An Improved Approach to Offshore QRA

Transcription

1 An Improved Approach to Offshore QRA Brian Bain 1 and Andreas Fack 2 1 DNV Energy UK 2 DNV Energy Norway QRA is now an estabished method used wordwide for the evauation of risks on offshore instaations. The technique is increasingy used as a too throughout the panning phase and more cosey integrated with the design processes. The scope of QRAs may aso now be extended to cover other types of oss such as asset and environmenta damage. However, there are many issues in the use of QRA which may chaenge the vaue which such studies provide. These incude; integration with the design process appropriate invovement of the operators and decision makers ack of consistency compexity of the overa mode structure uncertainties ack of functionaity ikeihood of errors knowedge of anaysts abiity to update existing studies, and incorporation of new data and methodoogies Each of these issues present chaenges to an efficient and effective approach. Some modes may have been used for a ong time and users may have become compacent - no onger striving to improve the mode s accuracy or functionaity. This paper ooks at these issues and suggests steps which can be taken to achieve an improved approach. Keywords: Offshore, QRA, Safety Case Introduction Risk anayses have been activey used by the offshore industry in the North Sea for more than 25 years and are now estabished toos which are used wordwide. However, the requirements for Quantitative Risk Assessment (QRA) differ between different geographica areas and they may aso have been modified with time as the technique has matured and egisative requirements have changed. QRA has deveoped from primariy being a verification activity to being a too which can be used throughout the panning and design process, athough the extent to which this atter function is appied may vary between operators and within different parts of the word. Whie the main focus of QRA historicay has been to evauate personne risk, other outcomes such as environmenta damage, asset damage and oss of production have atey been cacuated/estimated.

2 This paper outines the issues and shows what steps can be taken to revitaise the QRA method and move to a more effective approach. The deveopment of offshore risk modes has been used as an exampe but many of the issues are equay appicabe to onshore studies. Current Chaenges in Offshore QRA There are many chaenges in the continua deveopment of QRA modes as a decision support too. Issues incude; consistency in modes handing of uncertainties impementing improvements in mode functionaity knowedge of anaysts effective presentation of resuts abiity to update existing studies Some of these issues have been described in detai [Gadd et a, 2003] and [Bain, 2003] but are summarised beow. Diversification of Approaches The seeds of probems in the current QRA modeing in the UK were possiby sewn in the eary 1990 s with the need to rapidy deveop modes to support Safety Case submissions. There was a confict between the need to produce assessments quicky and the need for adequate accuracy and consistency. This speed of deveopment made it difficut for the offshore oi and gas industry to evove standard ways of tacking the various technica probems. Inevitaby, different operators and different consutants adopted different approaches to each of these aspects. This has ed to a mutitude of mode types. Athough the basis of QRA is straightforward, its impementation in a mode with the capabiity of providing resuts to support decision making in the design process is compex. It invoves many aspects of physica modeing each of which can have arge uncertainties and there might be itte consensus on the most appropriate methodoogy and computationa toos to use. There are many different aspects to consider, each of which has a number of different approaches which coud be foowed. It is itte wonder, therefore, that modes created independenty of each other have evoved in very different ways. There were some views that QRAs shoud be created or customised to dea with specific instaations or the specific requirements of a cient. Whie there is some merit in this, the number and variety of soutions offered went beyond the need to meet these requirements and simiar situations have been deat with in entirey different ways. For exampe, assessment of fire hazards can be addressed by a variety of phenomenoogica modes, empiricay derived equations or simpe rue sets. The same can be said of ignition modeing, reease modeing and the structure of event tree risk cacuations. 2

