Sie sind auf Seite 1von 500

Risk Assessment Data Directory

Report No. 434


March 2010

Summary
International Association of Oil & Gas Producers
P ublications

Global experience
The International Association of Oil & Gas Producers has access to a wealth of technical
knowledge and experience with its members operating around the world in many different
terrains. We collate and distil this valuable knowledge for the industry to use as guidelines
for good practice by individual members.

Consistent high quality database and guidelines


Our overall aim is to ensure a consistent approach to training, management and best prac-
tice throughout the world.
The oil and gas exploration and production industry recognises the need to develop consist-
ent databases and records in certain fields. The OGP’s members are encouraged to use the
guidelines as a starting point for their operations or to supplement their own policies and
regulations which may apply locally.

Internationally recognised source of industry information


Many of our guidelines have been recognised and used by international authorities and
safety and environmental bodies. Requests come from governments and non-government
organisations around the world as well as from non-member companies.

Disclaimer
Whilst every effort has been made to ensure the accuracy of the information contained in this publication,
neither the OGP nor any of its members past present or future warrants its accuracy or will, regardless
of its or their negligence, assume liability for any foreseeable or unforeseeable use made thereof, which
liability is hereby excluded. Consequently, such use is at the recipient’s own risk on the basis that any use
by the recipient constitutes agreement to the terms of this disclaimer. The recipient is obliged to inform
any subsequent recipient of such terms.
This document may provide guidance supplemental to the requirements of local legislation. Nothing
herein, however, is intended to replace, amend, supersede or otherwise depart from such requirements. In
the event of any conflict or contradiction between the provisions of this document and local legislation,
applicable laws shall prevail.

Copyright notice
The contents of these pages are © The International Association of Oil and Gas Producers. Permission
is given to reproduce this report in whole or in part provided (i) that the copyright of OGP and (ii)
the source are acknowledged. All other rights are reserved.” Any other use requires the prior written
permission of the OGP.
These Terms and Conditions shall be governed by and construed in accordance with the laws of Eng-
land and Wales. Disputes arising here from shall be exclusively subject to the jurisdiction of the courts of
England and Wales.
Risk Aassessment data directory – summary

Background
At the end of 1996, the E&P Forum (the previous name of OGP) completed and issued the Risk
Assessment Data Directory. Its aim was to provide a catalogue of information that could be used
to improve the quality and consistency of risk assessments with readily available benchmark data
and references for common types of incident analysed in upstream production operations. Incidents
typically analysed in E&P risk assessments were identified and divided into four major categories,
within which twenty-six individual datasheets were developed. Each datasheet contained informa-
tion describing the event: incident frequency, population and causal data and a discussion of the data
sources, range, availability and application.
These datasheets were made available to OGP members and other interested parties in a loose bound
file. They were also available as electronic Word documents and more recently as PDF files in the
members’ area of the OGP website (http://members.ogp.org.uk). In 2006, OGP’s Safety Commit-
tee formed a task force to consider the future of the data directory. As a first step, the task force
undertook a survey of staff in member companies to establish the level of interest in the existing
data directory and in an updated directory. The survey showed strong interest in an update. The task
force acted accordingly.
Another OGP document, Guidelines for the development and application of health, safety and envi-
ronmental management systems (1994), identifies “evaluation and risk management” as a key ele-
ment of an effective HSE management system. The use of formal risk assessment in achieving the
goal-setting objectives of this element has become widely accepted in the E&P industry. It is now an
essential framework in recent legislation. Experience shows that the application of risk assessment is
important both to improved plant and system integrity and to cost effectiveness. It provides valuable
information for risk-based decision-making.
Formal risk assessment is a structured, systematic process. It supplements traditional design and
risk management processes. It can be based on qualitative or quantitative methods or a combina-
tion thereof. The objective of formal risk assessment is to analyse and evaluate risk. Risk assess-
ment is made up of the following fundamental steps: hazard identification to identify what could go
wrong, consequence assessment to address the potential effects, frequency assessment to determine
the underlying causes and likelihood or probability of occurrence of a hazardous event, assessing the
risks and evaluating potential risk reduction measures.
In risk assessment, frequency is estimated based on knowledge and expert judgment, historical expe-
rience, and analytical methods. These combine to support judgments made by risk assessment teams.
Historical experience is expressed in terms of statistical data gathered from existing operations, gen-
erally in the form of incidents, base failure rates and failure probabilities. A key issue when using risk
assessment is the uncertainties associated with the results. This has a bearing on the confidence with
which the information can be used to influence decisions. Therein lies the need for reliable data to
support E&P risk assessment work.

Risk Assessment Data Directory


The objective of the Risk assessment data directory is to provide data and information that can be
used to improve the quality and consistency of risk assessments with readily available benchmark
data. The directory includes references for common incidents analysed in upstream production
operations. The original 1996 data directory included 26 individual datasheets. The updated direc-
tory (2009) now includes 20 datasheets, although the scope of the material presented is similar to
the original with some reorganisation. The structure of four major categories from the 1996 direc-
tory is retained.
Each datasheet contains:
• information describing the event
• incident frequency
• population and causal data
• a discussion of the data sources, range, availability and application.

©OGP 1
International Association of Oil & Gas Producers

The intention is that the Risk assessment data directory may facilitate the systematic assessment of
risks within individual OGP member companies and across the E&P industry. It is hoped that the
updated directory will continue to be a valuable reference document.
Examples of specific applications of the directory include:
• Estimating screening level and order of magnitude incident frequencies
• Reviewing external risk assessment (ie those performed by consultants, design contractors, etc)
• Evaluating risk in QRAs and qualitative assessments
• Comparing industry and corporate performance
• Identifying important risk contributors
The directory also provides reference lists of data sources that can be consulted for more detailed
information. The directory is not intended to be a comprehensive source of incident data. Appli-
cations requiring more comprehensive data should consult the original references as well as other
publicly available information and company data sources. Sources for the data include information
available to the public and industry such as may be obtained from industry projects and the litera-
ture. That is, the directory contains organised publicly available information and data contributed
by individual companies, which has been previously submitted by others.
While every reasonable effort has been made to ensure the quality and accuracy of the information
and data provided, it is the responsibility of each company or organisation using the data to review
the information and determine that the material is suitable for their specific application.

Directory update process


The original data directory was developed as a QRA Subcommittee activity without any central
funding of external consultants. For this, update the task force decided to rely on a centrally funded
consultant to update and revise the datasheet in a consistent manner. With this approach in mind,
a number of consultants operating in the risk assessment field were invited to submit bids for the
update of the entire data directory. They were also invited to make proposals for how the directory
might be modified or improved based on their experience and developments made in the quantita-
tive risk assessment field in recent years.
The work was awarded to DNV Energy, which proposed some deletions, recombination and addi-
tional datasheets. To spread the cost to OGP, update work was commenced in 2007 and continued
through 2008 and into the early part of 2009. A focal point for each datasheet was appointed. He
or she had the responsibility of collecting and compiling comments from the task force and their
organisations on the various datasheets. Periodic meetings with DNV Energy provided opportuni-
ties to discuss and agree the comments.
OGP agreed to make the datasheets available on the OGP website and carried out the necessary
work to do this. Datasheets are available as PDF files and also provide hyperlinks to other more
detailed or useful data sources. As a quality assurance check, an independent expert reviewed the
draft directory. After approval from the OGP Safety Committee, the Data Directory was issued in
the third quarter of 2009. As with all OGP documents the data directory is available to the public
at no charge.

2 ©OGP
Risk Aassessment data directory – summary

Directory scope and content


The directory covers both onshore and offshore E&P activities. The data have been collated under
four major categories:
Accident data: Collated statistical data of accidents (i.e., events that have led to detrimental effects in terms of loss of
life, environmental damage or property damage)
Event data: Collated statistical data of hazardous events (i.e., events that led to or had the potential to lead to an
accident)
Safety systems: Collated statistical data on the reliability of various safety systems employed to prevent and/or
mitigate hazardous events.
Vulnerabilities: Criteria for assessing the vulnerability of plant and humans to hazardous events.
Under each category, there is a series of individual datasheets. The original 1996 Data Directory had
a total of 26 datasheets as follows: Accident Data 7; Event Data 8; Safety Systems 6; Vulnerabilities
5. In the updated directory the number of datasheets in each category is revised to 6, 8, 1 and 4
respectively.
These changes arise from reordering, recombination, splitting and deletion of certain datasheets.
Accident and Event datasheet subject matter remains largely unchanged with the exception that
separate Ignition Probability and Consequence modelling datasheets have been created. This type
of data was then removed from other event datasheets. The four human factors datasheets from the
1996 directory have been organised in a single human factors datasheet. Extreme weather has been
included in the structural failure risks datasheet. These changes leave a total of twenty datasheets as
listed below:
Accident data: Major accidents
Occupational risk
Land transport accident statistics
Aviation transport accident statistics
Water transport accident statistics
Construction risk for offshore units
Event data: Process release frequencies
Risers & pipeline release frequencies
Storage incident frequencies
Blowout frequencies
Mechanical lifting failures
Ship/installation collisions
Ignition probabilities
Consequence modelling
Structural risk for offshore installations
Safety systems: Guide to finding and using reliability data for QRA
Vulnerabilities: Vulnerability of humans
Vulnerability of plant/structure
Escape, evacuation and rescue
Human factors in QRA

©OGP 3
International Association of Oil & Gas Producers

The basic content of each datasheet is as follows:


1. Scope and application Brief outline of data presented in datasheet and details of
the situation for which the datasheet would be applicable.
This includes statements regarding where care should be
exercised in its use.
2. Summary of recommended data: Data presented in a tabular and/or graphical format.
3. Guidance on data use: Guidance on general validity and precautions to be applied
in using the data. Consideration of uncertainties.
4. Review of data sources: The data sources used to obtain the data presented in
section 2.
5. Recommended data sources for further information: Listing of sources of more detailed and specific data.
6. References: Detailed list of references.
Note that the format presented above is general. Individual datasheets vary to some extent,
depending on relevance and availability of information.
The objective has been to identify so far as practical data available in the public domain and to dis-
cuss their applicability. However in a few isolated cases, reference is made to data not publicly avail-
able yet held by an OGP. Where this is the case, the judgment of the RADD Task Force is that these
data are sufficiently robust to include even though the user is not able to source the data directly.
It is not the intention of the Directory to address or comment in any way on the best approach or
methods for risk assessment studies. In some of the datasheets, particularly for Safety Systems, the
key data presented are in terms of how ‘reliable’ these systems are. “Reliability Analysis” is a distinct
specialist area. Any detailed assessment would require expert assistance. Another area that is recog-
nised as directly influencing the frequency of accidents and events is Human factors. Again, this is a
distinct specialist area, which would require expert assistance if any detailed assessment work was to
be undertaken. It should also be noted that there are many other areas where expert assistance would
be needed to undertake an in-depth study, eg assessing structural vulnerabilities or marine hazards.

Updating plans
It is recognised and accepted that the data presented in OGP’s Risk assessment data directory will
become out-of-date. Nevertheless, many of the data bases identified are actively maintained and by
directly accessing these source databases, up-to-date information can be obtained.
This update is the first to take place since the directory was originally issued in 1996/97. This is con-
sidered too long a delay between revisions. New arrangements will allow users to provide feedback
on errors, omissions and potential revisions or any new or better information, or data from other
geographic areas on the OGP website. Users and other interested parties are encouraged to make
use of this facility. OGP will then arrange to review this information periodically and update the
datasheets as required. Some datasheets have been allocated to other OGP Task Forces or Subcom-
mittees to maintain the data more frequently.

4 ©OGP
Risk Assessment Data Directory

Report No. 434 – 1


March 2010

Process
release
frequencies
International Association of Oil & Gas Producers
RADD – Process release frequencies

contents
1.0 Scope and Definitions ........................................................... 1
1.1 Equipment ....................................................................................................... 1
1.2 Release types .................................................................................................. 2
2.0 Summary of Recommended Data ............................................ 2
3.0 Guidance on use of data ...................................................... 19
3.1 General validity ............................................................................................. 19
3.2 Uncertainties ................................................................................................. 20
3.3 Definition of release types ........................................................................... 20
3.3.1 Full releases.............................................................................................................. 20
3.3.2 Limited releases ....................................................................................................... 21
3.3.3 Zero pressure releases ............................................................................................ 21
3.4 Consequence modelling for the largest release size ................................ 21
3.5 Modification of frequencies for factors specific to plant conditions ....... 22
3.5.1 General considerations ........................................................................................... 22
3.5.2 API 581 Approach..................................................................................................... 22
3.5.3 Safety Management.................................................................................................. 24
3.5.4 Inter-unit piping ........................................................................................................ 25
3.5.5 Flanges...................................................................................................................... 26
4.0 Review of data sources ....................................................... 27
4.1 Basis of data presented ............................................................................... 27
4.1.1 Summary of release statistics................................................................................. 28
4.1.2 Methodology for obtaining release frequencies ................................................... 28
4.1.3 Uncertainties in release frequencies...................................................................... 29
4.1.4 Comparison with experience .................................................................................. 29
4.1.5 Conclusions.............................................................................................................. 30
4.2 Other data sources ....................................................................................... 30
5.0 Recommended data sources for further information ............ 31
6.0 References .......................................................................... 31
6.1 References for Sections 2.0 to 4.0 .............................................................. 31
6.2 References for other data sources examined ............................................ 32

©OGP
RADD – Process release frequencies

Abbreviations:
ANSI American National Standards Institute
API American Petroleum Institute
DNV Det Norske Veritas
ESD Emergency Shutdown
HC Hydrocarbon
HCRD Hydrocarbon Release Database
HSE (UK) Health and Safety Executive
LNG Liquefied Natural gas
OREDA Offshore Reliability Data
OSHA Occupational Safety and Health Administration
PSM Process Safety Management
QRA Quantitative Risk Assessment (sometimes Analysis)
UKCS United Kingdom Continental Shelf

©OGP
RADD – Process release frequencies

1.0 Scope and Definitions


1.1 Equipment
This datasheet presents (Section 2.0) frequencies of releases from the following
process equipment types. They are intended to be applied to process equipment on the
topsides of offshore installations and on onshore facilities handling hydrocarbons but
are not restricted to releases of hydrocarbons.
1. Steel process pipes 10. Compressors: Reciprocating
2. Flanges 11. Heat exchangers: Shell & Tube, shell
side HC
3. Manual valves
12. Heat exchangers: Shell & Tube, tube
4. Actuated valves
side HC
5. Instrument connections
13. Heat exchangers: Plate
6. Process (pressure) vessels
14. Heat exchangers: Air-cooled
7. Pumps: Centrifugal
15. Filters
8. Pumps: Reciprocating
16. Pig traps (launchers/receivers)
9. Compressors: Centrifugal
OREDA [1] gives frequencies of releases from subsea equipment. If these are used, it
should be noted that these are based on only a small number of incidents (a total of 13
from several different components) and so are subject to considerable statistical
uncertainty. It is suggested that use of onshore/topsides failure frequencies, i.e. the
frequencies for the corresponding equipment types from nos. 1 to 16 above, is
preferable.
The precise definition of each equipment type is given with the data in Section 2.0.
Besides the equipment defined in the above list, the equipment types listed in Table 1.1
are also covered by the data given in Section 2.0.

Table 1.1 Other Equipm ent Types Covered

Equipment Type See Equipment Type See


Datasheet or Datasheet or
Section No. Section No.
Absorbers 6 Grayloc flanges Section 3.5.5
Clamp connections 2 Knock-out drums 6
Columns 6 Pipe connections 2
Distillation columns 6 Process reactors 6
ESD valves 4 Reactors 6
Fin-fan coolers 14 Scrubbers 6
Fittings (small-bore) 5 Separators 6
Gaskets Section 3.5.5 Small-bore fittings 5

©OGP 1
RADD – Process release frequencies

1.2 Release types


According to analysis of historic process release frequency data [2], releases can be
split into three different types:
• Full releases: consistent with flow through the defined hole, beginning at the
normal operating pressure, and continuing until controlled by emergency shut-down
and blowdown (if present and operable) or inventory exhaustion. This scenario is
invariably modelled in any QRA.
• Lim ited releases: cases where the pressure is not zero but the quantity released
is much less than from a full release. This may be because the release is isolated
locally by human intervention (e.g. closing an inadvertently opened valve), or by a
restriction in the flow from the system inventory (e.g. releases of fluid accumulated
between pump shaft seals). This scenario may be modelled, depending on the detail
of the QRA, but the consequences should reflect the limited release quantities.
• Zero pressure releases: cases where pressure inside the leaking equipment is
virtually zero (0.01 barg or less). This may be because the equipment has a normal
operating pressure of zero (e.g. open drains), or because the equipment has been
depressurised for maintenance. This scenario is typically excluded from QRA, and
is included mainly for consistency with the original HSE data (see Sections 3.3, 4.0).

Therefore, the release frequencies are tabulated for each of these release types, as well
as the overall frequencies for all release types taken together being tabulated1.

2.0 Summary of Recommended Data


A datasheet is given below for each of the equipment types listed in Section 1.1. The
definitions given of the equipment types are consistent with those used by the UK HSE.

1
Note that these overall frequencies are not the sum of the frequencies for each release type;
they are calculated by a separate mathematical function, as described in Section 4.1.2, fitted to
the release data.

2 ©OGP
RADD – Process release frequencies

Equipment Type: (1) Steel process pipes


Definition:
Offshore: Includes pipes located on topsides (between well and riser) and subsea (between
well and pipeline).
Onshore: Includes pipes within process units, but not inter-unit pipes or cross-country
pipelines.
The scope includes welds but excludes all valves, flanges, and instruments.

(a) All piping release frequencies (per metre year) by pipe diameter

6" DIA 12" DIA 18" DIA 24" DIA 36" DIA
HOLE DIA 2" DIA (150 (300 (450 (600 (900
RANGE (mm) (50 mm) mm) mm) mm) mm) mm)
1 to 3 9.0E-05 4.1E-05 3.7E-05 3.6E-05 3.6E-05 3.6E-05
3 to 10 3.8E-05 1.7E-05 1.6E-05 1.5E-05 1.5E-05 1.5E-05
10 to 50 2.7E-05 7.4E-06 6.7E-06 6.5E-06 6.5E-06 6.5E-06
50 to 150 0.0E+00 7.6E-06 1.4E-06 1.4E-06 1.4E-06 1.4E-06
>150 0.0E+00 0.0E+00 5.9E-06 5.9E-06 5.9E-06 5.9E-06
TOTAL 1.5E-04 7.4E-05 6.7E-05 6.5E-05 6.5E-05 6.5E-05

(b) Full piping release frequencies (per metre year) by pipe diameter

6" DIA 12" DIA 18" DIA 24" DIA 36" DIA
HOLE DIA 2" DIA (150 (300 (450 (600 (900
RANGE (mm) (50 mm) mm) mm) mm) mm) mm)
1 to 3 5.5E-05 2.6E-05 2.3E-05 2.3E-05 2.3E-05 2.3E-05
3 to 10 1.8E-05 8.5E-06 7.6E-06 7.5E-06 7.4E-06 7.4E-06
10 to 50 7.0E-06 2.7E-06 2.4E-06 2.4E-06 2.4E-06 2.3E-06
50 to 150 0.0E+00 6.0E-07 3.7E-07 3.6E-07 3.6E-07 3.6E-07
>150 0.0E+00 0.0E+00 1.7E-07 1.7E-07 1.6E-07 1.6E-07
TOTAL 8.0E-05 3.8E-05 3.4E-05 3.3E-05 3.3E-05 3.3E-05

(c) Limited piping release frequencies (per metre year) by pipe diameter

6" DIA 12" DIA 18" DIA 24" DIA 36" DIA
HOLE DIA 2" DIA (150 (300 (450 (600 (900
RANGE (mm) (50 mm) mm) mm) mm) mm) mm)
1 to 3 3.1E-05 9.9E-06 8.1E-06 7.8E-06 7.7E-06 7.6E-06
3 to 10 1.5E-05 4.9E-06 4.0E-06 3.8E-06 3.8E-06 3.7E-06
10 to 50 1.3E-05 2.5E-06 2.0E-06 1.9E-06 1.9E-06 1.9E-06
50 to 150 0.0E+00 3.2E-06 5.2E-07 5.0E-07 4.9E-07 4.9E-07
>150 0.0E+00 0.0E+00 2.4E-06 2.4E-06 2.4E-06 2.4E-06
TOTAL 5.9E-05 2.0E-05 1.7E-05 1.6E-05 1.6E-05 1.6E-05

(d) Zero pressure piping release frequencies (per metre year) by pipe diameter

6" DIA 12" DIA 18" DIA 24" DIA 36" DIA
HOLE DIA 2" DIA (150 (300 (450 (600 (900
RANGE (mm) (50 mm) mm) mm) mm) mm) mm)
1 to 3 3.7E-06 3.2E-06 3.1E-06 3.1E-06 3.1E-06 3.1E-06
3 to 10 2.7E-06 2.3E-06 2.3E-06 2.3E-06 2.3E-06 2.3E-06
10 to 50 6.0E-06 1.9E-06 1.8E-06 1.8E-06 1.8E-06 1.8E-06
50 to 150 0.0E+00 3.4E-06 7.7E-07 7.6E-07 7.6E-07 7.6E-07
>150 0.0E+00 0.0E+00 2.6E-06 2.6E-06 2.6E-06 2.6E-06
TOTAL 1.24E-05 1.07E-05 1.06E-05 1.05E-05 1.05E-05 1.05E-05

©OGP 3
RADD – Process release frequencies

Equipment Type: (2) Flanges


Definition:
The following frequencies refer to a flanged joint, comprising two flange faces, a gasket
(where fitted), and two welds to the pipe. Flange types include ring type joint, spiral wound,
clamp (Grayloc) and hammer union (Chicksan).

(a) All flange release frequencies (per flanged joint year) by flange diameter

6" DIA 12" DIA 18" DIA 24" DIA 36" DIA
HOLE DIA 2" DIA (150 (300 (450 (600 (900
RANGE (mm) (50 mm) mm) mm) mm) mm) mm)
1 to 3 4.4E-05 6.5E-05 9.6E-05 1.2E-04 1.5E-04 2.1E-04
3 to 10 1.8E-05 2.6E-05 3.9E-05 5.1E-05 6.2E-05 8.5E-05
10 to 50 1.5E-05 1.1E-05 1.6E-05 2.1E-05 2.5E-05 3.4E-05
50 to 150 0.0E+00 8.5E-06 3.2E-06 4.1E-06 5.1E-06 6.9E-06
>150 0.0E+00 0.0E+00 7.0E-06 7.6E-06 8.2E-06 9.3E-06
TOTAL 7.6E-05 1.1E-04 1.6E-04 2.1E-04 2.5E-04 3.4E-04

(b) Full flange release frequencies (per flanged joint year) by flange diameter

6" DIA 12" DIA 18" DIA 24" DIA 36" DIA
HOLE DIA 2" DIA (150 (300 (450 (600 (900
RANGE (mm) (50 mm) mm) mm) mm) mm) mm)
1 to 3 2.6E-05 3.7E-05 5.9E-05 8.3E-05 1.1E-04 1.7E-04
3 to 10 7.6E-06 1.1E-05 1.7E-05 2.4E-05 3.2E-05 4.9E-05
10 to 50 4.0E-06 3.0E-06 4.7E-06 6.6E-06 8.8E-06 1.4E-05
50 to 150 0.0E+00 2.0E-06 6.1E-07 8.7E-07 1.1E-06 1.8E-06
>150 0.0E+00 0.0E+00 1.7E-06 1.8E-06 1.9E-06 2.2E-06
TOTAL 3.8E-05 5.3E-05 8.3E-05 1.2E-04 1.5E-04 2.4E-04

(c) Limited flange release frequencies (per flanged joint year) by flange diameter

6" DIA 12" DIA 18" DIA 24" DIA 36" DIA
HOLE DIA 2" DIA (150 (300 (450 (600 (900
RANGE (mm) (50 mm) mm) mm) mm) mm) mm)
1 to 3 1.5E-05 2.3E-05 3.1E-05 3.8E-05 4.4E-05 5.4E-05
3 to 10 7.9E-06 1.2E-05 1.6E-05 2.0E-05 2.3E-05 2.8E-05
10 to 50 8.6E-06 6.4E-06 8.7E-06 1.1E-05 1.2E-05 1.5E-05
50 to 150 0.0E+00 5.4E-06 2.4E-06 2.9E-06 3.4E-06 4.1E-06
>150 0.0E+00 0.0E+00 4.3E-06 4.8E-06 5.2E-06 5.9E-06
TOTAL 3.2E-05 4.7E-05 6.2E-05 7.5E-05 8.7E-05 1.1E-04

(d) Zero pressure flange release frequencies (per flanged joint year) by flange diameter

6" DIA 12" DIA 18" DIA 24" DIA 36" DIA
HOLE DIA 2" DIA (150 (300 (450 (600 (900
RANGE (mm) (50 mm) mm) mm) mm) mm) mm)
1 to 3 1.5E-06 1.7E-06 2.6E-06 4.2E-06 6.7E-06 1.4E-05
3 to 10 1.1E-06 1.2E-06 1.9E-06 3.1E-06 4.9E-06 1.1E-05
10 to 50 2.0E-06 1.0E-06 1.5E-06 2.5E-06 4.0E-06 8.6E-06
50 to 150 0.0E+00 1.3E-06 6.4E-07 1.1E-06 1.7E-06 3.6E-06
>150 0.0E+00 0.0E+00 1.4E-06 2.2E-06 3.5E-06 7.6E-06
TOTAL 4.6E-06 5.3E-06 7.9E-06 1.3E-05 2.1E-05 4.5E-05

4 ©OGP
RADD – Process release frequencies

Equipment Type: (3) Manual valves


Definition:
Includes all types of manual valves (block, bleed, check and choke); valve types gate, ball,
plug, globe, needle and butterfly. The scope includes the valve body, stem and packer, but
excludes flanges, controls and instrumentation.

(a) All manual valve release frequencies (per valve year) by valve diameter

6" DIA 12" DIA 18" DIA 24" DIA 36" DIA
HOLE DIA 2" DIA (150 (300 (450 (600 (900
RANGE (mm) (50 mm) mm) mm) mm) mm) mm)
1 to 3 4.4E-05 6.6E-05 8.4E-05 9.8E-05 1.1E-04 1.3E-04
3 to 10 2.3E-05 3.4E-05 4.3E-05 5.0E-05 5.6E-05 6.4E-05
10 to 50 2.1E-05 1.8E-05 2.3E-05 2.7E-05 3.0E-05 3.4E-05
50 to 150 0.0E+00 1.1E-05 6.3E-06 7.3E-06 8.0E-06 9.3E-06
>150 0.0E+00 0.0E+00 7.8E-06 8.7E-06 9.5E-06 1.1E-05
TOTAL 8.8E-05 1.3E-04 1.7E-04 1.9E-04 2.1E-04 2.4E-04

(b) Full manual valve release frequencies (per valve year) by valve diameter

6" DIA 12" DIA 18" DIA 24" DIA 36" DIA
HOLE DIA 2" DIA (150 (300 (450 (600 (900
RANGE (mm) (50 mm) mm) mm) mm) mm) mm)
1 to 3 2.0E-05 3.1E-05 4.3E-05 5.3E-05 6.2E-05 7.8E-05
3 to 10 7.7E-06 1.2E-05 1.7E-05 2.1E-05 2.4E-05 3.0E-05
10 to 50 4.9E-06 4.7E-06 6.5E-06 8.0E-06 9.4E-06 1.2E-05
50 to 150 0.0E+00 2.4E-06 1.2E-06 1.5E-06 1.8E-06 2.2E-06
>150 0.0E+00 0.0E+00 1.7E-06 1.9E-06 2.1E-06 2.3E-06
TOTAL 3.2E-05 5.0E-05 6.9E-05 8.5E-05 1.0E-04 1.2E-04

(c) Limited manual valve release frequencies (per valve year) by valve diameter

6" DIA 12" DIA 18" DIA 24" DIA 36" DIA
HOLE DIA 2" DIA (150 (300 (450 (600 (900
RANGE (mm) (50 mm) mm) mm) mm) mm) mm)
1 to 3 2.4E-05 2.7E-05 3.2E-05 3.7E-05 4.3E-05 5.4E-05
3 to 10 1.4E-05 1.5E-05 1.8E-05 2.1E-05 2.5E-05 3.1E-05
10 to 50 1.4E-05 9.5E-06 1.1E-05 1.3E-05 1.5E-05 1.9E-05
50 to 150 0.0E+00 6.4E-06 3.5E-06 4.1E-06 4.7E-06 6.0E-06
>150 0.0E+00 0.0E+00 4.1E-06 4.8E-06 5.5E-06 7.0E-06
TOTAL 5.1E-05 5.8E-05 6.9E-05 8.1E-05 9.3E-05 1.2E-04

(d) Zero pressure manual valve release frequencies (per valve year) by valve diameter

6" DIA 12" DIA 18" DIA 24" DIA 36" DIA
HOLE DIA 2" DIA (150 (300 (450 (600 (900
RANGE (mm) (50 mm) mm) mm) mm) mm) mm)
1 to 3 3.6E-07 7.1E-07 1.1E-06 1.4E-06 1.7E-06 2.2E-06
3 to 10 3.5E-07 6.9E-07 1.1E-06 1.4E-06 1.7E-06 2.1E-06
10 to 50 2.4E-06 7.8E-07 1.2E-06 1.6E-06 1.9E-06 2.4E-06
50 to 150 0.0E+00 4.0E-06 7.1E-07 9.2E-07 1.1E-06 1.4E-06
>150 0.0E+00 0.0E+00 5.4E-06 7.0E-06 8.5E-06 1.1E-05
TOTAL 3.1E-06 6.2E-06 9.5E-06 1.2E-05 1.5E-05 1.9E-05

©OGP 5
RADD – Process release frequencies

Equipment Type: (4) Actuated valves


Definition:
Includes all types of actuated valves (block, blowdown, choke, control, ESDV and relief), but not actuated pipeline valves
(pipeline ESDV and SSIV). Valve types include gate, ball, plug, globe and needle. The scope includes the valve body, stem
and packer, but excludes flanges, controls and instrumentation.

(a) All actuated valve release frequencies (per valve year) by valve diameter

6" DIA 12" DIA 18" DIA 24" DIA 36" DIA
HOLE DIA 2" DIA (150 (300 (450 (600 (900
RANGE (mm) (50 mm) mm) mm) mm) mm) mm)
1 to 3 4.2E-04 3.6E-04 3.3E-04 3.1E-04 3.0E-04 2.8E-04
3 to 10 1.8E-04 1.5E-04 1.4E-04 1.3E-04 1.3E-04 1.2E-04
10 to 50 1.1E-04 6.6E-05 6.0E-05 5.6E-05 5.4E-05 5.0E-05
50 to 150 0.0E+00 3.3E-05 1.3E-05 1.2E-05 1.1E-05 1.1E-05
>150 0.0E+00 0.0E+00 1.8E-05 1.8E-05 1.8E-05 1.7E-05
TOTAL 7.1E-04 6.2E-04 5.6E-04 5.3E-04 5.0E-04 4.7E-04

(b) Full actuated valve release frequencies (per valve year) by valve diameter

6" DIA 12" DIA 18" DIA 24" DIA 36" DIA
HOLE DIA 2" DIA (150 (300 (450 (600 (900
RANGE (mm) (50 mm) mm) mm) mm) mm) mm)
1 to 3 2.4E-04 2.2E-04 2.1E-04 2.0E-04 2.0E-04 1.9E-04
3 to 10 7.3E-05 6.6E-05 6.3E-05 6.0E-05 5.9E-05 5.6E-05
10 to 50 3.0E-05 1.9E-05 1.8E-05 1.7E-05 1.7E-05 1.6E-05
50 to 150 0.0E+00 8.6E-06 2.4E-06 2.3E-06 2.2E-06 2.2E-06
>150 0.0E+00 0.0E+00 6.0E-06 5.9E-06 5.9E-06 5.9E-06
TOTAL 3.5E-04 3.2E-04 3.0E-04 2.9E-04 2.8E-04 2.7E-04

(c) Limited actuated valve release frequencies (per valve year) by valve diameter

6" DIA 12" DIA 18" DIA 24" DIA 36" DIA
HOLE DIA 2" DIA (150 (300 (450 (600 (900
RANGE (mm) (50 mm) mm) mm) mm) mm) mm)
1 to 3 1.7E-04 1.3E-04 1.1E-04 9.7E-05 8.9E-05 7.7E-05
3 to 10 8.8E-05 6.9E-05 5.7E-05 5.1E-05 4.7E-05 4.1E-05
10 to 50 7.8E-05 3.8E-05 3.2E-05 2.8E-05 2.6E-05 2.3E-05
50 to 150 0.0E+00 2.3E-05 9.0E-06 8.0E-06 7.3E-06 6.4E-06
>150 0.0E+00 0.0E+00 1.1E-05 9.8E-06 9.2E-06 8.3E-06
TOTAL 3.3E-04 2.6E-04 2.2E-04 1.9E-04 1.8E-04 1.6E-04

(d) Zero pressure actuated valve release frequencies (per valve year) by valve diameter

6" DIA 12" DIA 18" DIA 24" DIA 36" DIA
HOLE DIA 2" DIA (150 (300 (450 (600 (900
RANGE (mm) (50 mm) mm) mm) mm) mm) mm)
1 to 3 1.1E-05 1.8E-05 2.5E-05 3.0E-05 3.4E-05 4.1E-05
3 to 10 7.8E-06 1.3E-05 1.7E-05 2.1E-05 2.3E-05 2.8E-05
10 to 50 1.3E-05 9.6E-06 1.3E-05 1.6E-05 1.8E-05 2.2E-05
50 to 150 0.0E+00 1.1E-05 5.2E-06 6.2E-06 7.1E-06 8.5E-06
>150 0.0E+00 0.0E+00 9.3E-06 1.1E-05 1.3E-05 1.5E-05
TOTAL 3.2E-05 5.1E-05 6.9E-05 8.3E-05 9.5E-05 1.1E-04

6 ©OGP
RADD – Process release frequencies

Equipment Type: (5) Instrument connections


Definition:
Includes small-bore connections for flow, pressure and temperature sensing. The scope
includes the instrument itself plus up to 2 instrument valves, 4 flanges, 1 fitting and
associated small-bore piping, usually 25 mm diameter or less.

Instrument connection release frequencies (per instrument year; sizes 10 to 50

mm diameter)

HOLE DIA ALL FULL LIMITED ZERO


RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 3.5E-04 1.8E-04 1.6E-04 8.8E-06
3 to 10 1.5E-04 6.8E-05 7.4E-05 5.5E-06
10 to 50 6.5E-05 2.5E-05 3.6E-05 3.8E-06
TOTAL 5.7E-04 2.8E-04 2.7E-04 1.8E-05

©OGP 7
RADD – Process release frequencies

Equipment Type: (6) Process (pressure) vessels


Definition:
Offshore: Includes all types of pressure vessel (horizontal/vertical absorber, knock-out drum,
reboiler, scrubber, separator and stabiliser), but not the HCRD category “other”, which are
mainly hydrocyclones.
Onshore: Includes process vessels and columns, but not storage vessels.
The scope includes the vessel itself and any nozzles or inspection openings, but excludes all
attached valves, piping, flanges, instruments and fittings beyond the first flange. The first
flange itself is also excluded.

