QRA (AND FRA) METHODOLOGY

This appendix gives an overview of the QRA methodology that DNV propose to apply
in this study and then sets out in more detail how each element, or task, would be
carried out.

The intention of this appendix is to provide an indication of the methodology typically

adopted by DNV for this kind of study. Detailed aspects of the modelling would be
developed as the study progresses, such as allowances for site-specific factors.

Note that this would also be applied for the FRA in this case.

III.1 Overview of QRA Methodology

The five normal components or stages of a risk analysis study are usually considered to
be:

• Hazard identification and failure case definition.

• Failure frequency estimation.
• Consequence calculations.
• Risk analysis.
• Risk assessment.

Figure III.1 shows the interrelationship of each step and the additional external data
requirements. It also shows how, once the risk levels have been calculated, potential
measures to reduce the frequency or consequences of the risk drivers can be analysed by
re-running the analysis until the desired risk reduction is achieved.

Each of the above stages are described in Sections III.2 to III.6, together with an
additional section (III.7) describing the proposed approach to the analysis of domino
effects (escalation analysis).

The above sections set out a relatively generic approach to QRA. There are a number
of specific requirements for the QRA defined in the Invitation to Tender, which are
addressed within Section III.8.
Figure III.1 - Classical Risk Assessment Procedure
III.2 Hazard Identification and Case Definition (and Data Gathering)

III.2.1 Data Gathering

Input data gathering will not simply be an exercise in gathering hardcopy

documentation. The project team will be interested in understanding the context of the
available data, and in agreeing key assumptions with CLIENT (and OWNER as
appropriate) personnel. As the study progresses this should be a two-way process,
where the influence of assumptions on the risks should be discussed directly (as well as
through the various interim and formal reports).

General interaction when gathering information can provide additional latent

advantages in that DNV, CLIENT and OWNER’s mutual understanding of expectations
of the risk assessment deliverables can also improve.

A key element in conducting effective QRA studies is the understanding of the

influence that the various input parameters and assumptions have on the risk results.
The risk modelling resources that are available to the Project team, and the experience
of the team, enables the detailed analysis to be conducted efficiently enabling them to
concentrate the analysis effort in understanding the influence of the many parameters.
This is a key aspect in producing effective recommendations, in ongoing support and
communication with CLIENT engineers and, initially, in the review and collation of the
available input data. Of particular importance will be ensuring that any areas of
uncertainty or significant assumptions are discussed and agreed to ensure that the most
realistic possible results are obtained.

III.2.2 Hazard Identification

The first stage in any risk analysis is to identify the potential accidents that could result
in the release of the hazardous (flammable, reactive / explosive, toxic) material from its
normal containment. This is achieved by a systematic review of the facilities and
proposed designs.

The Hazard Identification (HAZID) is covered separately within this project and would
provide a direct input to the definition of major accident hazards (i.e. cases) for analysis
in the QRA. Note that the same personnel will be used for the HAZID and the QRA
studies if practical.

It should be noted that the hazard identification exercise provides a key input into the
risk analysis itself, but is also a fundamental aspect in ensuring that the risk analysis is
conducted in accordance with OWNER’s appropriate procedures.
III.2.3 Case Definition

The analysis of the facility will be conducted on a sectional basis, grouping the
processes within the facility into a series of sections where the various release sources
will have similar characteristics, and hence consequences. The key factors in selection
of these representative sections are:

• Material / phase released

• Release condition (whether the driver for the release is the inventory of a vessel
upstream, pumped flow, etc)
• Process conditions (temperature and pressure)
• Release location (the area in which the release occurs, including the height)
• Isolation (consideration is given to whether the inventory that may be released can
be isolated by ESD, noting that the time taken for such isolation to occur will be a
key factor)

For each of the sections, or hazardous scenarios, representative release sizes will be
considered.

Typically, for process equipment, this would include:

• Full-bore rupture (based on the most representative line size within each section)
• Large leaks (e.g. due to connection failures) - 75 mm (3”) equivalent diameter
• Medium, Small and Very Small leaks (e.g. due to corrosion, impact and other such
cases) – 25, 12 and 2 mm (1”, ½” and 1/10”) equivalent diameter leaks respectively

For storage tank and marine accident scenarios, releases are typically considered in
terms of catastrophic ruptures and large leaks. The detailed release scenarios would be
derived as part of the detailed analysis.

