ABS TECHNICAL PAPERS Jorge Ballesio, American Bureau of Shipping (ABS), Houston, USA

Transcription

1 Evaluation of Classification Rules Related to Machinery for an Oil Tanker Robert Cross, ABSG Consulting, Houston, USA Jorge Ballesio, American Bureau of Shipping (ABS), Houston, USA Published in the proceedings of Probabilistic Safety Assessment and Management, Volume 6, Page 3473, published by Springer-Verlag, edited by C. Spitzer, U. Schmocker and V. N. Dang, ISBN X. Copyright Springer-Verlag London Limited Presented at Probabilistic Safety Assessment and Management 2004, PSAM 7 - ESREL'04, Berlin, June 14-18, 2004 Reprinted with the kind permission of Springer-Verlag London Limited Introduction Classification Societies for the maritime industry are responsible for the development and implementation of rules, guidance, and standards which provide for the structural strength of marine vessels or offshore structures, and the safety and reliability of critical systems to promote the security of life, property and the natural environment. One of the fundamental aspects of classification is the process by which these rules, guidance and standards are established. The objective of these classification rules has always been to ensure that the probabilities of accidents with the potential for adversely affecting life, property, and the natural environment are low. However this assurance was not explicit, as rules and regulations were developed without the benefit of quantitative estimates of risk. The recent introduction of a structured risk analysis into the classification business is formalizing this process and bringing considerable benefits to all involved parties. 2 The Tanker Model A Quantitative Risk Assessment (QRA) model was developed for an oil tanker in part to perform an evaluation of classification rules [1, 2]. The tanker model used in the evaluations discussed is constructed as a typical large integrated QRA model. It consists of initiating events that may lead to consequences of interest by themselves or with subsequent failures. All important systems are modeled either to determine an initiating event frequency or as part of mitigation of an event. Fault trees are used for the system analysis. The basic mission assumed by the model are the transit conditions after loading the tanker at Valdez, Alaska, to offloading in Washington and Long Beach, and the return voyage. The scenarios are quantified using event trees to combine the initiating event frequencies and subsequent potential system failures or other factors (e.g. human error, external events such as tug rescue, etc.). The consequences of interest to the study are broken into three categories. The first category of consequences considered are the intermediate consequences. These are: Concurrent Propulsion and Steering Propulsion Steering Fire Initiation Explosion These consequences are events, among others, that the classification rules seek to prevent. They do not by themselves necessarily lead to fatalities or environmental damage, however they are precursors to those types of events. For this evaluation, the annual frequency of the event occurring is used. The second category of consequences evaluated are the ultimate consequences. These are: Drift Grounding Powered Grounding Fire Propagation Evaluation of Classification Rules Related to Machinery for an Oil Tanker 41

2 These consequences may result from the intermediate consequences and directly lead to fatalities or environmental damage. For this evaluation, the annual frequency of the event occurring is used. The last category of consequences is the expected risk in terms of number of fatalities per year and barrels of oil spilled per year. These consequences consider not just the frequency of the ultimate consequence, but the estimated amount of fatalities or barrels of oil spilled which is dependent on the scenario. 3 Component Risk Screening The first evaluation performed [3] was a risk screening to determine which components are the most important risk contributors, and to determine the corresponding classification rules which can impact their effectiveness in preventing unwanted consequences. As has been done in other industries (e.g. the nuclear power industry), risk importance factors were used to discriminate the components into different risk bins. Two importance factors were chosen: the Fussell- Vesely (F-V) importance, and the Risk Achievement Worth (RAW). The F-V importance factor was chosen to identify components with a relatively low reliability whose failure could result in an undesired consequence. This evaluation includes the consideration of common cause for those components with like redundancy. The RAW was chosen to identify components that have an inherently high reliability, but their failure alone or coupled with the failure of other relatively unreliable components may result in a consequence of interest. After looking at the results of the model for both factors, subjective judgment was used to classify or bin components into groups. These are shown in Tables 1 and 2 below. F-V Importance Description Category < Not Applicable to Consequence or 1 Negligible Contributor Small Contributor 2 > Moderate Contributor 3 > 0.1 Significant Contributor 4 Table 1. Fussell-Vesely Importance Criteria for Component Screening RAW Description Category < 1.1 Not Applicable to Consequence or 1 Negligible Contributor Small Contributor 2 > Moderate Contributor 3 > 10 Significant Contributor 4 Table 2. Risk Achievement Worth Importance Criteria for Component Screening For the purposes of this paper, it was decided to focus on results that were important from a risk perspective, and could also be taken to the next level in terms of analysis. The components chosen are those that have classification rule requirements that may be evaluated in more detail quantitatively by the QRA model [4]. Table 3 shows the scope of rules for which results are reported in this paper. Most of the components listed in Table 3 were shown to have a significant impact on risk using both the F-V importance and RAW for propulsion and steering related consequences. Rule [5] Redundancy Requirement / 5.3.1(a) Main engine lube oil pumps / Main engine fuel oil pumps / 3.3.1(a) / 7.7.1(a) Main engine cooling (jacketwater) pumps / 5.1 Steering gear hydraulic units / / / 7.7.1(a) Sea water cooling pumps / 7.7.1(a) Fresh water cooling pumps / Firewater pumps Table 3. Rules and Redundancies Evaluated 42 Evaluation of Classification Rules Related to Machinery for an Oil Tanker