3 Even where there is consensus on an approach or set of data to use there may sti be differences in how this is impemented. In the UK and most other counties, the UK HSE s hydrocarbon reease database (HCRD) [HSE, 2007] is acknowedged by most practitioners as the best source of data on process reease frequencies. However, different QRA providers wi sti interpret the resut in different ways eading to different cacuated risk eves. Mode Compexity In many parts of the word, the impression has formed that QRA studies are simpe commodity services which any competent practitioner can undertake with a high eve of accuracy. In fact, the process of providing a QRA which produces meaningfu answers is quite invoved. There is an expectation that a simpe QRA with a reduced set of input parameters can identify the difference in risk associated with different design or operationa options but this often isn t the case. Ignition contro is an exampe of a key safety systems and it is therefore often important to evauate the effect of different measures and configurations as part of a QRA. In order to do so, it is necessary to simuate their effect in the mode itsef. Adopting a simpified mode with generic ignition probabiities wi not be abe to differentiate between aternative strategies. In many parts of the word cients may express a desire for a simpified approach and whie this is we motivated and has some benefits there are aso some obvious disadvantages. In this market there is itte incentive for a QRA service provider to invest in deveoping the toos they use in their anaysis. The mode is ikey to be ess accurate and ess capabe of being inspected to understand the drivers which ead to a particuar risk eve for a given hazardous event. In Norway the trend is going in a sighty different direction with a stronger focus on detaied and compex modes and where the customer often is very active in the risk anaysis process. Invovement of Operator in the Process Few operators carry out QRA studies using their own safety departments. Typicay they are contracted to an externa consutancy. On occasions they may be further removed from the detai through other intermediaries, e.g. where the operator empoys an engineering consutancy who contract a consutant to prepare a safety case who in turn rey on a separate group of providers to perform the QRA. This distancing makes it harder, both to refect the operationa aspects of the instaation in the anaysis and for the persons who are in a position to impement improvements to benefit from information and insights uncovered in the mode. Typicay, anaysts carry out the work in an office and base their assumptions on the information provided by the cient in the form of drawings, tabes, information in the existing Safety Case and other documentation. Some of this information may be out of date but this may not be apparent. An anayst is not aways afforded the opportunity to visit the patform and assess at first hand the effect a given hazard might have. 3

4 Use of Resuts In the UK the main purpose of QRA has been to demonstrate compiance with toerabe risk criteria in the Safety Case egisation [HMSO, 2005]. Consequenty, there was a focus on demonstrating that the criteria for Temporary Refuge Impairment Frequency (TRIF) and Individua Risk per Annum (IRPA) were met. A typica approach was to initiay carry out the anaysis using conservative assumptions and progressivey refine the mode as necessary to meet the acceptance criteria. When compiance with these criteria had been reached, the incentive to deveop the anaysis further decined. There is sti a requirement to demonstrate ALARP (As Low As Reasonaby Practicabe) and this puts further requirements on the QRA mode. Simpe modes and approaches as described above are ess ikey to be abe to support such processes in a satisfactoriy manner. The approach in Norway has been different; here QRAs have been more integrated with the design process and there has been more of a drive towards accuracy through the use of CFD modeing, and probabiistic toos, particuary for exposion anaysis [NORSOK, 2001]. In the past, risk anayses were often carried out in isoation from the main design process and the overa panning. The findings of the QRA were not aways effectivey impemented because the best soutions were often identified ate in the design process resuting in costy variations and compromises which coud have been achieved more simpy if these issues had been identified earier. Experience in the use of the technique, changes in egisation, and some very costy incidents such as Aexander Kieand, Piper Apha and the P36 disasters have infuenced the use of QRA. Today it is a too that is activey used throughout a project s panning and design phase. It is used for decision support as we as to expore the safety impications of the choices being made. The QRA activities are cosey integrated with the design processes and are in many respects considered as routine. Updating of Existing Studies QRAs are normay intended to be iving studies which can be updated to refect changes in configuration and operation of the instaation. Uness there are major changes in design or operation, there wi normay be an expectation that risk eves wi be within the toerabe criteria and therefore the motivation to carry out the work to a high degree of rigour and to deveop more accurate approaches is essened. The time avaiabe to update a QRA wi normay be far ess than for the origina anaysis and so the opportunity to modify it to incude improved data and methodoogies wi be compromised. Very often the anayst updating the study is different from the one who carried out the origina work. The process of buiding up a detaied knowedge of the mode may take days or even weeks. In such circumstances it may be necessary to accept that a compete understanding won t be achieved. This wi diminish the abiity of the anayst to fuy understand the interaction of the various parameters and hence the abiity to identify the key safety critica parameters and remedia measures which coud provide risk reductions. 4