The key parameters determining the behaviour of the release, and the subsequent
consequences, are the representative release rate, the duration of the release, and the
release velocity. These parameters are typically derived from initial discharge
modelling conducted within the PHAST software based on the representative inventory,
temperature and pressure. However, it should be noted that the project team’s
experience will be utilised in the definition of scenarios, where modifications to ensure
that the release scenarios are as representative as possible will include consideration of
the influence of mitigation measures such as drainage and kerbing, and modelling
techniques to ensure that the oil and gas components of the header / well fluid releases
are both accounted for in a realistic manner.

III.3 Frequency Analysis

DNV have access to a wide range of appropriate failure data, where the most
appropriate data sets will be selected for the study.

The UK HSE’s Hydrocarbon Release Database (known as the “HCRD”, or “OIR 12”,
database) is proposed as that best suited to this study, for the main ‘process’ failure
scenarios, as used in many similar studies.

The basis of the hazardous release frequencies for storage tanks will be drawn from
DNV’s technical reference data, which is based on review of all available incident data
and appropriate standards. However, the assessment of the likelihood of release events
arising from specific major accident hazards, such as external events (seismic, aircraft,
etc) and operational aspects (specific procedures such as pump maintenance), will be
the key influences on the frequency (and type) of the release scenarios.

As for the other release frequencies, the escalation (domino effects) analysis will also be
a key contributor to the potential release frequency.

III.4 Consequence Analysis

The consequences are proposed to be calculated in the PHAST consequence modelling

software, with specific explosion analysis also conducted within the risk software
BLAST, both of which are described briefly in Section III.4.4.

Using the failure case data derived in Section III.3, PHAST undertakes consequence
calculations for each identified failure, starting with the dispersion of the released
material. At its heart is the Unified Dispersion Model (UDM), an atmospheric
dispersion model which can be applied to vapour and flashing liquid releases which are
dense, neutral or buoyant over a wide range of initial momentums (velocity). The
model has been subject to independent comparisons with experiment and other such
models and found to perform well.

For flammable materials, the modelling then proceeds to determine the effect zones for
the various possible outcomes of such a release. A release can ignite as the result of
the event which causes it, or can ignite close to the source before the flammable cloud
has travelled away from the release source. If a release does not ignite in this way, and
it is still flammable, it can be ignited at a number of points downwind if its path is such
that it goes across (for example) a road, an area where people are present or other
ignition sources. The risk analysis must account for all these possible outcomes.

A brief summary of the key aspects in modelling the various outcomes (jet, pool and
flash fires, fireballs and VCEs) is given below.

III.4.1 Jet and Pool Fires

The key input parameters in defining jet fires are the release rate (for impacts), duration
(for escalation) and velocity. Other key input parameters include the material and
release elevation and orientation. For pool fires the rate, released inventory and the
material (i.e. burning rate) are the key parameters.

In either case, the consequences are modelled directly within PHAST, based on the
discharge parameters defined for each case using standard (and fully validated) models.

PHAST jet and pool fire results giving the downwind and crosswind semi-axis for the
flame and various radiation levels are obtained as the input to the BLAST risk model.

III.4.2 Vapour Clouds (Dispersion, Flash Fires and VCEs)

Dispersion of unignited gas releases is conducted within PHAST to determine the shape
of the vapour cloud for input to the BLAST risk model, where it is used to determine
both flash fire and vapour cloud explosion (VCE) consequences. Note that the
PHAST modelling determines the vaporisation from liquid releases, where the defined
parameters will include consideration of the kerbing and containment arrangements.

Two types of dispersion are typically modelled, intended to represent the two extremes
of release behaviour with respect to VCE consequences:

• Horizontal clouds correspond to the idealised (i.e. unobstructed) release conditions,

where the dispersion will tend to be dominated by the release momentum.
• Low momentum clouds are modelled as an estimate of the cloud behaviour for
releases that are impinged (either on adjacent equipment or the ground), where the
initial momentum will be lost and the dispersion will generally take the form of a
broader, shorter cloud (where the wind has more influence than for momentum-
driven releases). The modelling parameters are exactly as defined for the idealised
 case, where the PHAST dispersion model in this case treats the releases as low
momentum (in effect, limiting the defined velocity).

The PHAST output is read directly by the BLAST risk model, such that the dimensions
of the resulting cloud are defined in detail (for up to 10 segments).

