Introduction

Safety is an important factor that needs to be considered in an oil and gas company, because even a low-risk event occurrings in the company could have serious consequences, affecting personnel, buildings, cost, and the company reputation (Yang et al. 2015). Since an oil and gas company has a high risk of accidents, a risk assessment should be applied. To prevent accidents that might affect the safety of personnel, facilities, environments, or the company reputation, an oil and gas company should implement the operation safety case (OSC) contained in a risk assessment. The OSC will identify and quantify any risks involved in the operations, thereby revealing the risk level. Depending on the risk value, the risks can be controlled or reduced by several activities to make the risk acceptable (as low as reasonably practicable ALARP).

Several risk-assessment methods have been implemented. For an offshore oil and gas company, a quantitative risk assessment (QRA) is a widely used and important method for identifying major offshore accident risks (Huang et al. 2015). One offshore accident risk assessment for a hydrocarbon-release event used the QRA method with the concept of a confidence level (Huang et al. 2015). A complete QRA was also performed on a liquefied natural gas floating storage and regasification unit by categorizing the potential hazards, assessing the probability, and estimating the frequency (Martins et al. 2016). Furthermore, a risk-based accident model was conducted using a QRA for the leakage failure of a submarine pipeline (Li et al. 2016). On the other hand, an integrated QRA was performed on a medium-sized floating regasification unit; it was assessed using software and compared with conventional qualitative and quantitative risk assessments (Jeong et al. 2017). In addition, an integrated risk assessment, including human and environmental risks, was implemented for a real oil platform in the Barents Sea, using the risk-matrix approach (Bucelli et al. 2017).

Good data are very important in a QRA application; however, the needed data are not always available. To overcome this challenge, semi-quantitative risk assessments are sometimes conducted. For example, in situations with limited knowledge about risk generation, point-estimate approaches have often been employed to evaluate the risk, due to their simplicity (Chan and Wang, 2013). A semi-quantitative risk assessment provides an intermediary level between the textual evaluation of a qualitative risk assessment and the numerical evaluation of a quantitative risk assessment, by evaluating the risks with a score. A semi-quantitative risk assessment provides a structured method for ranking risks according to their probability, impact, or both (severity), and for ranking risk-reduction actions according to their effectiveness. This is achieved through a predefined scoring system, which allows one to map a perceived risk into a category, with a logical and explicit hierarchy between categories (World Health Organization 2009).

Based on the literature study, the authors aimed to improve the QRA method by applying a semi-quantitative risk analysis (SQRA) to obtain the risk value at a normally unmanned installation facility (NUI). An NUI is a type of building/platform in an offshore oil and gas company, which picks up oil and is designed to operate automatically, without the constant presence of workers. Nevertheless, in this study, the risk assessment of the NUI will include the existence of workers as security personnel. The SQRA method is appropriate for calculating the risk in the NUI, because it considers both qualitative and quantitative assessments. Therefore, the risks can be evaluated both textually and with score. The SQRA method offers a more consistent approach than qualitative risk assessments by avoiding some of the ambiguity. In addition, an SQRA is the most preferred method for stating the risks in the industry (Wijeratne et al. 2014).

Methods

Determination of the risk level to security personnel in the NUI involves five main steps, as follows.

Collecting data and information

Data and information were collected by reviewing the inspection reports of NUI facility platforms. The data on the platform condition were obtained by collecting and reviewing historical data, including maintenance reports, operational damage and maintenance reports, operational failures and maintenance reports, operational accidents and maintenance reports, documented human errors, and pipeline-network patrol-inspection documents. The collected data were classified into process, equipment process, and occupational.

Determining risk factors

The risk factors were identified through hazard identification (HAZID) mechanism for potential hazards that pose a security threat to security personnel in an NUI. Potential dangers were listed in the worksheet, along with the consequences. Determining the risk factors included the likelihood and the consequence with the parameter criteria. An assessment was then done for each criterion according to the existing NUI condition.

