QRA Uses

13


EG551E Applied Risk Analysis & Management, 2015/2016





















On Usefulness and Relevance of QRA in Safety Assessments























Table of Contents

CASE STUDY 1 – Usefulness and Relevance of QRA

Introduction 1
System Definition 2
Hazard Identification 2
Hazard Frequency Analysis 4
Consequence Analysis 5
Risk Calculation 6
Discussion 7
Conclusion 8
References 8


CASE STUDY 2 – Misuse of QRA

Introduction 9
Case 1: Ship impact risk from a 2500 tons supply vessel 9
Case 2: Ship impact risk from a 7500 tons w2w vessel 11
Discussion 13
Conclusion 13
References 13

CASE STUDY 1 – Usefulness and Relevance of QRA

Gas Lift Riser

1.1 Introduction

For the purpose of this assignment, one specific hazard aspect of a gas lift riser is studied to quantify the associated major accident risk. The problem for this exercise is a simplified model from a North Sea platform where hydrocarbon gas is compressed in two stages from an atmospheric separator pressure up to inlet separator pressure of 10 barg by a low pressure (LP) gas compressor. This gas is then mixed with gas from the inlet separator and is compressed to 140 barg by the high pressure (HP) compressor. The compressed gas is then cooled by a heat exchanger before passing on to gas lift or export.

This cooling down of the gas temperature has a great significance in that lower down in the gas lift riser there is a section of flexible pipe which has a design maximum temperature limit of 50 deg C. If the temperature of the high pressure gas exceeds the flexible pipe design temperature at any time, it is conservatively assumed that the riser material will be damaged, potentially causing its rupture.

This problem is important in a mature field like the North Sea because many of the old installations tend to undergo additions or modifications to existing plant to maintain or improve production rate. Gas lift is a common technique used to increase production flow rate in low pressure production wells, a scenario common in a mature basin such as North Sea. In carrying out modifications such as adding a high pressure line for gas lift, if not careful, a localised assessment may not necessarily identify the limitation placed by a downstream component or section, especially if only a small segment such as the connection to manifolds etc are out with the design specification of the larger part of the system. If the issue is not identified early on it could significantly affect the project, sometimes causing significant delays and cost escalation.

A risk assessment tries to answer the following three main questions [1];
What can go wrong?
What is the likelihood of that happening?
What are the consequences?

This could then be expanded to determine the barriers that could prevent, control or mitigate the risks posed by the identified hazards. Quantification of risks helps to demonstrate if a desired target level is achieved and to identify factors that influence the level of risk.

For the present case study, the methodology used to carry out the Quantified Risk Assessment (QRA) to assess the risks associated with the gas compression process involves the following stages:

System definition
Hazard identification
Hazard event frequency analysis
Consequence analysis
Risk calculation









TICTAHTAHHGas LiftExportDEHYDRATIONKnockout drumSDV1SDV-EG1SDV-GL1TICTAHTAHHGas LiftExportDEHYDRATIONKnockout drumSDV1SDV-EG1SDV-GL1Figure 1Figure 1
TIC
TAH

TAHH
Gas Lift
Export
DEHYDRATION
Knockout drum
SDV1
SDV-EG1
SDV-GL1
TIC
TAH

TAHH
Gas Lift
Export
DEHYDRATION
Knockout drum
SDV1
SDV-EG1
SDV-GL1
Figure 1
Figure 1
1.2 System Definition

The process flow diagram of the section of the system to be risk assessed is shown in Figure 1. The gas from the LP compression module is passed through the HP compressor and heat exchanger for gas lift and export downstream.


1.3 Hazard Identification

A hazard is a physical situation that, either directly or through escalation, may cause harm to personnel or the environment. Hazard identification is the first stage in any risk assessment process and forms the basis of the risk assessment.

Hazards to be assessed quantitatively are typically identified in a Hazard Identification (HAZID) study. This is a structured technique for systematically identifying and recording hazards on an area-by-area, system-by-system basis, using a multidisciplinary team to provide a broad range of operational and platform knowledge. The identification of possible causes of accidents, or precursors that may lead to accidents is based on their accumulated operational experience.