• Where the cloud is ignited without being in contact with any area of congestion, a
flash fire is assumed to occur. The hazard range is typically taken as the distance
to LFL, i.e. is equivalent to the cloud dimensions.
• The BLAST risk model applies the Multi-Energy Model to the vapour clouds to
determine various levels of overpressure against distance. Starting (maximum)
overpressures of 1 barg are typically assumed for hydrocarbon facilities, and the
cloud energy is derived from the cloud shape assuming a stochiometric
concentration.

III.4.3 Fireballs

Fireballs occurring due to ignition of instantaneous flammable gas releases from vessels
are typically calculated in addition to the potential jet fires associated with the
corresponding pipe connection events, and are approximated to hemispherical shapes
and are based on the total mass released. The radius is determined according to the
standard IChemE model, with a surface emissive power (SEP) of 400 kW/m2 assumed
for masses of greater than 5 te and 350 kW/m2 for smaller masses.

III.4.4 PHAST and BLAST Software

The PHAST suite of consequence models is fully integrated into the BLAST package,
and it is proposed that BLAST and (hence) PHAST are used as the basis for the
analysis. These packages are summarised briefly below, while further details (on these
and other DNV Software products) are readily available upon request.

• PHAST is a comprehensive hazard analysis software tool which is applicable to all

stages of design and operation across a wide range of process industries. The
Unified Dispersion Model (UDM) at its heart is respected as one of the world’s
leading dispersion models for process safety applications. The theory and
performance has been independently reviewed as part of the EC funded project
SMEDIS, and it has excelled in both areas.
• BLAST is a comprehensive in-house onshore QRA package, which was originally
developed to address on-site risk modelling in applications where explosion risks
are of particular significance. Explosions are modelled using the TNO Multi-
 Energy Model, taking account of the congestion in process units and other areas.
BLAST has been developed to combine the output from the consequence models in
PHAST with meteorological data, population, frequency and, in the case of
explosions, process congestion data to produce risk predictions. The program
models toxic and flammable consequences to produce on and offsite risks.

• BLAST has been developed specifically to enable onshore QRA studies to provide
relevant design inputs (such as fire and explosion loads at all locations within a site,
for a range of design levels, enabling design decisions to be based either on worst-
case loads or to use a risk-based approach). Risk can be presented by BLAST in a
number of formats: individual risk contours, societal FN-curves, risk ranking tables,
etc. Individual consequences or combined hazard frequencies can be overlaid on
to site plans.

III.5 Risk Analysis

III.5.1 Background Data

Besides the consequence and frequency analysis results, as described in the previous
sections, several other sets of ‘background data’ inputs are needed for the risk analysis:

• Population distribution indoors and outdoors, onsite and offsite, for day and night
time (or other representative time periods as appropriate);
• Congested areas (volumes);
• Strong ignition sources active during day and night time;
• Fatality probabilities per building (and populated area) for each outcome;
• Weather condition and wind direction probabilities.

The key background data assumptions in each case, are summarised below.

• Ignition probabilities are key aspects in the determination of the frequency of fires
and the type of fires / explosions. The overall, background probability of ignition
will be based on the mathematical functions derived by UKOOA (UK Offshore
Operators Association), as recommended by OGP (Oil and Gas Producers), among
others, which relate ignition probabilities in air to release rates for typical scenarios
both onshore and offshore. In addition to the ‘background’ delayed ignition
probability, strong ignition sources are defined within the risk model to account for
additional ignition potential in specific release / dispersion directions.

• The values for the probability of explosion, given that ignition occurs, are typically
based on a model derived by Cox, Lees and Ang, which relates the explosion
 probability to the release rate. In accordance with the Multi-Energy Model
explosion framework, if the cloud does not cover a region of congestion, then the
explosion probability is assigned to a value of 0.

• Data relating to the wind directionality and speed (i.e. wind rose data) is assumed to
be readily available and is a key input in terms of the direction in which flammable
clouds disperse, and the associated hazard range. The stability category is also a
key influence on the dispersion, particularly for low momentum / dense clouds.
Review of the available meteorological data will be conducted to select appropriate
stability categories, where the default would be to use D5 (neutral, 5 m/s) and F2
(very stable, 2 m/s) representative weather classes, which are broadly consistent
with ‘typical’ and ‘worst case’ vapour cloud dispersion conditions.

• Population data would be used as provided by CLIENT / OWNER, where the

building types in which each group spend their time (or a proportion of their time)
will be key inputs in terms of the vulnerability to impacts.