5 Changes to the mode may be made in a way which addresses the aims of the present study but they may be done in a ess than robust manner which wi be difficut to understand by others at a ater date. It aso increases the risk of inadvertenty introducing errors into the mode. It is aso ikey that there wi be a different person commissioning the study on behaf of the operator. It is therefore important that risk assessment reports are written in a way which ceary describes the status of the instaation and the assumptions made. This wi assist in identifying changes that have taken pace in the intervening years. Updates to QRAs are normay driven by technica or operationa changes. Changes in anaytica modes and our knowedge of physica phenomena may, however, aso necessitate modifications. In such cases it is important to anayse the effect of improved modeing and the effect reated to changes in configuration and operation in separate stages. This aows the actua risk change to be evauated as opposed to changes in cacuated vaues which are purey the resut of different methodoogies. For exampe, in 1998 fire and exposion experiments performed by the Stee Construction Institute gave new knowedge to the industry regarding potentia exposion risk. This resuted in the re-anaysis of most patforms in the North Sea and changed the design parameters for many instaations. It is easy to see why a vicious circe might be set up whereby the vaue the cient paces on the mode and the essening abiity of the QRA provider to maintain their understanding and make improvements eads to a decine in the overa quaity of the mode and further reduction in its vaue to the cient - quite the opposite of what shoud be aimed for. Uncertainty in Risk Anaysis It is we known that uncertainties in risk and consequence assessments can be considerabe. Furthermore, the accuracy of such studies wi vary extensivey with detaied anayses providing more accurate estimates than coarse assessments. A systematic way of managing uncertainties in risk estimates is particuary important when the accuracy of the resuts is critica, e.g. if probabiistic exposion resuts are to be used as the basis of the design of a bast wa, or if the resuts are cose to an acceptance criterion. In structura engineering it is norma practice to refect uncertainties through safety factors. Use of safety factors has not been norma practice in the area of risk assessments; instead a best estimate approach is the norm, whie the nature and effect of uncertainties may be discussed but not quantified. It has become apparent that, because of the uncertainties in the anaysis and the wide variety of approaches which can be taken, the resuts obtained by different QRA providers wi differ significanty. A risk anaysis may, for exampe, be compared to a weather forecast. Based upon modes and avaiabe data, one tries to say something about what can be expected. The accuracy of the weather forecast is dependant on anaytica skis, avaiabe toos, quaity 5

6 of data and the degree of detai required. The uncertainty of a quantitative risk anaysis wi be reated to aspects such as reevance and degree of detai of: Anaytica modes. Faiure data (scarce or no data on equipment representing new technoogy). Engineering judgement (response assessment, human reiabiity etc.). The uncertainties in even the most detaied risk assessment may be significant and the user of the resuts needs to be aware of this in making decisions based on them. In genera, a evauations of risk in the anaysis are sought to be best estimates, i.e. no systematic conservatism (or optimism) is incuded in the evauation. However, the assessment of issues where the uncertainty is significant tends to be on the conservative side in order to account for the uncertainty. In addition, sensitivity anaysis is often performed to investigate which input parameters infuence the resuts to the greatest extent. Here, the effect of a sma change in an input parameter on the resut is quantified. The resuts from these sensitivity anayses can then be used to focus more attention on evauating the key parameters which infuence risk. An Improved Approach A risk anaysis by itsef is of no vaue uness it is used as input to rea decisions. The risk anaysis must therefore focus on issues where it can identify practica improvements in design or operation. The anaysis must be suitabe for its purpose and this wi impose severa requirements on the anaysis itsef and how it is integrated in the decision process. In order to get more benefit from QRAs and hence an improved abiity to identify cost effective safety improvements, a number of steps are suggested. These are discussed in turn. Integration of Anaysis in the Design Process and Cient Invovement In order to achieve the goa, the risk anaysis must be initiated earier and be more integrated in the design process; Effective communication between the risk anaysts and the design team is essentia. The risk anaysis process shoud be synchronised with the engineering activity. Finay, the QRA resuts need to be transated into engineering terms. Many QRAs suffer from ack of cient invovement. As a resut, the quaity of data based on subjective judgements wi not be as high as it shoud be. The cient s staff may be in the best pace to provide both the factua data and judgements on the ikey consequences of initia and escaated events. Simiary, the resuts of the anaysis need to be fuy understood by the cient in order to correcty interpret them as an input to decision making. The active use of QRA for decision support for the panning and design phases of a patform ifecyce poses severa chaenges to the risk anaysts, the engineering team and 6

