/44
Figure 2 – Risk matrix and associated criteria
FREQUENCY CATEGORIES
Field of Risk
F5 / VHI(Pr) Probable(10-1 – 10-2)
covered
Event may occur once on a given installation or project.
F4 / HI(Po) Possible(10-2 – 10-3)
TOTAL
Event may occur when considering several similar installations or projects. FREQUENCY
F3 / MED(LP)Low Probability (10-3 – 10-4) (Events per year)
MATRIX
Event may occur when considering all similar installations or projects. 10-1
F2 / LO(R)Remote(10-4 – 10-5)
Event is conceivable for the industry and may have already occurred. F5 I
F1 / VLO(VR)Very Remote(10-5 – 10-6) -2
Event or its potential has never been reported for the industry. 10
II
F4
CONSEQUENCE CATEGORIES
C1 / VLO(Neg)Negligible 10-3
Personnel- Without injury F3 III
Material Damage / Loss– Without damage to equipment
Environment– Insignificant impact (0 – 10 bbls) 10-4
Financial - $2000 to $10 000
C2 / LO(Mi)Minor F2
Personnel – Single injury
Environment – Local area only, no offsite effect (10 – 100 bbls) 10-5
Material Damage / Loss – Limited damage F1
Financial - $10 000 to $100 000
C3 / MED(S)Significant 10-6
Personnel – Multiple injuries
Environment – Possible offsite effects, third party interests not endangered (100 – 1000 bbls) NEG MOD SEV MAJ CAT
Material Damage / Loss – Damage to essential equipment C1 C2 C3 C4 C5
Financial - $100 000 to $1 million
C4 / HI(Ma)Major
Personnel – One fatality SAIBOS
Environment – Extended damage, third party interests endangered but not directly effected (1000 – 10 000 bbls) MATRIX
Material Damage / Loss – Extended damage CONSEQUENCES
Financial - $1 million to $2 million (Severity Categories)
C5 / VHI(C)Catastrophic
Personnel – Multiple fatalities
Environment – Regional effect, third party interests effected (> 10 000 bbls)
Material Damage / Loss – Possible loss of facility
Financial – Above $2 million
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 24/44
Figure 3 – Risk matrix showing design dimensioning surge scenarios

-1
10
Case 4
Case 1.2
Case 5 Case 6
F5 Case 3.2
Case 7 (mitigated)
Case 8
Case 1.8
10
-2
I
F4
10
-3
II
F3
10
-4
III
F2
-5
10
F1
-6
10
NEG MOD SEV MAJ CAT

C1 C2 C3 C4 C5
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 25/44
8. OFFLOADING SCENARIOS
8.1 Introduction
In this section the various offloading incidents that have been modelled by HAL have been
reviewed and assessed. The objective was to describe the sequence of events and potential
consequences for each scenario, then assess their likelihoods of occurrence and hence
applicability as design dimensioning events. The references have been given for each scenario
to the results table in the surge analysis (Table 1.01 of Ref. 1).
8.2 Normal offloading conditions
The system is operating with ten cargo pumps and three oil offloading pumps on the FPSO
delivering a total of 6600 m3/hr of crude to the export tanker.
During the operation according to the FPSO and tanker draft, the pressure profile can slightly
change; the following maximum pressure profiles are obtained considering the maximum FPSO
draft and minimum tanker draft.
Flowrate Operating Pressure