3 4 Explicit Evaluation of Redundancy Requirements The next step in the process was to perform an explicit evaluation of the worth of the specific rules from Table 3. The rules from Table 3 are all associated with redundancy requirements. A typical redundancy design for a fluid system has two pumps, with either one able to perform the necessary function. For normally operating systems, one component (e.g. pump) is in standby while the other is operational. Upon loss of the operating component, a sensor will automatically start the standby component. In order to perform the evaluation, the model was modified for each case by removing the standby capability. Each case was analyzed separately, and a final case was performed assuming all of the redundancy was removed. 5 Individual Rule Evaluation Results Table 4 shows the baseline results from the tanker model with the classification rules in place for redundancy along with the percent change from the baseline if the redundancy (i.e. rule requirement) is not incorporated into the design. Consequence Baseline Frequency (per year) Percent Increase in Consequence from Baseline Without Rule Required Redundancy Main Engine Lube Oil Main Engine Fuel Oil Main Engine Jacketwater Steering Gear Hydraulic Units Intermediate Consequences Seawater Freshwater Firewater Concurrent Propulsion 5.59E and Steering Propulsion 5.13E Steering 3.36E Fire Initiation 1.25E Explosion 9.37E Ultimate Consequences Drift Grounding 4.45E Powered Grounding 6.55E Fire Propagation 5.37E Expected Risk Barrels of Oil Spilled Fatalities 3.3E Table 4. Baseline Consequence Frequencies and Percent Increases Without Rule Redundancy The results show that the required redundancy can dramatically affect the occurrence of both intermediate and ultimate consequence frequencies. The largest impact occurs on the intermediate consequences, because that is what the classification rule requirements affect directly. The ultimate consequences are somewhat less affected because external factors (e.g. rescue tug availability, weather conditions) come into play. The expected risk increases the least because of the role of external factors, and also because the ultimate consequence scenarios that the redundancies evaluated are intending to prevent (for environmental damage) are not the major contributors to the expected risk. 6 Combined Rule Evaluation Results An analysis to determine the combined effect of all of the previously evaluated rules was then performed. The results are shown graphically in Figures 1 and 2. One of the benefits of performing the evaluation quantitatively is that system interactions are accounted for. What this means is, the combined evaluation of risk for the various rules may be different than the sum of the individual evaluations of risk. In particular, Figure 1 shows the change in baseline results for a concurrent loss of propulsion and steering to be close to 1600 percent, i.e. an increase by a factor of almost 17, while the results from Table 4 show that a sum of the individual results is closer to 1350 percent, i.e. an increase by a factor of around Evaluation of Classification Rules Related to Machinery for an Oil Tanker 43

4 Increase From Baseline (%) Concurrent Loss of Propulsion and Steering Propulsion Steering Fire Explosion Intermediate Consequence Figure 1. Combined Effect of Rule Required Redundancy on Intermediate Consequences Increase From Baseline (%) Drift Grounding Powered Grounding Fire Propagation Ultimate Consequence Figure 2. Combined Effect of Rule Required Redundancy on Ultimate Consequences 44 Evaluation of Classification Rules Related to Machinery for an Oil Tanker

5 7 Conclusions The use of a quantitative risk model to evaluate classification rule requirements has proved to be useful for both screening of components/rules from a risk perspective and performing detailed evaluations on specific rules. Some general conclusions from the analyses performed for this paper are: 1. The overall impact to the intermediate consequences from the redundancy rules is very significant ranging from an increase in loss of propulsion of approximately 1600 percent (factor of 17) to an increase in loss of steering of approximately 200 percent (factor of 3). While these types of failures do not necessarily translate to barrels of oil spilled or fatalities, they can certainly impact operations and downtime. 2. Not requiring redundancy in almost any of the evaluated systems (except firewater) would result in that system becoming the dominant risk for intermediate consequences. In most cases, removal of the redundancy resulted in that system contributing to approximately 50 percent of the intermediate consequence frequency. 3. The overall impact of the seven redundancy rules evaluated translates to an estimated reduction of 8 barrels of oil spilled per tanker year or 6 percent of total estimated risk. The impact of each rule individually generally is between 0.6 and 1.5 percent with the firewater system being the exception. The firewater system is designed to respond to fires, and not support propulsion or steering as the other systems are. 4. The single rule for redundant firewater pumps that impacts fatalities (as estimated by the model) reduces fatality risk by 0.8 percent when measured in fatalities per tanker year. Fire propagation frequency is reduced 8.6 percent with the redundant pump required by the rule. 5. Based on the results of this evaluation, there are implications for maintenance planning. A reduction in redundancy while in restricted waters or severe weather would increase risk significantly. References 1. Oil Tanker Quantitative Risk Assessment Final Report, Rev. 1 Technical Report, Project No , ABS Consulting, November An Integrated Quantitative Risk Assessment of an Oil Carrier, R. B. Cross, J. E. Ballesio, Proc. European Safety and Reliability Conference, ESREL 2003, Maastricht, June A Risk Evaluation of Selected Machinery Components with Their Relationship to ABS Steel Vessel Rules, Technical Report, Project No , ABS Consulting, July An Evaluation of Oil Tanker Rule Required Redundancy, Technical Report, Project No , ABS Consulting, November Rules for Building and Classing Steel Vessels 2001, Part 4 Vessel Systems and Machinery, American Bureau of Shipping, 2001 Evaluation of Classification Rules Related to Machinery for an Oil Tanker 45

6