7 the decision makers. QRA modes are very abstract representations of the actua scenarios being modeed. Effective communication is essentia, both to ensure a proper understanding of the design probems so that these can be effectivey addressed in the QRA, and aso to ensure that the QRA resuts are understood by the design team and decision makers. Another important communication aspect is that the risk anaysis process is synchronised with the engineering activity. It needs to provide the right information at the right time. As the design progresses, the eve of detai in the design increases and the uncertainties reduce. The risk anaysis needs to refect this in order to address the key required decisions as the design progresses. It is therefore necessary to aim for a iving QRA, i.e. a risk mode of the patform that is updated and refined as required. Assumptions being made at an eary stage to compensate for missing information need to be foowed up and eventuay repaced by factua information when avaiabe. Finay, the QRA resuts need to be transated into engineering terms. Risk is measured in terms dictated by the risk acceptance criteria; PLL (Potentia Loss of Life), FAR (Fata Accident rate), etc. and risk reduction wi typicay be measured in terms of these. This is not reevant information for the engineering team. The requirements must be specified in terms of, for exampe, design capacities for exposion barriers or ocation of critica equipment. The risk anaysis needs to be sufficienty detaied to address the effects of safety critica eements so that aternatives can be assessed. Consequenty, the risk anaysis needs to be cosey integrated with detaied engineering studies. A graphica representation of how the QRA views the patform ayout and the hydrocarbon equipment may aid cient invovement by providing a more convenient means of presenting data and resuts. Standardisation The singe most important aspect which paces a barrier in the way of improvements in QRA is the ack of standardisation. With numerous variations of mode to maintain, possiby a different one for each instaation anaysed, there is unikey to be the opportunity to appreciaby enhance a given mode s capabiity within a given project budget. There is a desire for consoidation but this conficts with a desire to minimise the spend on a given study. Some improvements can be made as the mode moves towards compatibiity with a perceived best practice approach but this is a ong and inefficient process which wi take many iterations. Some operators have come to recognise this probem and how it impairs their abiity to compare risk eves between different instaations. Some have decided to contract the provision of QRA services, at east within a geographica region, to a singe provider who has been tasked with deveoping a consistent approach. Other operators are documenting their requirements for a standard approach which they require their QRA providers to foow. The Dutch government have, for exampe, specified one particuar too to be used for onshore QRA s One major operator is deveoping a standard too for high eve QRA to be appied to its instaations wordwide. However, they wi sti rey on different providers for detaied QRA. These approaches have some cear benefit but is ikey to sti eave 7

8 room for interpretation eading to different resuts from two anaysts compying with the same requirements. Some countries have sought to introduce standards to improve consistency but most have put the onus on operators to appy suitabe techniques and engineering practices. Standardisation of approach is amost essentia for the ong term deveopment of QRAs. It wi have the foowing advantages. More efficient deveopment because cost can be spread over a number of projects. Greater accuracy because the mode wi be scrutinised by more anaysts who can feedback information on errors and possibe enhancements. Consistency of resuts between instaations. Easier to justify the writing of user manuas and training materia. Structure It is cear that appropriate data and methodoogies are important in creating a successfu QRA mode. Less obvious is the need for an appropriate structure and its importance is generay underestimated. The carity of how the mode is operated and how the component parts interact with each other is essentia for deveoping a good understanding of it. A compex intertwined mode with itte or no documentation wi be difficut to understand. It wi take a new user onger to understand than woud otherwise be the case and is more ikey to contain errors. It aso makes updating the mode harder and errors are more ikey to be introduced when making changes to it. The more compex a structure becomes the more effort is required to change it into a simper one which is easier to foow. The temptation to make changes using a quick fix is greater but this makes the mode structure more difficut to foow for future users. The size and compexity of a QRA mode can vary consideraby. At one end of the spectrum there are highy integrated modes with automatic transfer of data between the component parts. At the other end, the study may consist of independent pieces of anaysis where the part referred to as the QRA mode itsef consists ony of the anaytica structure for combining the resuts of the separate frequency and consequence anayses. Some eements of the overa QRA may be externa programmes or cacuations whereas the part regarded as the mode itsef wi have a greater degree of connectivity. This is iustrated in figure 1. The greater the proportion of eements within the QRA boundary, the faster it is ikey to be to process changes in data through to fina resuts. Modes which require the manua transfer of data between one component and another are time consuming to operate. When a change to an item of data is made and the mode has to be re-run the user may be faced with the time consuming task of re-running arge parts of the mode and having the tedious task of carrying out data transfer operations. transfer operation can incude; Viewing data in the output from one mode and typing it to the input of another. Cutting and pasting operations between spreadsheets. 8

