Working in an environment where the sea freezes for four months a year adds a layer of complexity that most offshore safety studies never have to account for. That was the reality Elixir Engineering stepped into when Metrix LLC commissioned us to carry out an Emergency Systems Survivability Assessment (ESSA) for the Kalamkas-Sea and Khazar Field Development Project in the Northern Caspian Sea.
The two fields sit in relatively shallow water around 6 to 7 metres but their remoteness and seasonal ice cover make emergency response planning anything but straightforward. Kalamkas-Sea lies roughly 132 km south-west of the giant Kashagan field, with Khazar a further 28 km beyond that. Between December and March, conventional support vessel access is limited, and that constraint has to be factored into every survivability decision made for the platforms.
The scope of the development is substantial. It includes two Drilling Platforms, two Living Quarter Platforms, a Central Processing Facility, compression and pumping stations, both offshore and onshore pipelines, a Gas Turbine Power Plant, and the full range of utilities and support infrastructure you would expect from a project of this size. Across all of that, the ESSA had one core purpose: to find out whether the emergency systems that personnel would depend on in a crisis would actually hold up when put under the physical stress of a major accident.
Before getting into the specifics of what we found on this project, it is worth explaining what an ESSA actually is because it is a study that gets requested often but is not always well understood.
At its core, an Emergency Systems Survivability Assessment asks a single, very direct question: if a fire, explosion, or toxic gas release happens on this platform, will the safety systems that are supposed to protect people still work? That sounds simple enough, but answering it properly requires pulling together the outputs of multiple other studies, mapping those hazard results against every critical system on the facility, and working through a structured logic to determine whether each system survives, fails safely, or needs to be improved.
The study focuses specifically on Safety Critical Elements the SCEs. These are the systems and components whose failure during a major accident could cost lives or significantly worsen the outcome. Think firewater pumps, deluge systems, emergency shutdown valves, escape lighting, lifeboats, and communications equipment. The ESSA does not assess whether these systems work under normal conditions. It assesses whether they work when they are surrounded by a jet fire, caught in an explosion blast, or enveloped in toxic gas conditions they might never face, but which they must be designed to survive.
This is what distinguishes an ESSA from a standard risk assessment. A Fire and Explosion Risk Assessment (FERA) tells you what the hazards are and how severe they could be. An ESSA takes those results and asks the follow-up question: given those hazard levels, can each SCE still do its job? The two studies are closely linked and are almost always carried out together as part of an integrated technical safety programme.
The Kalamkas-Sea field has been known about for over two decades the discovery well, KAL-1, was drilled back in 2002 and confirmed commercially viable hydrocarbons in Jurassic reservoirs. Three further appraisal wells followed, and the field extends across roughly 40 km, spanning several structural culminations. Khazar came later; well Khazar-1 was drilled in 2007 and found commercial hydrocarbon volumes in the same Jurassic reservoir system. Two more appraisal wells have since confirmed the extent of that accumulation.
Developing both fields together requires an impressive amount of surface infrastructure. The full list runs to Drilling Platforms and Living Quarter Platforms at both fields, a shared Central Processing Facility handling oil separation, gas treatment, water processing, utilities and flaring, product storage tankage, compression and pumping stations, offshore and onshore pipelines, a Gas Turbine Power Plant, and all the control rooms, telecommunications, instrumentation, roads, drainage and operational facilities that go with a development of this scale.
For the ESSA, the most operationally significant aspect of the project is not the infrastructure count it is where these facilities sit. The Buzachi Peninsula, the nearest land, is around 62 km away. In winter, ice conditions restrict marine access. Those two facts mean that if something goes seriously wrong on one of these platforms, the window for external rescue response is longer and less predictable than it would be for a North Sea platform with a port an hour away. That reality shapes everything about how emergency systems need to be specified, positioned, and protected.
The objectives for this ESSA were agreed with Metrix LLC at the outset and shaped the entire structure of the work. There were five things we needed to demonstrate by the end of the study.
First, we needed to identify every emergency system on the Drilling Platforms and Living Quarter Platforms that qualifies as Safety Critical meaning every system whose failure during a major accident would meaningfully affect the outcome for the people on board.
Second, for each of those systems, we needed to evaluate its vulnerability. That meant overlaying the physical effects of credible accident scenarios thermal radiation, explosion overpressure, toxic gas dispersion, smoke onto the actual locations of each SCE and asking whether the system would survive those conditions.
