Quantitative Risk Assessment (QRA) 1 Concept

The figure below summarises an individual risk plotting process. This is a preliminary individual risk diagram of a LPG tank at a service station. Known hazards include a relief valve fire on the tank itself, a relief valve fire on the truck that fills it, major leak valve fires and a tank rupture with resulting vapour cloud explosion. Each has a different likelihood of occurrence and a different consequence severity as well as a different location and hazard radius.

0 Events and

Frequencies

Tank Relief Valve Fire (17x10 pa)

Tanker Relief Valve Fire (10x10 pa) Major Leak Fire (7x10 pa) Tank Rupture Explosion (3x10 pa) 40 30 20 10 Chances in a million per year

-6 -6 -6 -6 Risk = 3 x 10 pa Risk = 10 x 10 pa Risk = 20 x 10 pa Risk =37 x 10 pa

Site Boundary

Individual risk plot for a LPG Tank (plan is a 10m grid)

The likelihood of each event occurring is shown in chances per year. Each circle represents the region in which an unprotected standing person is likely to be killed if a particular event eventuates. So if the sum of all the event frequencies per year is calculated at a point, the likelihood of killing an individual standing at that spot continuously for one year is known.

Having added up the cumulative risk at different locations, it is then possible to plot iso-risk contours and compare these to the land use planning criteria described later in this chapter to determine the acceptability/unacceptability of the facility or operation in question.

Individual risk is the risk that an individual would face from a facility if they remained fixed at one spot 24 hours a day 365.25 days per year, the so called “tethered person”. This effectively relates to an

individual such as a toddler or elderly adult who has limited mobility and may be expected to be present at a residential location for much of the time.

The generic steps for the QRA procedure for the risk assessment process hazards are: a) Context and Scope

b) Credible Threat (Hazard) Identification c) Likelihood Assessment

d) Consequence Assessment

e) Risk Assessment (combining c & d)

The five key stages of the QRA process are expanded in the following sections. 13.3.2 Credible Threat (Hazard) Identification

Credible threat (hazard) identification is the stage where materials, equipment and operations that have the potential to do harm are identified. Threats can include the storage or processing of hazardous substances and operations where error can result in the release of hazardous material or damaging energy.

There are a number of generic techniques that can be used to perform a well documented and

systematic threat (hazard) identification. Some of these techniques are discussed in Chapters 7, 9 and 10. Chief amongst these are:

Top Down

* Threat and Vulnerability Assessments (can be done on a geographic or zonal basis). * Tiered Approach (Section 13.2.2)

Bottom Up

* Fault Mode Effects & Criticality Analyses (FMECA) * Hazard and Operability Studies (HazOps)

13.3.3 Likelihood Assessment

When all threats (hazards) have been identified the frequency of their occurrence is estimated, usually by consideration of relevant historical data. For the process industries the initial incident usually involves a loss of containment of some sort, typically a leak. Hence the most common failure modes are various hole sizes producing different sized leaks. R2A like to use the term “Hazardous Event” for the initial incident, as at this point there is the chance that no harm will eventuate.

Hazards can have a variable number of potential failure modes. For example, piping sections have an infinite spectrum of potential hole sizes and resultant release rates. In order to deal with this the failure modes (hole sizes) of the equipment making up the hazard are broadly categorised in a number of discrete groups, such as pinhole, hole, and rupture. The number of discrete groups used to classify potential releases is dependent on the sensitivity of the overall risk results to this grouping, the nature of available historical failure rate data, and the need to constrain the analysis from becoming overly complex.

With the failure modes of a hazard categorised, all components contributing to each failure mode are identified. The process of how the failure rate of various components is aggregated into an overall failure rate is shown in the next figure.

Potential Failure

Components _{Hazardous Event} Failure Mode Piping

The process described here has been systematically expressed as the R2A computer based system of work as follows.

• Process and instrumentation diagrams (P&IDs) are imported as images into the R2A system. • Identified hazards are separated into isolatable sections containing common failure modes (pipes or

vessels). Intelligent computer 'objects' representing all valves, flanges, vessels, pumps, pipework etc are overlaid on the P&ID. These (potential) failure items are linked to a failure rate database. Each isolated section is aware of failure items associated with it. Thus the failure rates for the range of hole sizes deemed appropriate for the section can be aggregated. Up to 4 hole sizes are selected to represent the spectrum of failure hole sizes possible for the process section under consideration. 13.3.4 Consequence Assessment

Incident Outcome Determination

Having established the range of failure modes to be considered for each hazard, the next stage of the analysis is to determine the range of possible outcomes for each failure mode. This is dependent on the existence and implementation of mitigation measures (automatic or manual detection & isolation), and on the potential for event escalation (for example, ignition of flammable material). A useful method for representing the time sequence of events and the possible outcomes following a release is an event (outcome) tree analysis.

