Proceedings of OMAE02

21st International Conference on Offshore Mechanics and Arctic

Engineering
June 2328, 2002, Oslo, Norway
OMAE2002-28103
COLLISION RISK ANALYSIS OF FPSO-TANKER OFFLOADING OPERATION


Haibo Chen
Department of Marine Structures
Norwegian University of Science and Technology
Trondheim, Norway
Torgeir Moan
Department of Marine Structures
Norwegian University of Science and Technology
Trondheim, Norway


ABSTRACT
Collision between FPSO and shuttle tanker in tandem
offloading operation has caused a growing concern in the North
Sea. Several recent contact incidents between FPSO/FSU and
shuttle tanker have clearly demonstrated a high likelihood of
contact between vessels in tandem offloading. The large masses
involved, i.e. high potential impact energy, make the collision
risk large. Traditional ship/platform collision risk model may
not be effective for tandem offloading operation. Further more
in a broader sense, offshore quantitative risk analyses generally
focus more on technical aspects, little on human aspects. This
leads to a hardware-centered risk control approach, which may
not be effective in the face of risks in complex marine
operations.
A collision risk modeling approach for FPSO and tanker
offloading operation is presented in this paper. The collision
frequency is modeled in the initiating stage and the recovery
stage. In the initiating stage, this paper is focused on tanker
powered forward movement (PFM) scenarios. The initiation of
tanker PFM involves a complex man machine interaction. The
risk model is set up which integrates technical events, human
actions and their interaction in the initiating stage. This model
guides us further to identify the two failure prone situations
where man machine interaction happened and resulted in most
collision incidents. The study to quantitatively analyze these
failure prone situations and minimize their occurrence is
presented in a companion paper OMAE 28101. In the recovery
stage, this paper is focused on the tanker initiated recovery.
Based on the proposed probabilistic model for the recovery
stage, possible recovery actions are identified and the event
development is modeled from initiation of tanker PFM to the
final outcome, i.e. collision or near miss. The success of
recovery is analyzed from the human action timing perspective.
Based on qualitative and preliminary quantitative analyses,
recommendations are made to reduce the failure of recovery in
design and operation.
ABBREVIATIONS
CPP Controllable Pitch Propeller
DARPS Diffstar Absolute and Relative Positioning System
DFM Drift Forward Movement (tanker)
DP Dynamic Positioning (system)
ESD Emergency Shut Down
FPSO Floating Production, Storage and Offloading (unit)
FSU Floating Storage Unit
HSE Health & Safety Executive
NPP Nuclear Power Plant
OIM Offshore Installation Manager
QRA Quantitative Risk Assessment
PFM Powered Forward Movement (tanker)
PRS Position Reference System
UFM Uncontrolled Forward Movement (tanker)
1 INTRODUCTION
Background
FPSO (Floating Production, Storage and Offloading)
vessels are by far the most popular platform for floating
production systems in offshore oil and gas fields worldwide.
Further, almost 60% of the floating production systems now on
order have ship-shape hulls (McCaul, 2001). Subsequently, it is
a growing importance of shuttle tankers, since they are often
used to offload hydrocarbons directly from FPSOs. The
offloading operation is generally carried out by tandem
offloading concept in harsh environments. Alongside
offloading is another possible, but less-adopted concept. The
tandem configuration is dominant in the North Sea, and is
discussed in this paper.
The tandem offloading (see Figure 1) means that shuttle
tanker is positioned at some distance, e.g. 80 m, behind the
1 Copyright 2002 by ASME
Proceedings of OMAE02
21
st
International Conference on Offshore Mechanics
and Artic Engineering
June 23-28, 2002,Oslo, Norway

OMAE2002-28103
SR TOC
FPSO. The two vessels are physically connected by mooring
hawser and loading hose through which cargo is off-loaded.
Tanker may position itself by its own dynamic positioning
system so that hawser is not tensioned (DP mode), or by
applying certain astern thrust and maintain small tension on
hawser (Taut hawser mode). Tug or standby vessel assistance
may be required for taut hawser mode. The DP tankers have
greater uptime in harsh environments, and are therefore widely
applied in the North Sea. This is the case that described in this
paper.
FPSO
Hawser
Wind, Wave, Current
Hose
Tanker
80 m
Turret