Risk forecasting

Risks were calculated for safety, environment, finance, and reputation. The calculation was conducted using the Monte Carlo uncertainty approach through the Crystal Ball simulation program. The Monte Carlo’s uncertainty calculations were done by simulating 100,000 experiments with an 85% certainty level. The 85% indicates the probability of a risk event occurring in the calculated experiment over the 100,000 times. The total risk was then calculated.

Mapping the results onto a risk matrix

The risk forecasting results were then reviewed and mapped onto a risk matrix (scale 25, risk matrix 5 \(\times\) 5), and then categorized in accordance with the ALARP principle.

Determining a protection and mitigation system

The mapping results will show one of three risk category levels. If the risk category is “medium” or “high” level, a protection and mitigation system must be implemented to reduce the risk value to “low” category.

Results and discussion

Data and information collection

Based on a direct review of the process flow diagrams (PFD), piping and instrumentation diagrams, and plant layouts of some NUI facility platforms, the platforms under study were divided into two types, according to their characteristics and consumptions. The descriptions of each platform type are shown in Tables 1 and 2.

Table 1 Description of type A platform
Full size table
Table 2  Description of type B platform
Full size table

Risk-factor determination

In addition to being identified through HAZID, the risk factors that threaten security officers at an NUI are also determined by directly reviewing the descriptions of each platform, and by considering the possible hazards while referring to several international standards, e.g., International Standard Organization (ISO 2000), Oil Gas Producers (OGP 2010), Center for Chemical Process Safety (CCPS 2003), and American Petroleum Institute (API 1991). The risk factors and a list of likely hazards to the security personnel in an NUI were determined and are shown in Table 3.

Table 3 Risk factors and likelihood
Full size table

Likelihood factor

The likelihood factor was defined as the potential hazard resulting from the HAZID process. The identified hazards were then classified into criteria with values from 1 to 5, where 1 denotes an “almost impossible” probability, while 5 indicates a “high” probability. The descriptions of the likelihood criteria are listed in Table 4.

Table 4 Description of the likelihood criteria
Full size table

Consequence factor

The consequence factor is the result that can be generated by an event that might occur, given the likelihood factor. The consequence factor will include safety, environment, financial, and reputational consequences. These factors are described in detail in Table 5.

Table 5 Consequences factor
Full size table

Qualitative assessment of the likelihood

The qualitative assessment of the likelihood was divided into seven factors including facilities, third party, environmental effect, corrosion, operation, human, and evacuation boats. The assessment results of these factors can be seen as follows and are summarized in Table 6.

Table 6 Qualitative assessment of likelihood
Full size table

Facility

Facility factors relate to all the facilities in the NUI and contribute to events that may impact the workers’ safety. The existing likelihood criteria in the facility factor are the guard house location, NUI lifetime, safety equipment, and hydrocarbon process unit.

  1. 1.

    Guard house location

Every platform has a guard house available for security personnel. The guard house is located next to the wellhead. Therefore, this factor obtains a value of 4, with a normal data distribution type.

  1. 2.

    NUI Lifetime

The NUI platform design was documented with a recognized code. The NUI operates according to its original design parameters; however, it has exceeded its lifetime. The value for this factor is 3, with a normal data distribution type.

  1. 3.

    Safety equipment

The following equipment was available on every platform: personal protective equipment (Cornils et al. 2000), personal survival equipment (PSE), a fire extinguisher, and a flashlight. This factor obtains a value of 1, with a normal data distribution type.

  1. 4.

    Hydrocarbon process unit

The hydrocarbon-processing facilities on every NUI platform were installed with the latest standards, when they were constructed over 20 years ago. This factor obtains a value of 5, with a normal data distribution type.

Third party

Damage caused by a third party refers to any accidental damage to pipes or vessels in the NUI caused by personnel activity other than that of the operator. The likelihood criterion of third-party factors is the confrontation.

  1. 1.