9 Frequency Anaysis Fire Anaysis Exposion Anaysis Frequency Anaysis Resuts Reease Modeing Non-process Hazards Modeing Exposion Anaysis Resuts Fire Modeing Smoke Modeing Risk Modeing Resuts Exported Resuts QRA Mode Boundary Figure 1. Interna and externa components of a QRA mode Linking of spreadsheet ces. Use of programming embedded in spreadsheets, e.g. visua basic macros, to manage the transfer between parts of the mode. Automated transfer between modes in tookit type modes. One further type might be termed operated adjusted data transfers in which the anayst considers the output from one or more modes and makes a judgement on the vaue to be entered into the next part. This might incude situations where, for exampe, the size of a fire and the ayout of the patform are considered together in order to make a subjective judgement on fataity rates in different areas. This has detrimenta effects on the speed and consistency with which modes can be run but this may be offset by aowing the anayst to take a fuer account of a the parameters which affect the resuts rather than being bound by prescriptive rue sets which may not aways be appropriate. Figure 2 shows an exampe of a data transfer too. Event Trees At the heart of the anaysis of a given hazard in a QRA is some form of event tree. This may be represented in the cassica format, in some variation presented graphicay or as a series of cacuations presented in tabuar form. Generay, some form of diagrammatic form is preferabe since it is easier to foow the ogic when it is spit into manageabe steps 9

10 Figure 2. Exampe of data transfer too in risk anaysis software rather than a compex equation which is difficut to understand. The compexity to which an event tree shoud be deveoped is a matter of opinion. The more parameters considered the more accurate and detaied the soution shoud be. This may be important in improving resoution for F-N curves, or in order to refect the impact of different safety systems. However, the number of parameters which coud be considered can be arge eading to a very great number of end outcomes which have to be handed. However there are some techniques which can be empoyed to increase the number of parameters whie sti maintaining a reativey simpe diagrammatic form. One method is to combine branches at an intermediate point in the event tree where the remaining branch structures are the same. For exampe, consider the segment of an event tree shown in Figure 3. A more advanced technique is the use of inked event trees where the end branch probabiities of the first become the top events for a second event tree which is then run iterativey to produce sets of end outcomes as iustrated in Figure 4. This approach reduces the overa event tree structure to a number of segments which are reativey easy to 10

11 Top Event Exposion Causes TR Wa Faiure Exposion Causes TR Structura Faiure Wind Bows Towards TR HVAC Trip Fais Reease is of Sufficient Duration No TRI Summation TR Wa Exposed to Heat TR Structure Exposed to Heat Reease is of Sufficient Duration Summation of No Impairment from Primary Ignited Event Exposion Causes Escaation Yes Yes No Yes Yes No Yes Yes No No No Yes No Yes No No TRI by Exposion Yes or Smoke Yes No No No No TR Impairment No E-02 Probabiities combined to singe vaue for further processing Figure 3. Combining of branches to reduce overa size of event tree Iterations of secondary event trees corresponding to each end branch of the primary event tree Primary Event Tree Figure 4. Linked primary and secondary event trees 11