Figure 1 FPSO-Shuttle tanker tandem offloading operation
The tandem offloading by a DP shuttle tanker is a complex
marine operation (SMS, 2000). It can be summarized into the
following 4 operational phases:
1. Approach: tanker approaches the FPSO stern
2. Connection: hawser and then loading hose are connected
3. Loading: cargo off-load from FPSO to tanker
4. Disconnection: disconnect loading hose and the hawser,
departure
The offloading operation may range from once every 3 to 5
days, depending on the production rate, storage capacity of
FPSO, and shuttle tanker size. The duration of operation is in
the order of 20 hours based on FPSO storage and oil transfer
rate. Meanwhile, suitable environmental condition is required.
The FPSO is continuously weathervaning around its turret
located either internally (as in Figure 1) or externally. It also
has significant low frequency motions in horizontal plane
(surge, sway and yaw) due to waves and wind if in harsh
environments. In order to stay connected and maintain the
separation distance, the shuttle tanker must position itself
according to the FPSO position.
Offshore loading by shuttle tanker has been carried out in
the North Sea for more than two decades (HSE, 1997).
Traditionally, this involves shuttle tanker with an articulated
loading platform or a spread moored loading buoy. This
situation has been changed dramatically in tandem loading
operation in which the installation (FPSO) and the shuttle
tanker with similar significant amount of mass are connected in
close proximity. However, offloading technical hardware,
software, operational procedures, and so on, which are largely
evolved from experience and lessons learned before, remain
same for this new context. Therefore, safety of offloading
operation involving FPSO and shuttle tanker deserves concern.
Collision risk experiences
There are at least five collision incidents involving
FPSO/FSU and shuttle tanker occurred in the North Sea in
recent years, based on the information from Vinnem (1999) and
Leonhardsen et al (2001).
- Emerald FSU: Impact by tanker Clipper, UK, 28.02.96.
- Gryphon FPSO: Impact by tanker Futura, 26.07.97.
- Captain FPSO: Impact by tanker Aberdeen, 12.08.97.
- Schiehallion FPSO: Impact by tanker Nordic Savonita,
25.09.98.
- Norne FPSO: Impact by tanker Knock Sallie, 05.03.00.
The collision frequency is relatively large based on the
incident record. The total number of tandem offloading
operations by DP shuttle tanker in the North Sea is estimated
around two thousand from year 1996 to 2000. This then
indicates one collision every four hundred offloading
operations. For a DP shuttle tanker undertaking 50 tandem
loading operations per year, this equals to one collision every
eight years.
The collision damage potential is large, due to the large
masses and subsequently the large impact energy involved in
possible tanker-FPSO collisions. The impact energy involved
in one of above collisions had reached 31 MJ. This is estimated
for a 154,000 dwt shuttle tanker at 0.6 m/s impact velocity from
the information in the investigation report (Statoil, 2000). Stern
damage on the FPSO may cause penetration and flooding in the
machine room. Moreover, with the widely adopted FPSO
design, e.g. Gryphon, Captain, Norne, sgard and etc. (Addy et
al, 1995 and Odland, 1995), the living quarters are located in
the bow area, thus the flare towers, which have to be located in
the stern area, are vulnerable to tanker impact. The worst
scenario could therefore be a major tanker collision that topples
down FPSOs flare tower on stern. This can initiate a chain of
events with severe fire and explosion on both vessels. From
one of the occurred collision incidents, damage of members
and bracings of the flare structure did happen (Leonhardsen et
al, 2001).
Ship/platform collision risk modeling approach
The risk modeling in this paper refers to the frequency
modeling. The collision consequence modeling is generally
based on energy method and non-linear structural mechanics.
This is not addressed in this paper. Details on this matter may
be found in Skallerud and Amdahl (2002).
The traditional ship/platform collision risk modeling may
not be suitable for FPSO and DP shuttle tanker offloading
context in this paper. Quantitative frequency modeling of
ship/platform collision is not a new issue. Furnes and Amdal
(1980) presented their quantitative frequency model based on
geometric consideration and fault tree technique in early 1980s.
Haugen and Moan (1992) developed a collision frequency
model based on consideration of traffic frequency, navigation
course and recovery actions initiated from ship and platform in
early 1990s. However these models were primarily developed
for collisions between passing vessels and a fixed platform.
There are some offshore risk studies of tanker FPSO
collision, e.g. by MacDonald et al (1999) in the recent Joint
Industry Project on Risk and Reliability of a FPSO in
2 Copyright 2002 by ASME
Deepwater Gulf of Mexico. However in general those studies
are limited in number, and their applicability to the North Sea
and level of detail of risk modeling are questioned.
In a broader perspective, offshore quantitative risk studies
have traditionally focused more on technical aspects than on
human and organizational aspects (Vinnem, 2000). However,
human and organizational errors are increasingly recognized as
the dominating cause of accidents connected to offshore
structural failure (Bea, 1997 and Kvitrud et al, 2001). In a
study of marine risks associated with the operation of shuttle
tankers at offshore export facilities and in the vicinity of
offshore installations, the HSE UK also identified that the
majority of incidents involving contact between shuttle tankers
and installations during 1997 and 1998 are DP problems and
human factors (HSE, 1998). Subsequently, in order to
effectively prevent collision incidents in tandem offloading,
human (and organizational) aspects must be explicitly modeled
in the risk analysis.
In the following, Section 2 presents a two-stage collision
risk model. Attempts have been made to explicitly address the
human contribution. Section 3 and Section 4 address model
details for initiating and recovery stages, respectively. Based on
detailed analyses in Section 4, recommendations to improve
tandem offloading safety are proposed in Section 5.
2 OFFLOADING COLLISION RISK MODEL
For a collision incident between tanker and FPSO in
tandem offloading to happen, irrespective to which operational
phases, there are two necessary conditions:
- Tanker has uncontrolled forward movement (UFM)
- Recovery actions (initiated from tanker and FPSO) fail to
avoid the collision
The tanker uncontrolled forward movement (UFM) may be
initiated in powered condition, termed as powered forward
movement (PFM) scenario. The PFM may be initiated by
various failures including operator maneuvering error. The
tanker UFM may also be initiated in drift condition when
tanker loses all its power, and the resultant environmental
forces push tanker towards FPSO. This is termed as DFM
scenario. The recovery actions are mainly performed on tanker
side. In some cases FPSO side may also take action, e.g. using
main screw to create current to blow tanker away in taut hawser
mode operation or in principle change heading.
In the light of above two necessary conditions, collision
frequency modeling in tandem offloading could be structured
into the following two stages:
1. Predict and evaluate the situations where something could
possibly go wrong to cause tanker UFM. This is termed as
the initiating stage.
2. Assess the ability of the tanker (and FPSO) to avoid
collision after uncontrolled forward movement happens.
This is termed as the recovery stage.
Subsequently, the collision frequency model in tandem
offloading can then be expressed at the top level as in Eq. 1.
( )
i i
i
P Collision = P(UFM ) P(Failure of Recovery | UFM )

Where: (1)
i
P(UFM ) - Probability of tanker uncontrolled forward
movement type i
i
P(Failure of Recovery | UFM ) - Probability of recovery failure
initiated from tanker and FPSO, conditioned on tanker UFM
type i
Detailed probabilistic models are presented in Section 3 for
in the initiating stage, and in Section 4 for
in recovery stage.
i
P(UFM )
P(Failure
i
of Recovery | UFM )
3 RISK MODELING OF THE INITIATING STAGE
As described above, the scenarios that are possible to cause
tanker UFM in the initiating stage can basically be categorized
as drive-off ahead and drift-off ahead.
P(UFM) = P(PFM) + P(DFM) (2)
P(PFM) - Probability of tanker powered forward movement
P(DFM) - Probability of tanker drift forward movement
The drift forward movement (DFM) scenario is considered
as a low probability and low consequence event, and is
therefore excluded from the further modeling. The reasons are:
Firstly, the tanker totally blackout during offloading is not a
frequent event. Secondly, given that event, an immediate ESD
II is reasonably expected which will physically disconnect two
vessels. The resultant environmental forces, due to
weathervane, will typically drift tanker away from instead of
towards the FPSO. Certainly there may be cases that tanker is
heavily loaded, and wind wave are small, tanker is under
dominant influence from current, and current may drift tanker
ahead. However in such cases, tanker typically wont gain
much speed within 80-100 m distance to FPSO stern.
The risk model of PFM scenario is presented in Eq.3
below.
( ) ( ) ( )
( ) ( ) ( )
( ) ( ) ( )
1 2
1 i i
i
2 k j k
j k
P PFM = P PFM P PFM
where: (3)
P PFM = P PFM | AI P AI
P PFM = P PFM | AR , TF P AR | TF P(TF )
+