    Confrontation

Type B platforms had no history of theft that could potentially injure personnel. For type A platforms, potentially harmful theft occurred two to five times a year. Thus, this factor obtains a score of 1 for type B platforms, and a value of 4 for type A platform, with a normal data distribution type.

Environmental effect

Using technology for evacuation has increased the attention to workers’ safety during the evacuation process. During the process of transporting security personnel to/from the NUI and also during the evacuation process, environmental factors determine the success of the process. The likelihoods for environmental factors are the weather (wind factor) and the sea level (wave factor).

  1. 1.

    Weather (wind factor)

The average wind speeds varied from 0–14 m/s (0–27 knots), so the value of this factor was from 1 to 3 with a uniform data distribution type.

  1. 2.

    Sea level (wave factor)

The average sea level around the NUI was 0–5 Beaufort (0–5 m), so its value ranged from 1 to 3 with a uniform data distribution type.

Corrosion

The corrosion factor considers the condition of each pipeline and vessel in the NUI. The likelihoods of corrosion are external inspection, external protection, and localized corrosion.

  1. 1.

    External inspection

A thorough external inspection was conducted of each pipe and vessel. Visual auxiliaries and anodes for some facilities were carried out in the range of 1–5 years. The examination results were checked and analyzed, and corrective actions were immediately undertaken to prevent further damage. This factor obtains a value of 3 with the normal data distribution type.

  1. 2.

    External protection

All installed pipes and vessels have external protection against corrosion effects in accordance with applicable standards. Inspections of their effectiveness were carried out on a regular basis each year. This factor obtains a value of 1 with the normal data distribution type.

  1. 3.

    Localized corrosion

The fluid in the pipes contains water, CO2, and H2S which has a negative effect on corrosion. This factor obtains a value of 3, with normal data distribution.

Operation

Operating factors are related to the possibility of errors that might occur in NUI operations and their potential for consequences. The likelihood of the operating factor is overpressure.

  1. 1.

    Overpressure

Excessive pressure may exist in pipe and vessel installations; however, they are protected by multiple protection systems to prevent excessive pressure (e.g., relief valves). This factor obtains a value of 3 with a triangular data distribution type (1–3).

Human factor

Human factors are related to human attitudes and their biological characteristics. The likelihoods of human factors are the worker’s age, working time, and competency.

  1. 1.

    Worker’s age

The ages of the security personnel to be deployed in the NUI were ranged from 29 to 39 years. This factor obtains a value of 2 with the normal data distribution type.

  1. 2.

    Working time

Security personnel were at the NUI for 8–12 h per day, followed by a 1-day break. This factor obtains a value of 2 with the normal data distribution type.

  1. 3.

    Competencies

The security personnel were given personal safety and emergency response training, but were not trained on the NUI construction. This factor obtains a value of 2 with the normal data distribution type.

Evacuation boats

Evacuation boats relate to the rescue of security personnel in emergency conditions. The likelihoods of evacuation boats are medical availability and response time.

  1. 1.

    Availability of medical

First aid kits and paramedics were available on the boat, so this factor obtains a value of 1 with a normal data distribution type.

  1. 2.

    Response time

The response time to pick up wounded security personnel was 30–60 min. This factor obtains a value of 2 with a triangular data distribution type (1–2).

Qualitative assessment of the consequences

The qualitative assessment of the consequences was classified into four factors including safety, environment, finance, and reputation. The assessment result of these four factors can be seen as follows and are summarized in Table 7.

Table 7 Qualitative assessment of consequences
Full size table

Safety

The safety consequences were defined as consequences that could harm the security personnel in an NUI. These consequences included death/injury and poisoning.

  1. 1.

    Death/injury

The consequences for death/injury vary from slight to brain death, so this factor obtains a score of 1 to 5.

  1. 2.

    Poisoning

The consequences for poisoning vary from slight to dangerous, so this factor obtains a score of 1 to 5.

Environment

Environmental consequences are defined as those that have an impact on the ecosystems surrounding the NUI. The environmental consequences surrounding an NUI depend on the output quantity, population density, and flammability/toxicity.