Location
(m3/hr) (barg)
6600 m3/hr (660 m3/hr per
Cargo Pump Discharge 14.3
pump)
Upstream of Metering Skid 6600 m3/hr 11.4
6600 m3/hr (2250 m3/hr per
Upstream of Booster Pumps 9.2
pump)
Oil Offloading Pump
6600 m3/hr 36.1
Discharge
Inlet to OOLs 6600 m3/hr 33.7
3
Inlet to SPM buoy 6600 m /hr 8.3
Export Tanker Arrival
3362 m3/hr (each hose) 2.0
Pressure
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 26/44
8.3 Abnormal shut down scenarios
8.3.1 SDV 89106 (buoy side) closure
See Case 4 of Ref. 1 – DESIGN DIMENSIONING.
This event corresponds to the spurious closure of the buoy SDV (valve is fail close
design) during an offloading operation. For the purposes of the study, it is assumed that
the buoy pressure protection system fails to operate, so the oil export pumps do not
receive a trip signal and keep running. This sequence of events is consistent with the
surge analysis requirements of Ref. 3.
The results of the HAL study show that this scenario can be mitigated by a controlled,
gradual closure of the SDV. For the purposes of a sensitivity study, two cases have been
run simulating closure over 24 and 30 seconds. The former gives surge pressures within
around 12% of the MASP at the outlet of the OOLs, compared with 19% for the slower
closure rate. As protecting the integrity of the upstream piping is essential to the
continued availability of the offloading system, the longer closure time of 30 seconds has
been retained for the design giving a greater safety margin for the upstream piping. No
oil spill to the environment occurs for this scenario.
Ref. 3 states that such an event shall be considered as occurring once within the 20 year
life cycle of the installation, deriving this from the PSD/ESD spurious operation frequency
-6
of 3.2 x 10 /hour quoted in GS SAF 260. The scenario is therefore retained as a design
dimensioning event in accord with the approach adopted by Ref. 3.
8.3.2 Hose end / tanker side valve closure
8.3.2.1 With full pressure protection system operation
See Case 1.2 of Ref. 1 - DESIGN DIMENSIONING.
This event corresponds to the hose end or tanker header valve(s) closure due
to failure of the valve internals, hence a very rapid closure of 1 second is
considered in the simulations. It encompasses therefore the less surge-critical
scenario of valve operator error during an offloading operation. The high
pressure wave travels upstream through the system, causing the MBCs to part
due to pressure. Then the three pressure sensors located on the buoy vote
activation of the pressure protection system. After a maximum delay of 2.25
seconds from the activation of the pressure protection system, all the pumps on
the AKPO FPSO trip. The shutdown valve on the buoy, SDV 89106, starts to
close immediately; it takes 30 seconds to completely close as specified in the
above section. Hence this case assumes that all the safety systems within the
OLT work correctly on demand.
The HAL analysis shows that the pressures in the system stay within the
ratings of the pipe work, apart from in the floating hoses where the pressure
(31.9 barg) slightly exceeds the MASP (30 barg) [note MASP since updated to
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 27/44
32 barg] but is well within the hose burst pressure of 75 barg]. The simulation
demonstrates that 10.15 m³ of crude oil is released into the sea from each hose
(a total spill of 20.3 m³), classifying the scenario as C3 on the criticality matrix
shown in Figure 3.
Due to the rapid valve closure that has been simulated, this scenario
corresponds to Case 5 in section 2.1 of Ref. 3, which combines simulation of
rapid valve closure with MBC parting. In reality this scenario can not concern
the hose end valves as the likelihood of two valves suffering simultaneous
internal failure is a diminishing one. Therefore the scenario arises due to full
offloading flow being directed through a single butterfly valve on the tanker, that
subsequently fails and slams shut. The event is stated by Ref. 3 to have “a very
low level of occurrence and one such occurrence over the field life is deemed
conservative”. This frequency estimate is assumed to be based on the industry
experience of MBC reliability, so for the purposes of the basic design surge
analysis, this scenario is analogous to the MBCs parting under tension due to
physical overload by the tanker and is hence design dimensioning.
The scenario of hose-end or tanker valve operator error leading to closure over
a period of 30-40 seconds has been simulated (see Case 1.7 in Ref. 1). It is
worth noting that the probability of the operator error scenario has been
quantified at two occurrences over 20 years, considering a 1% on-demand
operator error probability with valve operation only requested once every 10 of
the 2000 offloading operations. This low demand rate results from tanker
operating procedures strictly forbidding common header valve operation during
offloading. Based on the results of the sensitivity case 1.7 it is possible to say
that the MBCs parting pressure would not be attained if the minimum closure
time is above 36 seconds (40 seconds are selected for conservativity) and
hence there will be no release to the environment.
Subsequent to the reduction in MBC parting pressure set point from 25 barg to
22.5 barg, the scenario of hose-end or tanker valve operator error leading to
valve closure against the full offloading flow had to be revisited. The objective
was to assess the tolerable valve closure time. As can be seen from Case 1.8
this was determined to be 44 seconds, which is slow by industry standards
whereby valve closure rate is normally estimated at 1 second per inch of
diameter.
Essentially the problem with mitigating such a scenario is the inability of the
overpressure protection system to protect the downstream tanker pipework.
The MBCs can only protect the OLT from damage and minimise the size of any
release to the environment.
8.3.2.2 With partial pressure protection system operation
See Case 1.4 of Ref. 1 – NOT DESIGN DIMENSIONING.
This event corresponds to the same scenario as in Section 8.3.2.1, but only
one of the MBCs parts for pressure. As can be seen from the results table in
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 28/44
Ref. 1, the parting of the single MBC is sufficient pressure protection to keep
the system surge pressures tolerable, with only the offloading hose MASP
marginally exceeded at 32.8 barg. Again, this is well within the 75 barg burst
pressure of the hoses. The resultant oil release to the environment is 18.0 m³,
i.e. 113 barrels which classifies the scenario as C3 on the criticality matrix
shown in Figure 3.
The likelihood of this scenario must be reviewed against the reliability of the
selected design of MBC. To date it is understood that this design of MBC has
functioned on demand 160 times without fault, statistics that are not surprising
given the simplicity of the design. Making the extremely conservative
assumption that the next time that an MBC is solicited it fails to part, a
probability of failure of 1/161 can be derived, as can a probability of successful
parting of 160/161. The base scenario stated in Ref. 3 to have a frequency of
-2
occurrence of 1 in 20 years, i.e. 5 x 10 per year.It is reasonable to conclude
that the frequency of occurrence of the scenario combined with failure on
-3
demand of one MBC is (1 x 160/161 x 1/161), i.e. 6 x 10 during the lifecycle of
-4
the installation. As this implies an annual frequency of 3 x 10 for an event that
only just exceeds the 100 barrel upper bound of the ‘moderate’ severity
category, it is judged that rejecting this scenario as a design dimensioning
event can be justified. Nonetheless, this simulation is an excellent
demonstration of the effectiveness of the MBCs as a system protection device,
in that even if only one of them parts on demand, there would be no damaging
surge pressures and the environmental pollution would be minimized.
8.3.2.3 Without pressure protection system operation
See Cases 1.3, 1.1 & 2 of Ref. 1 – NOT DESIGN DIMENSIONING.
Case 1.3 corresponds to the same scenario as in Section 8.3.2.1, but neither of
the MBCs parts for pressure. The results indicate that the surge pressures
would be excessive at the FPSO end of the OOLs, downstream of the buoy
swivel, and would marginally exceed the bursting pressure of the offloading
hoses. It can be assumed that system damage and downtime would result,
though the environmental impact would be reduced by the successful operation
of the pump trip and SDV closure. Due to the potential for OOL, buoy and hose
damage and loss of containment, the scale of the release to the environment
can not be quantified accurately. For the purposes of this study it has been
estimated that C4 is the appropriate consequence category in the matrix shown
in Figure 3, equating to a ‘major’ spillage to the environment of between 1,000
and 10,000 barrels.
The likelihood of this scenario occurring is extremely low. Extending the