Pressure vessel release frequencies (per vessel year; connections 50 to 150 mm

diameter)

HOLE DIA ALL FULL LIMITED ZERO


RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 9.6E-04 3.9E-04 3.5E-04 1.8E-04
3 to 10 5.6E-04 2.0E-04 2.0E-04 1.4E-04
10 to 50 3.5E-04 1.0E-04 1.2E-04 1.2E-04
>50 2.8E-04 5.1E-05 7.9E-05 1.8E-04
TOTAL 2.2E-03 7.4E-04 7.4E-04 6.3E-04

Pressure vessel release frequencies (per vessel year; connections >150 mm

diameter)

HOLE DIA ALL FULL LIMITED ZERO


RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 9.6E-04 3.9E-04 3.5E-04 1.8E-04
3 to 10 5.6E-04 2.0E-04 2.0E-04 1.4E-04
10 to 50 3.5E-04 1.0E-04 1.2E-04 1.2E-04
50 to 150 1.1E-04 2.7E-05 3.7E-05 5.5E-05
>150 1.7E-04 2.4E-05 4.2E-05 1.4E-04
TOTAL 2.2E-03 7.4E-04 7.4E-04 6.3E-04

8 ©OGP
RADD – Process release frequencies

Equipment Type: (7) Pumps: Centrifugal


Definition:
Centrifugal pumps including single-seal and double-seal types*. The scope includes the
pump itself, but excludes all attached valves, piping, flanges, instruments and fittings beyond
the first flange. The first flange itself is also excluded.
* Analysis has shown that there is no statistical difference between single- and double-seal
types for releases in the size range considered.

Centrifugal pump release frequencies (per pump year; inlets 50 to 150 mm

diameter)

HOLE DIA ALL FULL LIMITED ZERO


RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 5.1E-03 3.4E-03 1.3E-03 2.4E-04
3 to 10 1.8E-03 1.0E-03 5.6E-04 1.4E-04
10 to 50 5.9E-04 2.9E-04 2.4E-04 9.4E-05
>50 1.4E-04 5.4E-05 8.3E-05 7.2E-05
TOTAL 7.6E-03 4.8E-03 2.2E-03 5.5E-04

Centrifugal pump release frequencies (per pump year; inlets >150 mm diameter)

HOLE DIA ALL FULL LIMITED ZERO


RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 5.1E-03 3.4E-03 1.3E-03 2.4E-04
3 to 10 1.8E-03 1.0E-03 5.6E-04 1.4E-04
10 to 50 5.9E-04 2.9E-04 2.4E-04 9.4E-05
50 to 150 9.7E-05 3.9E-05 5.0E-05 3.1E-05
>150 4.8E-05 1.5E-05 3.3E-05 4.1E-05
TOTAL 7.6E-03 4.8E-03 2.2E-03 5.5E-04

©OGP 9
RADD – Process release frequencies

Equipment Type: (8) Pumps: Reciprocating


Definition:
Reciprocating pumps including single-seal and double-seal types*. The scope includes the
pump itself, but excludes all attached valves, piping, flanges, instruments and fittings beyond
the first flange. The first flange itself is also excluded.
* Analysis has shown that there is no statistical difference between single- and double-seal
types for releases in the size range considered.

Reciprocating pump release frequencies (per pump year; inlets 50 to 150 mm

diameter)

HOLE DIA ALL FULL LIMITED ZERO


RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 3.3E-03 2.1E-03 8.9E-04 0.0E+00
3 to 10 1.9E-03 1.2E-03 6.2E-04 0.0E+00
10 to 50 1.2E-03 7.4E-04 4.7E-04 0.0E+00
>50 8.0E-04 5.0E-04 5.3E-04 0.0E+00
TOTAL 7.2E-03 4.5E-03 2.5E-03 0.0E+00

Reciprocating pump release frequencies (per pump year; inlets >150 mm

diameter)

HOLE DIA ALL FULL LIMITED ZERO


RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 3.3E-03 2.1E-03 8.9E-04 0.0E+00
3 to 10 1.9E-03 1.2E-03 6.2E-04 0.0E+00
10 to 50 1.2E-03 7.4E-04 4.7E-04 0.0E+00
50 to 150 3.7E-04 2.3E-04 1.9E-04 0.0E+00
>150 4.3E-04 2.7E-04 3.4E-04 0.0E+00
TOTAL 7.2E-03 4.5E-03 2.5E-03 0.0E+00

10 ©OGP
RADD – Process release frequencies

Equipment Type: (9) Compressors: Centrifugal


Definition:
The scope includes the compressor itself, but excludes all attached valves, piping, flanges,
instruments and fittings beyond the first flange. The first flange itself is also excluded.

Centrifugal compressor release frequencies (per compressor year;


inlets 50 to 150 mm diameter)

HOLE DIA ALL FULL LIMITED ZERO


RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 6.7E-03 3.4E-03 2.9E-03 3.7E-04
3 to 10 2.6E-03 6.8E-04 1.4E-03 2.4E-04
10 to 50 1.0E-03 1.3E-04 7.4E-04 1.8E-04
>50 3.0E-04 1.3E-05 3.5E-04 1.8E-04
TOTAL 1.1E-02 4.2E-03 5.5E-03 9.6E-04

Centrifugal compressor release frequencies (per compressor year; inlets >150

mm diameter)

HOLE DIA ALL FULL LIMITED ZERO


RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 6.7E-03 3.4E-03 2.9E-03 3.7E-04
3 to 10 2.6E-03 6.8E-04 1.4E-03 2.4E-04
10 to 50 1.0E-03 1.3E-04 7.4E-04 1.8E-04
50 to 150 1.9E-04 1.0E-05 1.9E-04 6.7E-05
>150 1.1E-04 2.5E-06 1.6E-04 1.1E-04
TOTAL 1.1E-02 4.2E-03 5.5E-03 9.6E-04

©OGP 11
RADD – Process release frequencies

Equipment Type: (10) Compressors: Reciprocating


Definition:
The scope includes the compressor itself, but excludes all attached valves, piping, flanges,
instruments and fittings beyond the first flange. The first flange itself is also excluded.

Reciprocating compressor release frequencies (per compressor year;


inlets 50 to 150 mm diameter)

HOLE DIA ALL FULL LIMITED ZERO


RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 4.5E-02 2.4E-02 1.9E-02 0.0E+00
3 to 10 1.7E-02 8.0E-03 9.4E-03 0.0E+00
10 to 50 6.7E-03 2.6E-03 4.7E-03 0.0E+00
>50 2.0E-03 8.8E-04 2.2E-03 0.0E+00
TOTAL 7.1E-02 3.6E-02 3.6E-02 0.0E+00

Reciprocating compressor release frequencies (per compressor year;


inlets >150 mm diameter)

HOLE DIA ALL FULL LIMITED ZERO


RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 4.5E-02 2.4E-02 1.9E-02 0.0E+00
3 to 10 1.7E-02 8.0E-03 9.4E-03 0.0E+00
10 to 50 6.7E-03 2.6E-03 4.7E-03 0.0E+00
50 to 150 1.3E-03 4.0E-04 1.2E-03 0.0E+00
>150 7.3E-04 4.8E-04 1.0E-03 0.0E+00
TOTAL 7.1E-02 3.6E-02 3.6E-02 0.0E+00

12 ©OGP
RADD – Process release frequencies

Equipment Type: (11) Heat exchangers: Shell & Tube, shell side
HC
Definition:
Shell & tube type heat exchangers with hydrocarbon in the shell side. The scope includes the
heat exchanger itself, but excludes all attached valves, piping, flanges, instruments and
fittings beyond the first flange. The first flange itself is also excluded.

Heat exchanger release frequencies (per heat exchanger year; inlets 50 to 150

mm diameter)

HOLE DIA ALL FULL LIMITED ZERO


RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 2.2E-03 1.2E-03 1.2E-03 0.0E+00
3 to 10 1.1E-03 4.1E-04 7.3E-04 0.0E+00
10 to 50 5.6E-04 1.4E-04 4.9E-04 0.0E+00
>50 2.6E-04 3.6E-05 4.0E-04 0.0E+00
TOTAL 4.1E-03 1.8E-03 2.8E-03 0.0E+00

Heat exchanger release frequencies (per heat exchanger year; inlets >150 mm

diameter)

HOLE DIA ALL FULL LIMITED ZERO


RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 2.2E-03 1.2E-03 1.2E-03 0.0E+00
3 to 10 1.1E-03 4.1E-04 7.3E-04 0.0E+00
10 to 50 5.6E-04 1.4E-04 4.9E-04 0.0E+00
50 to 150 1.4E-04 2.4E-05 1.7E-04 0.0E+00
>150 1.2E-04 1.2E-05 2.3E-04 0.0E+00
TOTAL 4.1E-03 1.8E-03 2.8E-03 0.0E+00

©OGP 13
RADD – Process release frequencies

Equipment Type: (12) Heat exchangers: Shell & Tube, tube side HC
Definition:
Shell & tube type heat exchangers with hydrocarbon in the tube side. The scope includes the
heat exchanger itself, but excludes all attached valves, piping, flanges, instruments and
fittings beyond the first flange. The first flange itself is also excluded.

Heat exchanger release frequencies (per heat exchanger year; inlets 50 to 150

mm diameter)

HOLE DIA ALL FULL LIMITED ZERO


RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 2.0E-03 8.2E-04 7.9E-04 1.8E-04
3 to 10 8.8E-04 3.8E-04 4.3E-04 7.7E-05
10 to 50 4.0E-04 1.8E-04 2.5E-04 3.4E-05
>50 2.0E-04 7.6E-05 1.9E-04 1.3E-05
TOTAL 3.4E-03 1.5E-03 1.7E-03 3.0E-04

Heat exchanger release frequencies (per heat exchanger year; inlets >150 mm

diameter)

HOLE DIA ALL FULL LIMITED ZERO


RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 2.0E-03 8.2E-04 7.9E-04 1.8E-04
3 to 10 8.8E-04 3.8E-04 4.3E-04 7.7E-05
10 to 50 4.0E-04 1.8E-04 2.5E-04 3.4E-05
50 to 150 9.1E-05 4.3E-05 7.4E-05 7.7E-06
>150 1.1E-04 3.3E-05 1.2E-04 5.4E-06
TOTAL 3.4E-03 1.5E-03 1.7E-03 3.0E-04

14 ©OGP
RADD – Process release frequencies

Equipment Type: (13) Heat exchangers: Plate


Definition:
The scope includes the heat exchanger itself, but excludes all attached valves, piping,
flanges, instruments and fittings beyond the first flange. The first flange itself is also
excluded.

Heat exchanger release frequencies (per heat exchanger year; inlets 50 to 150

mm diameter)

HOLE DIA ALL FULL LIMITED ZERO


RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 5.1E-03 3.9E-03 2.7E-03 0.0E+00
3 to 10 2.8E-03 2.0E-03 1.3E-03 0.0E+00
10 to 50 1.6E-03 1.1E-03 6.7E-04 0.0E+00
>50 9.9E-04 6.3E-04 3.2E-04 0.0E+00
TOTAL 1.0E-02 7.3E-03 5.0E-03 0.0E+00

Heat exchanger release frequencies (per heat exchanger year; inlets >150 mm

diameter)

HOLE DIA ALL FULL LIMITED ZERO


RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 5.1E-03 3.9E-03 2.7E-03 0.0E+00
3 to 10 2.8E-03 2.0E-03 1.3E-03 0.0E+00
10 to 50 1.6E-03 1.1E-03 6.7E-04 0.0E+00
50 to 150 4.8E-04 3.2E-04 1.7E-04 0.0E+00
>150 5.1E-04 3.1E-04 1.5E-04 0.0E+00
TOTAL 1.0E-02 7.3E-03 5.0E-03 0.0E+00

©OGP 15
RADD – Process release frequencies

Equipment Type: (14) Heat exchangers: Air-cooled


Definition:
Often referred to as fin-fan coolers but in principle includes all air-cooled type heat
exchangers. The scope includes the heat exchanger itself, but excludes all attached valves,
piping, flanges, instruments and fittings beyond the first flange. The first flange itself is also
excluded.

Heat exchanger release frequencies (per heat exchanger year; inlets 50 to 150

mm diameter)

HOLE DIA ALL FULL LIMITED ZERO


RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 1.0E-03 1.0E-03 0.0E+00 0.0E+00
3 to 10 4.9E-04 4.9E-04 0.0E+00 0.0E+00
10 to 50 2.4E-04 2.4E-04 0.0E+00 0.0E+00
>50 1.1E-04 1.1E-04 0.0E+00 0.0E+00
TOTAL 1.0E-03 1.0E-03 0.0E+00 0.0E+00

Heat exchanger release frequencies (per heat exchanger year; inlets >150 mm

diameter)

HOLE DIA ALL FULL LIMITED ZERO


RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 1.0E-03 1.0E-03 0.0E+00 0.0E+00
3 to 10 4.9E-04 4.9E-04 0.0E+00 0.0E+00
10 to 50 2.4E-04 2.4E-04 0.0E+00 0.0E+00
50 to 150 6.0E-05 6.0E-05 0.0E+00 0.0E+00
>150 4.9E-05 4.9E-05 0.0E+00 0.0E+00
TOTAL 1.0E-03 1.0E-03 0.0E+00 0.0E+00

16 ©OGP
RADD – Process release frequencies

Equipment Type: (15) Filters


Definition:
The scope includes the filter body itself and any nozzles or inspection openings, but
excludes all attached valves, piping, flanges, instruments and fittings beyond the first flange.
The first flange itself is also excluded.

Filter release frequencies (per filter year; inlets 50 to 150 mm diameter)

HOLE DIA ALL FULL LIMITED ZERO


RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 2.0E-03 1.3E-03 5.1E-04 1.3E-04
3 to 10 1.0E-03 5.1E-04 3.3E-04 9.3E-05
10 to 50 5.2E-04 1.9E-04 2.3E-04 7.7E-05
>50 2.6E-04 5.5E-05 2.1E-04 1.0E-04
TOTAL 3.8E-03 2.1E-03 1.3E-03 4.0E-04

Filter release frequencies (per filter year; inlets >150 mm diameter)

HOLE DIA ALL FULL LIMITED ZERO


RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 2.0E-03 1.3E-03 5.1E-04 1.3E-04
3 to 10 1.0E-03 5.1E-04 3.3E-04 9.3E-05
10 to 50 5.2E-04 1.9E-04 2.3E-04 7.7E-05
50 to 150 1.4E-04 3.5E-05 8.4E-05 3.3E-05
>150 1.2E-04 2.0E-05 1.3E-04 7.2E-05
TOTAL 3.8E-03 2.1E-03 1.3E-03 4.0E-04

©OGP 17
RADD – Process release frequencies

Equipment Type: (16) Pig traps


Definition:
Includes pig launchers and pig receivers. The scope includes the pig trap itself, but excludes
all attached valves, piping, flanges, instruments and fittings beyond the first flange. The first
flange itself is also excluded.

Pig trap release frequencies (per pig trap year; inlets 50 to 150 mm diameter)

HOLE DIA ALL FULL LIMITED ZERO


RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 3.2E-03 2.3E-03 7.4E-04 2.7E-04
3 to 10 1.9E-03 7.2E-04 5.6E-04 2.3E-04
10 to 50 1.2E-03 2.2E-04 4.8E-04 2.3E-04
>50 8.3E-04 4.7E-05 7.1E-04 5.2E-04
TOTAL 7.0E-03 3.3E-03 2.5E-03 1.3E-03

Pig trap release frequencies (per pig trap year; inlets >150 mm diameter)

HOLE DIA ALL FULL LIMITED ZERO


RANGE (mm) RELEASES RELEASES RELEASES PRESSURE
RELEASES
1 to 3 3.2E-03 2.3E-03 7.4E-04 2.7E-04
3 to 10 1.9E-03 7.2E-04 5.6E-04 2.3E-04
10 to 50 1.2E-03 2.2E-04 4.8E-04 2.3E-04
50 to 150 3.7E-04 3.3E-05 2.1E-04 1.1E-04
>150 4.6E-04 1.4E-05 5.0E-04 4.1E-04
TOTAL 7.0E-03 3.3E-03 2.5E-03 1.3E-03

18 ©OGP
RADD – Process release frequencies

3.0 Guidance on use of data


3.1 General validity
The data presented in Section 2.0 can be used for process equipment on the topsides of
offshore installations and for onshore facilities handling hydrocarbons2, and could also
be used as appropriate for subsea completions.
DNV [3] have compared failure rate data for LNG facilities with the data presented in
Section 2.0. The comparison indicates that LNG failure frequencies may be around 40%
to 65% of those given here. However, this has not been verified and the data for LNG
installations is relatively sparse. We therefore recommend use of the same frequencies
for LNG installations as given in Section 2.0. A 50% reduction could be considered as a
sensitivity but decisions based on this would need to be fully justified.
The release frequencies given in Section 2.0 are valid for holes of diameter (d) from
1 mm to the diameter of the equipment (D). Frequencies of smaller holes may be
estimated by extrapolation of the frequencies to smaller hole sizes, but this is beyond
the range of the HSE data (see Section 4.0). The data are not sufficient to determine the
frequencies of larger holes (e.g. long splits or guillotine breaks allowing flow from both
sides) and this can only be addressed using engineering judgment.
The release frequencies are valid for equipment diameters (D) within the normal range
of offshore equipment. This is not precisely defined in the available equipment
population data. Using judgment based on the trends of the estimated diameter
dependence and the average diameters of the available data groups, the following
ranges of validity are suggested:
• Pipes: 20 to 1000 mm • Actuated valves: 10 to 1000 mm
• Flanges: 10 to 1000 mm Instruments:
• 10 to 100 mm
• Manual valves: 10 to 1000 mm • Pig traps: 100 to 1000
mm
• All other equipment: 40 to 400 mm

With lesser confidence, the datasheets in Section 2.0 can be used to estimate
frequencies over larger ranges, but they should be subject to sensitivity testing. These
functions have been checked for mathematical consistency over a range of equipment
diameters from 10 to 1000 mm. The frequencies are not recommended for equipment
outside this range.

2
The justification for using offshore data for onshore facilities is two-fold. First, no public
domain dataset for onshore facilities is available that is comparable to HCRD, considering both
the equipment population and completeness of recording releases. Second, although offshore
facilities operate in a more challenging (e.g. more corrosive) environment, this is compensated
for in the design, inspection and maintenance. Hence there is no apparent reason why onshore
and offshore release frequencies should differ significantly. However, some environmental
factors are considered in Section 3.5. The standard of the safety management system is also
believed to have a major influence on release frequencies, regardless of operating environment,
as also discussed in Section 3.5.

©OGP 19
RADD – Process release frequencies

3.2 Uncertainties
The sources of uncertainties in the estimated release frequencies are discussed in
Section 4.1.3.
The uncertainty in the release frequencies presented in Section 2.0 tends to be greatest
for large hole sizes, for equipment sizes far from the centres of the ranges of validity
given in Section 3.1, and for equipment types where fewer releases have been recorded
(see Section 4.1.1).
No quantitative representations of the uncertainty in the release frequency results have
yet been derived. Based on the sensitivity test that have been conducted and on
previous analyses of the same dataset, the uncertainly in the results may be a factor or
3 (higher or lower) for frequencies of holes in the region of 1 mm diameter, rising to a
factor of 10 (higher or lower) for frequencies of holes in the region of 100 mm diameter.
A simple sensitivity test would therefore be to use the frequencies for All releases in
place of the Full release frequencies.

3.3 Definition of release types


The three release frequency types defined in Section 1.0, and for which frequencies are
given separately in Section 2.0, are described in further detail in the following sub-
sections.

3.3.1 Full releases


This scenario is intended to be consistent with QRA models that assume a release
through the defined hole, beginning at the normal operating pressure, until controlled
by ESD and blowdown, with a small probability of ESD/blowdown failure. Full releases
are defined as cases where the outflow is greater than or broadly comparable with that
predicted for a release at the operating pressure (since the normal pressure is unknown
in HCRD) controlled by the quickest credible ESD (within 1 minute) and blowdown
(nominally a 30 mm orifice3). This is subdivided as follows:
• ESD isolated releases, presumed to be controlled by ESD and blowdown of the
leaking system.
• Late isolated releases, presumed to be cases where there is no effective ESD of the
leaking system, resulting in a greater outflow.
Typical use in the QRA:
These events should always be included in quantified risk assessments. They have the
potential of developing into serious events endangering personnel and critical safety
functions.
These releases represent approximately 31% of all releases in the HSE HCRD for 1992-
2006.

3
The actual orifice diameter should be used in QRA modelling, or preferably the orifice diameter
that gives blowdown to a specified pressure in the actual time

20 ©OGP
RADD – Process release frequencies

3.3.2 Limited releases


This scenario includes all other pressurised releases. They are defined as cases where
the equipment is under pressure (over 0.01 barg) but the outflow is less than from a
release at the operating pressure controlled by the quickest credible ESD (within 1
minute) and blowdown (through an orifice nominally of 30 mm diameter). This may be
because the release is isolated locally by human intervention (e.g. closing an
inadvertently opened valve), or by a restriction in the flow from the system inventory
(e.g. releases of fluid accumulated between pump shaft seals).
Typical use in the QRA:
a) Coarse QRAs. Limited Releases should normally be included in the risk analysis, and
treated as Full Releases with regards to the consequence modelling. This is a
conservative approach, which normally is in line with the nature of Coarse QRA.
b) Detailed QRAs. Limited Releases could be considered for their expected (realistic)
consequences. These events may be of concern for personnel risk, but it is less
likely that they develop into any major concern for other safety functions, such as
structural integrity, evacuation means, escalation, etc. Any consequence
calculations should reflect that these events involve limited release volumes. If the
consequences are not specifically assessed, the approach of a) above apply also for
detailed QRAs.
There are two possible approaches to modelling these releases, depending on whether
the limitation is on the duration (through prompt local isolation) or the flow (through a
restriction). In the first case (limited duration), flow is likely to be at the same release
rate as for a full release but reduced to a short duration (e.g. 30 seconds). In the second
case, the release rate will be much lower than for the corresponding full release and the
quantity released also smaller. In this case an approach previously suggested [4] has
been to model the flow rate as 8% of the full release rate and the duration as 6% of the
full release duration.
These releases represent approximately 59% of all releases in the HSE HCRD for 1992-
2006.

3.3.3 Zero pressure releases


This scenario includes all releases where the pressure inside the releasing equipment is
virtually zero (0.01 barg or less). This may be because the equipment has a normal
operating pressure of zero (e.g. open drains), or because the equipment has been
depressurised for maintenance.
Typical use in the QRA (but not limited to this example):
These are events that typically are excluded from QRA assessments. Most likely there
are no serious consequences and if so, the contribution to the overall risk level is
considered insignificant. These events are mainly included for consistency with the
original HSE data.
The event is likely to result in release of a small quantity of hydrocarbon. This could
be taken as the inventory of the system hydrocarbon full at atmospheric pressure.
These releases represent approximately 10% of all releases in the HSE HCRD for
1992-2006.

3.4 Consequence modelling for the largest release size


Where the data tables in Section 2.0 show “>50 mm” or “>150 mm” for the largest hole
diameter range, the consequences of the release should be modelled using the size of
the actual pipe/valve/flange or the largest connection to other equipment types.

©OGP 21
RADD – Process release frequencies

3.5 Modification of frequencies for factors specific to plant conditions


3.5.1 General considerations
The frequencies tabulated in Section 2.0 are generic frequencies for installations
designed and operating to “typical” European / North American standards. A large
number of possible factors may suggest that these generic frequencies ought to be
modified to make them specific to the local conditions. These factors include the
physical characteristics of the equipment, the operating conditions, and characteristics
of the management system in place. Factors related to the physical characteristics and
operating conditions could include:
• Design code • Operating environment • Process continuity
• Material of construction • Cold or hot weather • Stress cycling
• Fluid inside equipment • Equipment age • Welds
• Operating pressure • Seismic activity • Radiography
• Operating temperature • Integrity status
Many of these are addressed in Section 8.3 of API 581 1st ed. [14], discussed in Section
3.5.2. Some more specific factors relating to inter-unit piping and flanges are presented
in Sections 3.5.3 (piping) and 3.5.5 (flanges). The influence of safety management, well
recognized as influencing release rates, is discussed in Section 3.5.3.

3.5.2 API 581 Approach


3.5.2.1 1st Edition
An equipment modification factor is developed for each equipment item, based on the
specific environment in which the item operates. This factor is composed of four
subfactors illustrated in Figure 3.1. These subfactors are summarised as follows:
• The Technical Module Subfactor is the systematic method used to assess the
effect of specific failure mechanisms on the likelihood of failure. The module
evaluates:
1. The deterioration rate of the equipment item’s material of construction (i.e.
corrosion), resulting from its operating environment.
2. The effectiveness of the facility’s inspection programme to identify and monitor
the operative damage mechanisms prior to failure.
• The Universal Subfactor covers conditions that equally affect all equipment items
in the facility: plant condition, cold weather operation, and seismic activity.
• The M echanical Subfactor addresses conditions related primarily to the design
and fabrication of the equipment item.
• Conditions that are most influenced by the process and how the facility is operated
are included in the Process Subfactor.
The API 581 document provides full details of how the four factors can be evaluated
individually and combined to obtain the overall equipment modification factor for each
equipment item. This can then be applied to the generic frequencies given in Section
2.04.

4
However, it should be noted that Section 8.2 of API 581 includes generic leak frequencies for
many of the equipment types covered in this Datasheet. The factors are presumably intended to
be used with those frequencies, although there is nothing to suggest that this is obligatory.
Hence the equipment modification factor approach set out in API 581 is considered suitable for
more detailed analysis based on the generic frequencies presented in this datasheet.

22 ©OGP
RADD – Process release frequencies

Figure 3.1 Overview of Equipm ent Modification Factor (from API 581 1st ed.)

©OGP
RADD – Process release frequencies

3.5.2.2 Possible Changes for 2nd Edition


The 2nd edition is currently out for consultation with interested parties so its final
content is not fixed. However, some of the proposed changes affect the approach
summarised in Section 3.5.2.1 as follows:
• Parts of the universal and mechanical subfactors will be removed.
• The entirety of the process subfactor will be removed.
• Additional factors will be introduced to address very specific issues:
− Thinning
− Component lining damage
− Stress corrosion cracking
− External corrosion
− Brittle fracture
− Embrittlement
− Piping mechanical fatigue

Users of the API 581 1st edition approach are recommended to apprise themselves of
changes in the 2nd edition, which will be finalised subsequent to the issue of this
datasheet.

3.5.3 Safety Management


The quality of operation, inspection, maintenance etc is a critical influence on release
frequencies, as illustrated by the Flixborough accident (Section 2.4). The selected pipe
release frequencies reflect safety management in UK offshore installations during 1992-
2006, which is believed to be a good modern standard. The release frequencies at plants
with lesser standards may be much higher.
In order to reflect the standard of safety management at an individual plant, it is
possible to quantify this using a safety management audit, and convert the audit score
into an overall management factor (MF), by which all the generic failure frequencies can
be multiplied. Due to lack of experience with this technique, the relationship between
the audit scores and management factors is highly speculative. Several such
techniques have been used, of which the most recent studies [11][12] suggest that MF
values should lie between 0.1 and 10.0 (i.e. from 10 times better than average to 10 times
worse than average)5.
API 581 [14] provides a management systems evaluation audit scheme, summarised in
Section 8.4 and set out in full in a workbook forming Appendix III. The subject areas,
from the OSHA PSM standard [14], are:
• Leadership and administration • Mechanical integrity
• Process safety information • Pre-startup safety review
• Process hazard analysis • Emergency response
• Management of change • Incident investigation
• Operating procedures • Contractors
• Safe work practices • Audits
• Training

5
Although it has been suggested [13] that the degradation in plant condition that occurred at
Bhopal as a result of safety management deficiencies led to the risk of a major accident
increasing by a factor of 1000.

24 ©OGP
RADD – Process release frequencies

The audit comprises 101 questions, and the answers are scored to obtain a percentage.
This is converted to a management factor that applies to the whole unit or facility
studied. The conversion is based on assuming, first, that an “average” US
petrochemical plant would score 50%, giving a management factor of 1 (i.e. generic
frequencies, which are multiplied by this factor, are unchanged). A “perfect” score of
100% would yield an order of magnitude reduction in total unit risk, i.e. a factor of 0.1. A
score of 0% would result in an order of magnitude increase in total unit risk, i.e. a factor
of 10. Figure 3.2 shows the resulting conversion graph.

Figure 3.2 Frequency Moification Factor vs. Managem ent System


Evaluation (API 581)

Note that the scoring is stated to be against an “average US petrochemical plant”.


Since the frequencies presented in Section 2.0 are based on offshore UKCS data, it
should not be assumed that safety management in that environment is comparable with
that on an average US petrochemical plant. However, no comparative study and
corresponding conversion system has been developed for offshore UK, hence use of
this system requires some care and guidance is beyond the scope of this datasheet.

3.5.4 Inter-unit piping


The frequencies given in datasheet 1 for steel piping are, for onshore installations,
intended to be applied within process units. For piping linking process units (inter-unit
pipe) and piping to/from storage or loading facilities (transfer pipe), the following
release frequency modification factors can be applied:
• Inter-unit pipe: 0.9
• Transfer pipe: 0.8
These have been derived from detailed analysis of the causes of piping failure [5] and
application to this analysis of judgemental modifications to account for the differences
in inter-unit and transfer pipes [6].

©OGP 25
RADD – Process release frequencies

3.5.5 Flanges
Studies [7], [8] of the effect of flange type on flange failure frequency developed
modification factors to the frequencies presented on datasheet 2. These functions
should be applied when performing detailed risk analyses where the flange types are
known, alternatively as decision input to design when flange types are to be decided.
The flange types considered are:
• ANSI Ring Joint
• ANSI Raised faced
• Compact flange
• Grayloc flange.
The release frequency for each flange type is based on the release frequency for flange
from HCRD data. HCRD data for flanges include ring joint, spiral wound, Grayloc and
hammer union, but the contribution from each type can not be identified from the flange
frequency. The ANSI Ring Joint, at this time the most common flange type, is assumed
to be represented by the HCRD data for flanges.
Because different flanges will have different failure modes, and thereby both different
release frequencies and different distribution of release frequencies, dependent on hole
size or release rate, the release frequency for the different flange types will be adjusted
relative to the release frequency for ANSI Ring Joint flanges. The resulting modification
factors are set out in Table 3.1.

26 ©OGP
RADD – Process release frequencies

Table 3.1 Release Frequency Modifications for Different Flange Types

Flange type Hole Modification


diameter
range (mm)
ANSI Ring Joint 1-3 None
3-10 None
10-50 None
50-150 None
>150 None
ANSI Raised 10% of total flange release
Face 1-3 frequency
10% of total flange release
3-10 frequency
30% of total flange release
10-50 frequency
30% of total flange release
50-150 frequency
20% of total flange release
>150 frequency
Compact 1-3 × 0.062
3-10 × 0.062
10-50 × 0.062
50-150 × 0.991
>150 × 0.991
Grayloc 1-3 × 0.064
3-10 × 0.064
10-50 × 0.064
50-150 × 1.020
>150 × 1.020

4.0 Review of data sources


4.1 Basis of data presented
The release frequencies for the main process equipment items presented in Section 2.0
are based on an analysis of the HSE hydrocarbon release database (HCRD) for 1992-
2006 [9], according to a methodology described in [4]. An overview of this methodology
is given in Section 4.1.2.
The HSE hydrocarbon release database (HCRD) has become the standard source of
release frequencies for offshore QRA and provides a large, high-quality collection of
release experience, now available on-line. All offshore releases of hydrocarbons are
required to be reported to the HSE Offshore Safety Division (OSD) as dangerous
occurrences under the Reporting of Injuries, Diseases and Dangerous Occurrences
Regulations 1995 (RIDDOR), which became effective offshore on 1 April 1996. The
Hydrocarbon Releases (HCR) system contains detailed voluntary information on
offshore hydrocarbon release incidents supplementary to that provided under RIDDOR
(and previous offshore legislation that applied prior to April 1996). The database
contains reports of 3824 releases dating from 1 October 1992 to 31 March 2006, of which
2551 relate to the equipment types addressed in this datasheet.

©OGP 27
RADD – Process release frequencies

The database is considered to be “high-quality” on a combination of two features:


• The equipment population is believed to be highly accurate
• The incident population is believed to be reasonably complete, and not to suffer so
much from the under-reporting of small incidents that often occurs
Hence it has been selected in preference to other data sources discussed in Section 4.2.

4.1.1 Summary of release statistics


Table 4.1 summarises the number of releases and exposure (population) for each
equipment type represented in the HSE HCRD.

Table 4.1 Sum m ary of Release Statistics for HSE HCRD 1992-2006

Equipment type All Releases Releases Exposure


excluding <
1 mm
1. Steel process pipes 700 646 5,958,814 pipe metre years
2. Flanges 327 298 3,368,520 flange joint years
3. Manual valves 175 154 1,498,038 valve years
4. Actuated valves 264 221 329,562 valve years
5. Instrument connections 528 442 749,786 instrument years
6. Process (pressure) vessels 42 37 17,494 vessel years
7. Pumps: Centrifugal 126 110 14,564 pump years
8. Pumps: Reciprocating 21 19 2,652 pump years
9. Compressors: Centrifugal 40 33 3,110 compressor
years
10. Compressors: 43 36 507 compressor
Reciprocating years
11. Heat exchangers: Shell & 18 14 3,398 exchanger years
Tube, shell side
12. Heat exchangers: Shell & 26 21 6,165 exchanger years
Tube, tube side
13. Heat exchangers: Plate 31 30 2,865 exchanger years
14. Heat exchangers: Air- 5 2 1,069 exchanger years
cooled
15. Filters 48 47 12,495 filter years
16. Pig traps 29 28 3,994 pig trap years

4.1.2 Methodology for obtaining release frequencies


The method of obtaining release frequencies from HCRD consists of three main steps:
• Grouping data for different types and sizes of equipment, where there is insufficient
experience to show significant differences between them.
• Fitting analytical frequency functions to the data, in order to obtain a smooth
variation of release frequency varying with equipment type and hole size. For some
equipment types the influence of equipment size can also be inferred.
• Splitting the release frequencies into the different release scenarios described above
(Sections 1.0, 3.3).

28 ©OGP
RADD – Process release frequencies

The release size distribution is represented by an analytical frequency function [2],


which ensures non-zero release frequencies for all holes sizes between 1 mm and the
diameter of the inlet pipe. In the case where the frequency depends on the equipment
size (Steel process pipes, Flanges, Manual valves), the function is of the general form:

where: F(d) = frequency per year of releases exceeding size d (mm)


D = equipment diameter
Frup = rupture frequency per year
C,a,m,n = constants specific to the equipment type and release scenario

In the case where the frequency does not depend on the equipment size the function is
of the simpler general form:

where the symbols have the same meanings as above.


The function can then be used to calculate the frequency of a release in any size range
(such as the ranges used in Section 2.0) d1 to d2 as F(d1) – F(d2).
The rupture frequency Frup and constants C,a,m,n referred to above are derived by a
combination of mathematical curve fitting and expert judgment.

4.1.3 Uncertainties in release frequencies


Uncertainties in the estimated release frequencies arise from three main sources:
• Incorrect information in HCRD about the releases that have occurred. This included
the possibility of under-reporting of small releases, errors in measuring the hole
diameter or estimating the quantity released etc. Although the data in HCRD
appears to be of unusually high quality, the possibility of bias or error is recognized.
• Inappropriate categorisation of the releases into the different scenarios.
• Inappropriate representation of the release frequency distributions by the fitted
release frequency distributions. This results in part from the small datasets, but also
from the simplifications inherent in the chosen functions, and their use to
extrapolate frequencies in areas where no releases have yet been recorded.
Sensitivity tests have been carried out [4] on the release frequency functions. The
sensitivity tests indicated that the results are sensitive to:
• The choice of isolation and blowdown times.
• The accuracy of the recorded release quantities.
• The treatment of cases where the inventory is not recorded.