• Vulnerability criteria will be proposed for each population type according to the
building type, which is typically classified according to the CIA guidance (e.g.
reinforced concrete, typical domestic brick, etc).

• Congested volumes are likely to involve a degree of judgement at this stage in the
design and will be a key aspect in which DNV’s expert explosion modellers would
be involved. The importance of recognising the potential uncertainty in the size
and extent of the potential congestions (and hence the resultant explosion hazard
ranges) is emphasised and it is anticipated that sensitivity cases will be included
(dependent on the quality of the available information and the influence of the
identified congestions).

III.5.2 Risk Analysis

As discussed in Section III.4 (and III.4.4 in particular), the risk analysis is proposed to
be conducted within the BLAST risk software. BLAST enables the comprehensive
dispersion and fire modelling of the industry-leading PHAST consequence modelling
software to be fully integrated with the Multi-Energy Model approach to assessment of
VCEs. The outputs of BLAST are such that all of the results requirements of the
Scope of Work (see also Section III.8) are readily provided directly from the risk model,
enabling the project team to focus on the quality of the inputs and on the analysis of the
outputs, to ensure that the study provides CLIENT with a full understanding of the risks
associated with the project.
BLAST generates the required risk measures, calculating both individual risk at grid
points and the societal group risk of each incident outcome.

These are then summed to present the risk levels associated with the proposed facilities
in the following standard risk measures:

• Individual risk contours which show the geographical distribution of risk to an

individual outdoors on a map of the area. From these, the average individual risk
at specified locations can be determined. Individual risks indoors will be
calculated at all occupied buildings.
• Societal risk (FN) curves which show the cumulative frequency (F) distribution of
accidents causing different numbers (N) of fatalities, usually shown for convenience
on a log-log plot.
• Potential Loss of Life (PLL) which is the sum of all accidental outcome
frequencies multiplied by their corresponding number of fatalities (thus the PLL is
an average number of fatalities per year). This is a single value measure of societal
risk, as compared with the FN curve which is a distribution.

As well as presenting the overall risk levels, the contributions to individual risk in each
building, and at selected points outdoors will be ranked to identify the cases that
dominate the risk. The analysis can identify not only the release cases which dominate
the risk, but the outcomes (e.g. explosion or jet fire). Frequency contours for each
hazard are plotted directly from the BLAST software, which also provides detailed
breakdowns of the frequency of events and the key contributors to consequences and
risks at specified locations, including exceedance curves.

The sensitivity of the risk results to the modelling of these cases will be investigated.
Once the base modelling is considered to be acceptable, the cases which dominate the
risk should form the focus of any risk reduction measures deemed necessary.

III.6 Risk Assessment

Demonstrating that the risks are ALARP is understood to require more than that the
risks be in the region between the lower and upper risk criteria; they are not necessarily
ALARP if they are in this region but only ‘tolerable if ALARP’. This requires that,
once the base risk level has been established for the design analysed, a range of risk
reduction measures must be assessed. This requires a balance to be determined
between costs (time, money, operability, etc.) and benefits (risk reduction). The means
used to determine this balance can range from qualitative through to Cost Benefit
Analysis. Typically, if a measure can be implemented quickly and cheaply, it should
be, regardless of the absolute risk levels. However, if this is not the case, more
analysis is needed. Only when it can be established that no more risk reduction
measures can be implemented that are ‘reasonably practicable’, can the risks be said to
be ALARP.

The above is a key objective of the work where the key aspects are considered to be:

• Ensuring that the initial risk analysis provides a full and clear understanding of the
base case risk contributors, enabling the release scenarios (e.g. rupture of loading
line), the specific outcomes (e.g. jet fire), the affected populations (e.g. operators)
and the influence of mitigating measures / modelling assumptions (e.g. isolation /
release height) to be clearly identified.
• Ensuring that the detailed modelling is used to make effective risk reduction
recommendations, which are also quantified.

It is considered that the depth of experience and the highly suitable risk modelling
software, will enable DNV to conduct the base case modelling accurately and
efficiently, leaving adequate time to focus on these key risk assessment aspects.

Note that Cost Benefit Analysis (CBA) is outside the scope of work and not considered
to be necessary at this stage of the design process. However, due consideration of the
relative costs will be given in selecting the most appropriate recommendations, where
the potential risk reduction, assuming implementation of the measures will be quantified
through sensitivity analysis.