j j
j

j
P(TF )
Probability of technical failure j
k j
P(AR | TF ) Probability of human response action k
conditioned on technical failure j
k
P(PFM | AR , TF ) Probability of powered forward
movement conditioned on human
response action k and technical failure j
i
P(AI )
Probability of human initiating action i
3 Copyright 2002 by ASME
i
P(PFM | AI ) Probability of powered forward
movement conditioned on human
initiating action i
The construction of this model is based on the following
reasoning. The initiation of tanker powered forward movement
involves a complex man machine interaction. This is observed
by the incident analysis. Subsequently, the probabilistic model
should not address technical initiating events only, as did in
many offshore risk studies. Modeling of human actions and
their interaction with technical events is then described. This
leads to the resulting probabilistic model for PFM in initiating
stage as presented in Eq.3. The implications of this risk model
to the safety of tandem offloading are addressed. The
identification and quantification of human actions are the
present research challenge. In this study, a promising approach
is outlined.
Analyses of incidents
The initiation of tanker powered forward movement
involves a complex human machine interaction. This is the
main observation from the analysis of 7 tanker PFM incidents
in tandem offloading. Through this analysis, our main findings
are various technical failures, operator actions, and their
context in the initiation of tanker PFM. These provide a basis
for the modeling approach.
A brief description of incident data: The incidents data are
mainly from the investigation reports made by field operators,
and are anonymized here due to confidentiality. The 7 incidents
all happened between 1997 and 2001 in the North Sea. It is
believed that earlier ones would not reflect the present tandem
offloading technical and operational configurations. Among
them, 4 incidents resulted in collisions with the installation
(FPSO), the remaining 3 ones were near misses.
The results from incident analyses are presented in Table 1.
The meaning of the terms used in this table is clarified below.
The initiating stage of these PFM incidents is structured as
Initiating Process and Context at the top level. The initiating
process is structured into Root Cause, Triggering Cause I, and
Triggering Cause II based on the event development. The Root
Cause refers to the traceable origin of chain of events that
initiated PFM. The Trigger Cause I and II refer to the
sequential contributing causes in the event chain. The causes
are evaluated with a scope covers various technical failures and
operator actions. Note operator actions that contributing to
the initiation of PFM are not necessarily the operator errors.
The Context is to address the circumstance during which the
technical failure and/or operator action were initiated. It
consists of Weather and Relative Motion. The Weather refers to
the environmental conditions, and only incidents during which
the field operational weather criteria were exceeded will
appear. The Relative Motion refers to surging, fishtailing and
heading deviation between FPSO and tanker. These are termed
as dynamic interaction in (HSE, 1997). Detailed analyses of
these motion phenomena are presented in a companion paper
OMAE 28101 (Chen et al, 2002). The analyses of the recovery
stage of these incidents are also performed. We will discuss this
issue in Section 4.4
Initiating Process Context
Collision
Incident
Root
Cause
Triggering
Cause I
Triggering
Cause II
Weather
Relative
Motion
a
Operator
Action
DP PRS /
Heading
deviation
b PRS
Operator
Action
DP / /
c
Operator
Action
DP
Thruster
capacity
Above
criteria
Surging,
fishtailing
Heading
deviation
e DP
Operator
Action
/ /
Heading
deviation
Near
Misses
Root
Cause
Triggering
Cause I
Triggering
Cause II
Weather
Relative
Motion
d CPP
Operator
Action
DP / /
f* DP / / / /
g PRS
Operator
Action
DP / /
*Note: very little info in incident f, so only DP is identified.
Table 1 Summary of incidents in initiating stage
From identified technical failures, operator actions, and
their context in the initiation of 7 tanker PFM incidents (a-g),
we find:
- The technical failures are propulsion system, i.e.
controllable pitch propeller (CPP) and thrusters, position
reference system (PRS), and DP system. They are
observed mainly as the root causes. This is in line with
other risk studies (HSE, 1997 and IMCA, 1999). However,
knowing the above does not help much. At best, this
information only pinpoints the vulnerable technical areas
in tandem loading.
- The operator action is observed as the root cause in two
cases, the remaining four are observed as the triggering
cause I. Clearly, interaction processes had been involved
between human actions and technical failures.
- Regarding the context, the severe weather condition
contributed to only one incident. However, the relative
motion is observed in three incidents. Further, these
comprise three of the four collision incidents. This implies
a potential correlation between relative motion and
collision.
Modeling of human actions
The human actions and their interaction with technical
failure events can be categorized into the following three
categories for the present study, based on the observations from
incident analyses.
- Initiating action An action itself initiates an event.
- Response action An action responds to meet system
demands, it may save or worsen the event or cause a
transition to another event.
- Latent action An action influences the status (failure
probability) of system components, e.g. maintenance
action.
4 Copyright 2002 by ASME
Two examples excerpted from the seven PFM incidents are
briefly outlined here. They mainly serve to illustrate the above
three types of human actions and their interaction with
technical failures.
- Incident a: Heading deviation between tanker and FPSO.
Operator took manual control to align two vessels
(Response Action). In the process, inappropriate use of DP
for vessel sideway movement caused PFM (Initiating
Action).
- Incident b: DARPS got repeated failure. DP operator had
to react to this by re-selecting DARPS into DP (Response
Action). The DARPS failure was probably rooted from bad
maintenance (Latent Action). The re-selected DARPS
signal was probably erroneous, and due to operator re-
selection, DP accepted the wrong distance info (not
rejected the signal as it had done), and then DP initiated
PFM.
The 1
st
type of human action, i.e. initiating action, can
directly initiate tanker PFM scenario. It is modeled
by P P in Eq.3. (
1
FM )
)
The 2
nd
type of human action, i.e. response action, may
interact with technical failures to initiate tanker PFM scenario.
It is be modeled by in Eq.3. (
2
P PFM
In principle, the technical failure may be influenced by
human action, e.g. during maintenance. So the 3
rd
type of
human action, i.e. latent action, can be modeled for P(TF
i
) as:
( ) ( ) ( )
j j i i
i
i
P TF = P TF | AL P AL
P(AL ) - probability of latent human action i

(4)
However, the technical failures may have their roots in
design, installation, or in operation and maintenance. The
human actions that may influence the probabilities of technical
failures will inevitably have a vast span in terms of time and
contents. It is more suitable to address this issue in dedicated
components risk studies, e.g. CPP failure study (IMCA, 1995).
It is also believed that the failure rates for components have
largely included this type of human action contribution.
Therefore, we exclude this type of human action in the
probabilistic model of PFM scenario in Eq.3.