4.1.4 Comparison with experience


A comparison has been made between historical release frequencies for a North Sea
platform and the corresponding frequencies predicted by the model described in the
preceding sub-sections. The results are set out in Table 4.2.

©OGP 29
RADD – Process release frequencies

Table 4.2 Com parison of Predicted Release Frequencies with Historical


Experience for One North Sea Platform

Data Release Release Gas Release Frequency (/year)


Source Categor Rate Full Limited Zero TOTAL
y (kg/s) Releases Releases Pressure
Releases
-1
Historical Small 0–1 N/A N/A N/A 1.3 × 10
data Medium 1 – 10 N/A N/A N/A 0
Large > 10 N/A N/A N/A 0
-1
TOTAL All N/A N/A N/A 1.3 × 10
-2 -2 -3 -1
HCRD Small 0–1 6.0 × 10 3.3 × 10 5.1 × 10 1.4 × 10
(see Note Medium 1 – 10 2.4 × 10
-2
5.6 × 10
-2
0 8.0 × 10
-2

below) -3 -2 -2
Large > 10 6.0 × 10 3.8 × 10 0 4.4 × 10
-2 -1 -2 -1
TOTAL All 9.1 × 10 1.4 × 10 3.4 × 10 2.7 × 10
Note: Frequencies as predicted by model described in the preceding sub-sections, based on
HCRD data up to 2003.

From the comparison in Table 4.2, the following observations and conclusions were
made:
• Compared to the original risk analysis frequencies, based on data from a 1995
analysis, the new total release frequencies estimated based on the HRCD data are
reduced significantly, by about 84%.
• Compared to the adjusted risk analysis frequencies, the new total release estimated
based on the HRCD data are reduced significantly, by about 71%.
• Compared to the historical release frequencies, the new total and full release
frequencies estimated based on the HRCD data are within a factor of about 2 (noting
that the platform concerned had only one recorded release during the period of
operation considered, introducing uncertainty into the estimate of the true historical
rate).

4.1.5 Conclusions
Others have also analysed the HCRD and obtained different functional forms for the
release frequencies. However, the release scenarios identified in Section 1.0 provide:
• A plausible representation of the different circumstances in which releases have
been found to occur;
• A model that ensures the frequencies of “full” releases (typically modelled in all
QRAs) are not over-estimated;
• A model that, overall, is consistent with experience.
On this basis, the data tabulated in Section 2.0 are presented as the best available
analysis of the best available data.

4.2 Other data sources


A large number of other data sources and analyses of process release frequencies were
analysed previously. These are listed in Section 6.2 (not all of these address all the
equipment types for which frequencies are given in Section 2.0).

30 ©OGP
RADD – Process release frequencies

5.0 Recommended data sources for further information


For further information, the data sources used to develop the release frequencies
presented in Section 2.0 and discussed in Sections 3.0 and 4.0 should be consulted.
These references are shown in bold in Section 6.1.

6.0 References
6.1 References for Sections 2.0 to 4.0
The principal references are shown in bold; the others were used to provide
supplementary information.
[1] SINTEF, 2002 (OREDA 2002). Offshore Reliability Data, 4th. ed.
[2] Spouge, J R, 2005. New Generic Leak Frequencies for Process Equipment, Process
Safety Progress, 24(4), 249-257.
[3] DNV, 2006. Confidential Report 2006-1269.
[4] DNV, 2004. Confidential Report 2004-0869.
[5] Technica, 1989. Confidential Report for UK HSE.
[6] DNV Technica, 1993. Confidential Report.
[7] DNV, 1997. Reliability Evaluation of SPO Compact Flange System, DNV Technical
Report 97-3547, rev. 2, for Steelproducts Offshore A/S.
[8] DNV, 2005. Decision model for choosing flange or weld connection, DNV Technical
Report (in Norweigan) 2005-0462, rev. 2.
[9] HSE HCRD. Hydrocarbon Releases (HCR) System , Health and Safety
Executive. https://www.hse.gov.uk/hcr3/ (Full data only available to
authorised users.)
[10] Pitblado, R M, Williams, J and Slater, D H, 1990. Quantitative Assessment of Process
Safety Programs, Plant Operations Progress, 9(3), AIChemE. (Presented at CCPS
Conference on Technical Management of Process Safety, Toronto).
[11] Hurst, N, Young, S, Donald, I, Gibson, H and Muyselaar, A, 1996. Measures of
Safety Management and Performance and Attitudes to Safety at Major Hazard
Sites, J. Loss Prevention in the Process Industries, 9(2).
[12] DNV, 1998. BRD on Risk Based Inspection, API Committee on Refinery Equipment,
unpublished draft.
[13] Wells, G L, Phang, C, and Reeves, A B, 1991. HAZCHECK and the Development of
Major Incidents, IChemE Symp. Ser. No. 124, 305-316, IChemE, Oxford: Pergamon
Press.
[14] API, 2000. Risk-Based Inspection Base Resource Document, API Publication 581,
1st ed.
[15] OSHA, 1992. 29 CFR 1910.119, Process Safety Management of Highly Hazardous
Chemicals; Final Rule; February 24, 1992. Federal Register, 57(36), 6356-6417.

©OGP 31
RADD – Process release frequencies

6.2 References for other data sources examined


ACDS, 1991. Major Hazard Aspects of the Transport of Dangerous Substances, Advisory
Committee on Dangerous Substances, Health & Safety Commission, HMSO.
AEA, 1998. Hydrocarbon Release Statistics Review, Report for UKOOA, AEA Technology.
AEA, 2000. A Preliminary Analysis of the HCR99 Data, Report for UKOOA, AEA
Technology.
AME (1998), PARLOC 96: The Update of Loss of Containment Data for Offshore Pipelines,
Offshore Technology Report OTH 551, Health & Safety Executive
Ames, S. & Crowhurst, D, 1988. Domestic Explosion Hazards from Small LPG
Containers, J. Haz. Mat., 19, 183-194.
Arulanatham, D.C. & Lees, F.P., 1981. Some Data on the Reliability of Pressure
Equipment in the Chemical Plant Environment, Int. J. Pres. Ves & Piping, 9, 327-338.
Aupied J.R., Le Coguiec, A. & Procaccia, H., 1983. Valves and Pumps Operating
Experience in French Nuclear Plants, Reliability Engineering, 6, 133-151.
Batstone, R.J. & Tomi, D.T., 1980. Hazard Analysis in Planning Industrial Developments,
Loss Prevention, 13, 7.
Baldock, P.J., 1980. Accidental Releases of Ammonia - An Analysis of Reported
Incidents, Loss Prevention, 13, 35-42.
Blything, K.W. & Reeves, A.B., 1988. An Initial Prediction of the BLEVE Frequency of a 100
te Butane Storage Vessel, UKAEA, SRD R448.
Bush, S.H., 1978. Reliability of Piping in Light Water Reactors, Symposium on Application
of Reliability Technology to Nuclear Power Plants, International Atomic Energy Agency, vol.
1, IAEA-SM-218/11.
Bush, S.H., 1988. Statistics of Pressure Vessel and Piping Failures, J. Pressure Vessel
Technology, 110/227.
Cox, A.W., Lees, F.P. & Ang, M.L., 1990. Classification of Hazardous Locations, Rugby, UK:
Institution of Chemical Engineers.
Crossthwaite, P.J., Fitzpatrick, R.D. & Hurst, N.W., 1988. Risk Assessment for the Siting of
Developments near Liquefied Petroleum Gas Installations, IChemE Symposium Series No
110.
Data Engineering, 1998. Hydrocarbon Release Database, Population Data Statistics, OTO
98 158, Health & Safety Executive, Offshore Safety Division.
Davenport, T.J., 1991. A Further Survey of Pressure Vessel Failures in the UK, Reliability
91, London.
E&P Forum, 1992. Hydrocarbon Leak and Ignition Database, Report 11.4/180.
GEAP, 1964. Survey of Piping Failures for the Reactor Primary Coolant Pipe Rupture Study,
Report 4574, General Electric Atomic Power.
Green A.E. & Bourne A.J., 1972. Reliability Technology, New York: Wiley
Gulf Oil, 1978. A review of Gulf and other data.
Hannaman, G.W., 1978. GCR Reliability Data Bank Status Report, General Atomic
Company, Project 3228.
Hawksley, J.L., 1984. Some Social, Technical and Economic Aspects of the Risks of Large
Plants, CHEMRAWN III.

32 ©OGP
RADD – Process release frequencies

HSE (1978), A Safety Evaluation of the Proposed St Fergus to Mossmorran Natural Gas
Liquids and St Fergus to Boddam Gas Pipelines, Health and Safety Executive
HSE, 1997. Offshore Hydrocarbon Releases Statistics 1997, Offshore Technology Report
OTO 97 950, Health & Safety Executive, London: HMSO.
HSE, 2000. Offshore Hydrocarbon Release Statistics 1999, Offshore Technology Report
OTO 1999 079, Health & Safety Executive, London: HMSO.
IAEA, 1988. Component Reliability Data for Use in Probabilistic Safety Assessment,
International Atomic Energy Authority Technical Document 4/8.
IEEE, 1984. IEEE Guide to the Collection and Presentation of Electrical, Electronic, Sensing
Component and Mechanical Equipment Reliability Data for Nuclear-Power Generating
Stations, Institute of Electrical & Electronics Engineers, Std 500-1984.
Johnson, D.W. & Welker, J.R., 1981. Development of an Improved LNG Plant Failure Rate
Data Base, Applied Technology Corporation, Report No. GRI-80/0093.
Kellerman, O. et al., 1973. Considerations about the Reliability of Nuclear Pressure
Vessels, International Conference on Pressure Vessel Technology, San Antonio, Texas,
USA.
Lees, F.P., 1996. Loss Prevention in the Process Industries, 2nd Ed., Oxford: Butterworth-
Heinemann.
Oberender, W. et al , 1978. Statistical Evaluations on the Failure of Mechanically Stressed
Components of Conventional Pressure Vessels, Technischen Uberwachungs-Vereine
Working Group on Nuclear Technology.
Pape, R.P. & Nussey, C., 1985. A Basic Approach for the Analysis of Risks From Major Toxic
Hazards, paper presented at Assessment and Control of Major Hazards, EFCE event no.
322, Manchester, UK, IChemE Symposium Series 93, 367-388.
Phillips, C.A.G. & Warwick, R.G., 1969. A Survey of Defects in Pressure Vessels Built to
High Standards of Construction and its Relevance to Nuclear Primary Circuits, UKAEA
AHSB(S) R162.
Reeves, A.B., Minah, F.C. & Chow, V.H.K., 1997. Quantitative Risk Assessment
Methodology for LPG Installations, EMSD Symposium on Risk and Safety Management in
the Gas Industry, Hong Kong.
Rijnmond Public Authority, 1982. A Risk Analysis of Six Potentially Hazardous Industrial
Objects in the Rijnmond Area - A Pilot Study, COVO, Dordrecht: D. Reidel Publishing Co.
Scandpower, 1981. Risk Analysis, Gas and Oil Leakages, Report for Statoil, Scandpower
Report 2.64.28.
Sherwin, D.J. & Lees, F.P., 1980. An Investigation of the Application of Failure Rate Data
Analysis to decision-Making in Maintenance of Process Plants, Proc. Instn. Mech. Engrs,
194, 301-308.
Smith, D.J., 1997. Reliability, Maintainability and Risk, 5th Ed., Oxfrod: Butterworth-
Heinemann.
Smith, T.A. & Warwick, R.G., 1974. The Second Survey of Defects in Pressure Vessels Built
to High Standards of Construction and its Relevance to Nuclear Primary Circuits, UKAEA
Safety and Reliability Directorate Report SRD R30.
Smith, T.A. & Warwick, R.G., 1981. A Survey of Defects in Pressure Vessels in the UK for
the Period 1962-78, and its Relevance to Nuclear Primary Circuits, UKAEA Safety and
Reliability Directorate Report SRD R203.
Sooby, W. & Tolchard, J.M., 1993. Estimation of Cold Failure Frequency of LPG Tanks in
Europe, Conference on Risk & Safety Management in the Gas Industry, Hong Kong.

©OGP 33
RADD – Process release frequencies

Svensson, L.G. & Sjögren, S., 1988. Reliability of Plate Heat Exchangers in the Power
Industry, American Society of Mechanical Engineers, Power Generation Conference,
Philadelphia, USA.
USNRC, 1975. Reactor Safety Study, Appendix III - Failure Data, US Nuclear Regulatory
Commission, NUREG-75/014, WASH-1400.
USNRC, 1980. ata Summaries of Licensee Event Reports of Valves at US Commercial
Nuclear Power Plants, by W.H. Hubble & C.F. Miller, EG&G Idaho Inc, for US Nuclear
Regulatory Commission, NUREG/CR-1363.
USNRC., 1981. Nuclear Plant Reliability Data System (NPRDS), US Nuclear Regulatory
Commission, NUREG/CR-2232, Annual Report.
Veritec, 1992. QRA handbook, DNV Technica Report 92-3147.
Wright, R.E., Steverson, J.A., & Zuroff, W.F., 1987. Pipe Break Frequency Estimation for
Nuclear Power Plants, US Nuclear Regulatory Commission, NUREG/CR-4407, Washington
DC.
Whittle, K., 1993. LPG Installation Design and General Risk Assessment Methodology
Employed by the Gas Standards Office, Conference on Risk & Safety Management in the Gas
Industry, Hong Kong.

34 ©OGP
Risk Assessment Data Directory

Report No. 434 – 2


March 2010

Blowout
frequencies
International Association of Oil & Gas Producers
RADD – Blowout frequencies

contents
1.0 Scope and Definitions ........................................................... 1
1.1 Application ...................................................................................................... 1
1.2 Definitions ....................................................................................................... 1
2.0 Summary of Recommended Data ............................................ 2
3.0 Guidance on use of data ........................................................ 6
3.1 General validity ............................................................................................... 6
3.2 Uncertainties ................................................................................................... 6
3.3 Example ........................................................................................................... 6
4.0 Review of data sources ......................................................... 7
4.1 Basis of data presented ................................................................................. 7
4.2 Onshore blowouts ........................................................................................ 11
4.3 Other data sources ....................................................................................... 12
5.0 Recommended data sources for further information ............ 12
6.0 References .......................................................................... 13

©OGP 1
RADD – Blowout frequencies

Abbreviations:
BOP Blowout Preventer
DNV Det Norske Veritas
EUB Alberta Energy and Utilities Board
GoM Gulf of Mexico
HPHT High Pressure High Temperature
NSS North Sea Standard
OCS (US) Outer Continental Shelf
UKCS United Kingdom Continental Shelf

2 ©OGP
RADD – Blowout frequencies

1.0 Scope and Definitions


1.1 Application
This datasheet presents (Section 2.0) frequencies of blowouts and well control
incidents. They are intended to be applied to well operations worldwide, both offshore
and onshore, as indicated in the table headings.

1.2 Definitions
The following definitions are taken from [1]:
• Blowout An incident where formation fluid flows out of the well or
between formation layers after all the predefined technical
well barriers or the activation of the same have failed.
• W ell release An incident where hydrocarbons flow from the well at some
point where flow was not intended and the flow was
stopped by use of the barrier system that was available on
the well at the time of the incident,
• Shallow gas An incident where shallow gas is released from the well
release after a gas zone has been penetrated before the BOP has
been installed (any zone penetrated after the BOP is
installed is not a shallow gas incidents)
• Oil well A well where the formation has an estimated gas/oil ratio
(GOR) less than 1,000
• Gas well A well where the formation has an estimated gas/oil ratio
(GOR) exceeding 1,000
• HPHT well A well with an expected shut-in pressure equal to or above
690 bar (10,000 psi) and/or bottom hole temperatures equal
to or above 150°C (300°F)
• North Sea Operation performed with BOP installed including shear
Standard (NSS) ram and two barrier principle followed
operation
• Production Production, injection and closed in production wells
• W ell intervention Completion, wireline, coiled tubing, snubbing and other
workover operations
• W ireline Wireline operations in production or injection wells (i.e. not
wireline operations carried out as part of drilling and
completion operations)
• W orkover Workover activities (not including wireline, snubbing or
coiled tubing operations). Often referred to as "heavy
workover"

©OGP 1
RADD – Blowout frequencies

2.0 Summary of Recommended Data


For well operations in the North Sea and in other offshore areas where the equipment is
of North Sea Standard (see Section 1.2), Scandpower’s analysis [2] of SINTEF’s blowout
database is recommended. For well operations in other areas of the world, SINTEF’s
own analysis [1] of the database is recommended. Both sets of data are tabulated
below. In the original reports [1,2] they are presented in different ways, however so far
as possible the tables below are consistent in layout for easy comparison.
For North Sea Standard operations, [2] does not give separate frequencies for topside
and subsea releases, except for shallow gas releases. DNV have estimated the fractions
of subsea releases where applicable; these are also included in the table below.
For onshore operations, comparable data were not found. It is recommended to use the
offshore data presented here. Some possibly indicative values are presented in Section
4.2.

2 ©OGP
RADD – Blowout frequencies

Blowout and W ell Release Frequencies for Offshore Operations of North Sea
Standard
Operation Category Frequency Fractio
Averag Gas Oil Unit n
e Subsea
-4
Exploration Drilling, Topside Blowout 6.0 × 10 - per drilled
shallow gas well
-4
Diverted Well Release 8.3 × 10 - per drilled
well
-5
Well Release 9.3 × 10 - per drilled
well
-4
Subsea Blowout 9.8 × 10 - per drilled
well
-4
Development Drilling, Topside Blowout 4.7 × 10 - per drilled
shallow gas well
-4
Diverted Well Release 6.5 × 10 - per drilled
well
-5
Well Release 7.3 × 10 - per drilled
well
-4
Subsea Blowout 7.4 × 10 - per drilled
well
-4 -4 -4
Exploration Drilling, deep Blowout 3.1 × 10 3.6 × 10 2.5 × 10 per drilled 0.39
(normal wells) well
-3 -3 -3
Well Release 2.5 × 10 2.9 × 10 2.0 × 10 per drilled 0.39
well
-3 -3 -3
Exploration Drilling, deep Blowout 1.9 × 10 2.2 × 10 1.5 × 10 per drilled 0.39
(HPHT wells) well
-2 -2 -2
Well Release 1.6 × 10 1.8 × 10 1.2 × 10 per drilled 0.39
well
-5 -5 -5
Development Drilling, deep Blowout 6.0 × 10 7.0 × 10 4.8 × 10 per drilled 0.33
(normal wells) well
-4 -4 -4
Well Release 4.9 × 10 5.7 × 10 3.9 × 10 per drilled 0.33
well
-4 -4 -4
Development Drilling, deep Blowout 3.7 × 10 4.3 × 10 3.0 × 10 per drilled 0.33
(HPHT wells) well
-3 -3 -3
Well Release 3.0 × 10 3.5 × 10 2.4 × 10 per drilled 0.33
well
-5 -4 -5
Completion Blowout 9.7 × 10 1.4 × 10 5.4 × 10 per operation 0
-4 -4 -4
Well Release 3.9 × 10 5.8 × 10 2.2 × 10 per operation 0
-6 -6 -6
Wirelining Blowout 6.5 × 10 9.4 × 10 3.6 × 10 per operation 0
-5 -5 -6
Well Release 1.1 × 10 1.6 × 10 6.1 × 10 per operation 0
-4 -4 -5
Coiled Tubing Blowout 1.4 × 10 2.0 × 10 7.8 × 10 per operation 0
-4 -4 -4
Well Release 2.3 × 10 3.4 × 10 1.3 × 10 per operation 0
-4 -4 -4
Snubbing Blowout 3.4 × 10 4.9 × 10 1.9 × 10 per operation 0
-4 -4 -4
Well Release 1.8 × 10 2.6 × 10 1.0 × 10 per operation 0
-4 -4 -4
Workover Blowout 1.8 × 10 2.6 × 10 1.0 × 10 per operation 0
-4 -4 -4
Well Release 5.8 × 10 8.3 × 10 3.2 × 10 per operation 0
-6 -5 -6
Producing Wells Blowout 9.7 × 10 1.8 × 10 2.6 × 10 per well year 0.125
-5 -5 -6
(excluding external causes) Well Release 1.1 × 10 2.0 × 10 2.9 × 10 per well year 0.125
-5 -5 -5
Producing Wells, external Blowout 3.9 × 10 3.9 × 10 3.9 × 10 per well year 0.125
causes Well Release - - - per well year -
-5
Gas Injection Wells Blowout - 1.8 × 10 - per well year 0.125
-5
Well Release - 2.0 × 10 - per well year 0.125
-6
Water Injection Wells Blowout 2.4 × 10 - - per well year 0.125
Well Release - - - per well year -

©OGP 3
RADD – Blowout frequencies

Blowout and W ell Release Frequencies for Offshore Operations Not of North Sea
Standard
Operation Category Well Frequency Fractio
Type n
Subsea
-3
Exploration Drilling, Blowout (surface flow) Appraisal 1.3 × 10 per drilled 0.59
shallow gas well
-3
Wildcat 1.9 × 10 per drilled 0.59
well
1 2
Blowout (underground flow) Appraisal 0 per drilled 0
well
1 2
Wildcat 0 per drilled 0
well
-4
Diverted well release Appraisal 3.2 × 10 per drilled 0
well
-4
Wildcat 9.3 × 10 per drilled 0
well
-4
Well release Appraisal 3.2 × 10 per drilled 1.0
well
-4
Wildcat 2.7 × 10 per drilled 1.0
well
-4
Development Drilling, Blowout (surface flow) - 9.6 × 10 per drilled 0.18
shallow gas well
-5 2
Blowout (underground flow) - 4.4 × 10 per drilled 0
well
-4
Diverted well release - 7.0 × 10 per drilled 0
well
-5
Well release - 8.8 × 10 per drilled 0
well
-3
Exploration Drilling, deep Blowout (surface flow) Appraisal 1.4 × 10 per drilled 0.41
well
-3
Wildcat 1.7 × 10 per drilled 0.41
well
1
Blowout (underground flow) Appraisal 0 per drilled -
well
-4 2
Wildcat 9.3 × 10 per drilled 0.17
well
1
Diverted well release Appraisal 0 per drilled -
well
1
Wildcat 0 per drilled -
well
1 3
Well release Appraisal 0 per drilled 1.0
well
1 3
Wildcat 0 per drilled 1.0
well
-4
Development Drilling, deep Blowout (surface flow) - 3.5 × 10 per drilled 0.14
well
-4 2
Blowout (underground flow) - 1.3 × 10 per drilled 0
well
1
Diverted well release - 0 per drilled -
well
-4
Well release - 2.2 × 10 per drilled 0.25
well
-4
Completion Blowout (surface flow) - 4.6 × 10 per 0
completion
1
Blowout (underground flow) - 0 per 0
completion
-4
Diverted well release - 3.1 × 10 per 0
completion
1
Well release - 0 per 0
completion

4 ©OGP
RADD – Blowout frequencies

Blowout and W ell Release Frequencies for Offshore Operations Not of North Sea
Standard
Operation Category Well Frequency Fractio
Type n
Subsea
-5
Production Blowout (surface flow) - 3.3 × 10 per well year 0.43
-6 2
Blowout (underground flow) - 4.7 × 10 per well year 0
1
Diverted well release - 0 per well year 0
-6
Well release - 9.5 × 10 per well year 0
-3
Workover Blowout (surface flow) - 1.0 × 10 per workover 0.05
1 2
Blowout (underground flow) - 0 per workover 0
1
Diverted well release - 0 per workover 0
-4
Well release - 8.5 × 10 per workover 0
-5
Wireline Blowout (surface flow) - 1.1 × 10 per wireline 0
job
1
Blowout (underground flow) - 0 per wireline 0
job
1
Diverted well release - 0 per wireline 0
job
-5
Well release - 1.1 × 10 per wireline 0
job

Notes
1. Based on no incidents to date. However, these scenarios are considered credible. Table 4.1
gives population data, from which estimates can be made of these frequencies if required.
2. For underground flow releases there are no topsides releases. For all other releases,
fractions of releases occurring at topsides = (1 - fraction subsea).
3. Only 2 occurrences, both located at subsea wellhead (see Section 4.1). Subsea fraction = 0 if
wellheads are located at topsides.

©OGP 5
RADD – Blowout frequencies

3.0 Guidance on use of data


3.1 General validity
The data presented in Section 2.0 should be considered valid for the North Sea and US
GoM OCS.
They can also be applied to other areas of the world, according to whether or not
standards are considered to be equivalent to those in the North Sea.
For onshore operations it is recommended to use the offshore data presented in Section
2.0.

3.2 Uncertainties
As in any analysis of historical frequencies, there are uncertainties in:
• The population (in this case, wells drilled, well operations or well years)
• The incident data
In particular, where incidents are infrequent, another incident just after the data period
may significantly increase the statistical frequency, especially when no incidents have
been recorded to date but are nevertheless credible (as is the case with some of the
SINTEF category – well type combinations).
The SINTEF database [1] has been extensively reviewed to ensure that it is as complete
as possible in regard both to population and incidents, minimising so far as possible
these uncertainties. According to [1]:
“It is SINTEF’s belief that from 1980-01-01 most blowouts occurring in the US
Gulf of Mexico (GoM) Outer Continental Shelf (OCS), the UK and Norway have
been included in the database.”
Therefore, they present frequencies based on this period and these geographical areas.
Neither SINTEF [1] nor Scandpower [2] have, in their reports, quantified these
uncertainties in the way that, for example, OREDA [5] does for equipment reliability;
instead they have focused on data quality.
Further potential uncertainties arise where the frequencies are used outside the context
of the data, for example, in other areas of the world. SINTEF present data for all
blowouts in their database, covering 49 countries/areas, and incident data for 4 other
countries/waters. However, the populations and numbers of blowouts in each case are
small, and hence SINTEF do not recommend using frequency estimates obtained from
these data in preference to the data used to obtain the frequencies presented in Section
2.0 (see Section 4.1). Hence there is greater uncertainty in using the data for other
countries/waters but no quantification of this uncertainty is available. Using the
frequencies for operations not of North Sea Standard will introduce an element of
conservatism to any analysis.

3.3 Example
A hypothetical North Sea platform has 8 oil producing wells and 2 gas injection wells.
There are one workover and two wireline jobs per year on the platform oil wells. The
following extract from Section 2.0 highlights the relevant frequencies:

6 ©OGP
RADD – Blowout frequencies

Operation Category Frequency Fractio


Averag Gas Oil Unit n
e Subsea

-6 -6 -6
Wirelining Blowout 6.5 × 10 9.4 × 10 3.6 × 10 per 0
operation
-5 -5 -6
Well Release 1.1 × 10 1.6 × 10 6.1 × 10 per 0
operation

-4 -4 -4
Workover Blowout 1.8 × 10 2.6 × 10 1.0 × 10 per 0
operation
-4 -4 -4
Well Release 5.8 × 10 8.3 × 10 3.2 × 10 per 0
operation
-6 -5 -6
Producing Wells Blowout 9.7 × 10 1.8 × 10 2.6 × 10 per well 0.125
(excluding external causes) year
-5 -5 -6
Well Release 1.1 × 10 2.0 × 10 2.9 × 10 per well 0.125
year

-5
Gas Injection Wells Blowout - 1.8 × 10 - per well 0.125
year
-5
Well Release - 2.0 × 10 - per well 0.125
year

The annual frequencies of blowouts and well releases are then:


Blowouts: (8 × 2.6 × 10-6) + (2 × 1.8 × 10-5) + (1 × 1.0 × 10-4) + (2 × 3.6 × 10-6) ≈ 1.6 × 10-4
Well releases: (8 × 2.9 × 10-6) + (2 × 2.0 × 10-5) + (1 × 3.2 × 10-4) + (2 × 6.1 × 10-6) ≈
4.0 × 10-4
The annual frequencies of topsides and subsea blowouts are:
Topsides Blowouts:
(0.875 × 8 × 2.6 × 10-6) + (0.875 ×2 × 1.8 × 10-5) + (1 × 1.0 × 10-4) + (2 × 3.6 × 10-6) ≈
1.6 × 10-4
Subsea Blowouts: (0.125 × 8 × 2.6 × 10-6) + (0.125 ×2 × 1.8 × 10-5) ≈ 7.1 × 10-6
Topsides Well releases:
(0.875 × 8 × 2.9 × 10-6) + (0.875 × 2 × 2.0 × 10-5) + (1 × 3.2 × 10-4) + (2 × 6.1 × 10-6) ≈
3.9 × 10-4
Subsea Well releases: (0.125 × 8 × 2.9 × 10-6) + (0.125 × 2 × 2.0 × 10-5) ≈ 7.9 × 10-6

4.0 Review of data sources


4.1 Basis of data presented
The key data source is the SINTEF Offshore Blowout Database, described in [1]. SINTEF
have performed their own analysis of this database, updated annually, in order to obtain
the frequencies set out in Section 2.0. These are based on blowout data from the US
Gulf of Mexico OCS, UKCS and Norwegian waters for the period 1st January 1980 to 1st
January 2005. Table 4.1 gives the numbers of wells and incidents in the database for
these areas and period.
Scandpower [2] annually review the SINTEF database and analyse it further to obtain
blowout frequencies applicable specifically to the North Sea (and other places where
equipment standards are comparable). They use the most recent 20 years’ data

©OGP 7
RADD – Blowout frequencies

available. Their report explains how the analysis is done, however two key elements of
this are:
• Elimination of irrelevant incidents
• Adjustment due to trend over time
Table 4.2 sets out the numbers of wells and incidents used in their analysis.
[4] provides the basis for the HPHT well frequencies, concluding that the blowout
frequency for an HPHT well is 12.3 times higher than for a normal well (including
underground blowouts).

8 ©OGP
RADD – Blowout frequencies

Table 4.1 Num bers of W ells and Incidents in SINTEF Offshore Blowout
Database [1]

Operation Category Well No. of


Type Wells/
Incidents
Exploration Drilling, Number of Exploration Appraisal 6,257 Wells
shallow gas Wells Drilled Wildcat 7,505 Wells
Blowout (surface flow) Appraisal 8
Wildcat 14
Blowout (underground Appraisal 0
flow) Wildcat 0
Diverted well release Appraisal 2
Wildcat 7
Well release Appraisal 2
Wildcat 2
Development Drilling, Number of Development - 22,833 Wells
shallow gas Wells Drilled
Blowout (surface flow) - 22
Blowout (underground - 1
flow)
Diverted well release - 16
Well release - 2
Exploration Drilling, deep Number of Exploration Appraisal 6,257 Wells
Wells Drilled Wildcat 7,505 Wells
Blowout (surface flow) Appraisal 9
Wildcat 13
Blowout (underground Appraisal 0
flow) Wildcat 7
1
Diverted well release Appraisal 0
1
Wildcat 0
Well release Appraisal 3
Wildcat 3
Development Drilling, Number of Development 22,833 Wells
deep Wells Drilled
Blowout (surface flow) - 8
Blowout (underground - 3
flow)
Diverted well release - 0
Well release - 5
Completion Number of Completions 20,328 Wells
Blowout (surface flow) - 9
Blowout (underground - 0
flow)
Diverted well release - 6
Well release - 0
Production Number of Well Years in 211,142 Well
Service Years
Blowout (surface flow) - 7
Blowout (underground - 1
flow)
Diverted well release - 0
Well release - 2
Workover Number of Workovers 19,920
Workovers
Blowout (surface flow) - 20
Blowout (underground - 0
flow)
Diverted well release - 0
Well release - 17
Wirelining Number of Wireline Jobs 358,941

©OGP 9
RADD – Blowout frequencies

Operation Category Well No. of


Type Wells/
Incidents
Wireline Jobs
Blowout (surface flow) - 4
Blowout (underground - 0
flow)
Diverted well release - 0
Well release - 4
Table 4.2 Num bers of W ells and Incidents in Scandpower Blowout Analysis
[2]

Operation Category No. of


Wells/
Incidents
Exploration Drilling Number of Wells Drilled 9,172 Wells
(shallow gas) Incidents 26
Development Drilling Number of Wells Drilled 13,022 Wells
(shallow gas) Incidents 29
Drilling (deep) Number of Wells Drilled 9,744 Wells
Blowout 2
Number of Wells Drilled 2,854 Wells
Well release 4
All Well Interventions Number of Oil Well Years in 95,270 Wells
Service Years
Number of Gas Well Years in 82,204 Wells
Service Years
Completion Number of Completions 16,381
Completions
Blowout 4
Well release 4
Wireline Number of Wireline Ops Per 1.7 Ops/Year
2
Year
Blowout 4
Well release 2
3
Coiled Tubing Number of Coiled Tubing Ops 358 Ops
2
Number of Well Years 4,214 Well
Years
Blowout 2
Well release 2
3
Snubbing Number of Snubbing Operations 196 Ops
2
Number of Well Years 4,214 well
years
Blowout 3
Well release 1
Workover Workover Interval – Oil Wells [3] 5 years
Workover Interval – Gas Wells 7 years
[3]
Blowout 8
Well release 11
Production Number of Well Years in Service 177,474 Well
Years
Blowout – external causes 7
Blowout – not external causes 5
Well release 2

Notes to Table 4.1 and Table 4.2


1. No number of incidents is given in the report for this scenario. It has been assumed that
there have been 0 such incidents to date.
2. Assumed based on feedback from oil companies.

10 ©OGP
RADD – Blowout frequencies

3. Norwegian Sector only used as basis for frequency estimates.


The basis for the subsea fractions for North Sea Standard operations are as follows:
• Exploration drilling, deep blowouts: 12 out of 31 from outside casing or underground
− Assumed also to apply to exploration drilling, deep well releases
− Assumed to be the same for HPHT wells as for normal wells
• Development drilling, deep blowouts: 5 out of 15 from outside casing or
underground
− Assumed also to apply to development drilling, deep well releases
− Assumed to be the same for HPHT wells as for normal wells
• Production well releases (excluding external causes): assumed to be the same as for
production blowouts (excluding external causes)
− Assumed also to apply to production well releases, external causes
− Assumed also to apply to gas and water injection wells
From the SINTEF report [1], Tables 4.5 to 4.7, the basis for the subsea fractions for
operations not of North Sea Standard are as follows:
• Exploration drilling, shallow gas blowouts:
− Surface flow: 13 out of 22 with known location
− Diverted well release: 9, assumed to have been topsides
− Well release: 2 out of 2 at subsea wellhead
− All assumed to be same for appraisal and wildcat wells
• Development drilling, shallow gas blowouts:
− Surface flow: 4 out of 22
− Underground: 1 at wellhead, assumed topsides
− Diverted well release: 16 at wellhead, assumed topsides
− Well release: 1 at subsea wellhead
• Exploration drilling, deep blowouts:
− Surface flow: 9 out of 22 with known location
− Underground: 1 out of 6 with known location (remainder no surface flow)
− Diverted well release, well release: all topsides
• Development drilling, deep blowouts:
− Surface flow: 1 out of 7 with known location
− Underground: 3 out of 3 no surface flow
− Well release: 1 out of 4 with known location
• Completion blowouts: 0 out of 15 subsea
• Production blowouts:
− Surface flow: 3 out of 7 with known location
− Underground: 1 out of 1 no surface flow
− Well release: 0 out of 2 with known location
• Workover blowouts:
− Surface flow: 1 out of 19 with known location
− Well release: 0 out of 17
• Wireline blowouts: 0 out of 7 with known location

4.2 Onshore blowouts


For onshore blowouts, the Alberta Energy and Utilities Board (EUB) maintains a
database of onshore drilling incidents [6]. This database includes drilling occurrence

©OGP 11
RADD – Blowout frequencies

data for Alberta from 1975 till 1990 with a total of 87,944 wells drilled. The database
contains incident reports for individual well control occurrences. The occurrence data
are presented below.