conservative quantification from the previous section, it is considered
reasonable to reduce the probability of occurrence during the lifecycle of the
-4
installation by at least a factor of 100, yielding 1 x 10 or an annual frequency
-6
of 5 x 10 . Therefore this can not be considered to be a design dimensioning
event.
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 29/44
In the most extreme cases (1.1 & 2), the above scenario has been
compounded with failure on demand of the buoy pressure protection system.
Note that for Case 2 the valve that slams closed is within the tanker manifold
rather than the hose-end valves, but the effect is identical. Again these
scenarios imply damaging levels of overpressure within the buoy and the
offloading hoses, but in addition the release to the environment would be very
significant (C4 assumed as per Case 1.3). Assuming one minute for operator
intervention to shut the OLT down, the pumped oil release would be at least
110 m³ without even considering the continued release of inventory from the
damaged piping. GS EP SAF 260 proposes a probability of failure on demand
-2 -3
for a SIL2 system of between 10 and 10 , conservatively giving a probability
of such a scenario occurring during the lifecycle of the installation of at most 1 x
-6
10 , i.e. clearly not design dimensioning.
8.3.3 Both MBCs (3-LB-89024/5) parting due to excessive load.
8.3.3.1 With full pressure protection system operation
See Case 3.2 of Ref. 1 - DESIGN DIMENSIONING.
This event corresponds to the two MBCs parting due to tanker pull after loading
hawser failure. The pressure waves from the closing MBCs travel back to the
buoy, tripping the buoy pressure protection system and causing SDV closure
and trip of the export pumps.
The HAL simulation indicates that the gradual closure of the MBCs prevents
damaging surge pressure throughout the OLT system. Two cases have been
run, allowing a sensitivity analysis on the MBC closure time. The 20 second
closure resulted in a surge pressure in the offloading hoses of over 39 barg,
exceeding the hoses’ MASP. On this basis, the MBC closure period has been
increased to 25 seconds, bringing the surge pressure back to 28 barg, within
the 30 barg MASP of the hoses. The increased closure period for OLT system
protection also increases the amount of oil that will be released to the
environment during the safe shutdown; the analysis indicates that the oil spill
will be up to 33.6 m³.
This sensitivity analysis was then extended to include the manufacturer’s

quoted ±1 second variance in closure time. The worst case oil spillage for this
scenario then results from a 26 second closure period, i.e. up to 34.9 m³. This
corresponds to a consequence category of C3 on the criticality matrix shown in
Figure 3, i.e. between 100 and 1000 barrels released to the environment.
This scenario can not be eliminated by design as it is only likely to occur due to
a procedural failure. For the tanker to overload the hoses it has to have lost
station, probably due to rising environmental loads. In general, it is anticipated
that such worsening conditions would lead to a safe shutdown of the offloading
operation before hawser failure would be likely to occur. For the purposes of
quantification this scenario corresponds to Case 5 in section 2.1 of Ref. 3,
which combines simulation of rapid valve closure with MBC parting. The event
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 30/44
is stated by Ref. 3 to have “a very low level of occurrence and one such
occurrence over the field life is deemed conservative”. This case has been
treated as design dimensioning.
8.3.3.2 Without pressure protection system operation
See Case 3.1 of Ref. 1 – NOT DESIGN DIMENSIONING.
This event corresponds to the two MBCs parting due to tanker pull after loading
hawser failure. It represents a base case, the objective being to simulate what
surge pressures would be attained if the buoy was not equipped with a
pressure protection system and the closure of the MBCs dead headed the
export pumps. For the purposes of this assessment the MBCs were given a 30
second closure time.
The simulation demonstrates that when the MBCs part, a pressure of 78.2 barg
is observed in the floating hoses. This peak pressure exceeds the 75 barg hose
burst pressure of the floating hoses and is therefore unacceptable. As the
pressure wave travels upstream, the pressures in the buoy piping reach 75.5
barg, exceeding the 65.17 MASP of the piping downstream of the buoy swivel.
It is possible that system damage and downtime would result, and the oil
release to the environment would be 41 m³ (260 barrels, i.e. consequence
category C3).without considering the potential for further release if buoy piping
or offloading hoses fail. Extending the closure time of the couplings would
reduce the surge pressures but would lead to a more severe spill volume than
41.0 m³. This simulation effectively makes the case for equipping the buoy with
a pressure protection system.
For the purposes of quantification this scenario corresponds to Case 5 in