Implications of the risk model of PFM scenario
The implications of the resulting risk model (presented in
Eq.3) for tanker PFM scenario in the initiating stage are
discussed below. This model has incorporated not only the
PFM scenarios that are rooted in human initiating actions, but
also those that are rooted in technical failures which interact
with human response actions.
However, knowing the above model does not directly offer
us recommendations to prevent incidents initiation in tandem
offloading. At best, it just pinpoints answers to one of the three
classic risk questions (Kaplan, 1997), i.e. What can go
wrong?. There are other two questions, i.e. How likely is it?
and What are the consequences?, remain to be solved. Note
the consequence term here refers to the amount of forward
thrust generated by tanker propulsion system in the powered
forward movement. It influences the success of recovery in the
recovery stage, as well as the final damage from the collision
should it happen.
Quantification of the likelihood of PFM scenarios and their
consequences (i.e. associated forward thrust level) may in
principle be achieved by evaluating the following three terms
based on our model, i.e., technical failures, human response
actions that interact with technical failures, and human
initiating actions. The technical failures identified by our study
are: a.) DP system, b.) position reference systems and vessel
sensors, and c.) propulsion system (CPP & thrusters). The
failure rates of these safety-critical components may be derived
from various offshore risk studies, e.g. (IMCA, 1995 and
DPVOA, 1994). However, identification and subsequent
quantitative evaluation of human initiating and response actions
are not easy to achieve. Qualitative models, e.g. in operational
HAZOP studies, may exist and are effective for identification
purpose. For quantification purpose, expert judgment
(Gudmestad, 2001) is used in practice. In all, this is the present
research challenge in risk studies of offshore marine operations.
Facing the above challenge, our first step based on the
probabilistic model of PFM in Eq.3 is to evaluate the context in
which technical failures and human actions occur. This is, in
spirit, inspired by Error Prone Situation (EPS) concept raised
by Fujita (1992). Human actions are based on situations and
how these situations (including technical failures) are
recognized, we therefore need to consider the context from
both technical and human perspectives.
We find, from the incident analysis results, that technical
failures and operator actions had not occurred at random
situations. Three out of four collision incidents actually
happened when relative motions between tanker and FPSO
were excessive. Specifically, we identified the following two
failure prone situations:
- Surging
- Yawing (heading deviation, excessive fishtailing motion)
Under above two situations or their combination, CPP may
fail, since there is a frequent pitch shift from astern to ahead.
Tanker may lack enough thruster capacity to maintain a sound
positioning, e.g. heading deviation occurs, operator may then
take manual control. Subsequently, erroneous action may be
made, or technical failure may occur, so that PFM is initiated.
The relative motion, i.e. surging and yawing, are
influenced by a number of factors, e.g. environmental
condition, technical system capacity, configuration, operational
philosophy, and so like. A quantitative study of these failure
prone situations is presented in a companion paper OMAE
28101 (Chen et al, 2002). Recommendations to effectively
minimize their occurrence and ultimately improve the safety of
offloading operation are proposed there from both design and
operational perspectives.
5 Copyright 2002 by ASME
4 RISK MODELING OF THE RECOVERY STAGE
The recovery stage starts from initiation of PFM and ends
with the final outcome, as structured in Section 2. Tanker in
PFM scenario will not necessarily collide with FPSO. Collision
could still be avoided if recovery made by tanker and FPSO are
successful.
The potential recovery initiated from FPSO is not further
modeled in the recovery stage for PFM scenario. The reasons
are explained below. Firstly, the recovery stage involves very
short time, i.e. in the order of 1-2 minutes. The time is too short
for FPSO in general to change its heading and avoid the
collision. Secondly, using main propeller (if FPSO has) to
create a current that blow away incoming tanker is not an
option in tanker PFM scenarios. At best, FPSO may call tanker
and address concern for tanker positioning, as happened before
collision in one of the incidents. However that may not help
much given the short recovery time window. (Note: FPSO does
have significant contributions to surging and yawing situation
and ultimately to the safety of offloading operation. However
those contributions are mainly in the initiating stage.)
The recovery initiated from tanker is modeled as the
recovery action(s) by tanker DP operator. This is because of the
following. After initiation of PFM, all tanker technical barriers
for maintaining correct position are out of function. There is no
technical system that can automatically bring tanker back to its
wanted position without the operator intervention. Therefore,
when addressing recovery from tanker, we need to target on the
recovery action taken by the tanker DP operator. It is basically
a response action in the face of PFM, and it is critically time
dependent. The same action may result in very different
outcomes if being initiated at different times.
Based on the above discussion, the risk model in recovery
stage can be written as:
( )
( )
( )
j
i j
j i
P collision | AR (t), PFM
P collision =
P AR (t) | PFM P(PFM )

i
i
)
)
)
i
(5)
(
i
P PFM Probability of PFM scenario i, i = 1, 2 as in Eq.3.
(
j i
P AR (t) | PFM
Probability of recovery action j
(time dependent) conditioned on
PFM
i

(
j
P collision | AR (t), PFM
Probability of collision
conditioned on PFM
i
, recovery
action j and its timing
The above probabilistic model conveys the message that
collision probability could still be effectively reduced if the
success rate of operator response action in recovery stage could
be improved. Moreover, it directs our efforts to the following
two questions:
1. What are the possible operator response actions in PFM
scenario, i.e. the term ?
( )
j i
P AR (t) | PFM
2. How likely will the action at time t prevent the collision,
i.e. the term ?
( )
j i
P collision | AR (t), PFM
To answer the above two questions, extensive operational
data are requested. The collected data are briefly outlined. The
Question no. 1 is answered by the identified recovery actions.
The event development is modeled from initiation of PFM to
the final outcome, i.e. collision or near miss. The Question no.
2 is addressed from the human action timing perspective
(certainly it could also be from human error perspective,
however not here.). This is because that action timing directly
influences whether or not this action will succeed. The analyses
consist of the time window analysis by simulation of tanker
PFM scenarios; and the operator response action analyses
based on a simple human action model and expert judgment of
action time. Findings and recommendations are summarized in
the end.
Operational data collection
Extensive operational data are important to the credibility
of the following analyses. The operational data are obtained
from various sources, including:
- Operational manual and guidelines (SMS, 2000).
- Incident and near miss information (Refer to Section 3.1).
- Interviews with shuttle tanker DP operators (Chen, 2001),
tandem offloading DP training instructor at Ship
Manoeuvring Simulator Centre in Trondheim (Chen,
2002), and DP software designer (Hals, 2001).
- Talk through and walk through during observation of
tandem loading operation on a North Sea shuttle tanker
(Chen, 2001).
Recovery action identification
Based on the collected operational data, we identify that
the recovery actions performed by DP operator can be
considered as guided by the following three possible recovery
strategies.
- The No.1 strategy is to maximize the rudder and thruster
effect so that maximum turning moment is generated, and
tanker is steered away from FPSO stern. Note during this
strategy, no effort is made to stop the tanker, nor to re-gain
pitch control from CPP.
- The No.2 strategy is to try to gain main propeller(s) pitch
control and command full astern thrust so that tanker could
be stopped before impacting FPSO stern.
- The No.3 strategy can be seen as a combination of the
above two, i.e. try to gain full astern pitch and initiate
maximum turning moment from rudder and thrusters.
Correspondingly, the possible operator recovery actions in
PFM scenario are identified and modeled by combining an
event tree model with a time axis in Figure 2. The event tree
gives out an overview of how an event may develop (into
collision or near miss) under various recovery actions from the
DP operator. The time axis has its origin at the initiation of
PFM. Operator action timing is represented (from T1 to T5).
Actions and event development after PFM based on the above
three recovery strategies are marked by routines (1), (2) and (3)
in the event tree model.
6 Copyright 2002 by ASME