  1. 1.

    Output quantity

Pipe and vessel diameters vary from 2 inches to 102 inches, with the majority of pipes measuring 6 inches; therefore, this factor obtains a score of 1 to 5.

  1. 2.

    Population

The NUI facilities were occupied by two people every night, so this factor obtains a score of 1 to 5.

  1. 3.

    Flammability/toxicity

The NUI was designed to produce natural gas, so this factor obtains a value of 1 to 5.

Finance

The financial consequence is the impact on the economic value of an industry where an event occurs that affects the facility structure. The severity level of the financial consequences is determined by the magnitude of the losses incurred. In normal operations, the consequences for finance were negligible. Based on this consequence, this factor obtains a value of 1.

Reputation

The reputation consequence is the value of the company’s reputation to those outside the industry. This offshore oil and gas company has a very high reputation. Under normal operating conditions, small accidents will only be covered by local news. Based on the consequence, this factor obtains a value of 2.

Risk forecasting

Crystal Ball is a graphically oriented forecasting and risk analysis program that removes the uncertainty from decision making. Through a technique known as a Monte Carlo simulation, Crystal Ball forecasts the entire range of possible results for a given situation. It also shows confidence levels, so the likelihood of any specific event taking place will be known. A sensitivity analysis shows which uncertainty variables are the most critical so that they dominate uncertainties related to the model.

A pre-formulated qualitative risk model was then incorporated into the Monte Carlo uncertainty calculations. The risk values obtained from the simulation were then evaluated using the risk matrix shown in Table 8.

Table 8 Risk matrix
Full size table

Based on the risk matrix, green areas show low or acceptable risk values, while red areas indicate high or unacceptable risks. The yellow areas indicate the risk values included in the ALARP (As Low As Reasonably Practical) risk zone. A Monte Carlo simulation using the Crystal Ball software was then applied to obtain the risk values for various factors and the total risk value for each platform. The risk value percentage for each likelihood factor for type A and type B platforms, produced by Crystal Ball, is listed in Table 9.

Table 9 Percentage of likelihood factor
Full size table

Safety risk of the facility factor for a type A platform

The safety risk of the facility factor for a type A platform shows a distribution of values from 8.40 to 11.10. The risk value obtained is 10.30, indicating that the safety risk on a type A platform is at a “medium risk” level. The most sensitive risk factor for the safety consequence is the hydrocarbon-processing unit, with a percentage of 49.7%. The safety risk result of the facility factor for a type A platform is shown in Fig. 1.

Fig. 1
figure 1

Safety risk of the facility factor for a type A platform

Full size image

Safety risk of the environmental effect for a type A platform

The safety risk of the environmental effect for a type A platform is shown in Fig. 2. The sea level and weather risk factor provide a relatively equal safety risk. The distribution value is between 3.00 and 6.00. By plotting on the risk matrix, the risk value is 5.18, which indicate a “low-risk” level.

Fig. 2
figure 2

Safety risk of the environmental effect for a type A platform

Full size image

Safety risk of the corrosion factor for a type A platform

The safety risk of the corrosion factor for a type A platform ranges between 6.00 and 8.10, as shown in Fig. 3. The risk value was 7.45, indicating that the safety risk on a type A platform was at a “low-risk” level. The external inspection and localized corrosion risk factors provide a relatively equal safety risk.

Fig. 3
figure 3

Safety risk of the corrosion factor for a type A platform

Full size image

Safety risk of human factor for type A platform

Figure 4 shows the safety risk of human factors for a type A platform. The distribution of values is between 5.00 and 7.00. The sensitivity chart shows that the risk factors of working time, competencies, and worker age provide a relatively equal safety risk. The risk value is 6.36, indicating that the safety risk on a type A platform is at a “low-risk” level.

