FPSO Risk Assessment by Project Stage: Safety Studies from Concept and FEED to First Oil and Operations

Which Safety Studies Does an FPSO Project Need? FPSO safety studies typically progress from broad hazard identification and concept risk screening to detailed hazard analysis, quantitative risk assessment, fire and explosion assessment, safeguard verification and operational readiness. Depending on project stage, design maturity, regulatory regime and risk profile, the programme may include HAZID, HAZOP, QRA, FERA, EERA, ESSA, SIL/LOPA, Safety Case development, readiness reviews and later-life revalidation. Not every FPSO requires every study, and not every study is performed only once. The right combination depends on three things: the hazards present, the maturity of the design, and the decision the assessment needs to support. That decision-based approach is the thread running through the lifecycle below.

Why FPSO Risk Assessment Changes Across the Project Lifecycle

FPSO risk assessment changes as the project matures. What matters at concept is not the same as what matters immediately before first oil.

At concept, the priority is identifying major hazards early enough to influence the design. During FEED, the focus shifts toward quantifying credible risks and defining the safeguards that will control them. As detailed design progresses, the question becomes verification: are the safeguards correctly specified and capable of delivering the required performance? Before first oil, the emphasis changes again to operational readiness. Once the FPSO is producing, risk assessment becomes something to maintain and revalidate rather than a project deliverable that can simply be filed away.

This guide explains which FPSO safety studies typically become relevant at concept, Pre-FEED, FEED, detailed design, conversion or redeployment, commissioning, first oil and operations – and, more importantly, what decision each study is intended to support. For the broader process-safety framework that integrates process, marine, storage and offloading risk, see SynergenOG’s FPSO Safety: The Role of PSM.

FPSO Risk Assessment – What & How?

FPSO risk assessment is the structured evaluation of process, marine, storage and offloading hazards using qualitative and quantitative studies across the facility lifecycle. It is not one single study; it is an integrated programme of studies, reviews and assurance activities.

Compared with a typical fixed production installation, an FPSO adds or intensifies several important risk interfaces, particularly station keeping, cargo storage, offloading and vessel interaction. These must be assessed alongside conventional process hazards such as loss of containment, fire and explosion. The programme also needs to consider personnel exposure, emergency response and the safety-critical barriers that prevent or mitigate major accident events.

Is FPSO risk assessment the same as QRA? No. Quantitative Risk Assessment (QRA) is one quantitative component within the wider FPSO risk-assessment programme. It normally works alongside HAZID, HAZOP, FERA and other specialist assessments rather than replacing them.

FPSO Safety Studies by Project Stage

Which studies apply and when depend on design maturity and the decision to be made next. The table below is a practical starting point rather than a mandatory checklist; actual scope should be set against project-specific hazards, operator requirements, class expectations and the applicable regulatory regime.

Which studies apply, and when, depends on design maturity and the decision that needs to be made next. The table below is a practical starting point rather than a mandatory checklist; actual scope should be set against project-specific hazards, operator requirements, class expectations and the applicable regulatory regime.

Project Stage	Main Safety Objective	Typical Studies / Activities	Key Decision
Concept / Pre-FEED	Identify major hazards and influence concept selection	HAZID; concept risk screening / preliminary QRA where appropriate; inherently safer design review	Is the concept sufficiently understood and viable to progress?
FEED	Quantify risk and define safeguards	HAZID update; HAZOP as design maturity allows; QRA; FERA; EERA/ESSA development	Does the design reduce and control risk to the required level?
Detailed Design	Verify detailed safeguards	HAZOP / HAZOP close-out; SIL/LOPA; fire & gas coverage assessment; hazardous area classification; EERA/ESSA; Safety Case development where applicable	Are safeguards correctly specified and demonstrably adequate?
Conversion / Redeployment	Identify change-driven risks	Gap assessment; HAZID; QRA/FERA revalidation; MOC; Safety Case update where applicable	Is the existing FPSO suitable for the new duty and location?
Commissioning / First Oil	Verify operational readiness	Operational readiness / PSSR; action close-out; safety-critical system verification; SIMOPS review as applicable	Is the FPSO ready for hydrocarbon introduction?
Operations	Keep the risk picture valid	MOC; barrier assurance; operational risk review; periodic revalidation; Safety Case updates where applicable	Have changes or degradation altered the risk basis?