Action initiated
?
Manual Takeover
Astern Pitch Initiated
?
Emer. Pitch Control
Main Engine Stopped
?
Rotation Initiated
?
Thrusters & Rudders
Contact with FPSO
Stern Avoided?
Outcome

Collision
N


Collision
N


Collision
N Y N


Y Near Miss
Powered
Forward
Movement





Collision
N

N

N
Y Near Miss

Y




Collision

Y
N

Y

Y Near Miss




Collision
N

N
Y Near Miss

Y





Collision

Y
N


Y Near Miss


0 T1 T2 T3 T4 T5 Time


(1)

(2)
(3)
Figure 2 PMF scenario recovery overview
Different views of which recovery strategy should be used
in PFM scenarios exist. Some simulator training instructors are
in favor of the No.1 strategy. However some tanker DP
operators consider the essential action is to stop the tanker, and
therefore support No.2 or No.3 strategies. The following
discussions are based on the No.2 strategy, but are valid for
other strategies too.
Time window simulation
The following two types of time window are of interest.
- 1
st
type: time to collision, assuming operator does not
initiate any action.
- 2
nd
type: maximum available time after initiation of PFM
for operator to initiate successful recovery actions.
The 1
st
type of time window information for a generic
North Sea shuttle tanker is presented in Table 2. The values are
derived from the simulated tanker movement as plotted in
Figure 3. Three levels (80%, 40%, 20%) of CPP forward thrust
involved in PFM and three tanker FPSO separation distances
(50 m, 80 m, 150 m) are considered. Note the 80% of CPP
forward thrust is generally the maximum forward thrust that DP
system on shuttle tanker can command, and is considered as
full-ahead PFM scenario.
Main CPP forward thrust % Separation
Distance
80% (1940 kN) 40% (970 kN) 20% (485 kN)
50 m 98 134 184
80 m 121 166 230
150 m 162 224 312
Table 2 1
st
type time window results (unit: seconds)

Figure 3 Simulated tanker powered forward movement
scenarios
The simulation of PFM scenario for a generic North Sea
shuttle tanker is done by a time-domain marine operation
simulation code, SIMO (Reinholdtsen and Falkenberg, 2000).
The construction of this tanker model is described in detail in
paper OMAE 28101 (Chen et al, 2002). The credibility of
using SIMO code and this tanker model to simulate PFM
scenario is confirmed by a reasonable match between
simulation results and full-scale measurements for a North Sea
shuttle tanker crash-stop test (Tnnessen, 2001). The simulated
position-speed curve is plotted together with the measured
speed and distance points (2 sets of measurements) in Figure 4.
The crash-stop test was done by using DP joystick. Initially,
tanker remained still, and full ahead command was given. At
the speed around 1 kn, full astern command was given. The
tanker was still picking up speed (and moving forward) until it
reached the maximum speed. This was the time that forward
pitch was reduced to zero, and astern pitch was started. The
main CPP hydraulic pitch control system has to take that time,
and even more time for older tankers. Then tanker speed slowly
started to drop, finally to zero.
Key assumptions and information used in simulation for 1
st

type time window are described below. Firstly, all cases are
simulated in still water. Results can be considered as
representative (in present study) to those under actual wave,
wind and current. The tanker model in SIMO is also capable to
simulate tanker motion under those environmental cases.
Secondly, the tanker has the following characteristics:
- It is in fully loaded condition with mass (plus added mass)
in the order of 143000 ton
- It takes about 20 s for forward thrust increasing from 0%
to 80%, and 20 s for forward thrust decreasing from 80%
to 0%. Linear increase/decrease is assumed.
- The 80% of maximum forward thrust from two main
propellers (CPP type) is 1940 kN. This is considered as the
maximum forward thrust from two CPP in PFM scenario.
7 Copyright 2002 by ASME