Category Number of Occurrences Frequency (per well


drilled)

Blow* 53 6.0 x 10-4


Blowout 43 4.9 x 10-4
Total 96 1.1 x 10 -3
* A category of well control incident defined as an uncontrolled release of wellbore fluids to
atmosphere that can be shut-in or diverted to flare in a short period of time. They are assumed
here to be equivalent to well releases as defined in the SINTEF and Scandpower work.
The total frequency is about 40% of the corresponding value for offshore drilling
blowouts.
During 2002 – 2006 there were 39 blowouts and 88,856 wells drilled (blows no longer
being recorded). Of the 39 blowouts, 7 involved release of gas, the remainder released
only fresh water. Taking the full number of blowouts gives a frequency of 4.4 × 10-4
blowouts per well drilled, about 10% smaller than the frequency above from 1975 – 1990
data and hence not significantly lower.
For comparison, this is about 40% of the corresponding value for offshore drilling
blowouts and well releases presented in Section 2.0. However it should be noted that
Alberta wells are believed to be sour, with precautions being taken accordingly to
minimise the likelihood of releases. Hence use of the above frequencies is not
recommended except in a similar context.
EUB also records the numbers of blowouts during well interventions and other
blowouts (from producing or suspended wells) but they do not record the
corresponding population data (numbers of well interventions, producing wells and
suspended wells).

4.3 Other data sources


Other databases previously used have been:
• BLOWOUT, an internal DNV compilation of blowouts and well control incidents from
the North Sea and US waters during 1970-89.
• WOAD (World Offshore Accident Databank), a public-domain database maintained
by DNV covering all offshore hazards.
The data from both of these are now included in the SINTEF database and hence are
superseded.

5.0 Recommended data sources for further information


The SINTEF and Scandpower reports [1,2] should be consulted for further information.
In particular, the Scandpower report [2] explains how the frequencies presented in
Section 2.0 are derived from the statistics in Table 4.2.

12 ©OGP
RADD – Blowout frequencies

6.0 References
1. SINTEF 2006. Blowout and Well Release Characteristics and Frequencies, 2006, Report
No. STF50 F06112.
2. Scandpower Risk Management AS 2006. Blowout and Well Release Frequencies –
Based on SINTEF Offshore Blowout Database, 2006, Report No. 90.005.001/R2.
3. Nilsen, E F 1999. Basis utblåsningsfrekvenser 1999, internal technical memo, Statoil
HMS T&T SIK.
4. SINTEF Safety and Reliability, Alliance Technology, Scandpower 1998. Estimation of
Blowout Probability of HPHT Wells, Report No. STF38 F98420.
5. OREDA 2002.
6. Alberta Energy and Utilities Board. Oil and Gas Well Blowout Reports.

©OGP 13
Risk Assessment Data Directory

Report No. 434 – 3


March 2010

Storage
incident
frequencies
International Association of Oil & Gas Producers
RADD – Storage incident frequencies

Contents:
1.0 Scope and Definitions ........................................................... 1
1.1 Application ...................................................................................................... 1
1.2 Definitions ....................................................................................................... 1
1.2.1 Atmospheric Storage Tanks...................................................................................... 1
1.2.2 Refrigerated Storage Tank Designs ......................................................................... 2
1.2.3 Pressurised Storage Vessels .................................................................................... 3
1.2.4 Non-process Hydrocarbon Storage Offshore.......................................................... 3
1.2.5 Underground Storage Tanks..................................................................................... 4
2.0 Summary of Recommended Data ............................................ 4
2.1 Atmospheric Storage Tanks .......................................................................... 4
2.2 Refrigerated Storage Tanks ........................................................................... 5
2.3 Pressurised Storage Vessels......................................................................... 6
2.4 Oil Storage on FPSOs..................................................................................... 6
2.5 Non-process Hydrocarbon Storage Offshore .............................................. 6
2.6 Underground Storage Tanks ......................................................................... 7
3.0 Guidance on Use of Data ....................................................... 7
3.1 General validity ............................................................................................... 7
3.2 Uncertainties ................................................................................................... 7
4.0 Review of Data Sources ......................................................... 8
4.1 Atmospheric Storage Tanks .......................................................................... 8
4.1.1 Selection of Generic Value for Atmospheric Storage Tanks ................................. 8
4.1.2 Overfilling.................................................................................................................... 9
4.2 Refrigerated Storage Tanks ......................................................................... 10
4.2.1 Selection of Generic Value for Refrigerated Storage Tanks ................................ 10
4.3 Pressurised Storage Vessels....................................................................... 11
4.3.1 Accident Source Data .............................................................................................. 11
4.3.2 Selection of Generic Value for Pressurised Storage Vessels.............................. 12
4.4 Oil Storage on FPSOs................................................................................... 13
4.5 Non-process Hydrocarbon Storage Offshore ............................................ 13
4.5.1 Methanol.................................................................................................................... 14
4.5.2 Diesel......................................................................................................................... 14
5.0 Recommended Data Sources for Further Information ........... 15
6.0 References .......................................................................... 15

©OGP 1
RADD – Storage incident frequencies

Abbreviations:
API American Petroleum Institute
ASME American Society of Mechanical Engineers
ATK Aviation Turbine Kerosene
BG British Gas
BLEVE Boiling liquid expanding vapour explosion
DNV Det Norske Veritas
FPSO Floating Production, Storage and Offloading Unit
GRI Gas Research Institute
HSE Health & Safety Executive
IPO Interprovinciaal Overleg
LNG Liquefied Natural Gas
LPG Liquefied Petroleum Gas
MIC Methyl Isocyanate
OREDA Offshore Reliability Database
QRA Quantified Risk Assessment
SRD Safety and Reliability Directorate
WOAD World-wide Offshore Accident Databank

2 ©OGP
RADD – Storage incident frequencies

1.0 Scope and Definitions


1.1 Application
This datasheet presents (Section 2.0) frequencies of releases from the following types
of storage:
1. Atmospheric storage
2. Refrigerated storage
3. Pressurised storage
4. Oil storage on FPSOs
5. Non-process Hydrocarbon Storage Offshore
6. Underground storage
For refrigerated storage tanks previous studies and available historical data have been
reviewed to produce a consistent set of estimates of frequencies of catastrophic rupture
for different designs of refrigerated storage tanks.
FPSOs typically store large quantities of crude oil in cargo oil tanks; this is periodically
transferred to shuttle tankers. Only fires/explosions from the cargo oil tanks are
considered,
Non-process hydrocarbon storage offshore includes methanol, diesel and ATK systems
together with the associated pipework.
Underground storage tanks can be divided into buried or mounded storage tanks (mainly
for fuels such as petrol and LPG), and excavated or leached storage caverns. Section
2.0 presents guidance how failure frequencies for buried or mounded storage tanks
might be estimated.

1.2 Definitions
1.2.1 Atmospheric Storage Tanks
Atmospheric storage tanks contain liquids ambient pressure and at or near ambient
temperature. They are usually fabricated from mild steel on a concrete base,
surrounded by a low bund wall. They are designed to withstand an internal
pressure/vacuum of 0.07 bar. The main types are [1]:
• Fixed roof tanks. These have a vapour space between the liquid surface and the
tank roof. They require a vent for vapour at the top of the tank. They are sub-
divided by roof design:
− Domed roof – up to about 20 m diameter.
− Cone roof – up to about 76 m diameter.
• Floating roof tanks. These have a roof that floats on the liquid surface to reduce
vapour loss. The roof requires a seal around the edge against the tank walls. Types
of roof design include:
− Pan roof.
− Annular pontoon roof.
− Double-deck roof.
• Fixed plus internal floating roof tanks. These are a combination of both types.

©OGP 1
RADD – Storage incident frequencies

In Section 2.0 failures from the tank walls are considered. Strictly, failures of associated
equipment such as inlet/outlet valves, pipes within the bund and pressure relief valves
should be excluded. In practice, many studies include failures at these points because
available failure data often does not distinguish them clearly from failures of the tank
itself. However, when considering tank ruptures and roof fires, the distinction is not
important.

1.2.2 Refrigerated Storage Tank Designs


There are several different designs of refrigerated storage tank, and different failure
frequencies may be applicable. The main types are [2]:
• Single containm ent tanks. These are a single primary container and generally
an outer shell designed and constructed so that the primary container is required to
meet the low temperature ductility requirements for storage of the product.
• Double containm ent tanks. These are designed and constructed so that both
the inner self supporting primary container and the secondary container are capable
of independently containing the refrigerated liquid stored. To minimise the pool of
escaping liquid, the secondary container should be located at a distance not
exceeding 6m from the primary container. The primary container contains the
refrigerated liquid under normal operating conditions. The secondary container is
intended to contain any leakage of the refrigerated liquid, but is not intended to
contain any vapour resulting from this leakage.
• Full containm ent tanks. These are designed and constructed so that both self
supporting primary container and the secondary container are capable of
independently containing the refrigerated liquid stored and for one of them its
vapour. The secondary container can be 1m to 2m distance from the primary
container. The primary container contains the refrigerated liquid under normal
operating conditions. The outer roof is supported by the secondary container. The
secondary containment shall be capable both of containing the refrigerated liquid
and of controlled venting of the vapour resulting from product leakage after a
credible event.
• Spherical Storage Tanks. Spherical, single containment tanks consisting of an
unstiffened, sphere supported at the equator by a vertical cylinder. For onshore
tanks, the lower part of the support cylinder is made of concrete and the tank is
protected by a domed concrete cover. The outside of the tank and the aluminium
part of the support cylinder are insulated by means of a panel system to the required
thickness for the specified boil-off rate.
• Mem brane tank. These are designed and constructed so that the primary
container, constituted by a membrane, is capable of containing both the liquefied
gas and its vapour under normal operating conditions and the concrete secondary
container, which supports the primary container, should be capable of containing all
the liquefied gas stored in the primary container and of controlled venting of the
vapour resulting from product leakage of the inner tank. The vapour of the primary
container is contained by a steel liner which forms with the membrane an integral
gastight containment. The action of the liquefied gas acting on the primary
container (the metal membrane) is transferred directly to the pre-stressed concrete
secondary container through the load bearing insulation.
Underground tanks have been constructed in the past. These are typically earth pits
where the ground around the pit is frozen by the cold liquid, thus providing a seal. Due
to practical difficulties, this type is now rare.

2 ©OGP
RADD – Storage incident frequencies

The characteristics of each type are set out in BS EN 1473.

1.2.3 Pressurised Storage Vessels


Pressurised storage tanks are considered to be storage tanks operating under pressure
of at least 0.5 bar. They include a wide variety of vessels, and are categorised for the
purposes of QRA (quantified risk assessment) as follows:
• Storage vessels – in which fluids are held under stable conditions. These are
subdivided for this analysis into:
− Large storage vessels – spheres and bullets (long cylindrical tanks) in excess of
approximately 50 m3 capacity, typically used in dedicated storage installations.
− Medium storage vessels – fixed cylindrical tanks less than approximately 50 m3
capacity, typically used in industrial or domestic installations.
• Small containers – portable cylinders and drums less than approximately 2 m3
capacity.
The main UK design code is BS 5500:1991 Specification for Unfired Fusion Welded
Pressure Vessels (see [1] p12/20). It divides vessels into 3 categories. The highest
standard, Category 1, requires full non-destructive testing of main seam welds. The
corresponding US code is the ASME Boiler and Pressure Vessel Code, 1992.
Section 2.0 covers pressure vessels and any equipment directly associated with them,
i.e. nozzles and instrumentation (with associated flanges), and the inspection cover
(manway). Connection points are included up to the first flange, although the flange
itself is not included. Lines into and out of the vessel, and the associated flanges and
valves are not included in the scope.
Although the lines into and out of the vessel are not included in the scope, the actual
number of lines would have an influence on the failure rate, as failures are more likely at
the connection points where these lines join the vessel. Other equipment may influence
the failure rate, such as relief systems being blocked. Such issues are not addressed in
this datasheet but should be considered separately if appropriate,

1.2.4 Non-process Hydrocarbon Storage Offshore


The term “non-process fires” covers any fires and explosions that are not covered by
the modelling of process hydrocarbon events. Most types of non-process fire involve
materials other than hydrocarbons (e.g. electrical fires, chemical gas explosions).
However, non process hydrocarbons such as diesel and ATK, and other hazardous
materials such as methanol, are frequently stored on offshore installations in
unpressurised tanks of a few m3 capacity. In the event of a leak or rupture, these
materials may be ignited and so have the potential to cause a fire that could result in
injury or possibly fatality. Some data are available for such systems.
Although most non-process fires are very small incidents (e.g. a chip-pan fire in the
galley lasting a few seconds), some have been larger causing damage and fatalities.
The frequency of non-process fires may be larger than process fires, suggesting that
they should not be overlooked if the risk analysis is to be comprehensive.

©OGP 3
RADD – Storage incident frequencies

1.2.5 Underground Storage Tanks


There are several types of underground storage tanks:
• Petrol filling station tanks – small buried atmospheric tanks, typically used for petrol
at filling stations.
• Underground pressure vessels – small buried or mounded pressure vessels,
typically used for LPG.
• Caverns – large excavated in-ground tanks, typically used for liquefied gas or crude
oil storage at refineries or storage terminals.
• Salt dome caverns – large capacity storage located deep underground in natural
rock formations, typically used for storage of gas under pressure.
In Section 2.0 failures of the first two types are discussed. Only failures of the tank
itself are considered; surface facilities are excluded. On a petrol tank, the surface
facilities may include underground pipes, and metering as well as above-ground
dispensing pumps. On a gas storage tank, surface facilities may include surge vessels,
injection pumps, gas driers and metering systems. Failures of the supply system, such
as loading from road tankers and leaks from loading hoses are also excluded.

2.0 Summary of Recommended Data


2.1 Atmospheric Storage Tanks
The best available estimates of leak frequencies for atmospheric tanks are summarised
in Table 2.1.

Table 2.1 Atm ospheric Storage Tank Leak Frequencies

Type of Tank Type of Release Leak Frequency


(per tank year)
-3
Floating roof Liquid spill on roof 1.6 × 10
-3
Sunken roof 1.1 × 10
-3
Fixed/ floating roof Liquid spill outside tank 2.8 × 10
-6
Tank rupture 3.0 × 10

The frequencies of different types of fire/explosion are summarised in Table 2.2.

4 ©OGP
RADD – Storage incident frequencies

Table 2.2 Atm ospheric Storage Tank Fire Frequencies

Type of Fire Floating Roof Fixed Roof Fixed plus


Tank Tank (per tank Internal
(per tank year) year) Floating Roof
Tank
(per tank year)
-3 -3
Rim seal fire 1.6 × 10 1.6 × 10
-4
Full surface fire on roof 1.2 × 10
-5 -5
Internal explosion & full surface 9.0 × 10 9.0 × 10
fire
-5 -5
Internal explosion without fire 2.5 × 10 2.5 × 10
-5
Vent fire 9.0 × 10
-5 -5 -5
Small bund fire 9.0 × 10 9.0 × 10 9.0 × 10
-5 -5 -5
Large bund fire (full bund area) 6.0 × 10 6.0 × 10 6.0 × 10

2.2 Refrigerated Storage Tanks


Estimates of frequencies of catastrophic rupture for different designs of refrigerated
storage tanks are shown in Table 2.3.

Table 2.3 Sum m ary of Refrigerated Storage Tank Leak Frequencies

Tank Design Catastrophic Rupture Frequency Leak Frequency


(per tank per year) (per connection
year)
Primary Secondary Primary
Containment Containment 2 Containment Only
Only 1
-5 -6 -5
Existing Single 2.3 × 10 7.3 × 10 1.0 × 10
Containment Tanks
-6 -7 -5
New Single Containment 2.3 × 10 7.3 × 10 1.0 × 10
Tanks
-7 -8 -5
Double Containment 1.0 × 10 2.5 × 10 1.0 × 10
Tanks
-7 -8
Full containment tanks3 1.0 × 10 1.0 × 10 0
-7 -8
Membrane tank 3
1.0 × 10 1.0 × 10 0
1
The pool area is that of the secondary containment
2
For single containment tanks this scenario corresponds to bund overtopping
3
No collapse is considered for these tank types if they have a concrete roof

A leak or rupture of the tank, releasing some or all of its contents, can be caused by
brittle failure of tank walls, welds or connected pipework due to use of inadequate
materials, combined with loading such as wind, earthquake or impact. Where there is
the potential for such loading – in particular, in seismically active zones – specialist
analysis of the failure likelihood should be sought.

©OGP 5
RADD – Storage incident frequencies

2.3 Pressurised Storage Vessels


Table 2.4 gives leak frequencies for typical hole size categories.

Table 2.4 Sum m ary of Pressure Vessel Leak Frequencies

Hole Diameter Leak Frequency (per


vessel year)
Range Nominal Storage Small
Vessels Containers
-5 -7
1-3 mm 2 mm 2.3 × 10 4.4 × 10
-5 -7
3-10 mm 5 mm 1.2 × 10 4.6 × 10
-6
10–50 mm 25 mm 7.1 × 10
-6
50-150 mm 100 mm* 4.3 × 10
-7 -7
>150 mm Catastrophic 4.7 × 10 1.0 × 10
-5 -6
TOTAL 4.7 × 10 1.0 × 10

*Or diameter of largest pipe connection if this is smaller

The frequency of a tank BLEVE (Boiling Liquid Expanding Vapour Explosion) should be
calculated using fault tree analysis, taking account of adjacent fire sources capable of
causing this event. Previous such analysis indicates that a frequency in the range 10-7
to 10-5 per vessel year would be expected for a large storage vessel.

2.4 Oil Storage on FPSOs


A frequency of fires in cargo oil tanks of 8.8 x 10-4 per tanker year was derived from data
on oil tankers [33]. This data is over 15 years old and based on oil tankers, and there
was very limited experience with FPSOs at that time compared with now. However,
more recent data (see Section 4.4) does not permit a better estimate. A suitable
frequency for QRA is therefore best obtained by a theoretical approach, e.g. using fault
tree analysis, taking account of the specific design features of the installation and the
potential for human error.

2.5 Non-process Hydrocarbon Storage Offshore


Table 2.5 and Table 2.6 present release frequencies for methanol and diesel/ATK
systems offshore, where the system includes the tank and the associated pipework.
Where there is more than one tank, the tank frequencies given can be multiplied up and
the totals recalculated.

Table 2.5 Offshore Methanol Storage Leak Frequencies (per year)

Small Medium Large Rupture Total


-3 -4 -4 -5 -3
Tank 1.6 × 10 4.6 × 10 2.3 × 10 3.0 × 10 2.3 × 10
-3 -3 -3 -2
Pipework 7.9 × 10 1.6 × 10 1.1 × 10 - 1.1 × 10
-3 -3 -3 -5 -2
Total 9.5 × 10 2.0 × 10 1.3 × 10 3.0 × 10 1.3 × 10
Fraction 74% 15% 10% 0.2% 100%

6 ©OGP
RADD – Storage incident frequencies

Table 2.6 Offshore Diesel/ATK Storage Leak Frequencies (per year)

Small Medium Large Rupture Total


-3 -4 -4 -5 -3
Tank 1.6 × 10 4.6 × 10 2.3 × 10 3.0 × 10 2.3 × 10
-2 -3 -3 -2
Pipework 2.1 × 10 4.1 × 10 2.8 × 10 - 2.7 × 10
-2 -3 -3 -5 -2
Total 2.2 × 10 4.6x 10 2.9 × 10 3.0 × 10 3.0 × 10
Fraction 74% 15% 10% 0.1% 100%

2.6 Underground Storage Tanks


There is inadequate data to estimate the frequencies of failures of underground tanks
directly, and they are usually obtained using data for above ground tanks and
eliminating contributions from hazards that are not relevant. In general, this involves
eliminating external impact and fire escalation cases. These approaches are not yet
sufficiently developed to recommend standard frequencies and so for buried/ mounded
tanks a specific assessment by a risk specialist is recommended. Note also that a leak
from a buried or mounded tank is likely first to be into the surrounding soil and may not
reach the open air; even if it does, it may not eject the intervening soil and so may be
limited in rate and velocity by this.
Likewise, there is inadequate data to estimate the frequencies of leaks from storage
caverns and a specialist assessment of this is recommended.

3.0 Guidance on Use of Data


3.1 General validity
The data presented in Section 2.0 can be used for storage tanks and containers for
onshore facilities containing refrigerated and ambient liquids; those presented in
Section 2.4 should be used for unpressurised storage of methanol and non-process
hydrocarbons offshore. The derivation and application of the data is discussed further
in Section 4.0.

3.2 Uncertainties
The sources of uncertainty in the estimated leak and fire frequencies are discussed in
Section 4.0 for the different tank types.
The uncertainty in the frequencies presented in Section 2.0 tends to be greatest for
catastrophic failures due to lack of failure experience. Furthermore, the applicability of
the failure modes in the historical events to modern tank designs may also be
inappropriate because of improvements in tank design.
The uncertainty in values for atmospheric storage tanks could be represented by a
range of at least a factor of 10 higher or lower. Estimates of leak frequencies for large
pressure vessels, for both the overall leak frequencies and the rupture frequencies,
range over 4 orders of magnitude.

©OGP 7
RADD – Storage incident frequencies

4.0 Review of Data Sources


4.1 Atmospheric Storage Tanks
Failure experience was reviewed from a number of sources:
• [3] includes 122 cases of atmospheric storage tank fires world-wide during 1965-89.
• [4] lists 69 such events during 1981-96.
• [5] lists 107 events during 1951-95 (see [1] App I).

4.1.1 Selection of Generic Value for Atmospheric Storage Tanks


A wide variation is apparent in the source data. The LASTFIRE data [4] is considered
the most reliable source for releases from floating roof tanks. The frequency based on
US petroleum industry tanks >10,000 bbl is believed to be the best estimate for rupture
frequency.
For large floating roof tanks, the LASTFIRE study [4] provides the best available fire
frequencies. In the absence of any other data, they are assumed applicable to all sizes
of floating roof tanks. The bund fire frequencies are assumed applicable to all types of
tanks.
For fixed roof tanks, the best available estimate is from a Technica study for tank
operators in Singapore [3]. For explosions in fixed roof tanks, the ratio of fires and
explosions in world-wide event data has been used. For tanks with both fixed and
internal floating roof, the frequencies of appropriate fire/explosion types have been
selected from the other tank types. For catastrophic ruptures, an estimate based on US
petroleum industry experience has been used, which is consistent with the absence of
ruptures in the LASTFIRE data.
Comparison of sources for atmospheric tank leak frequency data suggests that the
uncertainty in these values could be represented by a range of at least a factor of 10
higher or lower.
For fixed roof tanks, the Singapore study [3] and API [5] give values in the range
1.8 × 10-4 to 3.0 × 10-4 per tank year. The Singapore data is considered to be
comprehensive and is more recent, so the value of 1.8 × 10-4 per tank year is adopted
here. The full surface fire frequency is 50% of this, i.e. 9 × 10-5 per tank year.
For tanks with fixed plus internal floating roof, the fire frequency might be expected to
be lower than for the other designs. However, these tend to be used for more highly
flammable products, so this may offset any reduction in the average fire frequency. In
the absence of better information, it is assumed that the frequency of rim seal fires is as
for open-top floating roof tanks, while the frequency of full-surface fires is as for fixed
roof tanks.
Explosions may occur inside fixed roof tanks if flammable vapour is ignited. If the tank
contains liquid, this is likely to result in a full-surface fire. If the tank is empty but not
gas free, there may be no further fire, although the event may be fatal for people inside
the tank at the time (e.g. 2 events described in [6]). Explosions inside fixed roof tanks
may produce debris that damages adjacent tanks (e.g. Romeoville, 24 September 1977).
Floating roof tanks are designed to eliminate flammable vapour within the tank, but in
principle explosions may also occur:
• Inside the tank when empty, while the roof is supported on legs above the tank base.
However, no such incidents are known.

8 ©OGP
RADD – Storage incident frequencies

• Above the roof but inside the shell, if vapour leaks past the floating roof. In an open-
top tank, this is expected to produce a flash fire rather than an explosion, if ignited.
However, such explosions may occur in tanks with fixed plus internal floating roof.
• Outside the tank area, if vapour drifts into a confined space before ignition occurs.
However, this should be modelled in the risk analysis as a tank leak.
No previous estimate of explosion frequency is available for storage tanks. Most
reports of explosions are derived from press accounts (e.g. MHIDAS), which do not
identify the type of tank involved. They also refer to world-wide experience, for which
the tank population is not known.
LASTFIRE [4] gives no cases of explosions in 33,906 tank years for open-top floating-
roof tanks. Making the common assumption that this is equivalent to “0.7 explosions to
date”, the frequency is assumed to be 2 × 10-5 per tank year. This may be conservative,
as it is similar to the frequency for tanks with fixed plus internal floating roof estimated
below.
Technica [3] analysed 122 tank fires from MHIDAS, in which 2% were initiated by
explosions. A total of about 22% of these incidents were recorded as involving
explosions. It is not known how many of these were in fixed or floating roof tanks.
These would be included in the fire frequencies above.
DNV [7] analysed MHIDAS reports of fires on crude oil tanks, in which 19 out of 92 were
reported as explosions followed by fires. This suggests that as many as 20% of fires
may begin with explosion-like events. It is not known how many of these were in fixed
or floating roof tanks.
Failure experience for fires/explosions where there is definite information about the roof
type and ignition consequences indicate that in tanks without an internal floating roof,
all full surface fires began with explosions. In addition, there were 3 explosions that did
not result in fires in the tank. Based on the frequency of 9 × 10-5 per year adopted above
for full surface fires, this suggests an additional frequency of 2.5 × 10-5 per year for
explosions without fires.
In tanks with an internal floating roof, there has been one incident of a full-surface fire
with no report of any preceding explosion. However, this event has little practical
significance for risk analysis. There is insufficient information to give a ratio of fires
and explosions significantly different to that estimated above for open top floating roof
tanks.

4.1.2 Overfilling
The main causes of liquid spill onto the roof were roof fracture and overfill. The
LASTFIRE report suggests that 19% of all leaks outside of a storage tanks were caused
by overfilling. There are a large number of variables involved in the mechanism for
overfill. It is therefore recommended that to model overfill effectively would require
detailed analysis using fault tree techniques.

©OGP 9
RADD – Storage incident frequencies

4.2 Refrigerated Storage Tanks


There have been several estimates of the failure frequency for refrigerated storage
tanks, addressing different tank designs. Historical data is mainly influenced by single
wall tanks. The Second Canvey Study [8] addressed double-wall LNG tanks; the COVO
study [9] addressed double integrity tanks; and IPO [10] further addressed double and
full containment tanks. No single study is superior in all respects. All these sources
and available historical data have been reviewed to produce a consistent set of
estimates of frequencies of catastrophic rupture for different designs of refrigerated
storage tanks.

4.2.1 Selection of Generic Value for Refrigerated Storage Tanks


During the last 30 years, there have been only 2 spontaneous catastrophic ruptures of
large refrigerated tanks although this might rise to 3 if the small tank at Varennes was
included and to 4 if the escalation event at Guayaquil was included.
The world-wide population of refrigerated storage tanks is not known with any
precision, although it has been estimated as approximately 2000 tanks. This would give
a historical catastrophic rupture frequency of 2/(2000 × 30) = 3 × 10-5 per tank year. This
would be 6 × 10-5 per tank year if the small tank and escalation events were included.
This approach is very uncertain, and the applicability of the failure modes in the
historical events to modern tank designs is unclear. Nevertheless, it does indicate that
rupture frequencies as low as 10-6 per tank year would be very difficult to justify when
compared to actual accident experience.
16 leaks from refrigerated storage tanks have been reported during the period 1965-95.
The total number of liquid leaks may be lower, since some of these may have been
vapour leaks, but this may be offset if some events have been omitted from MHIDAS.
Using this value, an overall leak frequency is 16 / (2000 × 30) = 2.7 × 10-4 per tank year.
Excluding ruptures and escalation events, this becomes 2.1 × 10-4 per tank year. These
leaks were mainly small.
A number of sources were reviewed in estimating the generic values for refrigerated
storage. These include:
• First Canvey Report [11]
• BG Estimate [12, 13, 14]
• Second Canvey Report [8]
• SRD LPG Study
• LA LNG Study
• COVO Study [9]
• GRI Data
• IPO Values [10]

None of the above analyses are superior in all respects. The BG estimate is based on
the most extensive engineering investigation of failure modes, but it appears to neglect
some failure modes (e.g. aircraft impacts) and is strongly influenced by judgement. The
estimate based on historical failure experience automatically includes all failure modes,
but some may not be applicable to modern tanks, and both the failure experience and
the tank exposure estimates may be inaccurate.
The values from the Second Canvey Report are between the BG and historical estimates
above. They also have the merit of having been used in a well-known public-domain
QRA. They are therefore adopted as cautious best estimates. The BG and historical

10 ©OGP
RADD – Storage incident frequencies

estimates could be used as optimistic and pessimistic sensitivity tests respectively.


The IPO values could be used as a more optimistic sensitivity test.
There have been no formal considerations of the effects of tank design on failure
frequencies. With the exception of the IPO study, each of the studies referenced above
addresses a different type of tank, so frequencies cannot be compared.
The historical data is probably dominated by single-wall ammonia tanks, and hence the
catastrophic failure frequency of 3 × 10-5 is appropriate for them. The Canvey studies
related to double-wall LNG tanks, and hence the value of 7.3 × 10-6 is appropriate for
them. The difference is a factor of 4, which seems subjectively realistic. This can be
compared to the difference of a factor of 10 assumed in the LA LNG study.
The effect of double integrity tanks would be to reduce the frequency further. The
COVO value [9] of 1 × 10-6 may be appropriate for this, i.e. a further reduction by a factor
of 7.
Double containment tanks have the same frequencies, but these apply to releases into
the middle space. The further probability of release beyond the secondary containment
depends on the likelihood of common cause failures. The IPO judgements suggest a
probability of 0.25.
Full containment tanks do reduce the frequencies of release further. The IPO
judgements suggest a frequency of 1 × 10-8 may be appropriate for them, i.e. a further
reduction by a factor of 100 compared to double integrity tanks.

4.3 Pressurised Storage Vessels


4.3.1 Accident Source Data
Lees [1] lists several major accidents involving large storage vessels including:
• Ruptures, BLEVEs and leaks of LPG tanks, including the well known Feyzin and
Mexico City disasters.
• The rupture of an ammonia tank at Potchefstroom, South Africa, 13 July 1973, that
caused 18 fatalities.
• A leak from a chlorine tank, Baton Rouge, Louisiana, USA, 10 December 1976. There
were no fatalities but 10,000 people were evacuated.

Major accidents involving medium storage vessels listed by Lees [1] include:
• Leak from of LPG tank, Wealdstone, Middlesex, UK, 20 November 1980.
• Leak of MIC from tank, Bhopal, India, 3 December 1984. A 46 m3 refrigerated
stainless steel pressure vessel containing methyl isocyanate (MIC) suffered a
release through the relief valve. The release may have been due to entry of water
causing an exothermic reaction that increased the temperature and pressure until
the relief valve lifted. The cloud of toxic gas caused approximately 2000 fatalities
among nearby residents.
• Rupture of a CO2 tank, Worms, Germany, 21 November 1988.
• Rupture of an ammonia tank, Dakar, Senegal, March 1992, causing 41 fatalities.
Gould [15] lists 16 failures of chlorine tanks in the range 4 to 30 tonnes.

©OGP 11
RADD – Storage incident frequencies

4.3.1.1 Additional Source Data for BLEVEs


In the UK, only one BLEVE of a fixed LPG vessel is known (a domestic vessel of less
than 1 tonne capacity, at Kings Ripton in 1988) in a population of approximately 925,000
vessel years up to 1989 [16]. This indicates a BLEVE frequency of 1 × 10-6 per vessel
year. An earlier published estimate was 3 × 10-6 per vessel year [17]. Using the
population of 132,000 vessels in 1991 [18] allows the exposure up to the end of 1998 to
be estimated as 2,113,000 vessel years, giving a frequency of 5 × 10-7 per vessel year.
Since 98% of the exposure relates to vessels under 5 tonnes capacity, this is
appropriate for medium storage vessels.

4.3.2 Selection of Generic Value for Pressurised Storage Vessels


The best available source of leak frequencies for hydrocarbon process pressure vessels
is provided by the HSE hydrocarbon release database [19].
In the absence of any collection of data on leak frequencies from storage vessels
(spheres and bullet tanks), available analyses indicate that these are not significantly
different to the leak frequencies from steam boilers [20]. This source does not give a
leak size distribution, but it gives frequencies a factor of 100 lower than estimated above
for process vessels, and therefore this factor has been applied to the process vessel
size distribution.
Available estimates of leak frequencies from small containers (drums and cylinders) for
liquefied gases indicate leak frequencies a further factor of 50 lower than for steam
boilers.
Comparison of the above estimates of leak frequencies for large pressure vessels
suggests both the overall leak frequencies and the rupture frequencies range over 4
orders of magnitude.
Pressure vessel design and inspection involves extensive effort to avoid catastrophic
cold rupture. Some studies have argued that such events are not possible. Fracture
mechanics analysis [21] has indicated that under normal circumstances defects in a
stress-relieved vessel will cause a leak rather than a catastrophic failure. For vessels
that are not stress-relieved, critical crack lengths could be so short that a leak-before-
break condition can be excluded.
A realistic leak size distribution might therefore use a continuous function up to the size
of the largest connecting pipe, together with a rupture probability. However, for
modelling purposes, the catastrophic rupture of the vessel will need to be represented
in a different way to a rupture the size of the connecting pipe.
For large/medium storage vessels, there is no high-quality data on leak frequency. Most
studies have used data on steam boilers, which is of questionable relevance, although
Davenport [20] shows no significant difference in the frequencies. Nevertheless, its use
is only justifiable in the absence of better data. Gould [15] considered that the air
receiver data from [20] was more appropriate for storage vessels, due to the absence of
temperature cycling. Arulanantham & Lees [22] show a leak frequency for storage
vessels that is not significantly different to that for process vessels, but this is not
supported by other sources.
Several judgmental reviews of data applied to LPG storage vessels [9,23,24,25] give leak
frequencies in the range 5 × 10-6 to 6 × 10-5 per vessel year. These appear to be based
on Davenport [20]. None are particularly authoritative. These judgements could be
represented by a size distribution 100 times lower than the HSE offshore data. This
would be a leak frequency of 5 × 10-5 per vessel year and a rupture frequency of 5 × 10-7
per year.

12 ©OGP
RADD – Storage incident frequencies

The published estimate of rupture frequency of 2.7 × 10-8 by Sooby & Tolchard [18] is as
yet unsupported by any collection of failure data. It is a factor of 20 below that
proposed above, and is considered suitable for a sensitivity test.
Similar leak frequencies have been observed for process vessels in the onshore
process industry [22] and the offshore industry (OREDA and HSE). It is therefore
assumed that otherwise similar pressure vessels in different industries have
approximately the same leak frequencies.