Read the table as an evolving risk-assessment programme rather than a rigid sequence. Early hazard identification informs the scenarios examined in later quantitative and detailed studies. As the design matures, HAZOP and other reviews refine those scenarios and safeguards. Where instrumented protection is relied upon for significant risk reduction, LOPA and SIL assessment can then establish the required integrity. The exact sequencing should reflect design maturity, study dependencies and the decisions each assessment must support.

1. Concept and Pre-FEED: Identify the Major Risks Before the Design Is Fixed

At concept and Pre-FEED, FPSO risk assessment should identify major accident hazards early enough for the findings to influence concept selection, layout, process philosophy and marine-system choices. This is the stage at which changes to layout, inventory, separation or fundamental design philosophy are usually easier to implement than they will be later.

HAZID: What Can Go Wrong?

A HAZID study at this stage may address hydrocarbon releases, collision, offloading, turret and mooring failure, riser hazards, cargo and storage hazards, fire and explosion escalation, environmental conditions and interfaces with marine operations. The output should be sufficiently robust to influence the developing concept, not treated as a finished risk register that will never change.

Concept Risk Screening and Preliminary QRA

Where quantitative comparison will materially support concept selection, a preliminary QRA can identify dominant risk contributors and compare design options. At this stage the assessment is necessarily based on less mature design information, so the emphasis should be on decision-relevant differences and uncertainty rather than presenting the result as a final risk estimate.

Without adequate concept-stage risk screening, important risk drivers may only become clear after major layout or process decisions have become more difficult and costly to change.

Inherently Safer Design Review

Risk reduction is most effective when hazards can be eliminated or reduced at source. An inherently safer design review looks for opportunities to minimise hazardous inventory, simplify systems, increase separation, reduce escalation potential or avoid unnecessary complexity before those choices harden into detailed design.

Read: Inherent Risk and Facility Phase-Specific Approach

2. FEED: Quantify Risk and Define the FPSO’s Safety Requirements

During FPSO FEED, the risk-assessment programme moves from broad hazard identification toward more detailed analysis of credible scenarios, consequences, frequencies and safeguards. This is a high-value window: the design is mature enough to analyse meaningfully, but still flexible enough for findings to influence layout, equipment selection and protection philosophy.

HAZID and HAZOP

HAZID and HAZOP answer different questions. HAZID looks broadly at what major hazards exist across the facility and its interfaces. HAZOP examines how deviations from design intent can create hazardous or operability scenarios at process-node level. The concept-stage hazard picture is normally revisited as the design matures, while HAZOP is best performed when P&IDs, operating philosophy and design intent are sufficiently mature for a systematic deviation review – and while there is still time to implement resulting changes.

QRA

A FEED-stage QRA can integrate relevant process and marine accident scenarios, personnel exposure and escalation to quantify risk using the measures required by the applicable project, operator and regulatory criteria. Depending on the regime, those measures may include individual, group, or societal risk, as well as other project-specific risk criteria.

For FPSOs, the model should consider cross-escalation between hazard domains. A marine event, such as loss of station keeping, may threaten risers or process equipment; conversely, a major topsides fire or explosion may affect marine systems, evacuation routes, or continued station keeping.

FERA

Fire and Explosion Risk Assessment (FERA) supports decisions on fire and explosion loads, layout, passive fire protection, deluge, detection, temporary refuge impairment considerations and escalation prevention. On an FPSO, congestion, ventilation, accommodation proximity and large hydrocarbon inventories make these decisions particularly important.