Figure 4 Tanker crash-stop test: Simulation vs. Full scale
measurements
Qualitatively, the 2
nd
type time window values should be
much smaller than the 1
st
type values, and action should be
initiated well in advance. This is because tanker propulsion and
steering system may take 20 s to 40 s to build-up to their max.
responses. Further, even after hardware reach the max. effect,
the big tanker inertia makes the vessel response slow.
Quantitatively, the 2
nd
type time window values may be
derived by taking values from 1
st
type of time window. This
is a conservative assumption with the reference from the crash-
stop test data. Take one set of measurements as example, the
full astern command was given at 71 s after full-ahead
command, and tanker reached max. speed at about 96 s.
Finally, it took 200 s to stop the tanker, and the drive-off
distance is 80 m. The 1
st
time window value of full ahead PFM
with 80 m separation distance is 121 s. In order to stop the
tanker to avoid the collision, the recovery action should be
initiated within the initial 71 s, which is approximately half of
the 1
st
time window value.
Main CPP forward thrust % Separation
Distance
80% (1940 kN) 40% (970 kN) 20% (485 kN)
50 m 49 67 92
80 m 60 83 115
150 m 81 112 156
Table 3 2
nd
type time window results (unit: seconds)
Operator action analysis
To quantitatively estimate how much time tanker DP
operator needs to initiate action, i.e. the T1, is a challenging
human reliability task. There are many studies of human
reliability in emergency situations. For example, Time
Reliability Correlation (TRC) (Hannaman and Worledge, 1988)
and Human Cognitive Reliability (HCR) (Dougherty and
Fragola, 1988) in late 1980s, operator cognitive model and
response action analysis under accident conditions (Parry 1995,
Hollnagel 1996, and Smidts et al, 1997) in middle 1990s, and
human reliability of emergency tasks in nuclear power plants
(Pyy, 2000 and Jung et al, 2001).
However, a shuttle tanker involves a different context to a
nuclear power plant (NPP) in which above studies are largely
rooted. The nature of task, human-machine interface, safety
culture, to list a few, are basically different. Moreover, during
emergency PFM scenario on tanker in tandem offloading, the
DP operator (tanker) is not like the control room operator
(NPP) who is, when under emergency, guided to take corrective
actions with various procedures, e.g. Emergency Operating
Procedures (EOPs), Abnormal Operating Procedures (AOPs),
and Functional Restoration Procedures (FRPs). EOPs or
operational guidelines for DP operator in the face of tanker
PFM scenario in tandem offloading do not exist in general.
A quantitative estimation of T1 should therefore be based
on a sound qualitative understanding of the cognitive process
that DP operator undergoes before he acts. To serve this
purpose, a simple 3-stage operator action model is developed.
It qualitatively describes the cognitive stages that DP operator
may go through in the context of PFM scenario. Based on this
qualitative operator action model, quantitative attempts have
been made by examining incident data and performing expert
judgment. Results are presented in the following sections Note
the action model and the quantification process are both
preliminary at this stage. Significant further work is needed.
Operator response action model
Attempt is made to model the cognitive stages that a DP
operator generally experiences during time duration from 0 to
T1, under the tanker PFM scenario. The objective of this action
model is to provide a microscopic basis for the following
quantitative estimation of response time T1. The quantitative
estimation based on this model will also help to pinpoint which
cognitive stages that may consume large amount of time, in
addition to a total response time estimation.
A simple 3-stage model is presented in Figure 5 with the
time reference. The operator response action is modeled by the
following three cognitive stages. Note these three stages are not
in a purely linear sequential manner.
- Information stage: this involves observation (i.e. receive
the abnormal signal or information) and detection (i.e.
actively search information after observing sign of
abnormal).
- Decision stage: this involves state evaluation (e.g. vessel
position, speed, environmental condition, vessel thruster
capacity, hardware response time, etc.) and task
formulation based on operators knowledge (e.g.
experience, training, guidelines, etc.). Recovery strategies
are formulated here.
- Execution stage: this is to transfer the selected task(s) into
sequenced muscle commands, and initiate action. The
action effect may then be observed and evaluated which
give out further action, as reflected in the figure.
8 Copyright 2002 by ASME
PFM initiates
T1
0
Time
Action initiates
DECISION