The event tree starts at the hazardous event, which is one of the failure modes of the hazard in

question. The tree branches, with each fragmentation representing an intermediate event such as early ignition of a flammable release. Each branch is assigned a probability, with the ends of the tree

representing the probabilistic distribution of all potential outcomes. The figure below shows an extension of the fault tree shown in section 13.3.3 Likelihood Assessment. It includes the fault tree as well as an event tree and hence becomes a cause-consequence diagram.

Hazardous Event Failure Mode (Loss of Control) Piping Flanges Valves etc Minor Leak OR Time Rapid Isolation? Delayed Isolation?

Small release Medium release Large release Yes Yes No No Threat (Hazard)

Components Intermediate Events Outcomes

Cause Consequence Diagram

The intermediate events that can cause a permutation of outcomes can be release intervention strategies such as:

* automatic detection and isolation equipment, * manual detection and isolation equipment, or factors effecting the nature of a release such as:

Each of the intermediate events is predetermined to occur at a nominated time, and in a specific time order, with changes to the time order influencing the potential outcomes. As timing can also affect the size of a release, the analysis can also demonstrate how the performance of mitigation and control equipment will affect the overall risk result.

The conditional probability of intervention strategies can be determined from reliability data of the components making up the system. For intervention and detection equipment that fails in a hidden manner, fractional dead time analysis can provide conditional probabilities that the equipment is in a failed state when called upon (refer section 12.4). Fractional dead time is dependent on the testing period of the equipment, which means another performance measure can be included in the risk model. Using event trees to show the time order of potential intermediate events following an initial release is a useful way of exploring the range of possible outcomes. For a simple plant where the number of possible intermediate events will be small, choosing a fixed time order is reasonable. For a complex and congested plant, the number of intermediate events will be large, and determining the time order of these events with certainty becomes impossible. In these cases more complex models are required which consider all possible permutations of the time order of intermediate events.

Impact Quantification

Event trees establish the size of potential releases and their probabilistic consequence scenarios. Scenarios resultant from a flammable release that have an impact include:

* Fireballs or BLEVEs (Boiling Liquid Expanding Vapour Cloud Explosions) * Flash Fires

* Vapour Cloud Explosions * Pool Fires

* Jet Fires

* Projectiles (especially 200 l drums of flammable liquid).

Releases of toxic materials can have wide ranging impacts as toxic clouds.

The severity of impact that can result from these consequence scenarios can be quantified in terms of: * Heat Radiation for Fireballs, Pool Fires and Jet Fires;

* Explosion Overpressure for Vapour Cloud Explosions; * Flammable Concentrations for Flash Fires &

* Toxic Load or dose for Toxic clouds.

In order to determine the extent of the impact of the consequence scenarios a model or combination of models is required for each type of consequence. The modelling of the impact of accidental releases of hazardous materials is an extensive subject, discussed briefly in this chapter.

Probit Equations

To quantify the risk of fatality or injury following a hazardous release, a dose response relationship is required. Probit equations are particularly useful for heat radiation or toxic releases, where a sustained low level exposure can be equally as fatal as an instantaneous high level exposure. Probit equations are usually written in the form:

Y = A+ Bln(hazardous load)

The probit, Y is a random variable with a mean of 5, and a variance of 1 (for example, Y=5 corresponds to a 50% chance of fatality). Probit equations for exposure to thermal radiation and toxic gas are

13.3.5 Risk Assessment

Risks to the life and safety of people on and off site can be measured in a number of ways, some of the more common are:

* Individual Risk, * Societal or Group Risk,

* Potential Loss of Life (PLL), and

* Other Criteria, for example TLS (Target Level of Safety) for rare maintenance events). Individual risk and societal risk are discussed in Chapter 6. Individual risk is the risk that an individual would face from a facility if they remained fixed at one spot 24 hours a day 365.25 days per year. Its value is a frequency of fatality, usually chances per million per year, and it is displayed as a 2

dimensional plot over a locality plan as contours of iso-risk. The fact that the values are for fixed targets is not always made clear, as it may be assumed that some individuals have the potential to only be present periodically. The figure below shows a simplified example of an individual risk plot.