III.7 Escalation Analysis

The escalation analysis will have the same basis as the BLAST modelling of risks to
personnel, but with extension of the consequences to account for the longer duration
effects. The emphasis in the escalation analysis will be on identifying the potential for
escalation, noting that:

• Where an initiating event has the potential to lead to escalation, this will be either
due to fires of at least 5 minutes duration or due to explosion events. It is assumed
that exposed personnel surviving an initiating event will evacuate the area before
 escalation events occur and hence the influence of escalation events (noting also the
relatively low frequencies involved) on the overall risks to people will be minor.

• Escalation will have implications to emergency response personnel, but this is

assumed to be addressed within the emergency procedures (and will vary for each
and every escalation event) and is considered to be outside the scope of this study.
The key mitigating measure with respect to risks to emergency personnel will be to
limit the potential for escalation, by minimising release durations and ensuring that
effective fire fighting measures are in place.

• Escalation potential will be defined in terms of design loads, for example,

corresponding to:

- Pool fire load of 10 minutes (conservatively taken as 40 kW/m2 radiation level)

- Jet fire load of 5 minutes (conservatively taken as 40 kW/m2 radiation level)
- Blast overpressure of 0.3 barg

• The frequency with which each of the above occurs will define the potential for
escalation. It should be noted that in most cases escalation will require greater
loads, but this will be dependent on the affected equipment, among other factors.
The above loads represent the threshold used as the basis for identifying the need for
mitigating measures.

• The design load is typically determined by fire / explosion loads occurring with a
10-4 per year frequency, although 10-5 per year frequency loads should be catered for
wherever practicable. However, the aim of this analysis will be to define the
frequency of the various loads; determining the acceptability of these loads is
considered outside the scope of this study.

III.8 Specific Requirements

The following table is included in order to indicate how the base case model and risk
analysis will address the specific requirements set out in the Invitation to tender
documents.
Table III.1 - Specific Requirements for the QRA Study

QRA Activity / DNV’s Proposed Approach

Requirement

Conduct BLAST Overpressure Overpressure frequency contours to be produced for 6 overpressure levels
Modelling to confirm blast protection (0.03, 0.07, 0.11, 0.15, 0.3 and 0.5 barg) with detailed results (e.g.
requirements for Building Structure overpressure exceedance curves) for specific locations, such as the control
and Plant (with particular regard to building or other locations of interest. It is proposed that the definition of
location, safe distance and design blast loads be based primarily on the peak side-on positive over-
survivability of the Control Building). pressure and phase duration data as these tend to be more onerous (and
Blast exceedance curves shall be generally of more benefit to apply as design basis) as compared to the
developed to aid in assessment of rarefaction (negative phase) explosion loads.
Blast Basis of Design. The following This requirement also applies for the FRA study.
parameters, to define the blast load,
shall be obtained:
• Peak side-on positive over-
pressure, positive phase
duration, rise time and the
corresponding positive impulse.
• Peak side-on negative pressure,
negative phase duration and the
corresponding negative
impulse.

Review Fire Protection drawings, Flash fire, pool and jet fire flame and radiation exposure frequency contours
Fireproofing Maps and F&G will be provided from the risk model and used to review the indicated
Detector drawings developed by CLIENT drawings. Fireproofing considerations will draw primarily on the
CLIENT. escalation analysis results (i.e. fire loads accounting for duration). A short
technical review note, describing the above with any recommendations that
are appropriate, will be issued independent of the QRA itself (and can also
be an appendix to the QRA if required).

Note that the fire (and explosion) hazard frequency contours from the risk
model also form the basis for the FRA study.

Perform Fire and Explosion Risk The fire and explosion risk analysis will be covered within the FRA study
Analysis and present the risk itself, and will be used as the basis for the QRA study.
contours on plot plans.

Perform Escape and Evacuation A coarse analysis will be performed in the context of the QRA. That is, the
Analysis fire and explosion risks in different areas will be used to make
recommendations with respect to escape and evacuation. Detailed
 QRA Activity / DNV’s Proposed Approach
Requirement

analysis of evacuation behaviour under different loads is not considered to

be within the scope.

Perform Safety Critical Element Safety critical elements will be identified in order to prevent, detect, control
analysis, and develop performance or mitigate those hazards identified in the HAZID review. Performance
standards for each standards for each safety critical element will then be proposed to enable
the re-assurance that safety critical elements (SCEs) are, and will remain,
suitable for their intended purpose throughout the life of the facility. Note
that the ultimate definition of performance standards is OWNER’s
responsibility.