section 2.1 of Ref. 3, which combines simulation of rapid valve closure with
MBC parting. The event is stated by Ref. 3 to have “a very low level of
occurrence and one such occurrence over the field life is deemed
conservative”. Though this base case was not intended to demonstrate MBC
closure combined with failure of the buoy pressure protection system, were this
latter feature assumed to be in place for this scenario then the frequency of
occurrence would be reduced by a factor of 1000, as per GS EP SAF 260 that
-2
proposes a probability of failure on demand for a SIL2 system of between 10
-3
and 10 (lower bound taken to avoid excessive combination of conservatism).
This would give a probability of such a scenario occurring during the lifecycle of
-3 -5
the installation of at most 1 x 10 , i.e. an annual frequency of 5 x 10 , a level
considered non-dimensioning for the system design as the consequences are
not judged to be in the ‘major’ or ‘catastrophic’ categories. Note also that this
quantification places the scenario in Zone III of the risk matrix shown in Figure
3.
8.3.4 One MBC (3-LB-89024) parting due to excessive load.
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 31/44
This case considers that only one MBC parts due to the load applied by the tanker. Once
this coupling parts an initial rise in flow is observed as the hose opens to atmosphere and
the pressure drops. When the MBC fully closes, all of the flow being pumped through the
system from the FPSO pumps is directed through the second MBC to the tanker.
When the MBC starts to close, the pressure rises immediately upstream of the coupling;
this pressure wave is then transferred upstream through the floating hoses, SPM pipe
work and 16 inch oil offloading lines before reaching the FPSO. The peak pressures in
the system remain within acceptable limits and the pressure at the pressure sensors
PSHH on the buoy remains below 12 barg, so the pressure protection system is not
activated. 17.9 m³ (113 barrels, i.e. consequence category C3) of crude oil is released
into the sea from the MBC as it closes in 25 seconds.
The likelihood of only one of the MBCs parting during offloading is hard to quantify given
the high reliability of these items in service. It is assumed that such an occurrence is
more likely than both the MBCs parting for load though the mechanism for loading only
one of the hoses is not clear. On this basis it is judged that one such occurrence over the
field life is probably representative, so the event is considered design dimensioning.
8.3.5 Offloading shut down
This event corresponds to the complete shutdown of all the operating cargo pumps and
oil offloading pumps whilst the system is initially operating at a total flowrate of 6600
3
m /hr. This causes an immediate fall in flowrate and pressure through the system and the
peak pressures observed are the initial steady state operating pressures. After the pump
trip, the peak pressures remain within the pressure ratings of the system and are
therefore acceptable, with no consequences other than operational delay while the
offloading operation is restarted. Hence no release to the environment and consequence
category C1.
Average results from a similar West African field operated by TOTAL have shown that
this scenario may take place 30 times a year.
8.3.6 Pigging loop bypass valve closure (16” 3-LB-89008),
This event corresponds to slam shut of the 16” valve due to failure. No abnormal shut
down scenario is generated, the system continues to operate as normal and no surge
pressure rises are observed, as all flow diverts around the valve. Hence no release to the
environment and consequence category C1.
This case has a very low level of occurrence and one occurrence over the field life is
deemed conservative based on the track record for similar systems. As such it is
considered to be a design dimensioning scenario.
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 32/44
8.3.7 Butterfly valve closure, (24” 3-LB-89023),
This critical scenario corresponds to a very rapid closure (1 second) of the manual 24”
butterfly valve, 3-LB-89023, positioned at the buoy outlet. Such a rapid closure implies
failure of the valve internals. The buoy pressure protection system trips the export pumps
and shuts the SDV, but the surge pressures still exceed the OOL inlet and outlet MASP
of 96.8 barg. The MASP of the buoy piping downstream of the swivel is 65.17 barg, so
the peak calculated pressure of 104.5 barg are very likely to lead to system damage and
an oil release to the environment. Environmental consequences not easy to quantify
given potentially major damage to the OLT, so categorised as C4 on the criticality matrix
shown in Figure 3.
This scenario is clearly unacceptable and can not be protected against by the current
OLT pressure protection devices. Furthermore, it is not possible to argue that the risk of
occurrence is negligible so this event would effectively be design dimensioning unless
appropriate mitigation can be put in place. Rating all piping to cope with the associated
surge pressures is not a practical proposition, so the preferred solution is to eliminate the
risk of occurrence by the selection of a fail-open valve design.
It is worth noting that the consequences of manual (gradual) closure of this 24” valve
during offloading have not been simulated. This is justified because the valve is locked
open and the buoy is unmanned during the offloading operation.
8.3.8 Sensitivity studies
In addition to the sensitivity studies carried out for the MBC closure time (see Section
8.3.3.1) and the SDV closure time (see Section 8.3.1), HAL carried out sensitivity studies
for two further parameters, as detailed below.
8.3.8.1 Pump trip delay time
See Cases 1.2 & 1.5 of Ref. 1
The scenario of slam shut failure of the hose-end butterfly valves was used for
the purposes of the pump trip delay time sensitivity study. Following the sudden
valve closures, the high pressure wave travels upstream through the system,
causing the MBCs to part due to pressure. Then the three pressure sensors
located on the buoy vote activation of the pressure protection system. The
shutdown valve on the buoy, SDV 89106, starts to close immediately; it takes
30 seconds to close completely. The delay from the activation of the pressure
protection system to the tripping of the OLT pumps on the AKPO FPSO has
been varied, using values of 2.25, 3.25 and 4.25 seconds.
As can be seen from the results table in Ref. 1, the variations in surge
pressures throughout the system due to the varied pump trip time are limited.
This is because the MBCs are still open at this stage and they effectively
control the surge pressure. However, the later the pump trip the greater the
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 33/44
release to the environment, hence the recommendation by HAL to go for the