Whilst all potential accidents should be considered, the focus, in terms of determining which hazards are to be assessed quantitatively, is on identifying Major Accident Hazards (MAHs). In this context, MAHs are legally defined in UK Offshore Safety Case Regulations 2015 [2] and are commonly accepted as being fire and explosion events, and other accidental events such as ship or helicopter collision that have the potential to result in multiple fatalities, either in the immediate area of the event or because they have the potential to escalate and result in fatalities outside the immediate area.

In this case study, it was identified that in the gas lift riser, one of the section is a flexible pipe which has a stated design maximum temperature of 50 deg C. Above this temperature, the liner material will deform permanently and it is conservatively assumed that the riser would rupture at this point. Considering the high pressure in the gas flow in this riser, a leak would mean a major gas release and could potentially escalate into a catastrophic fire and explosion event if the remaining barriers fail.

Therefore the identified hazard for this specific scenario is the case of failure of the Temperature Control Valve in the heat exchanger cooling medium, resulting in the gas exiting from the heat exchanger with a temperature greater than 50 deg.

If no action is taken to stop the higher temperature gas flow into the gas lift riser at this point, the flexible pipe section would be subjected to temperatures greater than its design limit causing the riser material to fail, potentially leading to a major gas release. A major release is defined as a release of a quantity of gas greater than 300kg or release with a rate more than 1 kg/s for a duration greater than 5 minutes [3]. It is vital that the heat exchanger functions correctly and if there is a fault for any reason, then immediate detection, control and mitigation actions are taken.




1.4 Hazard Frequency Analysis

This stage of the risk assessment process involves assessing the frequencies at which the identified hazards are expected to occur. Hazardous event frequencies can be estimated by applying historical data, with allowance for installation-specific circumstances as required.

Event tree analysis (ETA) can be used to analyse and quantify the heat exchanger temperature control valve failure scenario whereby the outlet gas temperature from the heat exchanger exceeds 50 deg C. ETA helps in identifying possible logical outcomes following the realisation of an initiating event.

An event tree has been created as shown in Figure 2 to analyse the event development and the barriers in place. Based on the results from the event tree analysis an assessment can be made of the;
Acceptability of the system
Potential improvement opportunities
Make recommendations for improvement


Heat exchanger
outlet gas temperature > 50deg



TAH fails



TAHH fails


SDV1 fails


SDV-GL1 fails

ETexit >50deg0.10.90.10.9TrueFalse2.85E-39.97E-12.85E-39,97E-1CDABFigure 2ETexit >50deg0.10.90.10.9TrueFalse2.85E-39.97E-12.85E-39,97E-1CDABFigure 2
E
Texit >50deg
0.1
0.9
0.1
0.9
True
False
2.85E-3
9.97E-1
2.85E-3
9,97E-1
C
D
A
B
Figure 2
E
Texit >50deg
0.1
0.9
0.1
0.9
True
False
2.85E-3
9.97E-1
2.85E-3
9,97E-1
C
D
A
B
Figure 2








0.02/yr0.02/yr
0.02/yr
0.02/yr










The respective final events from the event tree in Figure 2 is given below along with their failure probability f per year.

A - Flexible Riser fails, f =2.0E-4
B - Flexible Riser fails, f= 1.46205E-08
C – Process Shut Down Gas flow stopped, f = 5.11461E-06
D - Process Shut Down, Gas flow stopped, f = 1.7946E-3
E - Alarm, operator action, Manual Shut Down, f = 1.8E-3


Failure frequencies and probabilities used in the even tree are generic in nature and are taken from openly available literature [4], [5]. The device specific values are difficult to get as it will require more specific information for example the make and model of shut down valves. In the absence of specific reliability data approximate conservative values are used which still can provide valuable insights into the system behaviour.


1.5 Consequence Analysis

Consequence analysis evaluates the physical effects of the hazards and hazardous outcomes identified in the previous stage. It evaluates the response of structures and systems to the hazard, and determines ways in which an event could escalate. It also provides a basis for estimating fatalities that could occur as a result of the incident, either immediately or whilst personnel are escaping to muster areas or evacuating the installation.