State Evaluation
Task Formulation
INFORMATION

Detection
Observation
Data Action EXECUTION


Muscle Command

Figure 5 A simple operator response action model
The reasoning and assumptions made in the construction of
this simple operator action model are described below.
First, this model is largely adapted from Wickens and
Flachs four-stage human information processing model in their
study of pilot action in aviation operations (Wickens and Flach,
1988). The aviation pilots perform operations in a context
which is considered of significant similarity to the one that
shuttle tanker DP operators facing in PFM scenarios. For
example, both cases involve receiving external information,
assessing the situation and performing action under critical
time pressure. Both have a few action alternatives to choose,
and actions are all performed in a confined area (airplane
cockpit vs. tanker bridge) with various steering gear.
Significant simplifications have been made in our model and
therefore, this operator model should be viewed only valid in
the context and time that we consider at present.
Second, the hierarchy and interaction between Decision
and Information in our model are based on the Step-Ladder
model developed by Rasmussen (1986). In his model,
Rasmussen proposed the following eight cognitive stages:
activation, observation, identification, interpretation,
evaluation, task selection, procedure selection, and execution.
Shortcuts between these stages are charted in this model.
Correspondingly, with our present objective in mind, we
grouped the first four stages in Rasmussens model into
Information Stage, the next two in Decision Stage, and the last
two in Execution Stage in our model. The interactions between
those eight stages in Step-Ladder model are reflected in our
model between Information and Decision stages. Note there is
no direct link from Information Stage to Execution Stage in our
model. This is because this type of skill-based behavior
(Rasmussen, 1981) has not been observed in our context.
A qualitatively description of this simple operator response
action model in the tanker PFM context is presented below.
1. Information stage
The Information stage involves interaction between
observation and detection. The observation is merely the
routine task that DP operator performs, i.e. watch the system
performance. The detection is defined as operator actively
searches information after observing sign of abnormal.
During the observation, operator may receive information
from either internally on the tanker or externally from FPSO or
standby vessel. For example, he may be alerted by distance
alarm. Or he may, during monitoring the offloading, see the
thrust output going abnormally, or he may observe vessel starts
to gain forward speed. Externally, it may be the FPSO (OIM or
other) calls asking status. As long as DP operator observes any
one of the above signs, i.e. position, speed, thrust output, alarm,
or external information, he may then start to search information
to clarify the abnormal sign.
The step following and iterating with observation is the
detection. This is an active activity. In the sense of something
might go wrong, DP operator starts to actively search the
information to test and confirm his suspicion, i.e., is this a
wrong signal or there is actually a powered forward movement.
He may perform cross check of four information sources, i.e.
position, speed, thrust output, and alarm, to detect the situation.
Other sources, e.g. noise from engine, vibrations may also help
operator to make the detection.
2. Decision stage
The Decision stage involves interaction between state
evaluation and task selection.
During state evaluation, DP operator process the
information obtained in previous Information stage. He may
find it is merely a wrong signal, and then select merely a minor
correcting task. Or he may find this is a PFM, he will have to
start to check the vessel position (distance to FPSO), velocity.
The information helps him to know how critical the situation is,
how much time window does he have, He may contact FPSO
and command to initiate ESD I or II.
If it is a PFM, based on the state evaluation made above,
the DP operator will start to formulate proper tasks which he
believes could effectively avoid the collision. He will also
consider the environmental conditions and vessel thruster,
rudder capacities and response time, when planning the tasks.
3. Execution stage
The last stage is the task execution. The formulated tasks
are interpreted into sequenced muscle commands, and DP
operator subsequently confirms (by observation) the execution
is being achieved.
Note this stage may be rather quick if the command is
quickly confirmed as intended. However in some cases when
there have been some technical failures, a command may result
no effect at all, or in a stressed situation command is even acted
on a wrong object. Operator may try again and wait (search
information to confirm command is being achieved) and try
until he or she changes decision to perform another task or to
find out the right object for command. In those cases, the
execution stage may involve longer time.
Preliminary estimation of action time
Seven incidents information is examined. The operator
action initiation time and collision (or tanker stop) time after
PFM are summarized in Table 4. The time span of action
initiation is observed between 58 to 167 s in collision incidents,
and well below 60 seconds in near misses. Further, based on
time to collision, incident a, b, and e could be considered as full
9 Copyright 2002 by ASME
ahead PFM situations. The time span of action initiation
implied from these three incidents is roughly between 60 and
120 s, and averagely as 90 s.
Collisions
Recovery Action
Initiation after PFM
Collision after PFM
a Close to120 sec 120 sec
b 91 sec 143 sec
c 167 sec Not Available
e 58 sec 125 sec
Near Misses
Recovery Action
Initiation
Stop time
d 40 sec 140 sec
f Not Available Not Available
g Almost immediately 72 sec
Table 4 Operator action initiation time (incident data)
The operator action initiation time is estimated by a DP
training instructor in Ship Maneuvering Simulator Center
(SMS) in Trondheim. This instructor has experience from
hundreds of tandem offloading DP training courses performed
in the past a few years. During the courses, various failures that
may cause (or combine with) tanker PFM are posed on trainees
by the instructor at random times. The trainees responses in
Bridge simulator are observed by the instructor via video
camera. (Note: there is no record of performance during the
training. This rules out the possibility of a statistical analysis of
response time in training.)
The estimation is built on the developed simple operator
response action model. Results are presented in Table 5. Our
approach is outlined below. 100 times of training with
experienced DP operators are mentally considered. After
initiation of tanker PFM, percentage of training is estimated for
different time intervals for Information, Decision, and
Execution stages., It is practically hard to differentiate the
Decision and Execution stages directly from the observation of
simulator training, therefore these two are combined together.
The separation of Information and Decision stages is by
observing trainee has detected a sign of PFM. The time
intervals were pre-made and were updated by the expert during
the estimation process.
Information Stage
Time (sec) 0 - 10 10 - 20 20 - 30 30 - 50
No. out of 100
times Training
10 20 20 50
Probability 0.1 0.2 0.2 0.5
Decision and Execution Stages
Time (sec) 0 - 20 20 - 30 30 - 60 60 - 90
No. out of 100
times Training
0 20 30 50
Probability 0.0 0.2 0.3 0.5
Table 5 Action time estimation by expert from simulator
training
The results in Table 5 show that the mean Information time
is 28.5 s, and the mean Decision and Execution time is 56 s.
The recovery action is then averagely initiated about 85 s after
the initiation of PFM. This is largely convergent to what we
have observed from the incident data. Given the 80 m
separation distance and a full-ahead PFM, we have obtained the
time window for recovery action is about 60 s. From the
distribution of trainees, we further find that only 20% to 30%
of them will be able to initiate recovery action within the time
window, i.e. potentially there is a big probability of recovery
action failure.
Further discussions of the present expert judgment
approach are described below.
Ideally, expert judgment should also be carried out with a
number of shuttle tanker Captains and DP officers.
Subsequently representative action time values may be elicited
to describe status of DP operator response. Practically
however, we have not been able to carry out this type of survey
at the time of writing this paper. The estimation by SMS DP
instructor should be viewed as our first step in expert judgment.
100 times training with experienced DP operators are
considered. This rules out the training with officers who are
first time in the tandem offloading DP training course and have
never operated DP onboard. They will use much more time to
start action in simulated PFM scenarios. In practical situation, it
will in general be the experienced DP operator, typically the
Captain, to take action under the tanker PFM scenario.