Fig. 4
figure 4

Safety risk of human factors for a type A platform

Full size image

Safety risk of a lifeboat evacuation for a type A platform

Figure 5 shows that the distribution value of the safety risk through an evacuation boat for a type A platform is between 3.00 and 5.10, and the most sensitive risk factor for safety consequences is the response time, with a percentage of 85.5% From these results, the risk value was 4.40, indicating a “low-risk” level.

Fig. 5
figure 5

Safety risk of lifeboat evacuation for a type A platform

Full size image

Total risk value for a type A platform

The total risk for the type A platform is a “low-risk” level, since the total risk is 5.42. The most critical risk factor is overpressure, while another is the confrontation factor. The total risk value has a distribution between 4.60 and 5.80, as shown in Fig. 6.

Fig. 6
figure 6

Total risk values for a type A platform

Full size image

Total risk value for a type B platform

The total risk of a type B platform has the same level as a type A platform, which is a “low-risk” level. The value is 4.42. The most critical risk factor of type a B platform was overpressure. Other factors have a small percentage. The total risk value for type B platforms, based on the calculation using the simulation program, has a distribution between 4.42 and 4.70; it is shown in Fig. 7.

Fig. 7
figure 7

Total risk values for a type B platform

Full size image

Mapping the results into risk categories

The risk conditions in each platform can be categorized based on the range of risk criteria described in Table 10.

Table 10 Mapping of risk value
Full size table

From this table, it can be seen that the total risk values of type A and type B platforms are at the “low-risk” level (4.59), which are acceptable. The conditions should be maintained, so that the risk values remain at a low-risk level. Furthermore, from the simulation results, the risk values for the type A and type B platforms are not too much different. Overall, the values for each factor on both types of platforms are similar in terms of operations, facilities, and the surrounding environment. The confrontation factor has a different value for each platform. Based on these results, the factors that affect the sensitivity analysis are overpressure and confrontation. Both of these factors have a large percentage compared to the other factors.

The risk calculation for the overpressure factor has a triangular distribution type, with a lower boundary 1 and upper limit 3. A triangular distribution type implies that the overpressure risk factor has a three-time greater probability than the other factors with a normal distribution. Thus, its contribution to the risk value will be greater and it will have a higher sensitivity to raise the risk value.

Meanwhile, in the two above-mentioned results tables, several factors have the same likelihood criterion values between type A and type B, but the order of the two results is different. The sensitivity values in the calculated total risk value of the type A platform—the hydrocarbon process unit, sea level, and weather—have the same relative percentage, 3.7, 3.6, and 3.2%, while these sensitivity values for a type B platform are 5.4, 5.0, and 4.8%.

From the above two results, a large percentage change in the sensitivity of the type A and type B platforms for the same factor is due to a change in the value of confrontation factor. When the value of one factor changes, the percentage sensitivity of the other factors will change and adjust so that the total percentage remains 100%. Furthermore, for type A and type B platforms, the percentage sequence for all three factors—the hydrocarbon process unit, sea level, and weather—is also different, since the risk calculation uses the Monte Carlo uncertainty approach. In the above calculations, the Monte Carlo uncertainty calculations will perform a series of 100,000 randomly calculated experiments; thus, for factors with the same criterion value, the sensitivity percentage can change every time it runs, but the percentage range of the sensitivity will be relatively the same.

Development of mitigation planning

Based on the results, it was found that the total risk value for the type A and type B platforms was at a low-risk level; therefore, mitigation plans were no longer required. In order to maintain the risk value in the “low-risk” category, it will be necessary to consistently supervise the facilities and risk factors.

Conclusion

A risk assessment of an NUI facility with type A and type B platforms was conducted using the SQRA method. Simulation using the Monte Carlo uncertainty approach provided a risk value of 5.42 for the type A platform and 4.42 for the type B platform. These values indicate that the operation of the NUI facility is in the low-risk category and the risk value is acceptable. The risk factors that have the highest percentage and contribute most to the risk value are overpressure and confrontation. Both of these factors have a high sensitivity due to the magnitude of their criterion. A triangular distribution type was included in the calculation.