12 understand but which combine to produce a very detaied structure addressing a arge number of safety critica parameters. Location of In a typica QRA, data is distributed throughout the structure and mixed with the anaytica eements and resuts. Figure 5 shows this situation diagrammaticay. This may not appear to be a probem but it creates difficuties when trying to continuay deveop a standardised approach. In this situation it becomes amost impossibe to maintain the consistency of the various modes. Either the same methodoogy change has to be appied to a of the modes or one mode has to be upgraded, copied to provide a series of tempates for the others and then data repaced. The aternative approach which resoves this issue is to separate out the data from the anaytica parts of the mode. This situation is shown in Figure 6. This configuration aows for the same mode to be used to anayse any number of data sets each representing a different patform or different variations of the same instaation. It is now possibe to modify the singe mode structure and in effect update a the QRA studies simutaneousy. The user wi sti have to update the data as the configuration of the patform changes but this is a reativey simpe task. Ony if the methodoogy change requires the structure of the data fie itsef to be modified do the individua data fies need to change and this wi normay be a reativey short task. Methodoogy The use of an appropriate methodoogy is sef evident, but what constitutes appropriate in this context may be a matter of opinion. Appropriate may not necessariy mean most accurate since this may invove the use of techniques which are expensive and time QRA for Instaation 1 QRA for Instaation 2 QRA for Instaation 3 Risk Modeing Component 1 Risk Modeing Component 2 Risk Modeing Component 1 Risk Modeing Component 2 Risk Modeing Component 1 Risk Modeing Component 2 Risk Modeing Component 3 Risk Modeing Component 3 Risk Modeing Component 3 Resuts Resuts Resuts Figure 5. QRA modes with embedded data in each component 12

13 #1 #1.... #n Unified Mode With No Embedded Risk Modeing Component 1 Risk Modeing Component 2 Risk Modeing Component 3 Resuts#1 Resuts#2.... Resuts#n Figure 6. Instaation specific data sets processed through a common mode consuming. Furthermore, the most detaied forms of dispersion, exposion and fire consequence anayses ook in depth at a set of very specific scenarios reating to the ocation, rate, direction and composition of a hydrocarbon reease, whereas a QRA has to consider the overa effects of a the possibe combinations of these parameters. Detaied anayses wi normay require speciaised software outside the QRA mode itsef and so there wi be issues of transferring the resuts in an appropriate manner into the overa anaysis so that it can be combined with the frequency data in order to cacuate risks. This is both time consuming and a potentia source of errors. The main issue is however that the mode must be suitabe for its purpose meaning that the compexity of the mode must refect the eve of detai required for supporting the reated decision. One possibe way of getting the benefit of sophisticated software in QRA is to generate a set of resuts from it covering a wide range of typica scenarios and use this to construct a data set which can be accessed by the QRA. The data set woud be part of the mode and so coud be readiy accessed when required, as shown in Figure 7. One simpe exampe of this is the use of the ookup correations for the UKOOA ignition mode [Energy Institute, 2006]. These are a series of curves reating ignition probabiity to reease rate for a number of typica scenarios. These curves were derived from a spreadsheet mode which impemented the fu methodoogy as described in the same report and which covers the deveopment of the method. Whereas, the use of the fu anaysis requires the user to obtain and enter a significant amount of data reating to the 13

14 Scenario #1 Scenario #2 Scenario #n Detaied Consequence Anaysis Programme Scenario Resuts#1 Scenario Resuts#2 Scenario Resuts#n Further Processing Bank Case Specific QRA Mode Component Case Specific Resuts Figure 7. Use of detaied anaysis to create data bank for subsequence input to QRA instaations configuration and ignition sources, the ook-up version requires ony the seection of the appropriate curve and the reease rate, as shown in Figure 8 for typica exampes. A more compex appication of this approach has been used by DNV Energy to make the detaied information avaiabe from the Computation Fuid Dynamic (CFD) modeing avaiabe in a simpified form within spreadsheet based QRA modes. 0.1 Offshore Process Gas Opendeck NUI (19) Ignition Probabiity 0.01 Offshore Process Gas Typica (20) Offshore Process Gas Large Modue (21) Offshore Process Gas Congested or Mechanica Vented Modue (22) Reease Rate (kg/s) Figure 8. Look-up correation curves from the UKOOA ignition mode 14