4.3.2.1 BLEVE Data


There were at least 25 large storage spheres world-wide subjected to fire impingement
during 1955-87, of which 12 were destroyed by BLEVE, leading to a BLEVE frequency of
approximately 10-5 per vessel year [27]. This value does not take account of design
improvements that resulted from these events. Few BLEVEs of storage vessels have
been reported since 1984. Therefore the current frequency should be lower.
The likelihood of a BLEVE on a given tank depends on its fire protection measures and
the site layout. This is best addressed using a fault tree approach, combined with
modelling of possible fire scenarios and their impact on the tank.

4.4 Oil Storage on FPSOs


A 1990 study [33] obtained a frequency of fires/explosions on oil tankers over 6000 GRT
of 2.2 × 10-3 per year from IMO data [34] for the period 1982-86. This frequency was
adjusted assuming the COT fire frequency is related to the number of tanks, and hence
the tanker frequency was reduced by 50% (6 tanks on FPSO compared with typically 12
on tankers.) A further 20% reduction was applied to reflect the historical trend in risk
between 1972 and 1986 to obtain a frequency of 8.8 × 10-4 per year for cargo tank
fires/explosions on FPSOs.
Based on data in [32], there have been no fire/explosion incidents on FPSOs operating
in UKCS up to 2005. There have been 2 incidents involving cargo tanks. One involved
overfilling and the other involved dropping liquid nitrogen onto the deck (above a tank),
which consequently cracked; both of these can be considered to be due to human error.
In neither case was there ignition. There have been no incidents of FPSO cargo oil tank
failure up to 2005 [32] other than due to human error.

4.5 Non-process Hydrocarbon Storage Offshore


The main source of data on non-process fires is the WOAD database [28]. It includes
802 fire/explosion events up to 1996, of which 516 did not involve a hydrocarbon leak
and hence were probably non-process fires. Most of these were recently reported
events in the Norwegian Sector, where reporting standards are highest. Since WOAD
relies on public domain reports, classification into process and non-process fires may
be imprecise.
The HSE hydrocarbon release database includes 117 leaks involving non-process
hydrocarbons in the UK Sector during 1992-97, 43 of which ignited. The published
report [29] includes system populations and leak frequencies for different utilities
systems.
The installation names and incident dates are not available, and hence this data is
impossible to combine with the WOAD data. The HSE offshore accident and incident

©OGP 13
RADD – Storage incident frequencies

statistics reports (e.g. [30]) include numbers of fires/explosions, but do not provide any
information to distinguish process and non-process fires.

4.5.1 Methanol
In [29] methanol leaks may be included under several systems. Although leak size
distributions are included, there is insufficient leak experience to give smooth
distributions.
Calculating methanol leak frequencies is awkward because the systems in the HSE
database include both methanol and other fluids. For flow lines and manifolds, the
systems are dedicated to a single product, but the population data includes condensate
lines.
Therefore the frequency should use the total number of leaks. This assumes that the
frequencies are the same for methanol and condensate. For process systems, both
methanol and other lines are included in all systems. Therefore the frequency should
use only the methanol leaks, and leaks from the oil and gas lines should be included
under process leaks.
An alternative approach is to use generic equipment leak frequencies. For example, the
tank leak frequency could be based on the pressure vessel value of 1.5 × 10-4 per year.
In the HSE database, none of the 12 methanol leaks during 1992-97 were from methanol
tanks. Methanol leaks might occur due to over-filling of the tank, and a fault tree
analysis could be made of this, taking account of the filling frequency and the tank’s
high-level and high-pressure trips. A further contribution to the failure frequency might
arise from escalation of other events near to the tank. The deluge system should be
adequate to cover the whole tank evenly as well as the tank supports, to prevent
collapse of the tank in a fire.
The data presented in Table 2.5 is a “system” leak frequency combining a tank leak
frequency distribution and a pipe work leak. The total number of leaks from a methanol
system is taken from [31] and set at 1.3 × 10-2 per system year.
Using data from [29] the overall contribution from tank leaks is 2.6 × 10-3 per tank year.
The rupture frequency is 3.0 × 10-5 per yr and the remaining small, medium and large
tank leak frequencies are calculated based on a continuous leak frequency function.
The contribution from pipework, pumps and flanges is calculated by dividing the
remaining leak frequency (system - tank) between Small (75%), Medium (15%) and Large
(10%) releases.

4.5.2 Diesel
In [29] diesel leaks may be included under several systems. Although leak size
distributions are included, there is insufficient leak experience to give smooth
distributions.
Calculating diesel leak frequencies from these is awkward because the systems in the
HSE database include both diesel and other fluids. The HSE use the 31 leaks
categorised as “utilities, oil, diesel” and an exposure 1511 diesel utilities systems, to
give a frequency of 2.1 × 10-2 per system year. However, this omits diesel leaks from
other systems. An alternative approach would be to divide the total of 52 leaks by the
1511 diesel utilities systems, to give a frequency of 3.4 × 10-2 per system year.
An alternative approach is to use generic equipment leak frequencies. For example, the
tank leak frequency could be based on the pressure vessel value of 1.5 × 10-4 per year.

14 ©OGP
RADD – Storage incident frequencies

In the HSE database, 5 of the 52 diesel leaks during 1992-97 were from tanks and one
was from a pressure vessel. Assuming that each of the diesel systems had one tank,
these 6 leaks in 1511 system-years would give a frequency of 4 × 10-3 per tank year.
The data presented in Table 2.6 have been calculated using a similar approach to that
used for methanol leaks. The total number of leaks from a diesel system is taken from
[31] and set at 3.4 × 10-2 per year. However, this frequency includes oil export and well
systems. Eliminating leaks involving these systems gives a system leak frequency of
3.0 × 10-2 per year.
Using data from [29] the overall contribution from tank leaks is 2.6 × 10-3 per tank year.
The rupture frequency is 3.0 × 10-5 per year and the remaining small, medium and large
tank leak frequencies are calculated based on a continuous leak frequency function.
The contribution from pipework, pumps and flanges is calculated by dividing the
remaining leak frequency (system - tank) between Small (75%), Medium (15%) and Large
(10%) releases.

5.0 Recommended Data Sources for Further Information


For further information, the data sources used to develop the release frequencies
presented in Section 2.0 and discussed in Sections 3.0 and 4.0 should be consulted.

6.0 References
The principal source references are shown in bold.
1. Lees, F.P. 1996. Loss Prevention in the Process Industries, 2nd. ed., Oxford:
Butterworth-Heinemann.
2. BS EN 1473: 1997. Installation and equipment of liquefied natural gas – Design of
onshore installations.
3. Technica 1990. Atmospheric Storage Tank Study, Confidential Report for
Oil & Petrochem ical Industries Technical and Safety Com m ittee,
Singapore, Project No. C1998.
4. LASTFIRE 1997. Large Atmospheric Storage Tank Fires - A Joint Oil
Industry Project to Review the Fire Related Risks of Large Open-Top
Floating Roof Storage Tanks.
5. API 1998. Interim Study - Prevention and Suppression of Fires in Large
Aboveground Atmospheric Storage Tanks, Am erican Petroleum Institute
Publication 2021A.
6. DNV 1997. Fires and Explosions in Atmospheric Fixed Roof Storage Tanks, Confidential
Report for Oil Refineries Ltd, Project No. C8263.
7. DNV 1998. HAZOP Study and Risk Assessment of Venezia Refinery, Confidential
Report for AgipPetroli SpA, Project No. C383005.
8. HSE 1981. Canvey - A Second Report - An Investigation of Potential Hazards
from Operations in the Canvey Island/Thurrock Area 3 years After
Publication of the Canvey Report, Health & Safety Executive, London:
HMSO.
9. Rijnm ond Public Authority 1982. A Risk Analysis of Six Potentially
Hazardous Industrial Objects in the Rijnmond Area - A Pilot Study, (the
“COVO Study”), Dordrecht: D. Reidel Publishing Co.

©OGP 15
RADD – Storage incident frequencies

10. IPO 1994. Handleiding voor het opstellen en beoordelen van een extern
veiligheidsrapport, Interprovinciaal Overleg.
11. HSE 1978. Canvey – An Investigation of Potential Hazards from Operations in the Canvey
Island/Thurrock Area, Health & Safety Executive, London: HMSO.
12. British Gas 1979. Further Studies on the Integrity and Modes of Failure of Canvey Above
Ground Storage Tanks, British Gas Engineering Research Station Report ERS R1983.
13. British Gas 1981a. The Hazard of Rollover – Canvey Terminal Above Ground Storage
Tanks, British Gas Fundamental Studies Group Report FST 812.
14. British Gas 1981b. An Assessment of the Probability of Unintentionally Filling to the Roof
an Above Ground LNG Storage Tank at the Canvey Island Methane Terminal.
15. Gould, J. 1993. Fault Tree Analysis of the Catastrophic Failure of Bulk Chlorine Vessels,
AEA Technology, Report SRD/HSE/R603, London: HMSO.
16. ACDS 1991.
17. Blything, K.W. & Reeves, A.B. 1988. An Initial Prediction of the BLEVE Frequency of a
100 Tonne Butane Storage Vessel, SRD Report R488.
18. Sooby, W. & Tolchard, J.M. 1993. Estimation of Cold Failure Frequency of LPG
Tanks in Europe”, Conference on Risk & Safety Management in the Gas Industry, Hong
Kong.
19. HSE 2000. Offshore Hydrocarbon Releases Statistics 1999, Offshore
Technology Report OTO 1999 079, Health & Safety Executive, London:
HMSO.
20. Davenport, T.J. 1991. A Further Survey of Pressure Vessel Failures in the UK,
Reliability 91, London.
21. Smith, T.A. 1986. An Analysis of a 100 te Propane Storage Vesse”, UKAEA Safety and
Reliability Directorate Report SRD R314.
22. Arulanatham, D.C. & Lees, F.P. 1981. Some Data on the Reliability of Pressure
Equipment in the Chemical Plant Environment, Int. J. Pres. Ves & Piping 9 327-338.
23. Crossthwaite, P.J., Fitzpatrick, R.D. & Hurst, N.W. 1988. Risk Assessment for the
Siting of Developments near Liquefied Petroleum Gas Installations, IChemE Symp.
Ser. 110.
24. Pape, R.P. and Nussey, C. 1985. A Basic Approach for the Analysis of Risks From
Major Toxic Hazards, Assessment and Control of Major Hazards, EFCE event no. 322,
Manchester, UK, IChemE Symp. Ser. 93, 367-388.
25. Whittle, K. 1993. LPG Installation Design and General Risk Assessment
Methodology Employed by the Gas Standards Office, Conference on Risk & Safety
Management in the Gas Industry, Hong Kong, October.
26. Reeves, A.B., Minah, F.C. & Chow, V.H.K. 1997. Quantitative Risk Assessment
Methodology for LPG Installations, EMSD Symposium on Risk and Safety Management
in the Gas Industry, Hong Kong, March.
27. Selway, M. 1988, The Predicted BLEVE Frequency of a Selected 200 m3 Butane Sphere
on a Refinery Site, SRD Report R492.
28. W OAD. W orld Offshore Accident Database, DNV.
29. HSE (1997a): Offshore Hydrocarbon Release Statistics, 1997, Offshore
Technology Report OTO 97 950, Health & Safety Executive.

16 ©OGP
RADD – Storage incident frequencies

30. HSE (1997b): Offshore Accident and Incident Statistics Report, 1997,
Offshore Technology Report OTO 97 951, Health & Safety Executive.
31. Spouge, J R 1999. A Guide to Quantitative Risk Assessment for Offshore
Installations, Publication No. 99/100, ISBN 1 870553 365, London: CMPT.
32. Det Norkse Veritas 2007. Accident statistics for floating offshore units on the UK
Continental Shelf 1980-2005, Research Report RR567, Health & Safety Executive.
33. Technica, 1990. Port Risks in Great Britain from Marine Transport of Dangerous
Substances in Bulk: A Risk Assessment, Report for The Health & Safety Executive,
Project No. C1216.
34. IMO, 1987. Casualty Statistics, Report of the Steering Group, Annexes 1 – 3 (Analyses of
Casualties to Tankers, 1972-1986), MSC 54/INf 6, 26.

©OGP 17
Risk Assessment Data Directory

Report No. 434 – 4


March 2010

Riser &
pipeline
release
frequencies
International Association of Oil & Gas Producers
RADD – Riser & pipeline release frequencies

contents
1.0 Scope and Definitions ........................................................... 1
1.1 Application ...................................................................................................... 1
1.2 Definitions ....................................................................................................... 1
2.0 Summary of Recommended Data ............................................ 2
3.0 Guidance on use of data ........................................................ 3
3.1 General validity ............................................................................................... 3
3.2 Uncertainties ................................................................................................... 3
3.3 Application of frequencies to specific pipelines ......................................... 3
3.3.1 Offshore pipelines...................................................................................................... 4
3.3.2 Onshore pipelines ...................................................................................................... 6
3.4 Application to pipelines conveying fluids other than hydrocarbons ........ 6
4.0 Review of data sources ......................................................... 6
4.1 Basis of data presented ................................................................................. 6
4.1.1 Risers and offshore pipelines ................................................................................... 6
4.1.2 Onshore gas pipelines............................................................................................... 8
4.1.3 Onshore oil pipelines................................................................................................. 9
4.2 Other data sources ....................................................................................... 10
5.0 Recommended data sources for further information ............ 11
6.0 References .......................................................................... 11
6.1 References for Sections 2.0 to 4.0 .............................................................. 11
6.2 References for other data sources.............................................................. 11

©OGP 1
RADD – Riser & pipeline release frequencies

Abbreviations:
AGA American Gas Association
ANSI American National Standards Institute
API American Petroleum Institute
ASME American Society of Mechanical Engineers
CONCAWE Conservation of Clean Air and Water in Europe
DNV Det Norske Veritas
DOT (US) Department of Transportation
EGIG European Gas Pipeline Incident Data Group
ESDV Emergency Shutdown Valve
PARLOC Pipeline And Riser Loss Of Containment
UK HSE United Kingdom Health and Safety Executive
UKOPA United Kingdom Pipeline Operators’ Association
VIV Vortex Induced Vibration

2 ©OGP
RADD – Riser & pipeline release frequencies

1.0 Scope and Definitions


1.1 Application
This datasheet presents (Section 2.0) frequencies of riser and pipeline releases.
Frequencies for offshore and onshore pipelines are included.
The frequencies given are based on analysis for pipelines conveying hydrocarbons.
They may be applied to pipelines conveying other fluids as discussed in Section 3.4.

1.2 Definitions
The pipeline frequencies are given for four different sections as shown in Figure 1.1.
Risers are considered to comprise three sections:
• Above water (often taken to be the topsides section below the riser ESDV)
• Splash zone (exposed to aggressive corrosion conditions and ship collisions)
• Below water (to the flange connection with the pipeline or a spool piece)

Figure 1.1 Definition of Pipeline Sections

For offshore sections, frequencies are given for steel and flexible risers and pipelines.
“Flexible” should be understood in the context of the source data (see Section 4.1.1),
which is from the North Sea. It therefore includes risers from FPSOs, TLPs and
semisubmersibles but would not include deepwater technologies such as steel catenary
risers. These are a specialist and relatively new area, and the failure frequency analysis
should accordingly be undertaken utilising suitable expertise.

©OGP 1
RADD – Riser & pipeline release frequencies

2.0 Summary of Recommended Data


The recommended frequencies and associated data are presented as follows:
• Table 2.1 Recommended Riser and Pipelines failure Frequencies
• Table 2.2 Recommended Hole Size Distributions for Risers and Pipelines
• Table 2.3 Release Location Distribution for Risers
Note that separate failure frequencies are not given for Segment III, Landfall zone. This
segment, representing the tidal zone, is defined as the area where the pipeline may be
wet and dry at different times. This allows the anode system to function. Onshore
pipelines are often more affected by corrosion than pipelines in the tidal zone. Hence
frequencies for onshore pipelines should be used in tidal zones. A pipeline in the
landfall zone may also be subject to increased risk of external impact, e.g. due to
grounding ships. Such risks may have to be assessed separately.

Table 2.1 Recom m ended Riser and Pipelines failure Frequencies

Pipeline Category Failure Unit


frequency
-4
Subsea pipeline: Well stream pipeline and other 5.0 × 10 per km-year
in open sea small pipelines containing
unprocessed fluid
-5
Processed oil or gas, pipeline 5.1 × 10 per km-year
diameter ≤ 24 inch
-5
Processed oil or gas, pipeline 1.4 × 10 per km-year
diameter > 24 inch
-4
Subsea pipeline: Diameter ≤ 16 inch 7.9 × 10 per year
external loads causing -4
damage in safety zone Diameter > 16 inch 1.9 × 10 per year
-3
Flexible pipelines: All 2.3 × 10 per km-year
subsea
-4
Risers Steel - diameter ≤ 16 inch 9.1 × 10 per year
-4
Steel – diameter > 16 inch 1.2 × 10 per year
-3
Flexible 6.0 × 10 per year
-3
Oil pipelines onshore Diameter < 8 inch 1.0 × 10 per km-year
-4
8 inch ≤ diameter ≤ 14 inch 8.0 × 10 per km-year
-4
16 inch ≤ diameter ≤ 22 inch 1.2 × 10 per km-year
-4
24 inch ≤ diameter ≤ 28 inch 2.5 × 10 per km-year
-4
Diameter > 28 inch 2.5 × 10 per km-year
-4
Gas pipelines onshore Wall thickness ≤ 5 mm 4.0 × 10 per km-year
-4
5 mm < wall thickness ≤ 10 mm 1.7 × 10 per km-year
-5
10 mm < wall thickness ≤ 15 8.1 × 10 per km-year
mm
-5
Wall thickness > 15 mm 4.1 × 10 per km-year

2 ©OGP
RADD – Riser & pipeline release frequencies

Table 2.2 Recom m ended Hole Size Distributions for Risers and Pipelines

Hole size Subsea Onshore pipeline Riser


pipeline Gas Oil
Small (< 20 mm) 74% 50% 23% 60%
Medium (20 to 80 mm) 16% 18% 33% 15%
Large (> 80 mm) 2% 18% 15%
25%
Full rupture 8% 14% 29%

Table 2.3 Release Location Distribution for Risers

Release location Distribution


Above water 20%
Splash zone 50%
Subsea 30%

3.0 Guidance on use of data


3.1 General validity
The frequencies given are based on analysis for pipelines conveying hydrocarbons.
They may be applied to pipelines conveying other fluids as discussed in Section 3.4.
There is an implicit assumption that the pipelines are built to a recognized international
standard such as ANSI/ASME B31.4/8 [1,2] or (for subsea pipelines) DNV-OS-F101 [3].

3.2 Uncertainties
In addition to the known causes of fluid release from transport pipelines, as discussed
in Section 4.0, new or unforeseen factors may cause shutdown of pipelines. It is
impossible to estimate the contribution from such incidents to the release frequencies,
neither is it possible to state that it is more likely that some pipelines will sustain failure
before others. Accordingly, unknown factors cannot be used either to identify pipelines
which are especially exposed to the possibility of leakage or to prioritize risk mitigation
measures.

3.3 Application of frequencies to specific pipelines


In Table 2.1, most frequencies are given per km-year as they are dependent on the
length of the pipeline. For a typical pipeline of length ℓ (km) with release frequency fkm,
the release frequency F along the full length of the pipeline is simply given by:
F = ℓ × fkm per year:

There are several causes that can result in the release frequency for a specific pipeline,
or for a section of a pipeline, being different from that obtained simply using the Section
2.0 frequencies.

©OGP 3
RADD – Riser & pipeline release frequencies

In general there are two main groups of causes causing pipeline failures. The first
group is related to loads exceeding pipeline critical loads, usually resulting in an
isolated incident. The second group is related to effects gradually weakening the
pipeline over a period of time. Those considered here are:
Isolated incidents – offshore Mechanisms acting over time – offshore
• Loads from trawl boards • Corrosion
• Ship anchor / sinking ship • Open spans causing fatigue
• Subsea landslide • Buckling
Isolated incidents – onshore Mechanisms acting over time – onshore
• External interference e.g. digging • Construction defect
• Hot-tap made by error • Material failure
• Ground movement e.g. landslide • Ground movement e.g. mining
• Corrosion

These are discussed further in Sections 3.3.1 (offshore pipelines) and 3.3.2 (onshore
pipelines), with some guidance given on modifying the Section 2.0 frequencies.
However, in situations where several of these causes pertain or critical decisions are
dependent on the analysis results, a detailed analysis should be carried out utilising
appropriate expertise and data specific to the situation. Such analysis is beyond the
scope of this datasheet.

3.3.1 Offshore pipelines

Where none of the additional causes listed in Section 3.3 that could exacerbate the
likelihood of a release are present, the release frequency can be reduced by 50%.
On pipeline sections where loads from trawl boards pose a threat, it is suggested that
frequencies could be up to a factor of 5 higher (see Section 3.3.1.1).
On pipeline sections where the other causes pose a threat, it is suggested that
frequencies could be up to a factor of 2 higher (see Sections 3.3.1.2 to 3.3.1.5).

3.3.1.1 Loads from trawl boards


Pipelines located in areas where trawling activity takes place may be damaged.
Pipelines are normally dimensioned to withstand loads from a trawl, such as impacts,
overdraw1 or hook up2. The pipe wall is normally covered by a concrete coating giving
protection against local impact loads to the pipeline, and it gives the pipeline the
necessary weight to gain stability.
Overdraw and hook ups can initiate buckling of the pipeline. Free spans will exacerbate
the effect of trawl impacts.
A trawl can also catch other equipments such as exposed flanges and bolts, and a trawl
hook up may cause pipeline fracture on smaller pipelines.

1
Overdraw is a situation where the trawl board comes in under the pipeline and is drawn over
applying force sideways.
2
Hook up is a situation where the trawl board gets stuck beneath the pipeline. The pipeline may
be damaged if the vessel tries to bring in the trawl.

4 ©OGP
RADD – Riser & pipeline release frequencies

Trawling with lump weights is a relatively new practice and consequently most pipelines
are not designed to tackle such loads. Even though no serious damage due to lump
weights has yet been registered, it is still uncertain what consequences boom trawl and
lump weights may cause.

3.3.1.2 Ship anchor / impact from sinking ships


Pipelines located in areas with shipping traffic may be damaged by anchors getting hold
of the pipeline, or a sinking ship hitting the line. The relevant factors include shipping
traffic density, distance from shore or port, water depth, vessel traffic surveillance.

3.3.1.3 Material left behind from war years


If a pipeline is laid through coastal areas that were mined during war years, there may
still be material present that poses a threat to the pipeline even if these areas were
cleared before installation of the pipeline.

3.3.1.4 Fatigue (mainly due to free spans)


Free spans can result in fatigue if the span is excited by current, and the pipeline can
fracture relatively quickly. Some spans develop as the soil beneath the pipeline is
washed away, and an already existing span may evolve quickly since the free spans
influence local currents near the pipeline.
Only one example, from China, is known to be caused by free spans. The incident was
caused by extreme climatic conditions (2 following cyclones) and the free span was
longer than what the pipeline was designed for. Vortex Induced Vibration (VIV) has
caused leakages in the past, but today’s pipelines are designed to resist the associated
stress.

3.3.1.5 Buckling
Buckling (bends) may occur if the pipeline is prevented from extension forced by
pressure tension in the axial direction. This can cause buckling sideways or upwards.
Some pipelines are designed to allow for a controlled buckling to relieve axial tension. It
is important that the buckling takes place over a long distance. In extremely
disadvantaged situations, when the buckling is very local, great strain may be placed on
the pipeline. The consequence may be pipeline leakage and subsequent replacement.
Buckling will normally occur during the first years of operation when temperatures are
at their highest, but may occur if operational conditions are changed, new connections
of pipeline or new compressor stations.

3.3.1.6 Material damage/failures


If there are indications of pipelines being especially exposed to a specific type of failure,
then corrections should be made utilising suitable engineering expertise. Typical
correction factors would be in the range 2 to 3, applied to the contribution from the
specific failure mechanism affected; expert engineering judgment should be used to
determine a suitable factor.

©OGP 5
RADD – Riser & pipeline release frequencies

3.3.1.7 Fluid medium


Both wet and dry gas should be properly processed to avoid corrosion or keep
corrosion under control. For example, control and monitoring techniques of the
pipelines operated by Norwegian companies is considered to be so good that wet gas
pipelines do not have a higher probability of corrosion than the dry gas pipelines. The
same applies to processed gas. Hence in general no correction need be applied for
fluid medium. However, if it is known that the control techniques in place or planned do
not meet current best practice, then a correction should be made in the same way as
described for material damage/failures (Section 3.3.1.6).

3.3.2 Onshore pipelines


The EGIG and CONCAWE reports [7,8] give breakdowns of release frequencies by cause
and release size. These are partially reproduced in Sections 4.1.2 (gas pipelines) and
4.1.3 (oil pipelines), and further data are available in the EGIG and CONCAWE reports.
These sources of information could be used to obtain more location specific estimates
of the release frequencies. However, in situations where several of these causes pertain
or critical decisions are dependent on the analysis results, a detailed analysis should be
carried out utilising appropriate expertise and data specific to the situation. Such
analysis is beyond the scope of this datasheet.

3.4 Application to pipelines conveying fluids other than hydrocarbons


Certain non hydrocarbon fluids can increase the likelihood of failure through specific
mechanisms. For example, under certain circumstances ammonia may cause stress
corrosion cracking, increasing the contributions from internal and external corrosion.
In the first European Benchmark Study, DNV [5] estimated a factor-of-3 increase in these
contributions to the overall failure frequency. As already discussed in Section 3.3.1, the
factor should be estimated using expert engineering judgment.

4.0 Review of data sources


4.1 Basis of data presented
4.1.1 Risers and offshore pipelines
The frequencies and distributions presented in Section 2.0 for risers and offshore
pipelines are derived from DNV’s re-analysis [6] of the data presented in PARLOC 2001
[4]. The re-analysis was performed because of recognised errors in the frequencies
given in PARLOC 2001 itself.
Table 4.1 presents the data used as the basis of the analysis.
Allocation of failures to failure mechanisms vary according to source. Table 4.2
indicates how much different mechanisms contribute to the overall failure frequency.
This can be used to determine how specific features of the pipeline design may affect
the frequency. Section 3.3 provides some general guidance that is not dependent on
failure mechanism. Expert judgment should be used where the likelihood of failure by a
specific mechanism is affected by specific features of the pipeline design (see Section
3.3.1).

6 ©OGP
RADD – Riser & pipeline release frequencies

Table 4.1 Incident and Population Data for Offshore Pipelines from [4]

Pipeline description No. of Exposure time


releases
Well stream pipelines and other
small pipelines containing 60033 km-years
30
unprocessed fluid, diameter ≤ 16 10576 pipe-years
inch
Well stream pipelines and other
36925 km-years
small pipelines containing
3 (pipe-years not
unprocessed fluid, diameter > 16
available)
inch
Processed oil or gas pipeline, 59003 km-years
3
diameter ≤ 24 inch 4320 pipe-years
Processed oil or gas pipeline, 147608 km-years
2
diameter > 24 inch 2949 pipe-years
External load causing pipeline
1 7 8836 years
damage , diameter ≤ 24 inch
External load causing pipeline 2
1 0.7 3734 years
damage , diameter > 24 inch
Steel riser, diameter< 16 inch 10 10979 riser-years
Flexible pipeline 3447 km-years
11
3898 pipe-years
2
Steel riser, diameter > 16 inch 0.7 5937 riser-years
Flexible riser 5 5 riser-years

Notes
1. Applies to near platform zone
2. No releases to date; estimate using standard statistical techniques.

Table 4.2: Allocation of Failure Mechanism s from [4]: Offshore Pipelines,


All Diam eters

Failure mechanism Distribution


Corrosion 36%
Material 13%
External loads causing damage 38%
Construction damage 2%
Other 11%
Note: This is a summary. The distribution varies between
hole sizes. For further information refer to the source
report [4].

Table 4.3: Hole Size Distribution for Offshore Pipelines from [4]

Hole size Number of releases


Pipelines Risers
Small (< 20 mm) 37 9
Medium (20 to 80 mm) 8 2
Large (> 80 mm) 1 4

©OGP 7
RADD – Riser & pipeline release frequencies

Full rupture 4
Total 50 15

4.1.2 Onshore gas pipelines


The frequencies presented in Section 2.0 for onshore gas pipelines are based on data
from EGIG’s most recently available report [7]. The EGIG database spans the period
1970-2004; it includes 1123 incidents on pipelines with a total exposure of
approximately 2.77 million km-years. It shows an average incident frequency over this
period of 4.1 × 10-4 per km-year and an average over the period 2000-2004 of 1.7 × 10-4
per km-year.
Table 4.4 reproduces the breakdown of failures by cause given in the EGIG report [7].

Table 4.4: Allocation of Failure Mechanism s from [7]: Onshore Gas


Pipelines, All Diam eters / W all Thicknesses

Failure mechanism Distribution


External interference 49.7%
Construction defect / Material 16.7%
failure
Corrosion 15.1%
Ground movement 7.1%
Hot-tap made in error 4.6%
Other/unknown 6.7%

The report also presents a graph showing the frequencies by cause separately for three
sizes of failure:
• Pinhole/crack: diameter of hole ≤ 20 mm.
• Hole: 20 mm ≤ diameter of hole ≤ pipeline diameter
• Rupture: hole diameter > pipeline diameter

The report presents more detailed frequencies for each of the causes listed above.
Those showing the dependence of the frequencies of failure due to external interference
and corrosion on pipeline wall thickness have been used to derive the frequencies
presented in Section 2.0 for pipelines with a wall thickness up to 15 mm. For thicker
walled pipes, it has been assumed that the frequency is 50% of that for pipelines with a
wall thickness of 10 – 15 mm based on the trend with diameter.
Wall thickness rather than pipeline diameter has been found to be the most significant
factor in determining pipeline failure rates. To some extent it is dependent on diameter,
so accordingly some dependence on diameter is implicit in the data presented.
Based on the rolling 5-year average total frequencies presented in the report, it has
been assumed that current frequencies are approximately 50% of the 1970-2004
average. The frequencies in Section 2.0 include this trend factor.
The report contains more detailed analysis of pipeline failure rate dependencies than is
presented here, addressing:
• External interference: pipeline diameter, depth of cover and wall thickness

8 ©OGP
RADD – Riser & pipeline release frequencies

• Construction defect / Material failure: year of construction


• Corrosion: year of construction, type of coating and wall thickness
• Ground movement: pipeline diameter
• Hot-tap made by error: pipeline diameter
• Other / unknown: main causes

For more detailed analysis of these factors, reference should be made to the report
directly.

4.1.3 Onshore oil pipelines


The frequencies presented in Section 2.0 for onshore oil pipelines are based on data in
CONCAWE [8]. The data include 379 failures on pipelines with a total exposure for
pipelines containing crude oil and products of approximately 667,000 km-years. More
detailed analysis has enabled the diameter specific frequencies presented in Section 2.0
to be derived.
The CONCAWE report [8] includes a detailed breakdown of failure size and mechanism,
partially reproduced in Table 4.5.
Based on the definitions of the failure sizes in the CONCAWE report [8], the hole size
distribution given in Table 2.2 has been derived as follows:
• Pinhole + Fissure: Small (diameter of hole ≤ 20 mm.)
• Hole: Medium (20 mm ≤ diameter of hole ≤ 80 mm)
• Split: Large (diameter of hole > 80 mm)
• Rupture: Rupture (pipeline diameter)

Table 4.5: Allocation of Failure Mechanism s from [8]: Onshore Oil


Pipelines, All Diam eters / W all Thicknesses

Failure Distribution
mechanism Pinhole Fissure Hole Split Rupture Overall
1
Total no. of failures 20 21 58 27 50 176
Percentage of total 12% 12% 34% 16% 29% 100%
Mechanical failure 5% 19% 12% 22% 24% 17%
Operational 0% 5% 2% 11% 4% 4%
Corrosion 90% 33% 29% 30% 18% 34%
Natural hazard 0% 5% 2% 11% 2% 3%
Third party 5% 38% 55% 26% 52% 43%
Note 1: Hole size data was only available for 176 out of the 379 failures.

©OGP 9
RADD – Riser & pipeline release frequencies

4.2 Other data sources


For risers and offshore pipelines, the PARLOC 2001 data [4] is regarded as the best
source despite the shortcomings in the report noted in Section 4.1.1. It should be
noted, however, that the previous cycle of 2-yearly revisions has lapsed.
Other data sources from which onshore pipeline failure frequency data can be obtained
included:-
1. US Department of Transportation. The US Department of Transportation Office
of Pipeline Safety maintains a database of leaks from hazardous liquid and gas
pipelines, together with exposure data. The database covers 800,000 km of pipelines,
and is the largest of its kind.
An analysis of the gas transmission and gathering line data was prepared for several
years for the American Gas Association (AGA) by Batelle (e.g. Jones & Eiber 1989).
An analysis of liquid pipeline data was prepared for DOT and API by Keifner &
Associates (Keifner et al 1999).
The database itself can be obtained from the DOT website at
ops.dot.gov/libindex.htm. It includes files of pipeline incidents for natural gas
transmission/gathering and distribution lines and liquid lines. Each is split into 1984
to date and pre-1984, due to a change in inclusion criteria. Pipeline population data
is available in separate files for each year for 1995-98 for gas transmission/gathering
and distribution lines. Summary statistics, together with population data for liquid
lines since 1986 are at ops.dot.gov/stats.htm.
2. United Kingdom Onshore Pipeline Operators’ Association (UKOPA).
UKOPA has issued a report (2005) that analyses pipeline product loss incidents in
the UK over the period 1962-2004, covering about 21,700 pipeline km at the end of
2004 and 650,000 km-years pipeline exposure. Products covered are: natural gas
(dry), natural gas liquid, ethane, ethylene, propane, propylene, LPG, butane,
condensate and crude oil (spiked).
Overall incident frequencies are calculated for 5-year periods. For the whole 43-year
period the report presents frequencies by hole size (not related to pipeline diameter),
and by cause and size of leak. There is further breakdown by hole size of the
frequencies for external interference and corrosion as follows:
External interference External corrosion
• Pipeline diameter • Wall thickness class
• Measured wall thickness • Year of construction
• Area classification • External coating type
• Type of backfill
3. UK HSE (1999). This study of the risk from UK gasoline pipelines collected data
on events worldwide involving gasoline leaks from cross country pipelines. The
data were used to determine the likelihood of events such as leaks and fires, and
also to generate consequence models based on the available data. The report
references CONCAWE and US DOT data.
4. UK HSE (2001). This study specifically addresses third party damage to onshore
pipelines, comparing EGIG data and BG Transco’s incident database. The latter
represents nearly 460,000 km-years exposure, with 32 third party incidents, 32 loss
events, and 564 incidents altogether. The third part activity failure model takes into
account such factors as: pipeline diameter, wall thickness and location; depth of
cover; damage prevention measures in place.

10 ©OGP
RADD – Riser & pipeline release frequencies

5.0 Recommended data sources for further information


For further information, the data sources used to develop the release frequencies
presented in Section 2.0 and discussed in Sections 0 and 4.0 should be consulted.
These references are shown in bold in Section 6.0.