It was commented by the expert during estimation that the
work attitude heavily influences the detection of abnormal
signal from tanker PFM. The experience gained from
emergency training and the knowledge of system (hardware)
may have significant impact on the decision and action
execution.
Findings and recommendations
The possible recovery strategies and subsequent recovery
actions from tanker are identified. However, the probability of
recovery action failure is significant due to lack of response
time. The recommendations are therefore the following.
To ensure enough time for tanker DP operator to initiate
recovery action is vitally important. Substantial increase of
separation distance may be considered. For example, if distance
is increased from 50 m to 150 m, the available time window for
action (given full-ahead PFM) will increase from 49 s to 81 s.
This may significantly improve the success of recovery.
However, if recovery fails, the increased distance will let tanker
gain more speed and therefore results in more collision
damage.
Efforts may also be directed to effectively reduce the
operator response time. This may be achieved by the following
two measures. Firstly, detection time can be reduced. This
may be achieved by providing early warning or alarm system
for detection of tanker PFM. Secondly, decision and
execution time may be reduced. This involves emergency
training both on board and in simulator for quick and effective
reaction.
10 Copyright 2002 by ASME
5 CONCLUSIONS
The collision frequency in tandem offloading is modeled
(Eq.1) in the following two stages: the initiating stage, i.e. to
predict and evaluate the situations where something could
possibly go wrong to cause tanker uncontrolled forward
movement, P(UFM); and the recovery stage, i.e. to assess the
recovery initiated from the tanker (and FPSO) to avoid
collision after tanker uncontrolled forward movement happens,
P(Failure of Recovery | UFM). In the initiating stage, this paper
is focused on tanker powered forward movement (PFM)
scenarios. A probabilistic model (Eq.3) for initiating stage is set
up which integrates technical events, human actions and their
interaction. This model guides us further to identify the two
failure prone situations, i.e. surging and yawing, where man
machine interaction happened and subsequently resulted in
most collision incidents. Therefore, to improve the safety of
tandem offloading, the occurrence of surging and yawing
should be minimized.
In the recovery stage, this paper is focused on recovery
initiated from tanker. Based on the probabilistic model (Eq.5)
for recovery stage, possible recovery actions are identified and
the event development is modeled from initiation of tanker
PFM to the final outcome, i.e. collision or near miss. The
success of recovery is analyzed from the human action timing
perspective. This is because that action time directly influences
whether or not this action will succeed. Based on our
qualitative and preliminary quantitative analyses, the
probability of recovery action failure is significant due to lack
of response time. Recommendations are then made to ensure
enough time for operator to initiate recovery action, and to
effectively reduce the operator response time.
ACKNOWLEDGEMENTS
The authors would like to thank Prof. Jan Erik Vinnem,
Prof. Per Hokstad of SINTEF, Leif Ivar Tnnessen of Navion
ASA, Sverre Haver, Kjell Larsen, and Harald Kleppest of
STATOIL, for many discussions and assistance throughout this
study. The opportunity the first author got to observe the
simulator training of DP officers for offshore loading operation
and the support in expert judgment from Ship Manoeuvring
Simulator Centre AS is also highly acknowledged.
REFERENCES
Addy, P. D., et al (1995): Gryphon A, the first purpose
built permanently moored FPSO in the North Sea, OTC 7424,
Offshore Technology Conference, 1994, Houston
Bea, R. G. (1997): Human and organization errors in
reliability of offshore structures, J. of Offshore Mechanics and
Arctic Engineering, Vol. 119, February 1997
Chen, H. (2001): Offshore trip findings, restricted internal
memo, Dept. of Marine Structures, NTNU
Chen, H. (2002): SMS interview preparation & result
summary, restricted internal memo, Dept. of Marine Structures,
NTNU
Chen, H., Moan, T., Haver, S., and Larsen, K. (2002):
Predicate of relative motions and probability of contact
between FPSO and shuttle tanker in tandem offloading
operation, OMAE 28101, to be appear in 21
st
OMAE
Conference, 2002.
Dougherty, E. M. Fragola, J. R. (1988): Human reliability
analysis: a systems engineering approach with nuclear power
plant applications, Wiley, New York
DPVOA (1994): Dynamic Positioning Systems Incidents,
1980-1992, source from OTO 97055
Fujita, Y. (1992): Human reliability analysis: a human
point of view, Reliability Engineering and System Safety, 38
(1992) 71-79
Furnes, O. and Amdahl, J. (1980): Computer simulation
study of offshore collisions and analysis of ship-platform
impacts, applied Ocean Research, 1980, Vol. 2, No. 3
Gudmestad, O. T. (2001): Risk assessment tools for use
during fabrication of offshore structures and in marine
operations projects, OMAE2001/S&R-2106, Proceedings of
OMAE 01, June 3-8 Rio de Janeiro, Brazil
Hals, T (Kongsberg Simrad) (2001): Private
communication regarding tandem loading DP software.
Hannaman, G. W., Worledge, D. H. (1988): Some
developments in human reliability analysis approaches and
tools, Reliability Engineering and System safety, 22 (1988)
235-256
Haugen, S. and Moan, T. (1992): Frequency of Collision
between Ships and Platforms. Proc. OMAE, Calgary
Hollnagel, E. (1996): Reliability analysis and operator
modeling, Reliability Engineering and System Safety, 52
(1996) 327-337
HSE (1997): Close proximity study. Offshore Technology
Report - OTO 97055, Health & Safety Executive, issued in
1997, UK
HSE (1998): Shuttle tankers and offloading operations at
FPSO/FSUs. Offshore Technology Report - OTO 98172,
Health & Safety Executive, issued in 1999, UK
IMCA (1995): Failure Modes of CPP Thrusters, source
from OTO 97055
IMCA (1999): Quantified frequency of shuttle tanker
collision during offtake operations. IMCA Report M150, The
International Marine Contractors Association, February 1999,
UK
Jung, W. D., Yoon, W. C., Kim, J. W. (2001): Structured
information analysis for human reliability analysis of
emergency tasks in nuclear power plants, Reliability
Engineering and System Safety, 71 (2001) 21-32
Kaplan, S. (1997): The Words of Risk Analysis, Risk
Analysis, Vol. 17, No. 4, 1997
Kvitrud, A., Ersdal, G., Leonhardsen, R. L. (2001): On the
risk of structural failure on Norwegian offshore installations,
Proceeding of 11
th
ISOPE Conference, Vol. IV, Stavanger,
Norway
Leonhardsen, R. L., Ersdal, G., Kvitrud, A. (2001):
Experience and risk assessment of FPSOs in use on the
11 Copyright 2002 by ASME
Norwegian Continental Shelf: Description of events,
Proceeding of 11
th
ISOPE Conference, Vol. I, Stavanger,
Norway
MacDonald, A. et al (1999): Collision Risks Associated
with FPSOs in Deep Water Gulf of Mexico, OTC 10999.
Offshore Technology Conference, 1999, Houston
McCaul, J. R. (2001): Special Report Floating
Production Systems, Oil & Gas Journal, June 11, 2001
Odland, J. (1995): The Norne Production Ship Design
Considerations, OTC 7926, Offshore Technology Conference,
1995, Houston
Parry, G. W. (1995): Suggestions for an improved HRA
method for use in probabilistic safety assessment, Reliability
Engineering and System Safety, 49 (1995) 1-12
Pyy, P. (2000): An approach for assessing human decision
reliability, Reliability Engineering and System Safety, 68
(2000) 17-28
Rasmussen, J., Pedersen, O. M., Carnino, A., Griffon, M.,
Mancini, C., and Gagnolet, P. (1981): Classification system for
reporting events involving human malfunctions. Report Riso-
M-2240, DK-4000, Riso National Laboratories, Denmark
Rasmussen, J. (1986): Information processing and human-
machine interaction, An approach to cognitive engineering,
ISBN 0-444-00987-6, Elsevier Science Publishings, The
Netherlands.
Reinholdtsen, S. A., Falkenberg, E. (2000): SIMO
Theory/User Manual, MT51 F93-0184, MARINTEK
Tnnessen, L. I. (Navion ASA) (2001): Private
communication regarding a shuttle tanker crash-stop test
information.
Skallerud, B., and Amdahl, J. (2002): Nonlinear Analysis
of Offshore Structures, Research Studies Press Ltd (to be
published).
Smidts, C., Shen, S. H., Mosleh, A. (1997): The IDA
cognitive model for the analysis of nuclear power plant
operator response under accident conditions. Part I. Problem
solving and decision making model, Reliability Engineering
and System Safety, 55 (1997) 51-71
SMS (2000): Offshore loading phase 2, course material.
Ship Manoeuvring Simulator Centre AS, Trondheim
[Restricted]
STATOIL (2000): Granskningsrapport fra berring,
Document No. 00A05*0209.
Vinnem, J. E. (1999): Offshore Risk Assessment Principles,
Modeling and Applications of QRA studies, PP393, ISBN 0-
7923-5860-0, Kluwer Academic Publishers. 1999
Vinnem, J. E. (2000): Operational safety of FPSOs: Initial
summary report, OTO 2000/86, Offshore Technology Report,
Health & Safety Executive, 2000, UK
Wickens, C. D., Flach, J. M. (1988): Information
Processing, Wiener, E. L. Nagel, D. C (edt.) Human Factors in
Aviation, ISBN 0-12-750030-8, Academic Press, Inc.

12 Copyright 2002 by ASME