2.25 second pump trip time.
8.3.8.2 MBC parting pressure
See Cases 1.2 & 1.6 of Ref. 1
The scenario of slam shut failure of the hose-end butterfly valves was used for
the purposes of the MBC parting pressure sensitivity study. Following the
sudden valve closures, the high pressure wave travels upstream through the
system, causing the MBCs to part due to pressure. Then the three pressure
sensors located on the buoy vote activation of the pressure protection system.
The shutdown valve on the buoy, SDV 89106, starts to close immediately; it
takes 30 seconds to close completely. After a 2.25 second delay the pumps
onboard the FPSO are tripped.
MBC parting pressure set points of 15, 20, 25 and 27.5 barg have been used
for the study. Each increase in parting pressure resulted in increases in the
surge pressures within the OLT system, though the pressures remained
tolerable up to the 25 barg parting pressure. The case at 27.5 barg parting
pressure was carried out to demonstrate that the +10% potential variance in
parting pressure yielded unacceptable surge pressures that exceed the hoses’
MASP. Oil spill volumes were the same for all four parting pressure set points,
as the release quantities are controlled by the coupling closure time.
The higher the MBC parting pressure the better, provided that the surge
pressures remain tolerable. This is because the set point of the parting
pressure also determines the applied load that the MBCs can take before
parting. In principle a higher parting load should reduce the number of MBC
parting incidents throughout the lifetime of the installation.
For this reason HAL had recommended an MBC parting pressure of 25 barg.
Though this leads to a surge pressure in the hoses marginally in excess of their
MASP (31.9 barg versus 30 barg allowable), this is far from the 75 barg
bursting pressure that the hoses are designed for. Furthermore, it was
subsequently agreed that the hoses would be subject to a static hydrotest to 32
barg with the supplier’s technical assurance that this level of pressure poses no
risk of damage, so can therefore be adopted as the MASP up to which no post-
incident hose inspection will be required.
The final MBC parting pressure of 22.5 barg was imposed by a requirement to
incorporate any potential variance in actual parting pressure. Given the MBC
manufacturer’s stated tolerance of ±10%, the parting pressure had to be
reduced by 10% to ensure minimal risk of the surge pressure exceeding 25
barg before the MBCs activate to mitigate the scenario. Thus the large margin
in surge pressure tolerability up to the hoses’ rated burst pressure of 75 barg
that could have mitigated the parting pressure variance will not be used. This
conservatism will theoretically increase the number of MBC parting incidents
during the lifecycle of the installation as their trip pressure is reduced.
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 34/44
8.3.8.3 System valve CV
See Cases 1.10 and 1.11
In accordance with a request to investigate the effect of valve CVs on the surge
scenarios, the worst case credible surge scenario (1 second closure of hose
end butterfly valves) was run with valve CVs varying by ±10%.
As can be seen from the results, the oil spill volume was unchanged and peak
surge pressures reduced in both cases below the 31.9 barg originally recorded.
This implies that the original run used an approximate worst case for valve CVs
and validated the other surge results that all used the same, original valve CV
figure.
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 35/44
ANNEX A
INCIDENT FREQUENCY REVIEW
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 36/44
Introduction
The availability of reliable statistics relating to offloading incidents is a pre-requisite to any meaningful
quantification exercise. With regard to the Akpo basic design phase, the only frequency data used in the
design of the OLT appears to be in Ref. 3, a Project Particular Specification (PPS) concerning the surge
load cycling on the OOL flex-joints. Accordingly this data was used as the basis for the first revision of this
report, on the basis that an approved surge incident frequency analysis pertaining to a critical component of
the OLT is equally pertinent to the rest of the OLT.
Following comments that this PPS was incorrect and not applicable to the surge analysis, it was necessary
to review and attempt to validate the event frequency figures that it proposes.
Basic Engineering Event Frequency Data
The critical figures in Ref. 3 that require review are those that relate to surge events significant enough to
cause parting of the MBC and the associated environmental impact. The table in Ref. 3 implies that this is
likely to occur three times during the 20 year life cycle of the OLT, either due to surge following operator
error (valve closure on the tanker during offloading - 2 events) or because of valve/hawser failure (1 event).
Availability of Offloading Incident Data
The following data sources have been made available for this exercise (data tables shown on following
pages):
1. Gall-Thomson (MBC supplier) have released a version of their incident database that protects the
identity of the operators concerned. However, they are quite clear that this includes only the events
of which they have been made aware. Furthermore, it is not associated with any idea of MBC in-
service years, a necessity if any frequency data is to be derived from the incidents recorded.
Therefore this database is only of interest to give the relative ratios of the causes of MBC parting
events, e.g:
Total number of incidents = 170 (disregarding 4 incidents for which no information is available).
Number of incidents resulting from tanker breakout = 124, i.e. 73%
Number of incidents resulting from pressure surges = 25, i.e. 15%
The remaining percentage is taken up by smaller contributors such as vessel/buoy collisions, anchor
chain failures, etc.
2. COMPANY have supplied a list of offloading incidents. As for the Gall-Thomson data the listing is
not associated with any idea of MBC in-service years so is of limited value for the purposes of
deriving event frequency. The one significant statistic that can be derived is that out of four surge
incidents caused by valve closure on the tanker, two resulted in pipework damage and crude oil
outflow on the tankers.
3. COMPANY have supplied MBC-related event data taken from another Operator. This yields useful
information as the number of MBC parting incidents is linked to the number of MBC in-service years,
as follows:
MBC activations from incidents = 1

Spurious activations = 3
MBC in-service years = 99
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 37/44
Discussion
Considering the data from 3. above and the three spurious activations. It is not known if these involved Gall-
Thomson MBCs or another make. This is significant as it is understood that the Gall-Thomson design has
been found to have a higher reliability than other designs, hence their large global market share.
Furthermore, Gall-Thomson make reference to incidents that have been stated by the operator concerned to
result from spurious activations, that on further metallurgical analysis of the break-studs involved have been
shown to have resulted from correct trigger-level loads on the MBCs, i.e. they were not spurious MBC
partings.
So making the assumption that the three spurious partings were in fact incidents where the MBCs parted as
per design intent, this gives a total of four MBC parting incidents for 99 years of operation, or an MBC
-2
parting frequency of 4 x 10 per year. Equating this to the two MBCs for the Akpo OLT (hence 40 years in-
service), this leads to the conclusion that approximately 2 individual MBC parting incidents can be
anticipated during the lifecycle of the installation. This could of course imply a single incident for which both
MBCs part.
Conclusion
Though the data used in this quantification exercise is that of a limited population, it is the only data
available. The statistics given in 3. above largely validate the conservatism of the incident frequency
prediction from Ref. 3, yielding a total lifecycle number of incidents of 2 compared to 6 (3 incidents with both
MBCs parting). As can be seen from Table 2 of this report, the number of MBC parting events assumed for
the purposes of this study total 5, which compares favourably with the assessed figure.
From 1. above, the statistics imply that approximately a quarter of the MBC parting incidents will result from
pressure surge, the remainder being caused by tanker breakout. For Akpo, given the more benign
conditions in the Gulf of Guinea and the application of best practice such as the precautionary suspension of
offloading if the environmental conditions deteriorate, a 50/50 distribution of these causes is judged to be
more likely.
From 2. above, it can only be concluded that for the surge events derived from valve manipulation or failure
on the tanker (estimated at 2 to 3 through the lifecycle), 50% of the incidents will result in pipework damage
and loss of containment on the tanker. It is impossible to determine whether such scenarios would cause
surge pressures high enough to cause the MBCs to part as this will depend on the pressure at which the
pipework fails, but as per the data in 2. it is likely that in such cases there will be no crude oil release to the
environment, the spillage being contained on the tanker.
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 38/44
1. Gall-Thomson data.
RANDOM SAMPLE (NOT DEFINITIVE) OF TANKER INCIDENTS REPORTED AT OFFSHORE

TERMINALS
NB. WHERE NOT MENTIONED IN “RESULT”, MBC’S NOT INSTALLED AT TIME OF EVENT
COUNTRY YEAR OPERATOR TERMINAL TYPE CAUSE RESULT
EGYPT 1989 SPM TB MD