6.0 References
6.1 References for Sections 2.0 to 4.0
1. ANSI/ASME B31.4:2006. Pipeline Transportation Systems for Liquid Hydrocarbons and
other Liquids.
2. ANSI/ASME B31.8:2003. Gas Transmission and Distribution Piping Systems.
3. DNV-OS-F101 2000 amended Oct. 2005. Submarine pipeline systems, Offshore
Standard.
4. PARLOC 2001 – The Update of Loss of Containm ent Data for Offshore
Pipelines, prepared by Mott McDonald for the UK HSE, UKOOA and IP, 2003.
5. DNV 1989. Phase 1 Report, CEC Benchmark Study – Project HH, Independent Risk
Analysis.
6. DNV 2006. Riser/Pipeline Leak Frequencies, Technical Note T7, rev. 02, unpublished
internal document.
7. EGIG 2005. 6 th EGIG-report 1970-2004 Gas Pipeline Incidents, 6 th report of
the European Gas Pipeline Incident Data Group, Doc. No. EGIG
05.R.0002.
8. CONCAW E 2002. Performance of crosscountry oil pipelines in W estern
Europe, Report No. 1/02.

6.2 References for other data sources


(US) Department of Transportation. Refer ops.dot.gov/stats/stats.htm.
((UK) Health and Safety Executive 1999. Assessing the risk from gasoline pipelines in the
United Kigdom based on a review of historical experience, Contract Research Report
210/1999, prepared by WS Atkins Safety & Reliability.
http://www.hse.gov.uk/research/crr_pdf/1999/crr99210.pdf.
(UK) Health and Safety Executive 2001. An assessment of measures in use for gas
pipelines to mitigate against damage caused by third party activity, Contract Research Report
372/2001, prepared by WS Atkins Consultants Ltd.
http://www.hse.gov.uk/research/crr_pdf/2001/crr01372.pdf.
UKOPA 2005. Pipeline Product Loss Incidents (1962 - 2004), prepared by Advantica,
Report Ref. R 8099, for UKOPA FDMG. http://www.ukopa.co.uk/.

©OGP 11
Risk Assessment Data Directory

Report No. 434 – 5


March 2010

Human
factors
in QRA
International Association of Oil & Gas Producers
P ublications

Global experience
The International Association of Oil & Gas Producers has access to a wealth of technical
knowledge and experience with its members operating around the world in many different
terrains. We collate and distil this valuable knowledge for the industry to use as guidelines
for good practice by individual members.

Consistent high quality database and guidelines


Our overall aim is to ensure a consistent approach to training, management and best prac-
tice throughout the world.
The oil and gas exploration and production industry recognises the need to develop consist-
ent databases and records in certain fields. The OGP’s members are encouraged to use the
guidelines as a starting point for their operations or to supplement their own policies and
regulations which may apply locally.

Internationally recognised source of industry information


Many of our guidelines have been recognised and used by international authorities and
safety and environmental bodies. Requests come from governments and non-government
organisations around the world as well as from non-member companies.

Disclaimer
Whilst every effort has been made to ensure the accuracy of the information contained in this publication,
neither the OGP nor any of its members past present or future warrants its accuracy or will, regardless
of its or their negligence, assume liability for any foreseeable or unforeseeable use made thereof, which
liability is hereby excluded. Consequently, such use is at the recipient’s own risk on the basis that any use
by the recipient constitutes agreement to the terms of this disclaimer. The recipient is obliged to inform
any subsequent recipient of such terms.
This document may provide guidance supplemental to the requirements of local legislation. Nothing
herein, however, is intended to replace, amend, supersede or otherwise depart from such requirements. In
the event of any conflict or contradiction between the provisions of this document and local legislation,
applicable laws shall prevail.

Copyright notice
The contents of these pages are © The International Association of Oil and Gas Producers. Permission
is given to reproduce this report in whole or in part provided (i) that the copyright of OGP and (ii)
the source are acknowledged. All other rights are reserved.” Any other use requires the prior written
permission of the OGP.
These Terms and Conditions shall be governed by and construed in accordance with the laws of Eng-
land and Wales. Disputes arising here from shall be exclusively subject to the jurisdiction of the courts of
England and Wales.
RADD – Human factors in QRA

contents
1.0 Scope and Definitions ........................................................... 1
1.1 Application ...................................................................................................... 1
1.2 Definitions and Terminology of HF ............................................................... 1
1.2.1 Definitions................................................................................................................... 1
1.2.2 Terminology................................................................................................................ 2
2.0 Human Factors Process Descriptions .................................... 3
2.1 Human Factors in Offshore Safety Cases .................................................... 3
2.1.1 Rationale ..................................................................................................................... 3
2.1.2 Stages ......................................................................................................................... 3
2.2 Human Factors in UK Onshore Safety Cases .............................................. 5
2.2.1 Rationale ..................................................................................................................... 5
2.2.2 Stages ......................................................................................................................... 6
2.3 Workload Assessment ................................................................................... 7
2.3.1 Rationale ..................................................................................................................... 7
2.3.2 Stages ......................................................................................................................... 8
2.4 Human Error Identification........................................................................... 11
2.4.1 Rationale ................................................................................................................... 11
2.4.2 Stages ....................................................................................................................... 12
2.4.3 Techniques ............................................................................................................... 14
2.5 Human Reliability Assessment.................................................................... 15
2.5.1 Rationale ................................................................................................................... 15
2.5.2 Stages ....................................................................................................................... 15
2.5.3 Techniques ............................................................................................................... 19
2.6 Human Factors in Loss of Containment Frequencies............................... 19
2.6.1 Rationale ................................................................................................................... 19
2.6.2 Stages ....................................................................................................................... 19
2.6.3 Techniques ............................................................................................................... 28
2.7 Human Factors in the determination of event outcomes.......................... 28
2.7.1 Rationale ................................................................................................................... 28
2.7.2 Stages ....................................................................................................................... 28
2.7.3 Techniques ............................................................................................................... 31
2.8 Human Factors in the assessment of fatalities during escape and
sheltering....................................................................................................... 32
2.8.1 Rationale ................................................................................................................... 32
2.8.2 Stages ....................................................................................................................... 33
2.9 Human Factors in the assessment of fatalities during evacuation, rescue
and recovery.................................................................................................. 38
2.9.1 Rationale ................................................................................................................... 38
2.9.2 Stages ....................................................................................................................... 39
2.9.3 Techniques ............................................................................................................... 46
3.0 Additional Resources .......................................................... 48
3.1 Legislation, guidelines and standards........................................................ 48
3.1.1 UK Legislation, Guidelines and Standards............................................................ 48
3.1.2 Key Guidance and References ............................................................................... 48
3.2 Key Societies and Centres........................................................................... 50
3.2.1 United Kingdom ....................................................................................................... 50
3.2.2 Europe ....................................................................................................................... 50

©OGP
RADD – Human factors in QRA

3.2.3 Scandinavia .............................................................................................................. 51


3.2.4 United States and Canada ....................................................................................... 51
3.2.5 South America .......................................................................................................... 51
3.2.6 Australia and New Zealand ..................................................................................... 51
3.2.7 Rest of the World ..................................................................................................... 51
4.0 References & Bibliography .................................................. 52
4.1 References..................................................................................................... 52
4.2 Bibliography .................................................................................................. 55

©OGP
RADD – Human factors in QRA

Abbreviations:
ALARP As Low As Reasonably Practicable
APJ Absolute Probability Judgement
COMAH Control of Major Accident Hazard regulations
CREE The Centre for Registration of European Ergonomists
CREAM Comprehensive Risk Evaluation And Management
DNV Det Norske Veritas
EEM External Error Modes
ETA Event Tree Analysis
FMEA Failure Modes and Effect Analysis
FTA Fault Tree Analysis
HAZOP Hazard and Operability study
HAZID Hazard Identification
HCI Human Computer Interaction
HEA Human Error Assessment
HEART Human Error Analysis and Reduction Technique
HEI Human Error Identification
HEP Human Error Rate Probability
HF Human Factors
HMI Human Machine Interface
HRA Human Reliability Assessment
HSC Health and Safety Commission
HSE Health and Safety Executive
HTA Hierarchical Task Analysis
LOC Loss of Containment
NORSOK The competitive standing of the Norwegian offshore sector
(Norsk sokkels konkurranseposisjon)
MAH Major Accident Hazards
OIM Offshore Installation Manager
OSHA Operational Safety Hazard Analysis
PA Public Address
PEM Psychological Error Mechanisms
PFEER Prevention of Fire, Explosion and Emergency Response
POS Point of Safety
PRA Probability Risk Assessment
PPE Personal Protective Equipment
PSA Probability Safety Assessment
PSF Performance Shaping Factors
PTW Permit to Work
QRA Quantitative Risk Assessment
RIDDOR Reporting of Injuries, Diseases and Dangerous Occurrences Regulations
SHARP Systematic Human Action Reliability Procedure
SHERPA Systematic Human Error Reduction and Prediction Approach
SMS Safety Management System
SRK Skill, Rule, Knowledge
SWIFT Structured What If Technique
THERP Technique for Human Error Rate Prediction
TR Temporary Refuge
UK United Kingdom

©OGP
RADD – Human factors in QRA

1.0 Scope and Definitions


1.1 Application
This report contains guidance material for Human Factors (HF) studies within the
various forms of risk and error assessment and analysis. It defines the terminology
used in such studies, and includes information on applicable legislation, guidelines and
standards; process descriptions and techniques.
In Safety, Health and Environment, Human Factors (also called ergonomics) is
concerned with "environmental, organisational and job factors, and human and
individual characteristics, which influence behaviour at work in a way which can affect
health and safety” [1]. As a multidisciplinary field involving psychology, physiology, and
engineering, among other disciplines, Human Factors is a broad subject. It is involved
in the design, development, operation and maintenance of systems in all industrial
sectors. This datasheet aims to provide the user with a greater awareness of Human
Factors theory and practice
It should be borne in mind that much of the material used in human factors is drawn
from a number of industry sources. Hence, for example human error rates are often
context specific (i.e. using data based upon error rates for control room operators it will
be necessary to determine if it requires some modification when considering error rates
in a different environment).
It is important to understand the processes that can be followed for Human Factors
since they often utilise a number of similar techniques. This datasheet outlines the
processes and makes reference to the techniques.
In Section 2.0, nine HF processes are described as follows:
1. Human Factors in Offshore Safety Cases
2. Human Factors in UK Onshore Safety Cases
3. Workload Assessment
4. Human Error Identification
5. Human Reliability Assessment
6. Human Factors in Loss of Containment Frequencies
7. Human Factors in the determination of event outcomes
8. Human Factors in the assessment of fatalities during escape & sheltering
9. Human Factors in the assessment of fatalities during evacuation, rescue and
recovery

1.2 Definitions and Terminology of HF


1.2.1 Definitions
‘Human Factors’ or ‘Ergonomics’ can be defined [2] as:
“that branch of science and technology that includes what is known and theorised about
human behavioural and biological characteristics that can be validly applied to the
specification, design, evaluation, operation, and maintenance of products and systems to
enhance safe, effective, and satisfying use by individuals, groups, and organisations”.

1 ©OGP
RADD – Human factors in QRA

Put simply, this means “designing for human use”. The user or operator is seen as a
central part of the system. Accident statistics from a wide variety of industries reveal
that Human Factors, whether in operation, supervision, training, maintenance, or
design, are the main cause of the vast majority of incidents and accidents.
Human Factors attempts to avoid such problems by fitting technology, jobs and
processes to people, and not vice versa. This involves the study of how people carry out
work-related tasks, particularly in relation to equipment and machines. When
considering the use of HF technology in safety-related systems, it is worth noting a
further Human Factors definition [1]:
“environmental, organisational and job factors, and human and individual characteristics, which
influence behaviour at work in a way which can affect health and safety”
Human Factors or ergonomics is generally considered to be an applied discipline that is
informed by fundamental research in a number of fields, notably psychology,
engineering, medicine (physiology and anatomy) and sociology.

1.2.2 Terminology
The term “Human Factors” has many synonyms and related terms. Most of these are
shown below, with explanation of key differences where generally agreed:
Ergonomics - the term ergonomics literally means “laws of work”. It is the traditional
term used in Europe, but is considered synonymous with “Human Factors”, a North
American-derived term. Some associate the term ergonomics more with physical
workplace assessment, but this is an arbitrary distinction. Other terms include Human
Engineering and Human Factors Engineering
Cognitive Ergonomics or Engineering Psychology - this is a branch of Human Factors or
ergonomics that emphasises the study of cognitive or mental aspects of work,
particularly those aspects involving high levels of human-machine interaction,
automation, decision-making, situation awareness, mental workload, and skill
acquisition and retention.
Human-Machine Interaction (HMI) or Human-Computer Interaction (HCI) – the applied study
of how people interact with machines or computers.
Working Environment - this emphasises the environmental and task factors that affect
task performance.

©OGP 2
RADD – Human factors in QRA

2.0 Human Factors Process Descriptions


2.1 Human Factors in Offshore Safety Cases
2.1.1 Rationale
The UK's Offshore Safety Case Regulations came into force in 1992. A ‘Safety Case’ is a
written document within which the company must demonstrate that an effective
management system is in place to control risks to workers and, in particular, to reduce
to a As Low As Reasonably Practicable (ALARP) the risks from a major accident. The
duty holder (owner or operator) of every offshore installation operating in British waters
is required to prepare a ‘Safety Case’ and submit it to the UK HSE Offshore Safety
Division for formal acceptance.
The main thrust of a Safety Case is a demonstration by the installation operator that the
risks to the installation from Major Accident Hazards (MAH) have been reduced to
ALARP. Traditionally the offshore industry has found it difficult to integrate Human
Factors into the Safety Cases. Although there is a requirement to address human factor
issues, the guidance has been unclear on how this should be achieved. A variety of
tools and techniques have been initiated by a legislative focus and these are used to
varying degrees by different operators.
There are two sections within Safety Cases that are of high importance, the Safety
Management System and Risk Assessment sections. Within these are a number of
factors that should be addressed in order to meet the legislative requirements of the
Safety Case.

2.1.2 Stages
The main part of the safety case which Human Factors issues are relevant to is the
Safety Management System (SMS). Within the SMS there are a number of areas that
should demonstrate the consideration of Human Factors issues. Areas include:

Human Reliability And Major Accident Hazards


The management system should demonstrate suitable methods for ensuring human
reliability and the control of major accident hazards. Offshore installation risk
assessments consist of both quantitative and qualitative components, considering the
following:
• Hazard Identification
• Assessment of Consequences
• Prevention, detection, control, mitigation, and emergency response.
Key approaches, both qualitative and qualitative, include HAZOPs and other Hazard
Identification (HAZID) techniques. HAZOP is an identification method designed
predominantly for the identification of hardware and people related hazards.
Engineering system HAZOPs are generally poor in their coverage of human factor
issues though this is mainly due to the knowledge and expertise of the participants and
the facilitator. Specific Human Factors and Procedural HAZOPs are available for use.
Structured What IF Technique (SWIFT) is an increasingly used technique for hazard
identification that is particularly good for examining organisational and Human Factors
issues.

3 ©OGP
RADD – Human factors in QRA

Workforce Involvement
A key component in the effectiveness of the management of installation MAHs is the
involvement of the workforce in the identification of MAHs and the development of
specific prevention, detection, control, mitigation and emergency response measures.
Involving the workforce helps to ‘buy-in’ support and ensure personnel are well
informed of changes. This is a key aspect required by the UK HSE when it decides on
the acceptance of the Safety Case and has been reinforced by changes in 2005 “By
involving the workforce, they become more familiar with how they manage their safety
in their day to day operations, enabling the safety case to be part of their daily
operations, achieving the objective of having a ‘live’ safety case.”

Incident and Accident Investigation


The RIDDOR regulations state that reporting of accidents and incidents is mandatory.
Efforts are being made to increase the reporting levels of near miss incidents [3].
Incident and accident investigation is a formal requirement within an effective safety
management system. It is one of the key tools for continuous improvement, a
requirement for demonstrating continuous safe operation and that risks are being
continuously driven to ALARP.

Safety Culture and Behavioural Safety (Observational Based Programs)


Many offshore installations now operate a behavioural safety programme within the
management system. Behavioural safety programmes may be a proprietary package or
developed in-house specifically for the operator’s organisation. A variety of behavioural
safety programmes are available and are designed to improve the safety culture of the
organisation [4].
There are also methods and proprietary packages for the assessment and monitoring of
an organisation's safety culture and climate.

Emergency Response
The safety management system should make consideration of the following areas of
emergency response:
• Emergency egress and mustering i.e. consideration of the route layout, alarm
sounding etc in relation to various foreseeable accident scenarios.
• Evacuation and rescue modelling. This is vital for identifying the weakness /
effectiveness of procedures
• Demonstration of a good prospect of rescue and recovery in accordance with the
Prevention of Fire, Explosion and Emergency Response (PFEER) regulations.
• Emergency training and crisis management, i.e. regular drills are held offshore on a
weekly basis.
• Survival Training. This is given to all offshore personnel and is refreshed on a
regular basis, the intervals being defined by age scales.

Work Design
The inclusion and consideration of personnel’s working arrangement is an important
part of the Safety Case. It can impact heavily upon the working performance and safety
behaviours of personnel. Current research is looking into the implications of shift work
on safety behaviours [5].

©OGP 4
RADD – Human factors in QRA

Of further importance is the handover process by personnel between shifts.

Workload and Manning Levels


Efforts have been made to reduce manning levels on installations to a safe operational
minimum. Various methods are available to enable risk assessment of these manning
levels (see Section 2.3).

Permit to Work Systems


The UK HSE and the Norwegian Oil Industry Association (OLF) have published guidance
for onshore and offshore activities [6], [7].

Working Environment
Key working environment issues offshore include lighting, access for maintenance and
operation, noise, vibration and exposure to weather. All of these affect the operator’s
ability to work effectively. The UK HSE is currently reviewing legislative requirements to
bring them in line with the Norwegian NORSOK standards.

Training and Competency Assurance


Training and competency assurance is increasingly being recognised as a vital human
factors issue. Demonstration of personnel training and competency is a requirement
within the safety management system. Training needs of personnel should be identified
and competency demonstrated and verified by an appropriate authority [8].
In addition to the demonstration that an effective safety management system is in place,
the Safety Case should demonstrate that the major accident hazards on the installation
have been identified and controlled. This can be demonstrated through the use of Safety
Critical Task Analysis in addition to complementary methods of analysis such as
Quantified Risk Assessment, HAZOPs and HAZID techniques.

2.2 Human Factors in UK Onshore Safety Cases


2.2.1 Rationale
It is generally understood that virtually all major accidents include Human Factors
among the root causes and that prevention of major accidents depends upon human
reliability at all onshore sites, no matter how automated.
Assessment is a team process; it is important that the team members do not examine
their topic in isolation, but in the context of an overall ALARP demonstration.

2.2.2 Stages
2.2.2.1 Identify potential for human failures
The COMAH safety report needs to show that measures taken and SMS are built upon a
real understanding of the potential part that human reliability or failure can play in
initiating, preventing, controlling, mitigating and responding to major accidents.
Occasionally quantitative human reliability data is quoted: this should be treated with
caution. Local factors make considerable impacts so generic data, if used, must be
accompanied by an explanation as to why it is applicable for the site.

5 ©OGP
RADD – Human factors in QRA

2.2.2.2 Choosing and justifying the measures


Few COMAH safety reports justify or explain how the choice is made between functions
that are automatic and those that are manual. Yet this can be key to showing that all
necessary measures are in place or that risks are ALARP, following principles of
inherent safety.
There should not be over reliance on training and procedures in place of reasonably
practical physical measures.

2.2.2.3 Implementing control measures


Once the potential human contribution has been identified, this should be reflected in
the choice and design of measures in place. All sites rely to a degree on compliance
with procedures. Yet many sites have areas of ineffective compliance rates and few, if
any, will ever reach 100%. Therefore regular reviews should be conducted of safety
critical procedures.

2.2.2.4 Management assurance


The main functions of a safety management system are to bring consistency and
discipline to the necessary measures by means of a quality assurance system by
maintaining good industry practice (which under pins the ALARP argument). This is
done by completing documentation, audit and control; and to ensure continuous
improvements towards ALARP by means of capturing lessons learned and setting and
meeting appropriate targets in relation to the major accident hazard.
The UK HSE has funded research into creating a model that allowed the easy integration
of HF issues into the identification of major chemical hazards, safety management
systems for managing those hazards and related organisational issues. Although, the
research for this model is based on onshore industries, the principles within it could
also be applied to the offshore industry. This model was trialled in a workshop with UK
HSE specialists from a broad range of industries. The feedback was both positive and
negative with a summary being that the model was usable but required packaging
differently so that it could be more easily understood and applied by a wider audience
[9].

2.3 Workload Assessment


2.3.1 Rationale
The construct of workload has no universally acceptable definition. Stein [10] uses the
following definition:
“The experience of workload is based on the amount of effort, both physical and psychological,
expended in response to system demands (task load) and also in accordance with the
operator’s internal standard of performance.” (p. 157).
Put simply, workload problems occur where a person has more things to do than can be
reasonably coped with. Workload can be experienced as either mental, or physical, or
both, and will be associated with various factors, such as:
• Time spent on tasks.
• Number, type (e.g. manual, visual), and combination of tasks.

©OGP 6
RADD – Human factors in QRA

• Task pacing and scheduling.


• Operator experience, state, and perceptions.
• Environmental factors (e.g. noise, temperature).
• Time, in relation to work-sleep cycle.
Problems with workload can occur when workload is too high (overload) or too low
(underload). Some examples of causes of workload are shown in Table 2.1.

Table 2.1 Som e Exam ples of Causes of Excessive and Insufficient


W orkload

EXCESSIVE W ORKLOAD INSUFFICIENT W ORKLOA D


Rapid task scheduling (e.g. excessive task Slow or intermittent task scheduling (e.g.
cycle times). downtime).
Signals occurring too rapidly, particularly in Signals occurring infrequently (e.g.
the same sensory modality (e.g. several visual monitoring a radar display in an area of very
alarms presented at the same time). low activity).
Unfamiliarity or lack of skill (e.g. a trainee Excessive skill relative to job (e.g. a highly
operator keeping up with a fast production skilled operator packing boxes).
line).
Complexity of information (e.g. an air traffic Monotonous or highly predictable
controller dealing with traffic at various information
speeds, directions, at flight levels).
Personal factors (e.g. emotional stress).

At the upper limits of human performance, excessive workload may result in poor task
performance and operator stress. Underload, may be experienced as boredom, with
associated distraction. Both may result in ‘human error’ - failing to perform part of a
task, or performing it incorrectly.
Workload assessment may be used as part of the investigation of several problems,
such as:
• Manning requirements and de-manning.
• Shift organisation.
• Information and HMI design.
• Job design.
• Team design.

2.3.2 Stages
2.3.2.1 Problem definition
First determine whether the problem is one of excessive or insufficient task load, and
whether the workload is primarily physical or mental. Then investigate, by discussing
with operators and supervisors, the source of the workload problem, e.g.:
• Manning arrangements - too many or too few operators will cause workload
problems.

7 ©OGP
RADD – Human factors in QRA

• Shift organisation - poor shift organisation can result in manning problems, but may
have other effects such as fatigue, which will have further effects on workload.
• Information and HMI design - problems with information display (e.g. too much,
poorly organised, badly designed, etc.) can overload the operator.
• Job design - poor task scheduling or organisation can lead to under- or overload.
• Team design and supervision - poor team design and supervision may result in
some operators being overloaded or underloaded.
• Competing Initiatives – Competition between teams can be good for productivity but
can also lead to an increase in operator workload as more tries to be carried out in
the same period of time.
• Unreliable hardware – If machinery is constantly failing then maintainers and
operators will have to work harder to achieve a reasonable level of performance.

2.3.2.2 Collection of background information


Important background information may include:
• Number of operators (and number affected by workload problem).
• Operator availability (particularly for safety-critical tasks).
• Cover arrangements for sickness, holiday/vacation, training, etc.
• Team design.
• Approximate percentages of time operators spend on different tasks.
• Extraneous operator duties (e.g. fire crew, first aid, forklift truck driver, etc.).
• Shift pattern/working hours.
• Overtime arrangements.
• Management and supervision (level of supervisor).
• Previous incidents associated with workload.
• Environmental and physiological information (heat, etc).

2.3.2.3 Selection and application of assessment method


The assessment method required will depend upon the source of the workload problem:
• Manning arrangements
• Shift organisation
• Information and Human-Machine Interface (HMI) design
• Job design (see Human Error Identification)
• Team design and supervision
In addition, a number of other more direct measures of workload are available. These
can be divided into the following categories:
• Primary task performance - indicates the extent to which the operator is able to
perform the principal work mission (e.g. production to schedule). These types of
measures can be difficult to implement and have little sensitivity when highlighting
problem areas.

©OGP 8
RADD – Human factors in QRA

• Secondary task performance - these measures involve the operator performing two
tasks, a primary and a secondary task. Both tasks are measured, but depending on
the purpose and scope of the task, either the primary or secondary task is given
priority. Errors or performance decrements may be measured. These techniques are
generally only suited to simulated or experimental settings.
• Physiological and psycho-physiological techniques - these techniques measure a
physiological function, and in the case of mental workload, one that is known to
have some relationship with psychological functions. Examples include respiratory
activity (physical workload), cardiac activity (mental and physical workload), brain
activity (mental workload), and eye activity (mental workload). Again, these
measures generally require a base-line (or control) for that participant to be recorded
so that the ‘delta’ as a result of that variable can be established.
• Subjective assessment techniques - these techniques provide an estimate of workload
based on judgement, usually by the person undertaking the task.
• Task analytic techniques - these techniques aim to predict mental workload at an
earlier stage of the system life-cycle, using task analysis and time-line analysis. The
rationale is that the more time is spent on tasks, especially overlapping or
concurrent ones, the greater the workload. The approaches assume that mental
resources must be limited and use various models of mental workload. These
techniques can also be used to highlight simple workload conflicts such as an
operator not being in the location of an alarm when necessary.
In practical settings, the main techniques for workload assessment are subjective and
analysis specific tasks or sub-tasks. Some examples of these techniques are shown in
Table 2.2. These are mainly intended for the assessment of mental workload, but must
involve some physical component.
However, they are not suitable for purely physical tasks (e.g. assessing physical
fatigue). Also, most were developed for the aviation industry, but may be adapted fairly
easily for other industries.

Table 2.2 Som e Subjective and Task Analytic W orkload Assessm ent
Techniques

TYPE / METHOD DESCRIPTION


Subjective Techniques
Uni-dimensional rating Assess workload along a single dimension with a verbal
scales descriptor (e.g. Workload), with a scale (e.g. ‘Low’ to ‘High’).
10cm line Workload is simply rated on a scale from 1 to 10.
Modified Cooper- Scale developed for use with pilots, with scale descriptors of
Harper Scale mental effort.
Bedford Rating Scale Developed from the Modified Cooper-Harper Scale.
Descriptors make reference to spare mental capacity.
Multi-dimensional Assess the different factors that are thought to contribute to
Rating Scales workload. More diagnostic than uni-dimensional scales.
NASA-TLX Assesses six dimensions: mental demand, physical demand,
temporal demand, performance, effort, and frustration.
Ratings are made on a scale from 1 to 20, then the
dimensions are weighted using a paired comparisons
technique. The weighted ratings can be summed to provide
an overall score.

9 ©OGP
RADD – Human factors in QRA

TYPE / METHOD DESCRIPTION


General General questionnaires can be developed and applied, or
Questionnaires and interviews can be conducted, to ask about specific aspects
Interviews of workload, e.g. how much, when, who, why, etc.
Instantaneous Measures that can ‘track’ workload over a time period,
Assessment allowing investigation of workload peaks and troughs.
Instantaneous Self Workload is rated at specific intervals on a scale of 1 (under-
Assessment (ISA) utilised) to 5 (excessive). The operator presses one of five
buttons every two minutes, when signalled by a flashing
light. The results for all operators are fed to a computer
terminal for observation.
C-SAW The operator watches a video replay of the task and applies a
rating on a scale of 1 to 10 using the Bedford Scale.
Task Analytic Techniques
Timeline analysis Timeline analysis is a general; task analysis technique that
maps operator tasks along the time dimension, taking
account of frequency and duration, and interactions with
other task and personnel. This method is most suited to
tasks that are consistently structured (in terms of task steps,
durations, frequency, etc), with little variation in how they are
performed. Workload can be rated in retrospect (by an
expert) on a 5- or 6- point scale from 0% to 100%.
Timeline Analysis and A timeline analysis is conducted for observable tasks and
Prediction (TLAP) their durations. The tasks are assumed to have different
channels: vision (looking); audition (listening); hands
(manipulating by hand); feet (using feet); and cognition
(thinking). By observing and listening to the operator, an
estimate can be made of the amount of time required for each
task.
Visual, Auditory, This uses experience subject matter experts to rate a variety
Cognitive, of tasks between 0 (no demand) to 7 (highest demand) to the
Psychomotor following workload channels: visual; auditory; cognitive and
psychomotor (movement). The demand on the channels is
summed to give a score, and a scope is available for
‘excessive workload’.
Workload Index W/INDEX is based on Wickens’ Multiple Resource Theory,
(W/INDEX) which describes humans as fixed capacity information
processors with access to different pools of resources. Six
channels are used: visual, auditory, spatial cognition, verbal
cognition, manual response, and voice response. W/INDEX
also tries to weight the interference between channels (e.g.
speaking and listening to speech at the same time).
Micro-SAINT Micro-SAINT is a computer simulation that simulates the
operator activities in responding to events.

Sometimes, techniques may be used with the entire population of operators affected. At
other times, it may be necessary to apply the technique on a sample of operators. This
will depend on the scope of the project, and the number of operators affected by the
workload problem. It may be sensible to employ more than one technique.

©OGP 10
RADD – Human factors in QRA

2.3.2.4 Workload smoothing


If workload is excessive or insufficient, it may be necessary to redesign the task, job, or
equipment, or re-organise the shift pattern, manning arrangements, etc. A sample of
operators should be involved in this process.

2.4 Human Error Identification


2.4.1 Rationale
Human Error Identification (HEI) is a generic term for a set of analytical techniques that
aim to predict and classify the types of human errors that can occur within a system so
that more effective and safer systems can be developed. HEI can be either a standalone
process or part of a wider Human Reliability Assessment (HRA) (see Section 2.5).
The concept of human error is at the heart of HRA and HEI. Reason [11] defines human
error as:
“a generic term to encompass all those occasions in which a planned sequence of mental or
physical activities fails to achieve its intended outcome, and when these failures cannot be
attributed to the intervention of some chance agency” (p.9).
HEI provides a comprehensive account of potential errors, which may be frequent or
rare, from simple errors in selecting switches to ‘cognitive errors’ of problem-solving
and decision-making.
Some errors will be foreseen or ‘predicted’ informally during system development, but
many will not. It is often then left to the operators to detect and recover from these
errors, or automated systems to mitigate them. HEI can be a difficult task because
humans have a vast repertoire of responses. However, a limited number of error forms
occur in accident sequences, and many are predictable. HEI is an important part of HRA
because errors that have not been identified cannot be quantified, and might not be
addressed at all. Kirwan [12] considers that HEI is at least as critical to assessing risk
accurately as the quantification of error likelihoods. HEI can also identify the
Performance Shaping Factors (PSFs), which may be used in the quantification stage,
and will be necessary for error reduction.
HEI can be used for various types of error such as [13]:
• Maintenance testing errors affecting system availability.
• Operating errors initiating the event/incident.
• Errors during recovery actions by which operators can terminate the event/incident.
• Errors which can prolong or aggravate the situation.
• Errors during actions by which operators can restore initially unavailable equipment
and systems.
Two models of human error underlie most techniques. The first is Rasmussen’s [14]
‘skill’, ‘rule’ and ‘knowledge’ (SRK) based performance distinction. The majority of
physical, communication or procedural errors are ‘skill' or ‘rule' based whilst the
majority of ‘cognitive’ errors of planning and decision-making are ‘knowledge-based’.
The second model is Reason’s [11] distinction of slips, lapses and mistakes. Slips and
lapses are:
'errors resulting from some failure in the execution and/or storage stage of an action sequence,
regardless of whether or not the plan which guided them was adequate to achieve its
objective'.

11 ©OGP
RADD – Human factors in QRA

Slips are associated with faulty action execution, where actions do not proceed as
planned. Lapses are associated with failures of memory. These errors tend to occur
during the performance of fairly ‘automatic’ or routine tasks in familiar surroundings,
and attention is captured by something other than the task in hand. Examples include
misreading a display, forgetting to press a switch, or accidentally batching the wrong
amount to a batch counter.
Reason [11] also defines mistakes as:
'deficiencies in the judgmental and/or inferential processes involved in the selection of an
objective or in the specification of the means to achieve it, irrespective of whether or not the
actions directed by this decision-scheme run according to plan'.
So intended actions may proceed as planned, but fail to achieve their intended outcome.
Mistakes are difficult to detect and likely to be more subtle, more complex, and more
dangerous than slips. Detection may rely on intervention by someone else, or the
emergence of unwanted consequences. Examples include misdiagnosing the
interaction between various process variables and then carrying out incorrect actions.
Violations are situations where operators deliberately carry out actions that are contrary
to organisational rules and safe operating procedures.

2.4.2 Stages
The first task is to determine the scope of the HEI, including:
• Is it a standalone HEI or HRA study?
• What are the types of tasks and errors to be studied?
• What is the stage of system development?
• Are there any existing HEIs or task analyses?
• What is the level of detail required?

2.4.2.1 Task analysis


HEI requires a thorough analysis of the task. This is because each stage of the task, and
the sequence and conditions in which sub-tasks are performed, must be described
before potential errors at each stage can be identified. ‘Task analysis’ covers a range of
techniques for the study of what an operator is required to do to achieve a system goal.
The most widely used method is called ‘Hierarchical Task Analysis’ or HTA. This
produces a numbered hierarchy of tasks and sub-tasks, usually represented in a tree
diagram format, but may also be represented in a tabular format. It will be necessary to
decide the level of resolution or detail required. In some cases, button presses,
keystrokes etc may need to be described, in other cases, description may be at the task
level. An operator may need to be involved in the study. Once a task analysis has been
developed, HEI can take place.

2.4.2.2 Human Error Identification Worksheet


A typical HEI worksheet may include the following information:
• Task Step - this may be at button-press/key-stoke level or task level depending on
the detail required.
• External Error Modes (EEM) - the external failure keywords.

©OGP 12
RADD – Human factors in QRA

• Psychological Error Mechanisms (PEM) - underlying psychological process producing


the error.
• Causes and Consequences.
• Safeguards and Recovery - automated safeguards and potential human recovery
actions.
• Recommendations - in terms of procedures, equipment, training, etc.

2.4.2.3 Screening
It is then necessary to comb through the HEI worksheets to find errors that are not
adequately protected against by safe guards. In particular, where there are no
technological safeguards and human recovery is required (especially the same
operator), then such errors should be taken further forward for analysis (qualitative or
quantitative).

2.4.2.4 Human Error Reduction


Human error reduction strategies or recommendations may be required where the
safeguards in place are not adequate in light of the risk of human error.
Recommendations may be made during the HEI or during the HRA itself, so this stage
may involve reviewing such recommendations in light of the screening exercise. Human
Factors should be considered during the implementation of solutions, and any
recommendations should be considered in an integrated fashion, taking into account
the context of the working environment and organisation. Kirwan [15] notes four types
of error reduction:
• Prevention by hardware or software changes - e.g. interlocks, automation.
• Increase system tolerance - e.g. flexibility or self-correction to allow variability in
operator inputs.
• Enhance error recovery - e.g. improved feedback, checking, supervision, automatic
monitoring.
• Error reduction at source - e.g. training, procedures, interface and equipment
design.
Typically, error reduction might focus on the following:
• Workplace design and Human Machine Interface
• Equipment design
• Ambient environment
• Job design
• Procedures
• Training
• Communication
• Team work
• Supervision and monitoring
Often, error reduction strategies are not as effective as envisaged, due to inadequate
implementation, a misinterpretation of measures, side-effects of measures (e.g.