FERA and QRA should be developed consistently. They commonly share release scenarios, frequencies, source-term assumptions and consequence models, while detailed fire and explosion results can in turn inform the wider QRA and design decisions. The studies are therefore often iterative rather than strictly sequential.

EERA and ESSA may also begin developing during FEED, with increasing detail as the layout, emergency systems and evacuation arrangements mature.

3. Detailed Design: Verify That the Required Safeguards Can Deliver

During detailed design, FPSO safety studies become increasingly system-specific. The objective is to confirm that safeguards identified in earlier studies are correctly defined, properly engineered, and capable of meeting the performance assumed in the risk assessment.

SIL and LOPA

Where HAZOP or another risk review identifies scenarios that rely on instrumented protection, LOPA and SIL assessment can determine the required risk reduction and the target integrity of safety instrumented functions. The assessment should be based on clearly defined scenarios and agreed assumptions regarding initiating events and independent protection layers. If later design changes or HAZOP actions materially change those assumptions, the affected LOPA/SIL assessment should be revisited.

ESSA and EERA

Emergency System Survivability Analysis (ESSA) examines whether emergency systems and supporting utilities – such as ESD, fire and gas detection, communications, deluge and emergency power – remain available for the accident conditions in which they are required. Escape, Evacuation and Rescue Analysis (EERA) asks whether personnel can reach muster, temporary refuge and evacuation or rescue provisions under credible accident scenarios.

Temporary refuge impairment and endurance should be considered through the applicable FERA, EERA, TR impairment or regulatory methodology rather than treated simply as another emergency system within ESSA.

Safety-Critical Elements and Performance Standards

In Safety Case regimes, the relationship commonly becomes explicit: major accident hazards -> control measures and barriers -> safety-critical elements or critical controls -> performance standards. The precise terminology and formal requirements vary by jurisdiction, but the objective is consistent: the controls credited in the risk assessment need measurable criteria for functionality, availability, reliability, survivability or other relevant performance attributes.

Safety Case Development

Where a Safety Case regime applies, the Safety Case becomes an integration point for the major-hazard assessment, control measures, assurance evidence and the demonstration that risk has been reduced to the level required by the applicable framework – for example, ALARP in jurisdictions that use that principle. It should not be treated as a document assembled after all technical decisions are already complete.

4. Commissioning and First Oil: Is the FPSO Actually Ready to Start?

Before first oil, the emphasis changes from design risk assessment to operational readiness: confirming that equipment, safeguards, procedures, people and outstanding safety actions are ready for hydrocarbon introduction. A sound design can still be unready to start if critical actions remain open or systems have not been tested in their as-built configuration.

Readiness activity may cover HAZOP and HAZID action status, safety-critical punch items, ESD and fire-and-gas readiness, procedures reflecting as-built conditions, emergency-response arrangements, competency and training, MOC closure, temporary overrides, SIMOPS interfaces and formal start-up authorization. The exact scope depends on the operator and regulatory framework.

The important distinction is that this is not merely a document review. It is a verification exercise: checking that what was assumed or promised in the design studies has actually been installed, tested, handed over and understood by the people who will operate the facility.

For more detail, see SynergenOG’s guide to Pre-Startup Safety Review (PSSR) and operational readiness. SynergenOG also provides Safety Review and Readiness Review services for this stage.

5. Operations: Risk Assessment Does Not End at First Oil

Once an FPSO enters operation, the risk picture continues to change. The studies remain useful, but the assumptions behind them can become outdated as throughput, equipment condition, operating practices or field duty evolve.

Reassessment may be triggered by Management of Change (MOC), production increases, new wells or tie-ins, equipment degradation, barrier impairment, a changed operating envelope, significant incidents, life extension planning, major maintenance, debottlenecking or regulatory change.

A useful concept is assumption validity: a QRA or FERA can be technically complete while its inputs no longer reflect the current facility. A study based on the original production profile does not update itself when throughput increases or new tie-ins are introduced. The operator needs a process for recognising when those changes are material enough to require review or revalidation.