EGYPT 1989 SPM EPS MD
EGYPT 1989 SPM EPS MD
EGYPT 1989 SPM TB MD. FHD.
EGYPT 1993 SPM TB MD. FHD.
EGYPT -- SPM TB ND-NEAR MISS
EGYPT 1994 SPM TB ND. MBC’S ACTIVATED
EGYPT 2000 SPM TB ND. MBC’S ACTIVATED
EGYPT 2003 SPM EPS ND. MBC’S ACTIVATED
IRAN 2005 SPM TB ND. MBC’S ACTIVATED
SAUDI ARABIA 1988 CBM TB SHR. PD. PLD. SP.
SAUDI ARABIA 1991 JETTY TB FHR. MP. JMD.
SAUDI ARABIA 1992 SPM TB MD
SAUDI ARABIA 1994 SPM TB ND. MBC’S ACTIVATED
KUWAIT 2004 SPM TB ND. MBC’S ACTIVATED
KUWAIT 1972 CBM TB SHR. PD. PLD. SP.
KUWAIT 1995 SPM EPS ND. MBC’S ACTIVATED
QATAR 1990 SPM TB ?
QATAR 1990 SPM TB FHD. MP.
QATAR 1993 SPM TB FHR. SP.
UAE 1991 SPM EPS MD.
UAE -- . SPM EPS MD.
UAE 1993 CBM TB ND. MBC’S ACTIVATED
UAE 1993 SPM TB TMD. FHD. SP.FIRE
UAE 1993 FSO TB FHR. SP.
UAE 2000 SPM EPS ND. MBC’S ACTIVATED
UAE 2000 FSO TB FHR. SP.
UAE 2003 SPM TB ND. MBC’S ACTIVATED
LIBYA 1975 CBM TB SHD. PD. PLD. MP.
LIBYA 1977 SPM TB FHR. SP.
LIBYA 1978 CBM TB SHD. PD. PLD. SP.
LIBYA 1991 CBM TB SHR. PD. PLD. SP.
LIBYA 1992 SPM TB FHR. MP. CSF.
LIBYA 1993 SPM TB FHR. SP.
LEBANON 1998 CBM PIPELINE/PLEM LEAK/FIRE
LEBANON 2000 CBM TB SHD. SP.
LEBANON 2000 CBM TB SHD. PLD. MP.
TURKEY 1995 CBM TB SHD
TURKEY 1995 CBM TB SHD. PLD. LPG SPILL
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 39/44
TURKEY 1999 CBM TB SHD. PD. PLD. MP.

LITHUANIA 1999 SPM TB ND. MBC’S ACTIVATED
LITHUANIA 2001 SPM TB ND. MBC’S ACTIVATED
LITHUANIA 2005 SPM TCWB AC’S STRETCHED, MBC’S NOT
COMPROMISED
POLAND 1994-03 SPM TB SEVERAL TB’S. MBC’S ACTIVATE
CYPRUS 1991 CBM TB SHR. SP.
CYPRUS -- CBM TB SHR. PLD. SP.
CYPRUS -- CBM TB SHR. PLD. SP.
CYPRUS 2003 CBM TB SHD. PD. MP.
GREECE 1988 CBM TB SHR. PLD. SP.
GREECE 1998 CBM TB SHR. PD. PLD.FIRE. FATALITIES
GREECE 1999 CBM TB HF. SP. PLD.
ALGERIA 1990 JETTY TB FHR. SP. FIRE
ITALY 1979 CBM TB SHR. PD. SP.
ITALY 1995 TOWER TBFHD. SP.
FRANCE 1989 CBM TB SHR. PD. PLD. SP.
UK. 1980-92 SPM TB AT LEAST 12 TB'S ND. MBC’S
UK. 1986 ALP TB ND. MBC’S ACTIVATED
UK. 1980 ALP TB SEVERE SYSTEM DAMAGE
UK. 1990 ALP TB ND. MBC’S ACTIVATED.
UK. 1993 ALP TB ND. MBC’S ACTIVATED
UK. 1982 ALP TB DAMAGE TO HOSE REEL
UK. 1977 SPM TB FHD. MP.
UK. 1984 SPM TB SEVERAL TB’S. ND. MBC’S ACTIVATED.
UK 1993 ALP TB FHD. MP.
UK. 1995 SPM TCWB SHD
UK. 2000 SPM TB FHD. MP.
HOLLAND 2006 ALP TB ND. MBC’S ACTIVATED
NORWAY 1984 ALP TB FIRE, CAPTAIN KILLED.
NORWAY 2000 ALP TB HF. MP.
NORWAY 2005 ALP EPS ND. MBC’S ACTIVATED
ARGENTINA 1992 SPM TCWB SHR. SP.
ARGENTINA 1992 SPM ? ?
ARGENTINA 1993 SPM EPS FHR. SP.
BRAZIL -- CBM ? ?
BRAZIL 1994-96 SPM TB/EPS11 TB’S. FHD. FHR. SP.
BRAZIL 2002 SPM TB ND. MBC’S ACTIVATED
BRAZIL 2004 SPM TB ND. MBC’S ACTIVATED
BRAZIL 2004 FPSO EPS ND. MBC’S ACTIVATED
BRAZIL 2006 FPSO EPS ND. MBC’S ACTIVATED
CHILE 1989 CBM ? ?
CHILE 1991 SPM TB FHD. MP. (X4)
CHILE 1991 CBM TB MD.
CHILE 1996 SPM TB ND.
CHILE 2003 SPM TB FHD. MP.
ECUADOR 2005 CBM TB PD, SHD, SP
ECUADOR 2006 SPM VCWHS ND. MBC’S ACTIVATED
COLOMBIA 1996 CBM TB SHD. PLD. SP.
MEXICO 1990 SPM EPS FHR. SP.
MEXICO 1997 SPM TB FHD. SP.
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 40/44
MEXICO 2000 CBM TB