Gas release (in air) under pressure

Ignition

Immediate ignition

Escalation

Top event




Gas release2e-30.0060.0040.80.2TrueFalseMajor accident, fire engulfing installation, 7.68E-70.80.2Figure 3No escalation, fire controlledDelayed ignitionNo ignitionGas release2e-30.0060.0040.80.2TrueFalseMajor accident, fire engulfing installation, 7.68E-70.80.2Figure 3No escalation, fire controlledDelayed ignitionNo ignition
Gas release
2e-3
0.006
0.004
0.8
0.2
True
False
Major accident, fire engulfing installation, 7.68E-7
0.8
0.2
Figure 3
No escalation, fire controlled
Delayed ignition
No ignition
Gas release
2e-3
0.006
0.004
0.8
0.2
True
False
Major accident, fire engulfing installation, 7.68E-7
0.8
0.2
Figure 3
No escalation, fire controlled
Delayed ignition
No ignition


















Computer models that have been validated against large-scale test data are used to model the hazardous events and their effects. These include models for pool fires, explosions, jet fires, structural response and gas dispersion.

In this study, the hazardous event to be assessed is the pressurised gas leak if the flexible riser is subjected to temperatures higher than its design limit. In order to have a realistic estimation, the interactions and effects of a large number of parameters have to be modelled using specialized computer programs / CFD software packages. Such a detailed study is far beyond the scope of this case study. Such a study will look at the location of the leak, leak rates, possible ignition scenarios, effects of wind, platform general arrangement etc.

It is therefore assumed that the failure of the flexible riser, in this case the leak assumed to be taking place above water, in the worst case scenario as shown in the simplified event tree in Figure 3, leads to a major gas leak as the line is pressurised at 140 bar and assuming an ignition source is very likely to be found for a large volume, a fire engulfing the installation and /or explosion is the likely consequence, unless other barriers intervene to prevent, control or mitigate it. Depending on the escalation paths, it can result in significant fatalities.

Here again a number of possibilities arise depending on the availability of an ignition source it can be either an immediate or a delayed ignition.

For the purpose of this study, from the event tree in Figure 2, the probability of riser failure is considered equivalent to the probability of a full gas release under pressure and therefore falls under the category of a major release.

At 140 barg pressure in the gas lift line, for an assumed hole size of 10mm in the riser, the release rate is about 1.67 kg/s and if sustained for 5 minutes, the net release is about 500 kg of gas, which is a large volume that if ignited can result in a major accident.

From OGP Report on ignition probabilities [6], from data of a riser fire that can engulf the platform, the ignition probability for this rate of release is about 0.0060.

The event escalation has to consider the control and mitigation measures such active and passive fire protection systems, level of Temporary Refuge integrity and evacuation arrangements. However these have not been considered in this very limited study and instead the event tree is terminated as a Major Fire engulfing the installation once ignited. The probabilities are assumed conservatively to make a relative assessment of the worst possible scenario.



1.6 Risk Calculation

The top event of fire engulfing the installation under this scenario for the conditions assumed above is estimated to have an annual probability of 7.68E-7.

If instead of the hole size of 10mm assumed above which consequently reduces the ignition probability, the highest ignition probability in the data sheet is chosen ( = 0.1), the top event probability increases to 1.28 E-5.
Considering this is an assessment of the suitability and sufficiency of a proposed pipeline arrangement the most suitable risk index to use to give an estimate of the risk would be the Potential Loss of Life (PLL). The Individual Risk Per Annum (IRPA) is also calculated to compare with the commonly accepted upper ALARP limit of 1E-3.

Potential Loss of Life
For the purpose of this study, the immediate PLL is calculated with a very high fatality rate of 75 %, assumed (based on Piper Alpha) for this major accident event [7]. The assumptions involved in estimating the PLL for the Later and Evacuation fatalities of the remaining 25 % makes it a largely approximate estimate and does not provide much additional useful information and are therefore not considered.