In day-to-day operations, MOC and barrier assurance provide much of that control. Tracking leading and lagging indicators such as safety-critical barrier impairments, overdue assurance activities, active overrides and process-safety events can provide early warning that risk controls are degrading. For upstream assets, IOGP Report 456 provides a directly relevant framework for process-safety KPIs and aligns its process-safety-event definitions with API RP 754.

FPSO Conversion and Redeployment: Revalidate the Basis, Not Just the Documents

An FPSO being converted, redeployed, or materially modified should not automatically rely on risk assessments prepared for its previous field or operating envelope. A vessel that was suitable for one duty is not automatically suitable for another.

Fluid composition, production rates, topsides modules, tie-ins, environmental conditions, offloading arrangements, risers, manning levels and regulatory jurisdiction can all change between deployments. Any of these can invalidate assumptions embedded in an older HAZID, QRA, FERA or Safety Case. Moving from a low-H2S fluid to a sourer service, for example, can materially change toxic-dispersion, detection and emergency-response assumptions even if much of the physical plant remains unchanged.

A redeployment gap assessment should compare the new operating basis against the existing risk studies, Safety Case where applicable, operator requirements, regulatory requirements, class requirements and relevant design standards. Examples may include API RP 2FPS for floating production systems and DNV-OS-A101 where applicable. The result should determine which studies can be retained, which require targeted updates, and which need full revalidation.

When should an FPSO risk assessment be revalidated? Whenever a material part of the basis on which it was built – such as fluid composition, throughput, layout, environment, operating mode, field duty or regulatory context – no longer matches the current facility.

How Should FPSO Owners Decide Which Safety Studies Are Needed?

The lifecycle provides a useful framework, but study scope should be set by the actual decision and risk context. Eight factors typically drive that scope:

1. Project stage – what decision needs to be made next.
2. Major accident hazards – what credible hazards and escalation paths have already been identified.
3. Design maturity – how stable the P&IDs, layout, equipment selection and operating philosophy are.
4. Regulatory and class requirements – including coastal state, flag state and classification expectations where applicable.
5. Operator standards – internal risk criteria, engineering practices and mandatory study requirements.
6. Changes since previous studies – anything that could invalidate assumptions or credited safeguards.
7. Study dependencies – what information this assessment needs from earlier or parallel work.
8. Decision the study must support – the approval, design choice, risk demonstration or readiness decision someone is waiting on.

Conclusion: Match the Safety Study to the Decision

FPSO risk assessment is most effective when each study is performed at the point where its findings can still influence a meaningful project or operating decision. Run an assessment before its inputs are sufficiently mature and uncertainty may limit its usefulness; run it too late, and the opportunity to change the design or operating plan may already have narrowed.

Across the lifecycle: concept identifies and screens risk, FEED quantifies and develops safeguards, detailed design verifies, first oil demonstrates readiness, and operations revalidate the risk basis as the facility changes.

 

References:

1. • https://www.hse.gov.uk/offshore/safetycases.htm
   • https://www.iogp.org/bookstore/product/process-safety-recommended-practice-on-key-performance-indicators/
   • https://www.hse.gov.uk/pubns/books/l65.htm
   • https://www.hse.gov.uk/offshore/topics.htm
   • https://www.nopsema.gov.au/guidance-available-hazard-identification-and-risk-assessment
   • https://www.nopsema.gov.au/offshore-industry/safety/safety-cases-and-validation
   • https://www.dnv.com/news/2026/standards-now-available-the-july-2026-edition-of-the-dnv-class-rules-and-standards-for-ship-and-offshore/

Technical Note: This article provides general guidance for selecting and timing FPSO safety and risk assessments across the project lifecycle. The studies listed are not a mandatory sequence and should be applied according to project stage, hazard profile, design maturity, regulatory and classification requirements, operator standards, study dependencies, and the decision being supported. Risk assessments should be updated or revalidated as the design, safeguards, operating conditions, or risk assumptions change throughout the FPSO lifecycle accordingly.