SHR. PD. PLD. SP.
EL SALVADOR 2005 CBM TB
ND. MBC’S ACTIVATED
USA 1989 SALM TB
FHD. MP. (X2)
TRINIDAD 1999 CBM TB
HF.PD.PLD.
BAHAMAS 2000 CBM TB
SHD. MP.
HAWAII 1989 SPM TB
FHR SP TANKER GROUNDED
GUATEMALA 1992 CBM TB
SHR. SP.
EL SALVADOR 1994 CBM TB
SHD. PD. SP.
DOMINICAN RP. 1989 CBM TB ND. MBC’S ACTIVATED
CANADA 1995 FSO TB ND. MBC’S ACTIVATED.
AUSTRALIA 1990 CBM TB SHR. PD. MP.
AUSTRALIA 1995 CBM EPS ND. MBC’S ACTIVATED
AUSTRALIA 1999 SPM EPS VAPOUR POCKET COLLAPSE ND. MBC
ACTIVATED
AUSTRALIA 1986 CBM TB NEAR MISS
AUSTRALIA 1993 FPSO EPS ND. MBC’S ACTIVATED
AUSTRALIA 1994 FPSO TB ND. MBC’S ACTIVATED
AUSTRALIA 1996 FPSO EPS ND. MBC’S ACTIVATED
AUSTRALIA 2006 FSO/SPM TBND. MBC’S ACTIVATED
INDONESIA 1986 SPM TB EXPLOSION FATALITIES
INDONESIA 1985 SPM TB CAMLOCK FAILED
INDONESIA 1993 FPSO TB FHR
INDONESIA 2000 SPM TB HF.SP.
INDONESIA 2001 SPM TB FHD. SP.
INDONESIA 2004 FPSO TB ND. MBC ACTIVATED
SINGAPORE 1989 SPM TB FHD. MP.
SINGAPORE 1989 SPM TCWB SHR. PD. PLD. SP.
SINGAPORE 2000 SPM ACP ND. SUBSEA MBC’S ACTIVATED
MALAYSIA 1986 SPM TB FHD. MP.
MALAYSIA 1989 SPM TB FHD. MP.
MALAYSIA 1996 SPM HF SP
MALAYSIA -- SPM TB ?
MALAYSIA 1986 SPM TB TMD
MALAYSIA 2002 SPM TB ND. MBC’S ACTIVATED
MALAYSIA 2006 SPM VCWHS ND. MBC’S ACTIVATED
VIETNAM 1994 FPSO TB ND. MBC’S ACTIVATED
VIETNAM 2004 FPSO EPS ND. MBC’S ACTIVATED
BRUNEI 1987 SPM TB BOLLARD MISALIGNED
THAILAND 2004 CBM TB PD – MBC’S NOT INSTALLED
CHINA 1991 FPSO TB ND. MBC’S ACTIVATED
CHINA 1999 FPSO TB SOLITON/CSF.
CHINA 2006 FPSO TB ND. MBC’S ACTIVATED
S. KOREA 1994 SPM TB FHD. MP.
JAPAN 1995 SALM TB FHD.
RUSSIA 1999 FPSO TB ND. MBC ACTIVATED
RUSSIA 2001 SPM EPS ND. MBC ACTIVATED
INDIA 1986 SPM EPS ND. MBC’S ACTIVATED
INDIA 1995 SPM TB FHD. MP.
INDIA 1998 SPM TB ND. MBC ACTIVATED (X2)
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 41/44
INDIA 1996 SPM TB FHD.

INDIA 1998 SPM TCWB SANK SPM & HOSES
SRI LANKA 1989 SPM TB FHD. MP.
SRI LANKA 1991 SPM TB FHD. MP.
NIGERIA 1985 CBM TB SHR. PD. SP.
NIGERIA 1985 CBM TB SHR. PD. SP.
NIGERIA 1993 CBM TB SHD. PD. SP.
NIGERIA 1994 SPM TB FHD. TMD. SP.
NIGERIA 1985 FSO EPS FHD.
NIGERIA 1986 FSO TB FHD + STRUC. DAMAGE
NIGERIA 1987 SPM EPS FHR. SP.
NIGERIA 1995 SPM TB FHD.SP.
NIGERIA 1995 FSO TB FHD. TMD. SP.
NIGERIA 1995 SPM TB MD. MP.
NIGERIA 1996 FSO TB FHD. MP
NIGERIA 1999 FPSO TB ND. MBC’S ACTIVATED
NIGERIA 2001 FSO TB ND. MBC’S ACTIVATED
NIGERIA 2001 SPM EPS ND. MBC’S ACTIVATED
NIGERIA 2001 FSO TB FHD. SP.
NIGERIA 2003 SPM TB ND. MBC’S ACTIVATED
NIGERIA 2004 FPSO TB ND. MBC’S ACTIVATED
NIGERIA 2006 JETTY TB 5 FATALITIES
NIGERIA 2005 FPSO TOHS ND. MBC’S ACTIVATED
NIGERIA 2006 FSO/SPM TBND. MBC’S ACTIVATED
CAMEROON 2000 SPM EPS HF. SP. SPM/PUMPS DAMAGED
GABON 1990 SPM EPS FHR. SP.
IVORY COAST 1993 CBM TB SHD. SP.
IVORY COAST 1998 CBM TB ND. MBC’S ACTIVATED
BENIN 1985 CBM TB SHD. MP.
BENIN 1986 CBM EPS SHR. MP.
ANGOLA 1993 SPM TB FHD. MP.
S. AFRICA 2004 SPM ACP ND. 3 X 8” MBC’S ACTIVATED
FHD = FLOATING HOSE DAMAGE CSF = CHAIN STOPPER FAILURE

FHR = FLOATING HOSE RUPTURE MP = MINOR POLLUTION
SHD = SUBSEA HOSE DAMAGE SP = SEVERE POLLUTION
SHR = SUBSEA HOSE RUPTURE ND = NO DAMAGE
HF = HOSE FAILURE MD = MINOR DAMAGE
PD = PLEM DAMAGE TB = TANKER BREAKOUT
PLD = PIPELINE DAMAGE EPS = EXCESSIVE PRESSURE SURGE
JMD = JETTY MANIFOLD DAMAGE TCWB = TANKER COLLISION WITH BUOY.
TMD = TANKER MANIFOLD DAMAGE ACP = ANCHOR CHAIN PARTING
TOHS = TUG OVERTENSION HOSE STRINGVCWHS=VESSEL COLLISION WITH HOSE STRING
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 42/44
2. COMPANY data
Country Terminal Date Type Origin Consequences/Actions