Immediate PLL = Frequency of hazard event x No of fatalities
IRPA = PLL x fraction of time offshore per year / POB
Fraction of time per year = 0.5

Assumed POB = 80
No of fatalities = 80 x 0.75 = 60

Immediate PLL in this case for an annual probability of 7.68E-7 = 4.61E-05
Corresponding IRPA = 2.88E-7

Immediate PLL for the case of an annual probability of 1.28E-5 = 7.68E-04
Corresponding IRPA = 4.80E-6


1.7 Discussion

The purpose of this QRA is to demonstrate the suitability of the system to use a flexible riser section with a relatively low design temperature within a high pressure gas lift line. This is a practical problem frequently encountered in old installations where the topside congestion would make the installation of long rigid risers extremely challenging or almost impossibly expensive. So, often duty holders of fixed jacket installations would resort to the use of sections or sometimes full length of flexible pipes that can be easily pulled in. If such a combination of rigid and flexibles are to be used for any reason, the limitations of each component part needs to be factored in the risk assessment, to address all potential failure paths.

The often regimented nature of offshore risk assessment would mean that someone assessing the upstream process section may not be aware of specific limitations in certain parts of the process line downstream. This is one such scenario where it is identified that a section of the gas lift line has a flexible pipe with a lower design temperature than the rigid pipeline elsewhere.

The temperature of gas output from the HP compressor is reduced by the heat exchanger. If the heat exchanger does not function as designed, it could result in the exiting gas having a higher temperature than what the flexible riser is designed to take. This could in turn damage the riser material causing it to fail.

The exact nature and extent of failure would depend on a number of parameters such as the actual temperatures reached, the material properties of the riser etc, but for the purpose of this study it was assumed that if the temperature exceeds the set limit, the riser is conservatively assumed to fail completely resulting in a full gas release.

Considering the seriousness of the issue, one temperature alarm, a temperature (high – high) trip and two shutdown valves are provided. The intention is to check if with these safety instrumentation, the total risk is acceptable.

It was seen that the annual probably of failure varies from 7.68E-7 to 1.28E-5 depending on the extent of release and the corresponding immediate PLL figures for this major accident event is 4.61E-05 and 7.68E-04 respectively and IRPA values respectively are 2.88E-7 and 4.80E-6.

This QRA is a rather coarse QRA with generic data with conservative assumptions used, in the absence of device / installation specific data. Moreover no account is taken of any other safety barriers that would control and mitigate the hazard such as the presence of active / passive fire protection. The IRPA values are much lower than the ALARP upper limit of 1E-3, though it understood that the it is the total value of risks from all individual hazards that needs to be below the target limit but it can be concluded that the risk contribution from this specific hazard is reasonably low.

If the temperature trip (TAHH) is removed from the system, the risk level increases by an order of magnitude, immediately raising warning bells on the suitability of the system, considering that the hazard being studied is the platform engulfing in fire.


1.8 Conclusion

The case study of the gas lift riser with a section of flexible pipe with a different temperature specification as compared to the rest of the line has shown how QRA can be used as a tool to quickly evaluate the adequacy of an arrangement and identify the critical safety components. The QRA also helps to identify areas for maximum influence on the safety outcome.


References:

M. Rausand, Risk assessment, Theory, methods and applications, Wiley, 2011
Guidance on regulations, L154, The Offshore Installations (Offshore Safety Directive) (Safety Case etc) Regulations 2015
Offshore Hydrocarbon Releases Statistics and Analysis, 2002, HSR 2002 002, HSE
Maryam Kalantarnia, Faisal I. Khan, Kelly Hawboldt, Risk Assessment and Management using Accident Precursors Modeling in Offshore Process Operation, OMAE 2009
Appendices, OLF Recommended Guidelines for the application of IEC 61508 and IEC 61511 in the petroleum activities on the Norwegian Continental Shelf, 2001
OGP Report No 434-6.1, Ignition probabilities
H Tan, Lecture notes on QRA for this course


CASE STUDY 2 – Misuse of QRA

Accidental Damage by Ship Impact

2.1 Introduction

The following case study uses a QRA to demonstrate major accident safety where the vulnerability of the installation would be expected to demand a consideration of additional barriers.

Installation X, 25 years old, is a Normally Unattended Installation (NUI), a conventional four legged carbon steel jacket with two main deck levels, the cellar deck and the weather deck, wellhead access platform and a helideck. Collision detection devices are provided on the installation when unattended to alert the remote control centre.