Third, we needed to ground that vulnerability analysis in the project's own quantified risk data. Generic assumptions were not going to cut it here. The ESSA had to draw on the findings from the FERA, the Escape Evacuation and Rescue Analysis (EERA), and the wider Quantitative Risk Assessment (QRA) for the project to ensure that the hazard scenarios being tested against each SCE were realistic and project specific.
Fourth, we needed to verify that the systems supporting evacuation and rescue from the helideck through to the lifeboats and communication equipment would be functional when personnel needed to use them. This matters particularly in a winter-ice environment where one evacuation route being out of action is not a minor inconvenience. Finally, for anything we found to be potentially inadequate, we needed to develop clear, practical recommendations for improvement with the aim of getting residual risks to ALARP levels.
The ESSA followed a six-step methodology that moves from the broad to the specific starting with scope definition and working through to an accept-or-improve decision for each SCE. Each step builds on the one before it, so by the time you reach the survivability evaluation in Step 5, you are working with a well-understood facility, a defined set of hazard scenarios, and a clearly bounded list of the systems that matter most.
Every assessment like this starts with getting the boundaries right. We established the purpose and scope of the ESSA in line with the project's safety objectives and the regulatory requirements applicable to operations in this part of the Caspian Sea. Getting this right at the start prevents scope creep and ensures the study delivers what the Safety Case actually needs.
Before evaluating any system, you need a thorough spatial understanding of the facility where equipment is located, how the decks are arranged, where personnel spend time, and how the safety zones are laid out across both platforms. This step is less glamorous than the analysis that follows, but it is where the quality of the assessment is really built. A hazard contour that misses a critical piece of equipment because its location was not properly mapped is a hazard contour that gives false confidence.
The credible MAH scenarios for the platforms were drawn from prior safety studies hydrocarbon jet fires, pool fires, vapour cloud explosions, flash fires, and toxic gas releases. Each scenario was characterized by its physical effects: how hot, how forceful, how toxic, and at what distances those effects would be felt. These scenarios set the test conditions that every SCE would subsequently be measured against.
With the facility understood and the hazard scenarios defined, the next step was to compile the full inventory of SCEs. These are the systems that prevent, control, or mitigate major accidents. For this project, the SCE list included the fixed fire suppression systems, passive fire protection, emergency escape lighting, the helideck and helicopter facilities, personal survival equipment, rescue facilities including lifeboats and ERRVs, emergency shutdown systems, emergency power supplies, and the platform communication systems.
The actual analytical work takes place here. Each SCE was put through a three-question decision logic.
The first question is whether the SCE is even exposed to the hazard. We used the hazard contours from the FERA and other studies to check whether each system sat within the thermal radiation, overpressure, or gas concentration envelope of any credible scenario. If it did not, the assessment was straightforward.
If the system was within a hazard envelope, the second question was whether it fails safely. Some systems are designed to default to a safe condition if they lose power or are damaged a normally closed ESD valve that shuts on signal loss is an example. If a system fails safely, vulnerability to the hazard does not necessarily mean it fails dangerously.
The third question, for systems that are both exposed and not inherently fail-safe, was whether there is adequate redundancy. Dual firewater pump arrangements, UPS backed lighting, and backup communication pathways are all examples of redundancy that can maintain overall system availability even when one component is impaired.
At the end of that logic, each SCE was given one of two classifications: acceptable or not acceptable. For anything classified as not acceptable, we developed specific recommendations to restore survivability and those recommendations were prioritized based on the frequency and severity of the scenarios that drove the vulnerability.
The assessment covered all the key prevention, protection, evacuation, and rescue systems across the Drilling and Living Quarter platforms, cross referencing each one against the Fire Protection Philosophy, Basis of Design, safety plot plans, and the outputs of the FERA and EERA studies. This is what resulted from SCE
The Deluge System, Sprinkler System, and Fixed Foam System were all assessed as acceptable by design. When we overlaid the credible thermal radiation and explosion scenarios from the FERA, none of these systems fell within a hazard contour that would impair their function. That is a genuinely positive finding, and it reflects well on how the fire protection systems were positioned and specified during the early design stages.
Emergency Escape Lighting was similarly assessed as survivable. The system has a dedicated Uninterruptible Power Supply, which means it keeps running even if normal power to the platform is lost something that, in a serious incident, is often one of the first things to go.