15 Methodoogy Options Generay the more compex the appied methodoogy the greater the amount of data it requires and the more time consuming it is to impement. In the eary stages of an instaation s design, much of this data may not be avaiabe and the anaysts may have to rey to a greater extent on more approximate methods. For this reason it is convenient to provide a number of options for some of the key parts of the consequence anaysis such as reease, dispersion, exposion, fire, escaation and smoke ingress. In the eary stages of the design the simper ess data intensive options can be chosen. In the ater stages these are repaced with more detaied aternatives. The key here is to ensure that the outputs from the various aternatives are in the same form so that it can be passed on to the next stage of the anaysis as indicated in Figure 9. nspectabiity A typica QRA has to process a mutitude of combinations in arriving at overa risk vaues. As a necessity the resuts have to be summarised for reporting purposes. However, this tends to hide the detai of the anaysis and with it the information which describes the Reease Modeing Methodoogy Option 1 Methodoogy Option 2 Methodoogy Option 3 Seected Resuts Option Register Exposion Anaysis Methodoogy Option 1 Methodoogy Option 2 Seected Resuts Figure 9. Consequence anaysis with processing options 15

16 reasons for the contributions of the individua components. Without the abiity to gain an understanding of these issues the QRA process oses much of its vaue since it is this detaied understanding of the safety critica parameters that may ead to the identification of risk reduction measures. A good QRA wi aow the anayst to access the detaied information in a convenient manner. One approach is to save a the intermediate data so that it can be referred to ater. This, however, may ead to the mode itsef being excessivey arge. A more convenient approach is to arrange for the mode to conduct the anaysis in iterative oops in which ony the resuts needed for ater parts of the anaysis are stored. When an event of interest is identified the user can cause the mode to recacuate that particuar scenario for inspection. In one mode used by DNV Energy the user is abe to access a detaied event tree reating to the risks for a worker in; a given area when the reease starts a given manning configuration a given isoation/bowdown faiure combination a given ignition condition, and a given reease size of a given hydrocarbon reease scenario This aows the anayst to view the progress of the cacuation in detai. This may enabe them to identify that some items of input data are inappropriate, and hence can be corrected, or to identify the significant safety critica parameters for the instaation. Resoution/Degree of Detai The resoution to which a QRA mode is constructed is important. In this context resoution, sometimes referred to as granuarity, is the degree to which the various possibe scenarios are treated independenty. It is common, for exampe, to average the effect of reease direction when determining the consequences for structures and workers in the various areas of a patform. One approach is to consider six broad directions (up, down, north, south, east and west), assign a faiure probabiity or fataity rate for each direction but then to average these before moving on to the next stage in the anaysis. The mode does not cacuate the number of fataities which woud be expected for a reease in each of the directions but ony the average. This does not affect the cacuation of risk for the patform workers but it does make it more difficut to examine the mode to gain an understanding of the impact of the hazard. Identifying why the fataity rate might be a certain vaue for a certain reease direction may be apparent to the anayst but the origins of the average may be more obscure. Typicay many more parameters such as manning density, exposion strength, HVAC (Heating, Ventiation, Air Conditioning) shutdown and the effect of weather conditions on evacuation fataity rates are a averaged. This means that when inspecting the fow of data through an event tree the anayst is ooking at an average effect of many different parameters rather than a specific scenario which woud be easier to evauate. 16

17 Resoution is particuary important if the mode is required to produce F-N curves. This is because whie intermediate parameters can be averaged without making a difference to the overa risk measured by traditiona parameters such as IRPA, FAR and PLL the distribution of f-n pairs is affected by the averaging process. A fataity rate of 0.1 appied to an exposed popuation of 20 wi resut in an average of 2 fataities. This might mean; that on each occasion 2 persons wi be kied that on 90% of occasions everyone wi survive but that everyone wi be kied in the remaining 10%, or that 50% of the time 2 persons wi be kied, 25% of the time 4 persons wi be kied and 25% of the time that a wi survive. There is actuay a spectrum of possibiities a covered by the same fataity rate. Each of these wi resut in the same contribution to persona risk but the f-n pairs generated are different and so the shape of the F-N curve wi be changed. This means that the reativey few incidents which resut in arge numbers of fataities can become diuted by the more numerous incidents where the number of fataities are sma or zero. This situation is iustrated in figure 10 which shows two curves from a hypothetica QRA. Both curves portray the risk distribution from a set of hazardous scenarios and have the same PLL. The difference is that some parameters have been averaged when arriving at the resut depicted by the Low Resoution curve. This may make the difference between passing and faiing an acceptance criterion especiay if a risk aversion factor greater than unity is used. 1.0E-01 Acceptance Criteria Line Frequency of Exceedance 1.0E E E E E E-07 F-N Curves From Anaysis With Low Resoution F-N Curves From Anaysis With High Resoution 1.0E Number of Fataities Figure 10. Variation in F-N curve output with resoution 17