13 ©OGP
RADD – Human factors in QRA

operators removing interlocks), or acclimatisation to measures (especially if


motivational). Hence, the efficacy of measures should be monitored.

2.4.2.5 Documentation and Quality Assurance


Results and methods are documented such that they are auditable. The rationale and all
assumptions should be made clear. This is important for error reduction strategies to
ensure that they remain effective and that the error reduction potential is realised and
maintained.
Ensure that the worksheets are reviewed by any operators involved. It is also useful to
involve an independent auditor. HEI can become too reliant on the individual analyst,
which can result in biases where the analyst loses sight of interactions, becomes too
focused on detail, and the analysis becomes repetitive and routine. An external auditor
(i.e. a second, independent assessor) can prevent this.

2.4.3 Techniques
A number of HEI techniques have been developed. Most existing techniques are either
generic error classification systems or are specific to the nuclear and process
industries, or aviation. These techniques range from simple lists of error types, to
classification systems based around a model of how the operator performs the task.
Some of the most popular techniques for Human Error Identification are:
• Systematic Human Error Reduction and Prediction Process-SHERPA
• Comprehensive Risk Evaluation And Management - CREAM
• Human Factors Structured What IF Technique - SWIFT
• Human Hazard and Operability Study - HAZOP
• Human Failure Modes and Effects Analysis - FMEA
2.5 Human Reliability Assessment
2.5.1 Rationale
Human error has been seen as a key factor associated with almost every major
accident, with catastrophic consequences to people, property and the environment.
Accidents with major human contributions are not limited to any particular parts of the
world, or any particular industry, and include the Aberfan mining disaster (1966), the
Bhopal chemical release (1984), the Chernobyl melt-down and radioactivity release
(1986), the Piper Alpha platform explosion (1988) and the Kegworth air disaster (1989).
The study of human error was given a major spur by the Three Mile Island accident
(1979).
Human Reliability Assessment (HRA) can be defined as a method to assess the impact
of potential human errors on the proper functioning of a system composed of
equipment and people. HRA emerged in the 1950s as an input to Probabilistic Safety (or
Risk) Assessments (PSA or PRA). HRA provided a rigorous and systematic
identification and probabilistic quantification of undesired system consequences
resulting from human unreliability that could result from the operation of a system. HRA
developed into a hybrid discipline, involving reliability engineers, ergonomists and
psychologists.
The concept of human error is at the heart of HRA. Reason [11] defines human error as:

©OGP 14
RADD – Human factors in QRA

“a generic term to encompass all those occasions in which a planned sequence of mental or
physical activities fails to achieve its intended outcome, and when these failures cannot be
attributed to the intervention of some chance agency” (p. 9).
It is necessary to understand several aspects of the socio-technical system in order to
perform a HRA. First, an understanding of the engineering of the system is required so
that system interaction can be explored in terms of error potential and error impact.
Second, HRA requires an appreciation of the nature of human error, in terms of
underlying Psychological Error Mechanisms (PEMs) as well as Human Factors issues
(called Performance Shaping Factors, PSFs) that affect performance. Third, if the HRA is
part of a PSA, reliability and risk estimation methods must be appreciated so that HRA
can be integrated into the system’s risk assessment as a whole.
A focus on quantification emerged due to the need for HRA to fit into the probabilistic
framework of risk assessments, which define the consequences and probabilities of
accidents associated with systems, and compare the output to regulatory criteria for
that industry. If the risks are deemed unacceptable, they must be reduced or the system
will be cancelled or shut down. Indeed, most HRAs are nowadays PSA-driven Human
error quantification techniques which use combinations of expert judgement and
database material to make a quantified assessment of human unreliability in situations
where the actual probability of error may be small but where the consequences could be
catastrophic and expensive.

2.5.2 Stages
The HRA approach has qualitative and quantitative components, and the following can
be seen as the three primary functions of HRA:
• Human Error Identification
• Human Error Quantification
• Human Error Reduction.
The qualitative parts of HRA are the identification or prediction of errors (along with the
preceding task analyses), the identification of any related PSFs such as poor
procedures, system feedback, or training, and the subsequent selection of measures to
control or reduce their prevalence. The quantitative part of HRA includes the estimation
of time-dependent and time-independent human error probabilities (HEPs) and the
estimation of the consequences of each error on system integrity and performance.
These estimations are based on human performance data, human performance models,
analytical methods, and expert judgement, described in more detail below.
There are 10 stages to HRA [15]:
1. Problem Definition.
2. Task Analysis.
3. Human Error Identification.
4. Human Error Representation.
5. Screening.
6. Human Error Quantification.
7. Impact Assessment.
8. Human Error Reduction.

15 ©OGP
RADD – Human factors in QRA

9. Quality Assurance.
10. Documentation.

2.5.2.1 Problem Definition


Determine the scope of the HRA, including:
• Is it a standalone or PSA driven assessment?
• What are the types of scenarios, tasks (operation, maintenance, etc.) and errors to
be studied?
• What is the stage of system development?
• What are the system goals for which operator actions are required, and how do
safety goals fit in?
• Is quantification is required - absolute or relative?
• What is the level of detail required?
• What are the risk assessment criteria (e.g. deaths, damage)?
• Are there any existing HRAs (including HEIs and task analysis)?
This will require discussions with system design and plant engineers, and operational
and managerial personnel. The problem definition may shift with respect to above
questions as the assessment proceeds (e.g. the identification of new scenarios).

2.5.2.2 Task analysis


Task analysis is required to provide a complete and comprehensive description of the
tasks that have to be assessed. Several methods may be used, such as Hierarchical
Task Analysis or Tabular Task Analysis. The main methods of obtaining information for
the task analysis are observation, interviews, walk-throughs, and examination of
procedures, system documentation, training material. For a proceduralised task, HTA is
probably most appropriate. Operational personnel should verify the task analysis
throughout if possible.

2.5.2.3 Human Error Identification


Human Error Identification (HEI) is a generic term for a set of analytical techniques that
aim to predict and classify the types of human errors that can occur within a system so
that more effective and safer systems can be developed (see Section 2.4).

2.5.2.4 Human Error Representation


Representation allows the assessor to evaluate the importance of each error, and to
combine risk probabilities of failures (hardware, software, human, and environmental).
The main representation techniques used in HRA are Fault Tree Analysis (FTA) and
Event Tree Analysis (ETA). These:
• enable the use of mathematical formula to calculate all significant combinations of
failures
• calculate the probabilities
• indicate the degree of importance of each event to system risk and

©OGP 16
RADD – Human factors in QRA

• allow cost-benefit analysis.


FTA is a logical structure that defines what events must occur for an undesirable event
to occur. The undesirable event is usually placed at the top of the FTA. Typically two
types of gates are used to show how events at one level can proceed to the next level
up but others do exist. The typical types of gates are:
• OR gate - the event above this occurs if any one of the events joined below this gate
occurs.
• AND gate - the event above this occurs if all of the events joined below this gate
occur.
FTA can be used for simple or complex failure paths, comprising human errors alone or
a mixture of hardware, software, human, and/or environmental events. The structured
events can be quantified, thus deriving a top event frequency. FTA is a good way of
incorporating Human Errors that act as contributors to initiating events in the reliability
assessment. One issue of consideration is the level of component data that is available
(e.g. failure to perform a single action or as a result of the failure to carry out a task).
ETA proceeds from an initiating event typically at the left-hand side of the tree, to
consider a set of sequential events, each of which may or may not occur. This results
normally in binary branches at each node, which continue until an end state of success
or failure in safety terms is reached for each branch. ETA is a good way of representing
the reliability of human actions as a response to an event, particularly where human
performance is dependent upon previous actions or events in the scenario sequence.
This is primarily because ETA represents a time sequence and most operator responses
are based on a sequence of actions that usually have to be carried out in a pre-defined
sequence.
Within both FTA and ETA it is important to recognise the potential of the human to be a
cause of dependent failure. This can either be through the fact that failure to carry out an
initial part of the task influences the probability of succeeding in the remainder of the
task, or that the same error is made when performing the task more than once. A good
example of the potential for dependent failure to occur would be the faulty maintenance
of redundant trains of equipment or miscalibration of multiple sets of instruments being
carried out by the same team. Such errors must not be treated independently, since
underestimation will result. Dependency is generally associated with mistakes rather
than slips. Additionally poor procedures or working practices can also be a frequent
cause of dependent failures.

2.5.2.5 Screening
Screening analysis identifies where the major effort in the quantification effort should be
applied, i.e. those that make the greatest contribution to system risk. In general terms, it
is usually easier to quantify error which refers to the failure to perform a single action.
However it is also unusual to have sufficient resource to, for example, identify all the
potential modes of maintenance error. Therefore a balance must be struck between the
level of modelling and the criticality of the failure. The Systematic Human Action Reliability
Procedure (SHARP) defines three methods of screening logically structured human
errors:
I. Screening out human errors that could only affect system goals if they occur in
conjunction with an extremely unlikely hardware failure or environmental event.
II. Screening out human errors that would have negligible consequences on system
goals.

17 ©OGP
RADD – Human factors in QRA

III. Assigning broad probabilities to the human errors based on a simple


categorisation, e.g. as given in Table 2.3.

Table 2.3 Generic Hum an Error Probabilities [15]

CATEGORY FAILURE
PROBABILITY
-3
Simple, frequently performed task, minimal stress 10
-2
More complex task, less time variable, some care necessary 10
-1
Complex unfamiliar task, with little feedback, and some 10
distractions
-1
Highly complex task, considerable stress, little performance 3 ×  10
time
0
Extreme Stress, rarely performed task 10 (= 1)

Note: Table 2.7 also contains some generic human error probabilities from a different source

2.5.2.6 Human Error Quantification


Human Error Quantification techniques quantify the Human Error Probability, defined as:

Human error quantification is perhaps the most developed phase of HRA, yet there is
relatively little objective data on human error. Some human error databases are now
becoming available [15], [16]. The use of expert judgement is therefore required with
some of the available techniques that use existing data, where it exists.
Most of the best tools available are in the public domain.

2.5.2.7 Impact Assessment


In order to consider impacts, the results of HRA can be:
• used as absolute probabilities and utilised within PSAs. It would be necessary to
demonstrate whether human error was a major contributor to inadequate system
performance, via analysis of the fault tree to determine the most important events.
Here, HEPs would be used in conjunction with system models to demonstrate that
the system meets acceptable criteria.
• used comparatively to compare alternative work systems to determine which
constitute the higher relative risk and therefore the higher priority for action.

2.5.2.8 Quality and Documentation Assurance


The HRA process must be documented clearly such that they are auditable. Rationale
and all assumptions should be clear, so that the study can be audited, reviewed (e.g. in
the case of a future accident), updated or replicated if necessary.

2.5.3 Techniques
Widely used and available techniques for HRA are:

©OGP 18
RADD – Human factors in QRA

• HEART (Human Error Assessment and Reduction Technique)


• THERP (Technique for Human Error Rate Prediction)
• APJ (Absolute Probability Judgement)

2.6 Human Factors in Loss of Containment Frequencies


2.6.1 Rationale
This section describes how Human Factors methods can be used to estimate the human
error component of loss of containment (LOC) frequencies.
According to some sources, the identification of management mechanisms which could
have prevented or recovered unsafe conditions leading to Loss of Containment
accidents, indicates that some 90% of LOC accidents are preventable. However, before
an accident can be prevented the hazard associated with it needs to be identified and
mitigated. These, accidents can be modelled and quantified by estimating the Human
Error rate and probability associated with the event. This in turn can be used to
determine whether the mitigation is truly ALARP.

2.6.2 Stages
To be able to estimate the human error component of LOC, three activities that need to
take place:
1. The human errors need to be established that lead to the LOC
2. The probability of that error occurring needs to be calculated.
3. If there is more than one error, this needs to be combined correctly to provide an
accurate result.

2.6.2.1 Establishing the Human Errors


Before the errors can be assessed their cause and direct consequence need to be
established. This can be established systematically using Hierarchical Task Analysis, or
from expert opinion via a HAZID, HAZOP or OSHA.
These error and events can then be logged and verified as being valid before being
combined with the probability data.
Most people only consider operator errors when looking for the sources of error.
However, examination of major accidents shows management failures to often underlie
these errors in the following organisational areas [17]:
• Poor control of communication and coordination:
− between shifts;
− upward from front line personnel to higher management in the organisational
hierarchy and downward in terms of implementing safety policy and standards
throughout the line of management (particularly in a multi-tiered organisation);
− between different functional groups (e.g. between operations and maintenance,
between mechanical and electrical);
− between geographically separated groups;

19 ©OGP
RADD – Human factors in QRA

− in inter-organisational grouping (particularly where roles and responsibilities


overlap) such as in the use of sub-contractors, or in an operation which requires
the co-ordination of multiple groups within the same operational "space";
− in heeding warnings (which is one of the important manifestations of the above
where the indicators of latent failures within an organisation become lost or
buried).
• Inadequate control of pressures:
− in minimising group or social pressures
− in controlling the influence of workload and time pressures
− of production schedules
− of conflicting objectives (e.g. causing diversion of effort away from safety
considerations)
• Inadequacies in control of human and equipment resources:
− where there is sharing of resources (where different groups operate on the same
equipment), coupled with communication problems, e.g. lack of a permit-to-work
(PTW) system.
− where personnel competencies are inadequate for the job or there is a shortage
of staff
− particularly where means of communication are inadequate
− where equipment and information (e.g. at the man-machine or in support
documentation) are inadequate to do the job
• Rigidity in system norms such that systems do not exist to:
− adequately assess the effects and requirements of change (e.g. a novel situation
arises, new equipment is introduced)
− upgrade and implement procedures in the event of change
− ensure that the correct procedures are being implemented and followed
− intervene when assumptions made by front line personnel are at odds with the
status of the system
− control the informal learning processes which maintain organisational rigidity
These are types of failure which can be addressed in a Safety Management System
(SMS) audit to derive an evaluation of the management system.
Further work had been carried out to look at the effectiveness of these error
establishing processes. In a study of accidents [18], [19] in the chemical processing
industry sponsored by the UK Health and Safety Executive, around 1000 loss of
containment accidents from pipework and vessels from onshore chemical and
petrochemical plants were analysed, and the direct and underlying causes of failure
were assessed.
The underlying causes were defined in terms of a matrix which expressed (a) the activity
in which the key failure occurred, and (b) the preventive mechanism failure (i.e. what
management did not do to prevent or rectify the error). The preventive mechanisms are
described below.

Hazard study (of design or as-built)

©OGP 20
RADD – Human factors in QRA

Hazard studies of design, such as HAZard and OPerability studies (HAZOP), should
identify and determine design errors and potential operational or maintenance errors to
the extent they fall within the scope of the review. Some underlying causes of failure
will be recoverable at the as-built stage such as certain layout aspects or wrong
locations of equipment. Hazard study covers:
• inadequacies or failures in conducting an appropriate hazard study of design;
• failure to follow-up recommendations of the HAZOP or other hazard study.

Human Factors review


This category specifically refers to cases of failure to recover those underlying causes
of unsafe conditions which resulted in human errors within the operator or maintainer -
hardware system, including interfaces and procedures. These errors are of the type that
can be addressed with a Human Factors oriented review. The unrecovered errors will
be information processing or action errors in the following categories:
• failure to follow procedures due to poor procedural design, poor communication,
lack of detail in PTW, inadequate resources, inadequate training, etc.;
• recognition failures due to inadequate plant or equipment identification, or lack of
training, etc.;
• inability or difficulty in carrying out actions due to poor location or design of
controls.

Task Checking
Checks, inspections and tests after tasks that have been completed should identify
errors such as installing equipment at the wrong location or failure to check that a
system has been properly isolated as part of maintenance.

Routine Checking
The above are all routine activities in the sense that they are part of a vigilance system
on regular look-out for recoverable unsafe conditions in plant / process. These
activities may be similar to the task checking category activities but they are not task
driven. This category also includes failure to follow-up, given identification of an unsafe
condition as part of routine testing or inspection. Evidence for events that would be
included in this category would be:
• equipment in a state of disrepair;
• inadequate routine inspection and testing
The distribution of failures is shown in Table 2.4 and Table 2.5, and graphically in Figure
2.1. Human Factors aspects of maintenance and normal operations account for around
30% of LOC incidents (a similar proportion could have been prevented by a hazard
study of the design (by HAZOP, QRA etc.).
A study of 402 North Sea offshore industry release incidents, from a single operator,
indicates results consistent with those obtained for the onshore plant pipework study
[20].

21 ©OGP
RADD – Human factors in QRA

Figure 2.1 Contributions to Pipework Failures According to Underlying


Causes and Preventive Mechanism s [19]

Table 2.4 Distribution of direct causes of pipework and vessel failures


[18],[19][18]

Cause Of Failure % Of Known Causes


Pipework Vessels
Overpressure 20.5 45.2
Operator Error (direct) 30.9 24.5
Corrosion 15.6 6.3
Temperature 6.4 11.2
Impact 8.1 5.6
External Loading 5.0 2.6
Wrong Equipment/Location 6.7 1.9
Vibration 2.5 0
Erosion 1.3 0.2
Other 2.5 2.6

Table 2.5 Percentage Contribution of underlying causes to pipework (P)


(n=492) and vessel (V) failures (n=193)
(all unknown origins and unknown recovery failures rem oved) [19][18]

RECOVERY NOT HAZARDS HUMAN TASK ROUTINE TOTAL


MECHANISM RECOVER STUDY FACTORS CHECKIN CHECKIN
ABLE G G

©OGP 22
RADD – Human factors in QRA

Origin P V P V P V P V P V P V
Natural 1.8 0.5 0 0 0 0 0.2 0 0 0 2 0.5
causes
Design 0 0 25 29 2 0 0 0 0.2 0.5 27.2 29.5
Manufacture 0 0 0 0 0 0 2.5 0 0 0 2.5 0
Construction 0.1 0 0.2 0.3 2 0 7.6 1.8 0.2 0 10.1 2.1
Operations 0 0 0.1 5.4 11.3 24.5 1.6 2.1 0.2 0 13.2 32
Maintenance 0 0 0.4 2.1 14.8 5.7 13 3.6 10.5 10.8 38.7 22.2
Sabotage 1.2 1 0 0 0 0 0 0 0 0 1.2 1.0
Domino 4.6 11.9 0.2 0.3 0 0 0 0 0.3 0.5 5.1 12.7
Total 7.7 13.4 25.9 37.1 30.1 30.2 24.9 7.5 11.4 11.8 100 100

The key areas already mentioned for the control of loss of containment incidents, can
be listed as follows (in order of importance for preventing pipework failures):
• Hazard review of design
• Human Factors review of maintenance activities
• Supervision and checking of maintenance tasks
• Routine inspection and testing for maintenance
• Human Factors review of operations
• Supervision and checking of construction/installation work
• Hazard review (audit) of operations
• Supervision and checking of operations
Swain and Guttman [21] have identified a global set of action errors which are
developed in numerous sources on error identification. The following list from [22] can
be used:
• Error of omission: omission of required behaviour
• Error of commission: operation performed incorrectly (e.g. too much, too little),
wrong action, action out of sequence.
• Action not in time: failure to complete an action in time or performing it too late/too
early.
• Extraneous act: performing an action when there is no task demand.
• Error recovery failure: many errors can be recovered before they have a significant
consequence; failure to do this can itself be an error.

2.6.2.2 The Probability of the Error Occurring


Table 2.6 shows the results of research carried out to determine the split on causes of
LOC between the human and equipment failure.

Table 2.6 Split of causes for LOC s in differing industries

SOURCE DOMAIN % CAUSED BY % CAUSED BY REFERENCE


HUMAN EQUIP

23 ©OGP
RADD – Human factors in QRA

Generic LOC 40 60 [23]


Crane Accidents 55 45 [24],[25],[26],[27][28]
Chemical Process 60-90 40-10 [28]
Petrochemical 50 50 [28]

Furthermore, in a study of 402 offshore LOC incidents, 47% originated in maintenance,


30% originated in design, 15% in operations, and 8% in construction. Of the
maintenance failures, 65% were due to errors in performing maintenance and 35%
failure to carry out the required activity.
The data which identify the relative contribution of human and hardware failures are
useful for benchmarking in fault tree analysis. This serves as a comparison about
whether the analysis is giving results consistent with the historical data, which is
particularly important when human failure probabilities in fault trees are derived
primarily from expert judgement.

2.6.2.2.1 Example Human Error Rates


A simple guide to generic human error rates is contained in Table 2.7.

Table 2.7 Exam ple Generic Hum an Error Rates [29]

Error Type of behaviour Nominal human error


type probability (per
demand)
-5
1 Extraordinary errors of the type difficult to conceive how 10
they could occur: stress free, powerful cues initiating for
success.
-4
2 Error in regularly performed commonplace simple tasks 10
with minimum stress.
-3
3 Errors of commission such as operating the wrong but- 10
ton or reading the wrong display. More complex task,
less time available, some cues necessary.
-2
4 Errors of omission where dependence is placed on situ- 10
ation cues and memory. Complex, unfamiliar task with
little feedback and some distractions.
-1
5 Highly complex task, considerable stress, little time to 10
perform it.
-1
6 Process involving creative thinking, unfamiliar complex 10 to 1
operation where time is short, stress is high.
Note: Table 2.3 also contains some generic human error probabilities from a different source

2.6.2.2.2 Performance Shaping Factors


Although a great deal is known about the effects of different conditions on human
performance, their quantification in terms of the extent to which error likelihood is
affected is poorly researched. Human Reliability Assessment techniques often provide
a database of the effects of PSFs, and these are generally based on judgement. The
PSFs with the biggest influence, such as high stress or lack of training, are broadly
estimated to result in an order of magnitude increase in error likelihood. Other effects

©OGP 24
RADD – Human factors in QRA

relate to performance over time such as a decrease in the ability to remain vigilant over
long periods and hence detect changes in the environment.
Some data on the factors influencing the performance of an individual when carrying
out a task are shown in Table 2.8.

Table 2.8 M ultipliers for Perform ance Shaping Factors [30],[31] (Maxim um
predicted value by which unreliability m ight change going from "good"
conditions to "bad")

Error-Producing condition Multiplier


Unfamiliarity with a situation which is potentially important but which only 17
occurs infrequently or which is novel.
A shortage of time available for error detection and correction. 11
A low signal-noise ratio. 10
A means of suppressing or over-riding information or features which is too 9
easily accessible.
No means of conveying spatial and functional information to operators in a 8
form which they can readily assimilate.
A mismatch between an operator's model of the world and that imagined by a 8
designer.
No obvious means of reversing an unintended action. 8
A channel capacity overload particularly one caused by simultaneous 6
presentation of non-redundant information.
A need to unlearn a technique and apply one which requires the application of 6
an opposing philosophy.
The need to transfer specific knowledge from task to task without loss. 5.5
Ambiguity in the required performance standards. 5
A mismatch between perceived and real risk. 4
Poor, ambiguous or ill-matched system feedback. 4
No clear direct and timely confirmation of an intended action from the portion 4
of the systems over which control is to be exerted.
Operator inexperience (e.g. newly-qualified tradesman vs. "expert"). 3
An impoverished quality of information conveyed by procedures and 3
person/person interaction.
Little or no independent checking or testing of output 3
A conflict between immediate and long-term objectives. 2.5
No diversity of information input for veracity checks. 2.5
A mismatch between the educational achievement level of an individual and 2
the requirements of the task.
An incentive to use more dangerous procedures. 2
Little opportunity to exercise mind and body outside the immediate confines 1.8
of a job.
Unreliable instrumentation (enough that it is noticed). 1.6
A need for absolute judgements which are beyond the capabilities or 1.6
experience of an operator.
Unclear allocation of function and responsibility. 1.6
No obvious way to keep track of progress during an activity. 1.4
A danger that finite physical capabilities will be exceeded. 1.4

25 ©OGP
RADD – Human factors in QRA

Error-Producing condition Multiplier


Little or no intrinsic meaning in a task. 1.4
High-level emotional stress 1.3
Evidence of ill-health amongst operatives, especially fever. 1.2
Low workforce morale. 1.2
Inconsistency in meaning of displays and procedures. 1.2
A poor or hostile environment (below 75% of health or life-threatening 1.15
severity).
st
Prolonged inactivity or high repetitious cycling of low mental workload tasks 1.1 for 1
half-hour,
1.05 for
each hour
thereafter
Disruption of normal work-sleep cycles. 1.1
Task Pacing caused by the intervention of others. 1.06
Additional team members over and above those necessary to perform task 1.03
normally and satisfactorily. Multiply per man
Age of personnel performing perceptual task. 1.02

This is a mature and commonly used approach. It is relatively simple to follow and
there are a large number of generic data sources for HEPs. However, it is very
dependent upon the skill of the analyst in identifying opportunities for error. It usually
requires at least a two person specialist team, one for the equipment and one for the
human reliability identification, with some mutual understanding of the operation of the
human-technical system.

2.6.2.3 Overall result


Operator error is incorporated through identification of opportunities for error which
could lead to the initiation of an accident. The opportunities for error could include:
• directly causing an initiating event (e.g. leaving a valve open and starting a pump)
• failing to recover (identify and correct) a mechanical failure or operator error which
directly or indirectly could cause an initiating event (e.g. failure to identify a stuck
valve, fail to check procedure completed)
• indirectly causing an initiating event (e.g. a calculation error, installing the wrong
piece of equipment)
Figure 2.2 shows the overall structure of incorporating human error into FTA

OR

AND

©OGP 26
RADD – Human factors in QRA

Figure 2.2 Overall Structure of Incorporating Hum an Error into FTA

AND

To quantify this event so that the probability of the event occurring can be established,
the human error scores or the probability values, along with the performance shaping
factors need to be added to the stages within the FTA. These scores, when combined
together will give a overall likelihood of the event occurring.
Note that the term "operator error" is frequently used to cover all cases of front line
human error such as in maintenance, operations, task supervision, and start-stop
decisions. When identifying opportunities for error, it is usual to express each error as
an external (observable) mode of failure, such as an action error (E.g. doing something
incorrectly). This is preferable to using internal modes of failure (E.g. short term
memory failure).
There is a tendency to overestimate human error probabilities relative to the hardware
failure estimates. One reason is that human error recovery mechanisms are often
forgotten. For example, a maintenance error could be recovered by checking by the
supervisor. This means that in FTA, many human errors should have an AND gate with
error recovery failure. The latter would be 1 if there is no opportunity for error recovery.
For a well designed error management system, the practice is to use an error recovery
failure probability of 10-2.
The data provide a statistical model which has been used as a basis for factoring
Generic LOC data using a Modification of Risk Factor derived from an assessment of
the quality of Safety Management. The modification factor for generic failure rates
ranges between 0.1 and 100 for good and poor management respectively [32], but more
typically between 0.5 and 10 in practice.

2.6.3 Techniques
To complete this task of predicting LOC the following techniques could be used as a set
or individually:
• Hierarchical Task Analysis
• Human Error Assessment and Reduction Technique
• Fault Tree Analysis

27 ©OGP
RADD – Human factors in QRA

And supported by:


• HAZIDs
• HAZOPs
• OSHAs

2.7 Human Factors in the determination of event outcomes


2.7.1 Rationale
Event outcome modelling is normally concerned with mitigation and escalation of an
initiating event. The outcome of events can be dependent on operator intervention,
either because the operator is required to perform a primary role, or because the
operator must rectify failures of automatic systems, e.g. if an automatic system fails or
an operator is aware of the event prior to automatic detection.
There are two approaches to event modelling. The first focuses purely on the activities,
errors or lapses that need to occur for the top event to occur. The second adds the
element of time into the equation so that scenarios where the outcome is affected by
response or reaction time can still be accurately modelled.

2.7.2 Stages
Before the event tree can be established, the initiating event and the tasks below that
need to be established. In addition, three human factor issues need to be considered as
part of the event tree. These are:-
• Human detection and recognition of the incident
• Operator activation of an emergency system
• Operator application of a specific procedure
Furthermore, factors that could affect these are:
• reliability of an operator recognising an emergency situation (clarity of the alerting
signal and subsequent information)
• familiarity with the task
• increased stress due to perceived threat
Each of these factors are applicable to both the time related ETA and the non-time ETA.

2.7.2.1 Establishing the top level event


The initiating event can be established from a number of sources. These include:-
• Practical experience – if the analysis is being carried out on a currently operating
system
• HAZID, HAZOP or OSHA – where expert judgement is used to define the critical
events
• Task Analysis – where the primary tasks and outcomes can be established.

©OGP 28
RADD – Human factors in QRA

2.7.2.2 Event Tree Analysis


Once the initiating event has been established the event tree can be built around it. The
event tree is constructed by working thorough each of the possible actions that occur
after the initiating event to determine the likelihood of each outcome. Quantification can
be applied to the likelihood of an event occurring. The figures for this can come from a
number of sources including Fault Tree Analysis, Human Error Analysis, expert opinion
and user judgement. These figures are then multiplied together to give a likelihood
score for that end event occurring. The example in Figure 2.3 shows the consequences
of a rupture or leak in an unloading hose at a chemical plant. The contribution of the
human to the event tree could be added as an extra branch along the top of the tree.

Figure 2.3 An exam ple of an event tree

2.7.2.3 Simulating Human Contribution to Event Mitigation


This process differs from the first approach to event tree modelling by quantifying the
time taken to carry out that task. Therefore, a Task Analysis needs to be carried out to
define the steps taken during the event. To each of these tasks a time needs to be
allocated. These times can established either by observation of the task during trial
operational or during training runs. The captured times need to include reaction and
response times to actions as well as the time taken to actually perform the task. This
additional information can then be applied to the model to provide a time based
response to the top event. An example of the time allocation can be seen in Table 2.9.

Table 2.9 Exam ple tim es per task

Task Time taken


Recognise the incident 70 seconds
Request sufficient power to be available to operate the winches 10 seconds
Determine the direction to move the installation 20 seconds

29 ©OGP
RADD – Human factors in QRA

Operate the winches so as to slacken and reel in opposing winches 30 seconds


Recognise the failure to request sufficient power 30 seconds
Recognise that the wrong direction has been selected 120 seconds
Recognise that the winches have been operated in the wrong 80 seconds
combination

2.7.2.4 Modifiers
As with all Human Factors and human performance issues, the ability to carry out tasks
can be altered by the environment in which they occur. These are called modifiers and
can affect time to complete the task, the procedure selected and the likelihood of an
error occurring. Example modifiers are:
• The clarity of the signal. If the signal is clear, highly attention gaining, and very
difficult to confuse with any other type of signal (including a false alarm) and the
required action by an operator is do nothing more than acknowledge it, the
-4 -5
likelihood of an operator error is small (in the region of 10 to 10 per demand).
Increasing the complexity of warning signals, therefore requiring the operator to
interpret a pattern of signals, raises the likelihood of error. The effect of a "low
signal to noise ratio" (i.e. signal masked by competing signals, or of low strength in
terms of perceptibility) can increase the likelihood of misdiagnosis by up to a factor
of 10.
• False alarm frequency. Data on human behaviour in fires in buildings shows that
80% to 90% of people assume a fire alarm to be false in the first instance (see
Section 2.8.2.2.2).
• Operator fam iliarity with the task. Due to the low probability of emergency
events operators can have little familiarity with the tasks that they have to perform.
This results in an increased likelihood of error. Table 2.10 below shows the human
error probabilities (HEP) for rule based actions by control room personnel after
diagnosis of an abnormal event [21].

Table 2.10 The hum an error probabilities (HEP) for rule based actions by
control room personnel after diagnosis of an abnorm al event

Potential Errors Hum an Error


error factor
probability
Failure to perform rule-based actions correctly when written procedures are
available and used:
Errors per critical step with recovery factors 0.05 10
Errors per critical step without recovery factors 0.25 10
Failure to perform rule-based actions correctly when written procedures are not
available or used:
Errors per critical step with or without recovery factors 1.0 -

Stress can also effect how a person reacts and has been shown to increase the
likelihood of error. Example modifiers are provided in Table 2.11.

©OGP 30
RADD – Human factors in QRA

Table 2.11 Exam ple of Modifiers when Calculating Event Tree Probabilities

Stress Level Modifiers (Multipliers) of Nom inal


HEPs
Skilled Novice
Very low (Very low task load) 2 2
Optimum (Optimum task load):
Step-by-step task 1 1
Dynamic task 1 2
Moderately high (Heavy task load):
Step-by-step task 2 4
Dynamic task 5 10
Extremely High (Threat stress):
Step-by-step task 5 10
Diagnosis task Error probability = 0.25 Error probability = 0.5
(EF = 5) (EF = 5)

Furthermore, where an operator is to perform a number of tasks as part of a predefined


procedure the analyst must decide whether to apply the modifier to some or all of the
errors which may be made in following the procedure. It can be argued that the modifier
should be applied once (i.e. to the procedure as a whole) rather than to each error, since
the tasks are inherently linked by the procedure rather than being independent actions

2.7.3 Techniques
For this process there is not one recommended technique. However the use of
Hierarchical Task Analysis, HEART, THERP and APJ together will help input to the event
tree itself.

2.8 Human Factors in the assessment of fatalities during escape and


sheltering
2.8.1 Rationale
This section deals with the Human Factors issues which have a significant bearing on
the safety of personnel during escape and sheltering. Methods and data are presented
for assessing the likelihood of fatalities as events progress.
The term "escape" is considered to cover the movement of personnel from their initial
location (at the time of the event) to a place of safety. The term "sheltering" is
considered to cover the time spent by personnel within the place of safety. In the UK
offshore regulations, this place of safety is termed the Temporary Refuge (TR) or Place
of Safety (POS). For onshore installations these can include muster points.
Fatalities during escape and sheltering can be divided into three sub-categories, e.g.:
• immediate fatalities - personnel who are in close proximity in the initial stages of the
event
• escape fatalities - personnel who are not initially in close proximity but become
exposed to the event as they attempt to reach a temporary refuge or place of safety.

31 ©OGP
RADD – Human factors in QRA

• sheltering fatalities - personnel who are exposed to a hazard while sheltering in the
temporary refuge or place of safety.
In estimating fatalities, assessment of the likelihood of personnel being exposed to the
hazard and the effect of exposure are required.
For hydrocarbon releases the hazards of concern are thermal radiation, explosion
overpressure or toxic gas/smoke inhalation and narcotic effects of hydrocarbon
inhalation, for which the methods of assessing the effect of exposure can include the
use of tolerability thresholds or Probit equations (see Human Vulnerability datasheet).
The estimation of the likelihood of personnel being exposed to a hazard during the
escape and sheltering phases involves both event consequence modelling (e.g. fire
propagation, temporary refuge impairment etc.) and human behaviour modelling. In an
offshore situation the behaviours of interest include:
• time taken to initiate escape
• speed of movement to the temporary refuge
• choice of route so as to minimise exposure
• choice of route based on perception of the hazard
• use of protective equipment.
Statistics for a QRA must be derived by interpreting data taken from a number of
sources. Particular factors to be taken into account in deriving the statistics are:
• the reliability of response to alarms and the effect of false alarm frequency on
response behaviour;
• characteristic behaviour patterns in life threatening situations
• changes in behaviour when exposed to a hazard (e.g. 2 operators died on the Brent
Bravo platform 2003 after they were exposed to light hydrocarbon which dulled their
senses and prevented rational decision making)

2.8.2 Stages
There are 3 key stages that need to be gone through in order to predict the number of
fatalities associated with escape and sheltering. These are:-
• Define the variables (including the Human Factors variables)
• Quantify those variables
• Model the variables

2.8.2.1 Defining the variables


The following list states some of the variables that could be manipulated to determine
the number of fatalities associated with these events:
• Number of people escaping
• The route they take
• Person reaction (time to respond and type of response)
• Where the incident occurred in relation to the temporary refuge / place of safety
• The temporary refuge (size, location, purpose)

©OGP 32
RADD – Human factors in QRA

• Availability of Personal Protective Equipment / Personal Survival Equipment


• Training of the escapees in use of PPE and emergency procedures
• Degradation of human performance under the event conditions (stress, exposure to
toxic substances, smoke etc)
• Effect of other persons behaviour (team leader, following the person in front etc )
• Time of day
• Environmental conditions
• A person’s previous experiences
This list is not exhaustive and there may be some site specific variables that could be
added.