Valve closure Pipe breakage in pump room. Pump room
Tunisia IFRIKIA 1 1977 Surge
on tanker submerged with crude oil.
Breakdown of flexible hoses two times. The piping
Valve closure was protected via a safety pressure valve on the
Tunisia IFRIKIA 2 07/79 Surge
on tanker main export pipe and on the delivery of the cargo
pumps. A PSH was also fitted.
Valve closure
Breakdown of submarine flexible hose. PSV installed
Congo DJENO 01/10/83 surge on tanker after
in 1985.
black out
throttling of
Increase of Two incidents before 1993 .PSH on cargo pumps
valves on
Cameroon KOLE pressure : near already and rupture disks on ACE ONE (back up
board the
miss receiver)
tanker
LICORNE Hawser Hawser breakdown and malfunction of GALL
Angola 09/01/1989 TRH tear away
PACIFIQUE breakdown THOMSON fuse
Breakaway
coupling
Excessive
Angola PALANCA 03-07/1992 SPEED-SEAL Change to GALL THOMSON
pressure loss
not
operational
Sudden Safety pin of TRH valve breakdown. Safety devices
Angola PALANCA 14/04/1992 Surge closure of 16” on valves were changed, PSH at 17 bars on export
TRH valve piping on board Palanca.
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 43/44
Spurious
36” export pipe moved on board PALANCA and
opening of
bending of line supports. Breakdown of coupling and
Surge ,pollution GALL
Angola PALANCA 11/09/1992 several other minor leaks on line. Breakaway
50 M3 THOMSON
coupling not reconnected and PSH change from 17
breakaway
to 13 bars
coupling
Throttling of 36” export piping bended, leaks on SPM flanges.
Angola PALANCA 07/04/1993 Surge valves on SPM fitted with pressure release valves inside the
board tanker well
Valve closure Pump room submerged with 75 M3 of oil. Since then
Cameroon KOLE 09/1/2000 Surge on tanker after a rupture disk was added to the system. Repair
black out costs at 3 MUS$
Supposed to
be surge from Overflow of surge tank, no activation of SDV
Angola GIRASSOL 2002 Surge tanker valves pollution of buoy well and sea. Re-commissioning of
or rupture disk buoy equipment.
failure
REPORT
Doc reference Rev.
IFC 2 22-Nov-07 44/44
3.
From XXXX’s MBC events:
• Terminals with MBC s fitted 10

• No of MBC s in service 20 (6 single closure)
• MBC in-service years 99
• Activations from incidents 1
• Spurious activations 3
• Spurious activation factor (MBC years) 0.03
• Maintenance frequency 3 –6 years
• Actual event frequency most likely greater than stated

NG50-3-200-ENG-RP-AB-83-6804

Uploaded by

Copyright:

Available Formats

You might also like

NG50-3-200-ENG-RP-AB-83-6804

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

NG50-3-200-ENG-RP-AB-83-6804

Uploaded by

Copyright:

Available Formats

NIGERIA - OML 130 AKPO

AKPO Field Development Project LOGO

CHANGE RECORD PAGE

Revision Description of revision

0 Issue for CPY Review

1 Issued for construction, incorporating CPY comments.

1. ADDITIONAL SURGE SCENARIOS .............................................................................................................. 5

8.3.3 Both MBCs (3-LB-89024/5) parting due to excessive load. ...................................................... 29

ANNEX A INCIDENT FREQUENCY REVIEW .......................................................................35

1. ADDITIONAL SURGE SCENARIOS

1.2 Discussion of additional surge simulations

See Cases 101 and 104 of Ref. 1.

See Cases 201, 202, 203, 206 and 207 of Ref. 1.

See Case 301 of Ref. 1 – NOT DESIGN DIMENSIONING

See Case 302 of Ref. 1 – NOT DESIGN DIMENSIONING.

See Case 402 of Ref. 1 – NOT DESIGN DIMENSIONING.

1.2.6 Parting of MBCs due to load – complete failure of buoy PSHH

See Case 404 of Ref. 1 – NOT DESIGN DIMENSIONING.

See Cases 601 & 602 of Ref. 1.

In accordance with a request to investigate the effect of a maximum flowrate of 7200

See Case 701 of Ref. 1.

See Case 801 of Ref. 1.

See Case 901 of Ref. 1.

3. PURPOSE OF THE DOCUMENT

[1] OIL OFFLOADING TERMINAL PRESSURE SURGE STUDY

[2] OIL LOADING TERMINAL – DESIGN DATA AND FUNCTIONAL SPECIFICATIONS

[3] PRESSURE & TEMPERATURE CYCLE EVENTS

[4] SAFETY RISK MANAGEMENT SYSTEM

[5] AKPO OFFLOADING TERMIONAL SURGE PROTECTION: EXP COMMENTS

6. OLT SYSTEM DESCRIPTION AND OVERPRESSURE PROTECTION PHILOSOPHY

6.1 OLT System Overview

FIGURE 1 – Schematic of OLT

6.2 OLT Overpressure Protection Philosophy

7.1 System Parameters

Table 1 – OLT variable parameters & proposed values

Parameter Proposed Discussion Ref.

7.2 Frequency Screening

Table 2 – OLT design dimensioning operating scenarios and consequence summary

Peak MBC Total oil Number of Reference,

Peak MBC Total oil Number of Reference,

Pigging loop bypass

Peak MBC Total oil Number of Reference,

Oil release due to

7.3 Risk Acceptability

Figure 3 – Risk matrix showing design dimensioning surge scenarios

NEG MOD SEV MAJ CAT

8.2 Normal offloading conditions

Flowrate Operating Pressure

8.3 Abnormal shut down scenarios

8.3.1 SDV 89106 (buoy side) closure

See Case 4 of Ref. 1 – DESIGN DIMENSIONING.

8.3.2 Hose end / tanker side valve closure

8.3.2.1 With full pressure protection system operation

See Case 1.2 of Ref. 1 - DESIGN DIMENSIONING.

8.3.2.2 With partial pressure protection system operation

See Case 1.4 of Ref. 1 – NOT DESIGN DIMENSIONING.

8.3.2.3 Without pressure protection system operation

See Cases 1.3, 1.1 & 2 of Ref. 1 – NOT DESIGN DIMENSIONING.

The likelihood of this scenario occurring is extremely low. Extending the