Site Boundary 1 x 10 1 x 10 1 x 10-7 -6 -5

Simplified Individual Risk Plot (numbers are fatality frequency per year)

Societal Risk is a measure of the frequency (F) of fatalities of various numbers (N) of the community for a particular hazard. This is represented as a curve on log axes, which is called an FN curve. The curve is cumulative in terms of frequency, as if there have been 10 fatalities there has also been 9, 8, 7 etc. Societal risk is designed to display how risks vary with changing levels of severity. For example a hazard may have an acceptable level of risk for just one fatality, but may be at an unacceptable level for 10 fatalities. The figure below shows a simplified example of a societal risk plot.

Netherland Unacceptable Limit Netherland Acceptable Limit 1 10 100 1000 10 10 10 10 10-3 -4 -5 -6 -7 -8 10 Number of Fatalities (N) Frequency of N or more fatalities per year

The data from a societal risk plot can also be used to determine the PLL (probable life loss). This is basically the sum of the product of each FN pair. The result is a single number, which represents the expected number of fatalities per year.

Whereas individual risk uses the "tethered person" approach, societal risk (and hence potential loss of life) is more flexible in terms of the habits of the population. Factors such as variable population densities during the day and protective measures installed can be taken into account when determining the number of fatalities.

Traditionally QRA for the petroleum and chemical industry is required to produce results as both individual risk and societal risk plots. This allows a comparison against regulatory risk criteria and facilitates the assessment of available risk control options.

Typically a QRA uses a facility’s stable, year to year operating mode. However, the risks associated with construction and commissioning provide for possible increased risk at that particular time. Annualising these risks in the QRA may not be wholly relevant since the precautions that are taken during normal operation may be expected to be different during construction.

In practice, some form of Not Less Safe (NLS) or common law criterion is often applied. The NLS criterion is essentially a question of the form, "What should be done during these potentially higher risk periods to ensure that the risk to people (the public and workers) remains not greater than the risk during normal operation". The QRA and the application of the Individual and Societal Risk criteria then become the base case to which any special process such as construction may be compared.

The common law criteria are final arbiters, which extend beyond all of the above and directly address causation, foreseeability, preventability and reasonableness. They really considers the question, "Is there any practicable good precaution, which should be applied?" This tests to see if there is a simple risk control available at minimal cost that should be applied irrespective of any formal QRA type criteria. 13.3.6 QRA Difficulties

Unreality

Quantitative risk analysis is all about finding out what things must conspire together to bring about a serious problem, assessing which of these has the greatest importance in the hazard, and suggesting that such items be the primary focus of risk management. It often deals with absurdly small numbers and statistics, which can often lead observers to question the validity of the approach. One important factor in the outcome is the failure data used. Often an analyst is forced to use failure data for 30 year old facilities simply because it is widely accepted in the field as being the most reliable, whereas more modern data is less certain.

A possible answer is that whilst it is not an exact description of reality, it can be the best available to date so that until another better method is developed it should be used to demonstrate due diligence. Not Reproducible

There are arguments that the results of QRA are best used to compare the relative safety of different systems and not look at the absolute magnitude of the risk in relation to risk criteria. Whilst relative risk may be useful for designers to choose an optimum design, it does not address the public and hence the regulator’s concern of the level of risk a facility presents beyond its site boundary.

However, the use of alternative failure rate data and consequence models can also provide different results for analyses conducted on the same plant. Standardised failure data and methodologies would also address some of the differences between QRA results that can arise between studies carried out by different analysts on similar facilities.

QRA is a methodology widely used in the process industry, where risk is localised, and can often be contained within the site boundaries. "Black box" QRA approaches contain value judgements that are not made explicit and that the wide range of parameters is beset by uncertainty. A more transparent approach seeks to exemplify the source, range and application of assumptions, so as to provide decision makers with the best possible information at the time the decision is made.

Expense

The expense of QRA is also of concern. Multilevel risk reduction ideas are being used as previously described in Section 13.2.2, 13.3. Regulatory authorities are increasingly adopting these to reduce the cost burden on industry.