18 Conversey, there is aso a danger of making the QRA so compex that the user oses an overview of the situation. The compexity must be baanced with respect to the state of knowedge, avaiabiity of data etc. It may aso be inappropriate to have detaied methodoogies empoyed in one part of the mode whie other parts empoy reativey simpe techniques. More compexity can be added but it then becomes increasingy important to impement it in a cear ogica structure. One way of deaing with this issue is to use a set of acceptance criteria measuring the risk for different groups of peope in different ways. Achievement of a combination of criteria for maximum individua risk together with average risk for a group of peope and F-N curves wi give a better presentation of the risk than measuring ony one of the criteria. Competence The above aspects focus on the structure and methodoogy of the mode itsef, but how it is used is aso important. It may be possibe to construct a mode and make its operation so automatic that the roe of the anayst is reduced to entering data, and initiating the run and transferring the resuts to a report. In these situations it can become easy to accept the resuts without spending the time to check that the mode is adequatey representing the frequency and consequences of the various risks or in deriving an understanding of the key drivers in the anaysis. The range of consequence anaysis, techniques and mathematica operation in a QRA may be quite extensive and cover topics which the anayst wi not have met in their education. In order to get the best vaue from a QRA the anaysts have to be adequatey trained in the various aspects of consequence anaysis and the operation of the mode being used. Athough some university programmes on risk assessment exist, most anaysts come from a more genera engineering background so the obigation wi tend to fa on QRA providers to educate their junior anaysts through structured training and on the job experience combined with appropriate supervision. Added Vaue In most parts of the word, QRAs focus on the threat to human ives. Whie this shoud remain the primary focus it shoud be noted that many of the resuts can aso form the basis of an anaysis of other forms of oss, particuary environmenta damage, asset damage and oss of production. Rather than studying these types of oss separatey they can be combined into a singe anaysis which can evauate the tota risks resuting from the hazards present. The QRA can provide resuts such as expected number of days of production oss per year and how this is distributed (many sma stops or fewer arger ones) together with the expected amount and distribution of accidenta oi spis. Resuts can be portrayed as an annua average or as frequency-cost curves. This can again be used as input to specific economic and environmenta studies and to emergency panning. 18

19 Concusions Risk Anaysis has been successfuy used to support decisions reating to the safety of offshore instaations. However, the benefits of using the technique may not aways have utiised its fu potentia. This is party because the creation and use of QRA modes is a compex process which requires a great dea of effort to impement effectivey and aso because the diversity of methods has ed to inconsistencies in output. Steps are therefore being taken to address these issues which shoud resut in the technique deivering greater vaue as an input to engineering decision support with consequent benefits to cost effective safety, environmenta and business risk management. The key factors in creating an effective approach can be summarised as foows; Active invovement of the customer in the process and better synchronising between the anaysis and the decision process. Standardisation of approach and methodoogies Use of a cear structure which the anayst can understand Provision of a mechanism in the mode to aow anaysts to inspect the various scenarios to gain understanding of the key factors affecting risk. Provision of aternative methodoogies appropriate to the stage in the design and the avaiabiity of data. Using appropriate higher degrees of resoution in the QRA. Striving to continuay improve eves of competence among practitioners. When impemented, the quaity and consistency of resuts obtained shoud provide a better basis for decision making. The same approach shoud aso deiver benefits in the fied of onshore risk anaysis. References 1) Probems in the Maintenance and Deveopment of QRA Modes for Offshore Patforms, B. Bain, Proceedings of the 12th Internationa Conference on Major Hazards Offshore, London, December ) Ignition Probabiity Review, Mode Deveopment and Look-Up Correations, IP Research Report, Energy Institute, January ) Good practice and pitfas in risk assessment, S. Gadd, D. Keeey and H.Bamforth, Heath & Safety Laboratory, HSE Research Report No. 151, ) Risk and emergency preparedness anaysis, NORSOK Standard Z-013, Rev 2, ) Hydrocarbon reease system HSE, ) The Offshore Instaations (Safety Case) Reguations 2005, Statutory Instrument 2005 No. 3117, ISBN