The more nuanced findings came from three SCE categories: Fire and Explosion Protection, Passive Fire Protection, and the Gaseous Fire Suppression Systems. All three showed vulnerability but only under low frequency scenarios, at the 1×10⁻⁵ per year hazard contour level. No impairment was identified at the higher 1×10⁻⁴ per year frequency level, which is the more commonly cited risk threshold in offshore safety assessments.
The affected areas were specific rather than platform wide selected locations on the Lower and Intermediate decks of the platforms. That specificity is important, because it means the recommendations that follow are targeted rather than requiring a wholesale redesign of the protection systems.
It is worth being clear about what a 1×10⁻⁵ per year frequency means in practical terms. It describes an event that would be expected to occur once in a hundred thousand years of platform operation. But a low probability is not the same as an acceptable probability particularly over a production life that could extend for decades, and in an environment where external rescue response times are extended by ice conditions. The vulnerabilities warranted action, and the assessment recommended it.
Helicopter Facilities came through the thermal radiation and explosion assessment cleanly the helideck was not impaired by any of the credible fire or explosion scenarios. The complication arose with toxic gas dispersion. Some gas release scenarios have the potential to affect the Living Quarters area, including the helideck, in a way that would make helicopter evacuation impractical or unsafe.
This is not an unusual finding for platforms where process areas and living quarters are in relatively close proximity, but it does mean that the Emergency Response Plan cannot treat helicopter evacuation as the primary or default route in all scenarios. The assessment flagged the need for alternative evacuation and rescue arrangements to be explicitly planned and available including lifeboat deployment and ERRV standby.
Personal Survival Equipment and Rescue Facilities were both assessed as acceptable, but with two conditions attached. First, PSE quantities need to be increased to ensure adequate provision for everyone on board at maximum personnel-on-board levels. Second, Emergency Response and Rescue Vessels need to be continuously available throughout the operational life of both fields not just on an ad-hoc basis. In a location where ice limits conventional rescue vessel access for part of the year, the ERRV is not a supplementary resource; it is a primary one.
For the three SCE categories that showed vulnerability under low-frequency scenarios, the ESSA produced a set of targeted recommendations. These were incorporated directly into the FEED deliverables which matters, because FEED is when it is still practical and cost-effective to make design changes. By the time a project reaches detailed engineering, the cost of retrofitting protection upgrades rises sharply.
The key recommendations covered the following areas:
There is a version of this project where the ESSA was deferred to detailed engineering. In that version, the vulnerability findings in the Lower and Intermediate deck areas would still have been found but the cost of addressing them through structural modifications, equipment relocations, and protection upgrades would have been significantly higher, and the design decisions that created the vulnerability would already have been locked in.
Running the ESSA at FEED stage meant those findings arrived when the design was still flexible. The recommendations could be absorbed into the detailed engineering scope without requiring rework of completed designs. The project team had the information it needed to make the right decisions before those decisions became expensive to revisit.
There is a broader point here too. An ESSA is not just a document produced to satisfy a Safety Case requirement or at least it should not be. Done properly, it is a practical engineering tool that drives specific design improvements. The recommendations that came out of this assessment were not generic; they were linked to specific systems, specific deck areas, and specific hazard scenarios. That level of specificity is what makes recommendations actionable.
The Kalamkas-Sea and Khazar ESSA was not a straightforward study. The combination of a large multi-platform scope, an ice constrained operating environment, and the need to integrate results from multiple upstream safety studies made it one of the more technically demanding assessments our team has worked on. But that is exactly the kind of project where a rigorous, properly structured ESSA earns its value not on the shelf as a compliance document, but in the specific design changes it drives and the confidence it gives to everyone from the project engineering team to the workers who will eventually live and operate on these platforms.
With the recommended enhancement measures in place, the emergency systems across the Kalamkas-Sea Drilling Platform and Living Quarter Platform are assessed as capable of meeting their survivability objectives. The platforms will be equipped with systems that have been tested against realistic, project-specific accident scenarios not just assumed to be adequate.
If your project requires an Emergency Systems Survivability Assessment, or if you need support Contact us with a related technical safety study including FERA, EERA, or QRA, the Elixir Engineering team is ready to help. Get in touch to talk through your project requirements.
