On the use of historical failures patterns to confront the unforeseen

Faculty of Science and Technology

MASTER’S THESIS

Study program/ Specialization:

Offshore Technology/

Industrial Asset Management

Spring semester, 2015

Open / Restricted access

Writer:

Andika Rachman ………

(Writer’s signature)

Faculty supervisor: R.M. Chandima Ratnayake

External supervisor(s): Arnaud Barre

Thesis title:

On the Use of Historical Failures Patterns to Confront the Unforeseen

Credits (ECTS): 30

Key words:

unforeseen failure black swan

accident

Pages: 84 + enclosure: 16

Stavanger, 15

June 2015













Unforeseen Events

Unknown unknowns

Unknown knowns

Events that are believed to have negligilble probability

Probability-based

thinking Knowledge

dimension Black swans

+ +

Preoccupation with failure

Reluctance to simplify

Sensitivity operationsto Commitment

to resilience Deference to

expertise







Unexpected Event (Unsafe Act)

Normally Functioning

System

Unwanted Consequences

Direction of Causality

Direction of Reasoning

Effect Cause

If we can see what the effect is...

Then we can find what the

cause is

















Pipeline washing Water entered MIC tank through leaky

valve

Contamination of MIC with water caused runaway

reaction

High temperature caused the bursting

of the tank casing





















Boundary to unacceptable

workload

Boundary to economic failure

Resulting perceived boundary of acceptable performance, i.e.

safety boundary defined by work practices

Boundary of functionally acceptable performance, i.e. the

real safety boundary

Sy stem

Management effort toward efficiency

Gradient toward

less effort

Accident Counter forces represented by safety

management system

Space of possibilities; day-to-day

operation; degrees of freedom to be resolves according subjective

preferences

Movement towards degrading safety defenses













Controller

Controlled Process

Actuator Sensor

Safety Management Process (Internal Variability)

Leading Indicators Environment (External Variability)

Safety Performance Desired Safety

Level Control

Signal

Feedback































Pressure Transmitter (PT)

• Send signal to HCM to indicate the flowlines pressure

HIPPS Control Module (HCM)

• Process the information from PT and send decisions signal to SDV

Shutdown Valve (SDV)

• Close or open the

flow based on

signal from HCM





HIPPS

Offshore Installation Manager

Operation Team Leader Regulations

Standards Certif ications

Accident Reports Saf ety Rev iews Whistleblowers

Saf ety Policy Standards Resources

Operation Reports Audit and Change Reports

Work Instructions Operating Manuals

Saf ety Policy Standards Resources

Operation Reports Problem Reports Change Requests

Problem Reports Operation Reports Change Requests

Operators

Alarms Pressure Trends Valv e Status Testing

Monitoring Correctiv e Actions Prev entiv e Actions

MCS

HCM Operator

SDV (Close/Open)

Alarm SDV Status

Signal to conduct PST PST

command

SDV Status Test result

interpretation

Deactivate solenoid valve

SDV Status Reactivate

solenoid valve











Process ModelOperator

· Standard procedure

· Training

· Safety policy

· Testing acceptance criteria

Alarm SDV Status

Signal to conduct PST Test command

SDV

SDV Status Test result

interpretation

Deactivate

solenoid valve SDV Status

Test command

· Send signal to conduct PST SDV Status Indicator

· Open

· Close

HCM Test command

· Deactivate solenoid valve

· Reactivate solenoid valve before the SDV reaches fully closed condition

Reactivate

solenoid valve

MCS

HCM Operator

The testing result is judged as acceptable when it is actually not

MCS provides false indication of SDV status

SCM provides false indication of SDV status

SDV Operator misinteprets output signal from MCS

No alarm is provided when SDV fails to close

MCS

HCM Operator

SDV is fully closed during partial stroke testing

MCS executes different command from the one that operator has given Operator sends wrong command to MCS

SDV

Failure of the solenoid valves

Failure of electrical line Failure of electrical line



















































