The installation has a rather low structural impact capacity of 6 MJ compared to present day expectations where the minimum impact capacities expected are 11 and 14 MJ impact energies for end on and sideways collisions respectively (from impact by a 5000 ton displacement vessel).

The installation will be attended for short periods for maintenance, when a supply boat is expected to serve the installation. The first part of this study examines the risk from a supply vessel impact on the installation while the second part examines the same scenario when a much larger vessel is used much more frequently.


2.2 Case 1: Ship impact risk for from a 2500 ton displacement supply vessel


2.2.1 Types of Collisions

The following types of collisions as described in Lloyd's guidance are to be investigated as a minimum in a QRA [1].

a. Passing vessel powered collision:
Passing Vessel collision due to inadequate / missing route planning or watch-keeping failure can have severe consequences due to large ship sizes and high speeds. This requires a detailed knowledge of the vessel traffic statistics in the area.

In this case study It is assumed that the installation is not located on a busy route, and standard marine safety measures for warning any passing traffic are implemented and therefore the risks are low. For the purpose of this study this is not examined further.


b. Passing vessel drifting collision:
This is the case of a vessel suffering a breakdown due to loss of propulsion or steering failure. The vessel drifts towards the target due to wind and wave forces. These collisions are usually less severe than powered collisions due to low drifting speed.

For the same reasons as above, this risk is not explored further in this study.
c. Supply vessel collisions:

Supply vessel Collision while alongside installation/target:
Collision with the installation while manoeuvring or performing transfer operations while alongside is another risk but in general these are at relatively low speeds (around 0.5 m/s) and are most likely to result in glancing blows resulting in mostly minor damage.

Therefore this type of collisions is also not explored further in this case study.

d. Supply vessel powered collision on approach
This is where a visiting vessel on approach collides with the installation. The causes may be mechanical failure, watch-keeping failure and failing to set way point away from target. This is the most onerous case considered here as these types of collisions generate the greatest impact energies due to the relatively higher speeds that can be attained.

The collision frequency will likely depend on the installation and the specific location the supply vessel is visiting. However, it is reasonable to use generic historical collision frequency per visit.

e. Attendant vessel collision:
Collisions due to Standby / Emergency Rescue vessel are generally low impact due to the small size and low speeds and are therefore not studied farther.


2.2.2 Supply vessel collision

Collision frequency
Based on infield collision statistics in the North Sea [2], collision frequency per visit is taken as 2.5E-5 (assumed an order of magnitude smaller than normally manned fixed installations)

f = 2.5E-5 / visit

Number of arrivals per year = N
= 25 (assuming a maintenance campaign window of 10 weeks)


Collision frequency = 2.5E-5 x 25
= 6.25E-4 per year

Energy of impact:
For powered collisions, it is most likely to take place end on, so added mass coefficient = 0.1
Energy in end on collision at a velocity of 2m/s (4 knots)
= 0.5x2500x1.1x2^2
= 5.5 MJ

A sideways collision at full 4 knots is not a realistic scenario; more likely is the vessel drifting broadside at a drift velocity of 1 m/s [3].

And so the drifting collision energy = 0.5x2500x1.4x1^2
= 1.75MJ
Structural strength against collision:
The NUI is a four legged structure. It is known from structural analysis that the TR integrity will be lost for impact energy greater than 6 MJ.

It can be concluded that using a 2500 ton vessel is acceptable for this NUI with the standard marine operational procedures in place to control risk.


2.2.3 Risk Calculation

In order to risk assess the ship impact hazard, Individual Risk Per Annum (IRPA) is a criterion commonly used and is used here as well.

Individual risk per annum:
IRPA = (Frequency of Hazard event) x (Fraction of time exposed) x (fatality rate)


Frequency of hazardous event = 6.25 E-4 / year

Fraction of time exposed
= fraction of time per day x fraction of time offshore x probability of being in area
= 0.5 x 0.5 x 0.5
= 0.625

Fatality rate = 0.1 (assumed conservatively, structural capacity adequate)

IRPA = (Frequency of Hazard event) x (Fraction of time exposed) x (fatality rate)
IRPA = 7.81E-7

This is much lower than the commonly accepted upper ALARP limit of 1 in 1000 [4]. For the purpose of this study, the ship impact risk is concluded to be ALARP. In a full QRA, risks from all remaining hazards will also be calculated and the gross risk should be within ALARP limit.



2.3 Case 2: Ship impact risk for from a 7500 ton displacement walk-to-work vessel

This ageing NUI is in need of significant repair and maintenance and the duty holder estimates that the work needs significantly more man hours than what is usually spent by the normal annual maintenance team of 8 crew staying for short periods on board with limited accommodation / sanitation facilities. Therefore it is decided to bring in a Walk –to-Work vessel.

Walk-to-work (W2W) is a recent concept where by a floatel, often with dynamic positioning capability is used to accommodate maintenance campaign crew due to lack of bed space in the host installation. The vessel essentially functions like a hotel taking workers to the installation and back for each shift, when it comes alongside the host installation and a retrievable bridge (eg; Ampleman) is used to connect the vessel to the installation and once all crew are transferred, the vessel retrieves the bridge and moves off to its stand-off location where it would wait till the next crew change operation. This is a convenient way of providing the much needed bed space for crew, to quash often large maintenance backlogs, a vital need for many of the ageing installations in the North Sea.

These vessels therefore are often much larger than the regular supply vessels and pose a significant impact risk. The following section examines the impact risk due to the walk-to-work vessel, like that was done for the regular supply vessel in the previous section.


Collision energy
In the case of the W2W vessel of 7500 tons displacement,

Bow/stern impact energy = 0.5x7500x1.1x22
= 16.5 MJ

Sideways impact energy = 0.5x7500x1.4x0.52
= 1.3 MJ
Sideways impact energy at a drift speed of 1m/s = 5.25 MJ, but is considered very unlikely for this vessel size.

The structural impact capacity of the TR is stated to be 6 MJ and therefore a collision above this energy could lead to the complete loss of TR integrity. A detailed structural analysis could be carried to study how this scenario unfolds and an assessment carried out to see the escalation paths.

However the method chosen to justify the risk was through an estimation of the IRPA.

Frequency
If the W2W vessel were to come alongside 2 times a day for 10 weeks,

No of visits = 2x7x10
= 140 visits

Collision frequency = 2.5E-5x140
= 3.5E-3

Risk Calculation

Frequency of hazardous event = 3.5E-3 / year

Fraction of time exposed
= fraction of time per day x fraction of time offshore x probability of being in area
= 0.5 x 0.5 x 0.5
= 0.125
Fatality rate = 0.75 (conservatively assumed due to the lack of structural capacity)

IRPA = (Frequency of Hazard event) x (Fraction of time exposed) x (fatality rate)
IRPA = 3.28 E-4

In the overall risk, helicopter travel risk is reduced by the introduction of the walk to work vessel and as there are no other changes, IRPA is still lower than 1E-3 and therefore the risk is deemed acceptable and no further assessments are carried out.



2.4 Discussion

In the case of the 7500 tons walk to work vessel, if there is a powered end on collision, it is possible that the entire installation could suffer a catastrophic collapse. Therefore justifying the risk purely through a risk assessment based on historic collision data fails to recognise the severity of the risk and its potential catastrophic consequence.

A practical assessment needs to be done to look for additional measures, mostly procedural in this case such as additional 500m safety zone checks, limiting the speeds within 500m zone to less than 1m/s, setting up additional watch keeping on both the vessel and the installation. Physical measures to improve the structural capacity may not be feasible in most cases due to the economics of structural modifications.


2.5 Conclusion

This case study demonstrates a scenario where a QRA is used as a justification for no consideration of additional barriers, when in fact additional measures would be deemed necessary from engineering judgement.



References:

Lloyd's Register, Guidance Notes for Risk Based Analysis: Collisions, 2014

John, Spouge, A guide to the QRA of offshore installations, CMPT, 1999

IAOGP, Ship / Installation collisions, OGP Risk Assessment Data Directory, 434-16, 2010

HSE, Reducing risks, protecting people