2.8.2.2 Quantification of the variables


The data within this section can be used to quantify some of the variables above during
the modelling process.

2.8.2.2.1 Varying the location of the event and the escapee


In analysing, the analyst cannot expect to find universally applicable historical data with
which to assess escape performance as this is location specific. For example, in regard
to the question of how likely it is that personnel will be in the vicinity of an event, the
analyst should consider the types of activities which take place on the installation. A
review should consider whether the alarm could be masked by other noises, and the
procedures followed to investigate an alarm, which may involve an operator being sent
to inspect the area.
Using the layout of the installation and details of the incident (such as availability of
escape ways, level of hazard) software tools can be used to assist in certain aspects of
escape evaluation. Most commonly they are used in the calculation of the time taken for
personnel to reach predefined points of safety. The approaches used by the models
differ and the scope for using them to estimate escape fatalities varies. Models which
may be suitable for applying to offshore installations include: EGRESS, MUSTER,
EVACNET+, SPECS, EXIT89.
A simple method for estimating the likelihood of personnel becoming exposed to a
hazard is to model the structure as a 3-D grid of cells and then consider, for an event in
a specific area, the likelihood of personnel entering the incident area as they make their
way to a TR/POS (see Figure 2.4).

33 ©OGP
RADD – Human factors in QRA

Figure 2.4 Plan view of a sim ple bridge-linked platform , dem onstrat
m ethod of estim ating exposure probabilities

In estimating the probability associated with each starting point, not only the routing of
the walkways can be taken into account but some Human Factors issues can be
accommodated in the analysis:
• the detectability of the event (i.e. personnel are more likely to see an ignited release
than an unignited one and re-route accordingly). Events could be grouped together
into categories and a different version of the grid produced for each category.
Detectability can be enhanced indirectly by informative announcements over the PA
system, therefore relevant procedures can be considered in the analysis.
• Preferences for certain walkways/routes. Bias could be introduced into the
probability figures based on the routes used by personnel, including short-cuts that
may have become the norm.
The number of behavioural aspects which have a bearing on escape performance is
large, and for many, data are limited or from a different field of activity. Therefore an
analyst who wishes to reflect a particular working method within the assessment, such
as Buddy-Buddy working, will not have a specific database of statistical evidence with
which to work. This does not imply that the analysis cannot reflect such issues, but it
does imply that doing so requires some insight into the behavioural implications.
Validating a theoretical analysis of escape performance, whether it be performed with
the assistance of a software tool or not, is clearly problematic. Observing the time it
takes personnel to move around the installation and perform relevant tasks is a starting
point. In order to compare these data to the predictions of a model, due account must
be taken of the effects of emergency circumstances on the personnel and the platform
is needed. An approach to validating predictions of escape performance is proposed in
[33].

2.8.2.2.2 Reliability and time to respond to alarms (e.g. time to initiate escape to a TR/POS)

The reliability of response to alarms is a key issue in the assessment of mustering


performance. A large amount of data has been collected with regard to the factors
which affect behaviour following an alarm signal. The findings indicate that the two
dominant factors are:
• previous experience of alarms (false alarms)

©OGP 34
RADD – Human factors in QRA

• confirmatory signals (such as smoke, fire, noise)


Data from building evacuations, where a high proportion of fire alarm signals are false,
indicate that a significant proportion of people are likely to seek confirmation before
commencing escape.
Further data to enable the factors affecting false alarm rate and response behaviour to
be identified are not available. It is expected that in the offshore environment the
proportion of personnel seeking confirmation before commencing escape would be less
than suggested by the data in Table 2.12 because of training and an awareness of the
potential danger.
Table 2.12 Data on response to alarm s

Issue Context Finding


Interpretation Fire drill in a building 17% assumed it to be a genuine alarm (sample of 176)
of alarm (without warning) false alarm - 83%
Interpretation Fire drill in a building 14% assumed it to be a genuine alarm
of alarm (without warning)
Interpretation Fire drill in a building 14% assumed it to be a genuine alarm (sample of 96)
of alarm (without warning)
Confirmation Actual fires in 9% (2 of 22) believed there was a fire before seeing flames
of hazard buildings 77% (17 of 22) required visual and other cues
Time to Research into normal 10% chose to evacuate after 35 seconds
respond to an alarms
alarm
Investigation Domestic fires 41 people performed 76 investigative acts
of the alarm
Tackling the Domestic fires 50% (268 out or 541) attempted to fight the fire
hazard
Tackling the Multiple occupancy 9% (9 out of 96) attempted to fight the fire
hazard fires
Use of fire Domestic fires Of 268 who knew of the nearby- location of an
extinguisher extinguisher, 50% tackled the fire but only 23% used the
extinguisher
Assisting Multiple occupancy 25 acts of giving assistance (total of 96 people)
others fires

2.8.2.2.3 Speed of movement of personnel


Data on speed of movement is relatively plentiful, and studies to assess degradation
due to exposure to hazards have been performed. Table 2.13 summarises some
relevant data.

Table 2.13 Data on the speed of m ovem ent

Issue Context Finding


Density of people Unhindered Average speed of 1.4m/s
walking
2
Density of people Movement in 0.05 m/s in density of 0.5m per person
congested
area
Effect of smoke on Evacuation 40% reduction (from normal walking speed)
speed of evacuation from buildings

35 ©OGP
RADD – Human factors in QRA

Effect of lighting Evacuation 10% reduction in speed (from normal walking speed)
level on speed of from buildings with emergency lighting of 0.2 lux
evacuation
Effect of lighting Evacuation 10% reduction in speed (from normal walking speed)
level on speed of from buildings if fluorescent strips, arrows and signs are used in
evacuation pitch black surrounding
Effect of lighting Evacuation 50% reduction in speed (from normal walking speed)
level on speed of from buildings in complete darkness
evacuation
Age of person Unhindered From the age of 19 onwards, decrease in speed of 1-
walking 2% per decade (average 16% reduction by age of 63)

The above table is for uninjured personnel. Although data is not available for personnel
with damaged limbs, a reduction in speed is expected. The relationship between
incapacitation and burns is complicated as burn injuries have a progressive effect. Stoll
and Greene [34] show that for second or third degree burns over 100% of body area, the
percentage incapacitation is less than 10% within the first 5 minutes, rising to 50% after
a few hours and reaching 100% in a day or so.

2.8.2.2.4 Choice of route


The choice of escape route contributes to the likelihood of a person being exposed to
the hazard while making their way to the TR/POS.
Two specific aspects of human behaviour which have been identified through review of
evacuations and are relevant to assessing the likelihood of route choice are:
• familiarity of personnel with the routes (i.e. seldom used emergency routes versus
normal routes);
• obstacles or hazards on the route (in particular the presence of smoke along the
route).
The data in Table 2.14 suggest a strong tendency for personnel to use routes with which
they have the greatest familiarity.
It is worth noting that it is common for personnel to become accustomed to using
routes which were not intended to be normal access routes (i.e. creating shortcuts).
Such an occurrence can invalidate the assumptions in a safety study.
Table 2.14 Hum an Behaviour Data on Choice of Evacuation Routes

Issue Context Finding Ref.


Familiarity with exits Hotel fire 51% departed through normal [35]
entrance
49% departed through fire exit
Familiarity with exits General evacuations 18% went to known exit without [36]
looking for another (sample size 50)
Familiarity with exits Evacuation drill in a 70% left through normal entrance [35]
lecture theatre 30% left through the fire exit
Moving through General evacuations Choice of exit is more influenced by [37]
smoke familiarity with the route than amount
of smoke
Moving through General evacuations 60% attempted to move through [38]
smoke smoke (50% of these moving 10 yards
or more)

©OGP 36
RADD – Human factors in QRA

2.8.2.2.5 Performance in the use of Personal Protective Equipment (PPE) or


Personal Survival Equipment (PSE) - reliability of success in using
PPE/PSE and time to use PPE/PSE
In an emergency situation the PPE required to give additional protection can be
relatively complex equipment such as smoke hoods or self contained breathing
apparatus.
In terms of risk assessment, failures or delays in the use of the necessary PPE/PSE can
increase the likelihood of fatalities. Therefore, an estimate of the percentage of the
population who can use PPE/PSE correctly and the likely time taken are relevant.
The findings of a study of the reliability of use of re-generative breathing apparatus are
presented in Table 2.15. The study involved visiting mines and asking miners, without
warning, to put on their apparatus. The authors used a five point rating scale instead of
simple pass or fail categories as they recognised that users may be able to rectify their
mistakes, either by themselves or with the assistance of their colleagues. However, the
category "failing" implies that a user would have very little chance of ever protecting
themselves with the equipment.

Table 2.15 Perform ance in using re-generative breathing apparatus,


m easured at four m ines

Donning Proficiency Profiles at each Mine (% of personnel)


Skill Level M ine A Mine B Mine C Mine D
Failing 6.3 18.2 40.0 6.9
Poor 50 27.3 40.0 6.9
Marginal 15.6 15.2 6.7 6.9
Adequate 15.6 33.3 10.0 44.8
Perfect 12.5 6.0 3.3 34.5

The results of the study show that performance in the use of PPE can be poor. The
authors suggested that training was a dominant contributor to the differences between
the four mines. However, they did not provide details of the training regimes and
therefore insights into the relative importance of induction training or frequency of drills
cannot be gained.
Data on the time to use breathing apparatus is not available. The findings above
suggest that there can be significant differences between personnel who are very
familiar and experienced with the equipment, from those who are not.

2.8.2.2.6 Allowing for degradation in human performance due to toxic or thermal


exposure
The data given in Table 2.15 takes no account of exposure to a hazard. It can be
expected that exposure to a hazard could significantly degrade human performance.
Choice of route, ability to put on a smoke hood, and capability to use an escape system
are examples of behaviour which could be impaired by exposure to a hazard.
In reviewing the data and considering the degree to which performance could be
degraded it is necessary to consider indirect factors such as cognitive performance
degradation, sensory performance degradation, and physical performance degradation

37 ©OGP
RADD – Human factors in QRA

(e.g. dexterity and co-ordination) when attempting to assess the effect on performance.
The greater the detriment to these performance parameters, the more likely will errors
be made and the time to perform tasks will increase.
There is limited data on the direct effect of exposure to hazards on human performance
and this is predominantly at concentrations below those possible in incidents. Table
2.16 has data on the effect of smoke inhalation.

Table 2.16 Data on the effect of exposure to sm oke on cognitive abilities

Issue Context Finding


Cognitive Effect of exposure to smoke 100% accuracy at 0.1 ltr/min
abilities on simple arithmetic tasks 58% accuracy at 1.2 ltr/min

Referring to the data on the effects of Hydrogen Sulphide (see Human Vulnerability
datasheet) it is clear that a person’s ability to see will be impaired, and it is possible that
cognitive abilities will be hampered as exposure increases. It is these types of
inferences which are necessary in assessing the effect of exposure on escape
performance and with due regard to PPE requirements.
A viable approach is to assume that a fraction of the lethal concentration is sufficient to
disrupt cognitive abilities. A common choice is to use 15% of the LC50 value as a
threshold where the rate of decision errors is significantly increased.

2.9 Human Factors in the assessment of fatalities during evacuation, rescue


and recovery
2.9.1 Rationale
To evaluate the number of fatalities during evacuation, rescue and recovery, the person
and the environment in which the evacuation and rescue are being made should be
considered along with the equipment to be used and its location. This section will focus
on the Human Factors issues that should be considered as part of the QRA, however
during the QRA both the effect of the equipment and the HF issues mentioned should be
considered in unison.

2.9.2 Stages
2.9.2.1 Scenario definition
Before this analysis can be run the scenario and variables that are to be modelled or
considered need to be determined. For example, the following should be considered:
• Number of people evacuating
• Physical characteristics (size and strength / Anthropometry) of those people
• Layout of the facility to be evacuated
• Route to be taken
• Equipment to be used during the evacuation and rescue
• Environmental conditions

©OGP 38
RADD – Human factors in QRA

• Type of event that has caused the escape and rescue. Specifically, the warning time
about the event, whether this event will cause confusion about the best form of
evacuation and rescue.
• Familiarity of the personnel to the evacuation and rescue procedures
• The history of the facility (number of false alarms, personal reaction to alarms)
This list is not exhaustive and there may be some additional site specific considerations
that need to be reviewed.

2.9.2.2 Task Analysis


Once the scenario for modelling has been defined, the detailed tasks to be carried out
need to be established so that the time duration and error analysis can be undertaken.
The most widely used method is called ‘Hierarchical Task Analysis’ or HTA. This
produces a numbered hierarchy of tasks and sub-tasks, usually represented in a tree
diagram format, but may also be represented in a tabular format. It will be necessary to
decide the level of resolution or detail required. In some cases, button presses,
keystrokes etc may need to be described, in other cases, description may be at the task
level. An operator may need to be involved in the study. Once the HTA is complete, each
stage can be reviewed to establish what the human limitations are so that they can be
considered within the analysis.

2.9.2.3 Issue Identification


Below is a summary of the potentially limiting factors that should be considered.

Anthropometry
• A person’s size and shape will have an effect on their ability to fit through escape
hatches and other confined spaces.
• The size of the individuals will effect the number of people who can fit into and move
around an escape craft.

Physiological
• The variations in the human ability to withstand the accelerations associated with
escape (e.g. deploying a life raft) need to be considered.
• The variation in the human body’s ability to survive at sea (cold adaptation, level of
training and survival skills etc)
• The range of strength when comparing individuals. This could affect a person’s
ability to open doors or hatches etc.

Psychological
The requirement for an evacuation implies that there is a significant risk to life.
Consequently the behaviour of personnel will be greatly affected by the stress of the
situation such that:
• the choice of actions is unlikely to be systematically thought through or weighed-up
against all others

39 ©OGP
RADD – Human factors in QRA

• over-hasty decisions may be made based on incomplete and insufficient information


• personnel will begin “running on automatic”. There will be a reduction in the
intellectual level, with personnel resorting to familiar actions
• personnel will focus on the immediate task at hand to the exclusion of others and
their ability to take on board new information will be reduced
• personnel may exhibit rigidity in problem solving, e.g. concentrating on one solution
even though it does not work
• performance on seemingly simple tasks will be greatly affected. Tasks requiring
manual dexterity will be very much more difficult and require more time to complete
than in normal circumstances

Other
• The clothing and the kit that the person is wearing / carrying will affect the likelihood
of a person surviving an evacuation and rescue.
• Location of the survival equipment, and the accessibility of it will affect how its
used.

These points are pertinent to the performance of the person in overall charge, referred
to here as the Offshore Installation Manager (OIM). As the person with the role of
evaluating the incident and choosing if, how and when to evacuate, the decisions of the
OIM can influence the outcome.
The OIM could evaluate the conditions on the installation correctly and order an
evacuation at the most opportune moment. The OIM will have been trained in these sort
of events on training simulators. However, the OIM could also:
• delay the evacuation, or fail to give the command to evacuate incurring greater
fatalities than necessary
• give the order to evacuate when there is no need to do so and therefore expose the
personnel to unnecessary risks
• choose the wrong mode of evacuation.
The OIM needs to have decision criteria with which to judge the situation in order to
choose a strategy. Ambiguity in the criteria and uncertainty or inaccuracies in the
information available introduce the chance of a non-optimum strategy being selected.
In addition, the stress of the situation may affect the behaviour of the OIM, and exposure
to smoke or other toxic substances can affect his cognitive performance (see Human
Vulnerability datasheet), adding weight to the argument that the OIM will not always
choose the optimum strategy. Furthermore, the OIM’s training and personal experiences
will affect this decision criteria and this aspect is virtually unquantifiable but yet needs
to be considered.

2.9.2.4 Quantification
Quantification within this process comes in a number of forms, these could be:
• The time taken to complete an activity can be established by either running user
trials or by witnessing training events. The timings taken from these events should
be considered against the environment in which they were taken and then compared

©OGP 40
RADD – Human factors in QRA

to the environment in which they will finally be carried out. It is likely that the final
environment is a stressful one which may alter the recorded task time. For example,
under a more stressful environment a person may rush to complete a task (making it
quicker) but this could increase the likelihood of making a mistake (which could
result in the action needing repeating or indeed different action having to be taken).
• Using anthropometric data it is possible to workout the proportion of the population
who cannot use, fit or access a piece of equipment. This will allow a percentage to
given about how many people could use it to escape.
• Human physiological limitations can be defined. This can be used to establish the
number of people who would be able to withstand the physical environment within
which the evacuation is taking place.
• A human error assessment can be carried out on the four stages of evacuation when
using a davit launched or freefall lifeboat system. This can be seen in [39]. This is
only one area of error that could occur. The likelihood of an error occurring should
be established on a case by case basis.
• Research can be carried out to establish how long humans can survive in an escape
made to the sea. The survivability of a person once they are in the water depends on,
water temperature, sea state, physiology of the person, equipment they are using
and their psychological state.
This list is not exhaustive and the variables applicable to the specific scenarios need to
be established.

2.9.2.5 Useful Data


This section is split into data applicable to three scenarios. These are:
• Estimating the proportion of personnel who are unable to use particular evacuation
systems
• Human Factors in lifeboat evacuation modelling
• Estimating fatalities during evacuation by other means

2.9.2.5.1 Estimating the proportion of personnel who are unable to use particular
evacuation systems

Human Physiological Limitations


Accelerations are experienced in accidental collisions (lifeboat striking the installation
structure) or as part of the evacuation process (jumping into the sea from a height,
freefall lifeboat launch, motions of the boat). Table 2.17 gives the average levels of
linear acceleration (g), in different directions, which can be tolerated on a voluntary
basis for specified periods). The figures are provided for acceleration in the x axes
(forwards/backwards) and the z axes (upwards/ downwards) [40].

Table 2.17 Average tolerable levels of linear acceleration (units of g = 9.81


m /s 2 )

Direction of Exposure Time


Acceleration 0.3 6 secs 30 1 min 5 mins 10 20
secs secs mins mins

41 ©OGP
RADD – Human factors in QRA

+gz 15 11 8 7 5 4 3.5
-gz 7 6 3.5 3 2 1.5 1.2
+gx 30 20 13 11 7 6 5
-gx 22 15 10.5 8 6 5 4

An approach for evaluating acceleration effects in both conventional and free-fall


lifeboats has been developed from the Dynamic Response Model [41], initially
developed to study the response of pilots during emergency ejection from aircraft [42].
The Dynamic Response Model uses human tolerance criteria and lifeboat accelerations
to infer the response of occupants to accelerations acting at the seat support. The
method establishes an index for relating accelerations to potential injury.
Three levels of risk for acceleration are defined in terms of the probability of injury,
where a high level of risk carries a 50 percent probability of injury, a moderate level has
a 5 percent probability and a low level has a 0.5 percent probability. The derived index
values are presented in Table 2.18.

Table 2.18 Dynam ic Response Index lim its for high, m oderate and low risk
levels

Coordinate Dynam ic Response Index lim its (g)


axis High Risk Moderate Low Risk
Risk
-x 46.0 35.0 28.0
+y 22.0 17.0 14.0
-y 22.0 17.0 14.0
+z 22.8 18.0 15.2
-z 15.0 12.0 9.0

With regard to the launch of freefall lifeboats, the accelerations are designed to be
within tolerable limits and precautions, such as headrest straps, are included in some
designs to further safeguard the occupants. To date, experience has not revealed the
launch process to be intolerable.
The motion of the boat can cause seasickness. However, there is little evidence that
seasickness contributes to death in a TEMPSC [43].

Psychological Restrictions
The use of relatively new evacuation technology, in particular freefall lifeboats, has
raised the issue of the willingness of personnel to use evacuation systems.
Discussions with training centres give large differences ranging from no recorded
refusals to as many as 1 in a 100. Reasons for refusals include concern over prior back
pain/injury.
It is suggested that the refusal rate among personnel would vary with the type of
emergency event on the installation and with the prevailing weather conditions.

©OGP 42
RADD – Human factors in QRA

Refusals are likely to increase in poor weather conditions, but decrease with increasing
perceived danger from the incident.

2.9.2.5.2 Human Factors in lifeboat evacuation modelling


Time taken to complete tasks
Table 2.19 shows example times taken to complete the various tasks carried out during
life boat launch.

Table 2.19 Estim ated Tim es for tasks in evacuation by traditional davit-
launched lifeboat (TEMPSC)

Task Nom inal


Tim e
Identify boat is useable (i.e. functioning of systems are checked) 2 min
Embark 6 min
Assess information and decide to descend 30 secs
Delay in descending (if there are difficulties with operating the 2 min
descent system)
Assess information and decide to disconnect 15 secs
Delay with disconnection (if there are difficulties with operating 2 min
the disconnection system)
Disconnect 10 secs
Release hooks manually (if there are difficulties with operating 3 min
the primary release system)
Manoeuvre from immediate vicinity of the installation 2 mins

Task Specific Human Error Rates


Table 2.20 and Table 2.21 present human error rates taken from a study that compared
freefall and davit launched lifeboats [39].

43 ©OGP
RADD – Human factors in QRA

Table 2.20 Estim ated hum an errors probabilities (HEP) and possible outcom e in evacuation by freefall lifeboat

Stage Error Contingent Conditions (necessary for the Estimated Outcome


outcome to be realised) HEP (and
1
EF )
-2
Prepare to Hook release not checked Hook attached 10 (5) Death or injury
-1
embark Hook release check fails Catastrophic fault in hook system 10 (10) Death or injury
-2
Fail to correct hook release fault Catastrophic fault in hook system 10 (3) Death or injury
-2
Cradle orientation not checked Cradle not angled correctly after maintenance/drill 10 (10) Death or injury
-2
Cradle orientation check fails Cradle not positioned correctly after maintenance/drill 10 (10) Death or injury
-3
Fail to correct cradle orientation Cradle not positioned correctly after maintenance/drill 10 (3) Death or injury
-2
Protection systems not checked One or more protection systems has a catastrophic 10 (5) Death or injury
-2
Recovery winch connection not fault 10 (5) Occupants stranded in boat
-3
checked 10 (10) Occupants stranded in boat
Fails to detach connected recovery
winch
-3
Embarkation Fail to embark (scenario dependent) 10 (100) Death or injury of an individual
-2
Stretcher carried into boat in wrong 10 (3) Departure delayed
orientation
-3
Departure Straps not used correctly by a 10 (5) Death or injury to the
-3
passenger 10 (5) occupant
-3
Primary release system used 10 (5) Departure delayed
incorrectly Departure delayed
Secondary system used incorrectly
-2
Move Away Gearbox/prop check not done System has a fault 10 (10) Unmanoeuvrable boat
-3
Gearbox/prop check fails System has a fault 10 (10) Unmanoeuvrable boat
-2
Steering check not done System has a fault 10 (10) Unmanoeuvrable boat
-3
Steering system check fails System has a fault 10 (10) Unmanoeuvrable boat
-3
Starting controls not identified System has a fault 10 (5) Unmanoeuvrable boat
-3
Unable to start propulsion system System has a fault 10 (5) Unmanoeuvrable boat
1
EF = Error Factor

1
EF= Error Factor

©OGP 44
RADD – Human factors in QRA

Table 2.21 Estim ated hum an errors probabilities (HEP) and possible outcom e in evacuation by conventional davit-
launched lifeboat

Stage Error Contingent Conditions (necessary Estimated Possible outcome


for the outcome to be realised) HEP (EF)
-3
Prepare to Davit structure not checked Catastrophic fault in structure 10 (5) Death or injury
-3
embark Davit structure check fails Catastrophic fault in structure 10 (3) Death or injury
-2
Winch system not checked Catastrophic fault in winch system 10 (10) Death or injury
-2
Winch system check fails Catastrophic fault in winch system 10 (10) Death or injury
-2
Maintenance Pendants not checked Maintenance pendants attached 10 (5) Departure Prevented
-2
Maintenance Pendants check fails Maintenance pendants attached 10 (10) Departure Prevented
-2
Winch system not checked Winch system not functioning 10 (10) Departure Prevented
-2
Winch system check fails Winch system not functioning 10 (10) Departure Prevented
-2
Hook release not checked Release system not functioning 10 (5) Occupants Stranded
-1
Hook release check fails Release system not functioning 10 (10) Occupants Stranded
-2
Fails to correct hook release fault Release system not functioning 10 (3) Occupants Stranded
-2
Winch system not checked Winch system fails during descent 10 (10) Occupants Stranded
-2
Winch system check fails Winch system fails during descent 10 (10) Occupants Stranded
-3
Embarkation All passengers do not embark 10 (100) Death or injury of
-3
Stretcher-bound injured do not embark 10 (5) person
-3
Departure Primary release system used incorrectly 10 (5) Departure Delayed
-3
Secondary system (if available) used incorrectly 10 (5) Departure Delayed
-3
Brake release not continuous 10 (5) Departure Delayed
-3
Wrong controls selected 10 (5) Departure Delayed
-3
Primary hook release system controls not operated 10 (5) Departure Delayed
-3
Occupants do not know how to use hook release 10 (5) Departure Delayed
-3
Occupants don’t know how to manually release hooks 10 (5) Departure Delayed
-2
Occupants do not know how to override hydrostatic hook 10 (10) Departure Delayed
release system interlock
-2
Move Away Incorrect direction navigated 10 (5) Death or injury
-3
Secondary manual release mechanism not operated 10 (5) Departure Prevented
-3
Primary release mechanism not operated 10 (5) Departure Delayed
-2
Incorrect direction navigated 10 (5) Departure Delayed
-2
Gearbox/prop check not done 10 (10) Unmanoeuvr. Boat
-3
Gearbox/prop check fails 10 (10) Unmanoeuvr. Boat
-2
Steering check not done 10 (10) Unmanoeuvr. Boat
-3
Failure of steering check 10 (10) Unmanoeuvr. Boat
-3
Starting controls not identified 10 (5) Unmanoeuvr. Boat
-3
Unable to start propulsion system 10 (5) Unmanoeuvr. Boat

1
EF = Error Factor

45 ©OGP
RADD – Human factors in QRA

2.9.3 Techniques
To complete this assessment a number of different techniques could be employed.
There is no one correct answer and the structure, order and detail of the individual
assessments will depend on the level of risk associated with the event and the level of
detail required in the output.
Software models are available for assessing lifeboat evacuation, examples being
ESCAPE and FARLIFE. The ESCAPE programme is based on the Department of Energy
study. The FARLIFE programme is a time based simulator which can use the same data
and can include operational errors within the model

2.9.3.1 Estimating fatalities during evacuation by other means


2.9.3.1.1 Escape to Sea
Table 2.22 gives statistics for fatality rates as guidelines.

Table 2.22 Guidelines for fatality estim ates

M ode Factors Fatality ranges Data


Source
Personnel killed by Jumping height 1-5% for low heights Judgement
escaping direct to
sea 5-20% for large heights Judgement

2.9.3.1.1.1 Survival in the water


Table 2.23 gives survival time data or personnel not wearing survival suits [44].

Table 2.23 50% Survival Tim es for Conventionally Clothed Persons in still
water [44]

W ater tem perature Survival tim e for


(°C) 50% of persons
(hrs)
2.5 0.75
5 1
7.5 1.5
10 2
12.5 3
15 6

For personnel wearing a survival suit the time is significantly increased. New designs
have been shown to protect for over 4 hours at water temperature of 4°C [45]. Further
information is presented in the Human Vulnerability datasheet.
For the QRA analyst a key concern will be the number who have successfully donned
survival suits and life jackets before entering the water. Given that personnel who
escape to sea are unlikely to have had much time to prepare for their escape, the
likelihood of them putting on the safety clothing will be dependent on its accessibility.

©OGP 46
RADD – Human factors in QRA

The analyst should consider whether the equipment is provided at the probable points
of alighting the installation or whether they are stowed in remote lockers.
The initial risk when entering the sea is from ‘cold shock’ which can cause you to inhale
even when underwater due to an involuntary gasping reflex [46].

2.9.3.1.1.2 Recovery from the sea


A review of the performance of attendant vessels in emergencies offshore [47] suggests
that the success for recovering personnel from the sea ranges between approximately
10% and 95% depending on the type of vessel and weather conditions.
Once individuals have been in the water for 3hrs or more they will become scattered
making locating and rescuing them more difficult.
Once recovery has been achieved there is still the risk of post-immersion collapse. This
could occur as the individual looses the hydrostatic assistance to circulation, leading to
collapse of blood pressure and consequent reduced cardiac output [46].

2.9.3.1.1.3 Modelling of Survivability


Robertson [46] found the Wissler model to be the most usable computer model when
predicting fatalities once they are in the water. This model uses the following
assumptions that are useful to note:
• Survival time will be reduced by 50% if the sea state is at Beaufort scale 3 rather
than 0. This is due to the increase in activity required to stay afloat and prevent
drowning.
• Survival time will be reduced by 10% if there is a 1 litre leakage of water into the
survival suit.
• An insulated immersion suit could increase the survival time by a factor of ten when
compared with a membrane suit.
• This model uses data about survival rate and water temperature to assessment
survivability.
• Each percentage of body fat equates approximately to a 0.1°C rise in deep body
temperature.
Many parameters can be varied within this model. However, there are many variable
which can effect a persons ability to survive and some of these are impossible to
determine. For example, the psychological factor of ‘giving up’ or ‘determination’ could
play a large part in a person’s ability to survive especially over drawn out period of time.

47 ©OGP
RADD – Human factors in QRA

3.0 Additional Resources


3.1 Legislation, guidelines and standards
3.1.1 UK Legislation, Guidelines and Standards
The European Commission now defines many of the legal requirements for the UK.
Each Member State is then responsible for incorporating these requirements into their
domestic law.
The Health & Safety Com m ission (HSC) are the UK body that controls all health
and safety issues within the UK. The Health and Safety Executive (HSE) are the
government agency responsible for regulations and their enforcement through
inspection and investigation. See http://www.hse.gov.uk/.

3.1.2 Key Guidance and References


3.1.2.1 HSE Publications
http://www.hsebooks.co.uk/
http://www.hse.gov.uk/signpost/index.htm
http://www.hmso.gov.uk/
• HSE (1990) Noise at work: Noise assessment, information and control: Guidance
notes. HSE Books.
• HSE (1995) Improving compliance with safety procedures: Reducing industrial
violations. HSE Books.
• HSE (1997) Successful health and safety management, HSG 65. HSE Books.
• HSE (1998) Manual Handling: Guidance on Manual Handling Operations Regulations
1992, L23. HSE Books.
• HSE (1998) A guide to the Offshore Installations (Safety Representatives and Safety
• Committees) Regulations 1989: Guidance on Regulations, L110. HSE Books.
• HSE (1998) A guide to the Offshore Installations (Safety Case) Regulations 1992:
Guidance on Regulations, L30. HSE Books.
• HSE (1998) Safe use of lifting equipment: Approved code of practice and guidance
for the Lifting Operations and Lifting Equipment Regulations 1998, L113. HSE Books.
• HSE (1999) A guide to the Control of Major Accident Hazards Regulations 1999:
Guidance on Regulations, L111. HSE Books.
• HSE (1999) Reducing error and influencing behaviour, HSG 48. HSE Books.
• HFRG (2000) Improving maintenance: A guide to reducing human error. HSE Books.

3.1.2.2 British Standards


http://bsonline.techindex.co.uk/
• BS EN ISO 9241-1 (1997) Ergonomics requirements for office work with visual
display terminals (VDTs) - Part 1: General introduction.
• BS EN 9241-2 (1993) Ergonomics requirements for office work with visual display
terminals (VDTs) - Part 2: Guidance on task requirements.

©OGP 48
RADD – Human factors in QRA

• BS EN 9241-3 (1993) Ergonomics requirements for office work with visual display
terminals (VDTs) - Part 3: Visual display requirements.
• BS EN ISO 9241-4 (1998) Ergonomics requirements for office work with visual
display terminals (VDTs) - Part 4: Keyboard requirements.
• BS EN ISO 9241-5 (1999) Ergonomics requirements for office work with visual
display terminals (VDTs) - Part 5: Workstation layout and postural requirement.
• BS EN ISO 9241-6 (2000) Ergonomics requirements for office work with visual
display terminals (VDTs) - Part 6: Guidance on the work environment.
• BS EN ISO 9241-7 (1998) Ergonomics requirements for office work with visual
display terminals (VDTs) - Part 7: Requirements for display with reflections.
• BS EN ISO 9241-8 (1998) Ergonomics requirements for office work with visual
display terminals (VDTs) - Part 8: Requirements for displayed colours.
• BS EN ISO 9241-9 (2000) Ergonomics requirements for office work with visual
display terminals (VDTs) - Part 9: Requirements for non-keyboard input devices.
• BS EN ISO 9241-10 (1996) Ergonomics requirements for office work with visual
display terminals (VDTs) - Part 10: Dialogue principles.
• BS EN ISO 9241-11 (1998) Ergonomics requirements for office work with visual
display terminals (VDTs) - Part 11: Guidance on usability.
• BS EN ISO 9241-12 (1999) Ergonomics requirements for office work with visual
display terminals (VDTs) - Part 12: Presentation of information.
• BS EN ISO 9241-13 (1999) Ergonomics requirements for office work with visual
display terminals (VDTs) - Part 13: User guidance.
• BS ISO 9241-14 (1997) Ergonomics requirements for office work with visual display
terminals (VDTs) - Part 14: Menu dialogues.
• BS EN ISO 9241-15 (1998) Ergonomics requirements for office work with visual
display terminals (VDTs) - Part 15: Command dialogues.
• BS EN ISO 9241-16 (1999) Ergonomics requirements for office work with visual
display terminals (VDTs) - Part 16: Direct manipulation dialogues.
• BS EN ISO 9241-17 (1998) Ergonomics requirements for office work with visual
display terminals (VDTs) - Part 17: Form-filling dialogues.
• BS EN ISO 7250 (1998) Basic human body measurements for technological design.
• DD 202 (1991) Ergonomics principles in the design of work systems Draft for
development.
• BS EN 60073 (1997) Basic and safety principles for man-machine interface, marking
and identification - Coding principles for indication devices and actuators.

3.1.2.3 ISO Standards


http://www.iso.ch/iso/en/ISOOnline.frontpage
• ISO 11064-1 (2000) Ergonomic design of control centres - Part 1: Principles for the
design of control centres, Working draft.
• ISO 11064-2 (2000) Ergonomic design of control centres - Part 2: Principles for
control suite arrangement.

49 ©OGP
RADD – Human factors in QRA

• ISO 11064-3 (2000) Ergonomic design of control centres - Part 3: Control room
layout.
• ISO 11064-4 (2000) Ergonomic design of control centres - Part 4: Workstation layout
and dimensions
• ISO 11064-5 (2000) Ergonomic design of control centres - Part 5: Displays and
controls.
• ISO 11064-6 (2000) Ergonomic design of control centres - Part 6: Environmental
requirements, Working draft.
• ISO 11064-7 (2000) Ergonomic design of control centres - Part 7: Principles for the
evaluation of control centres.
• ISO 11064-8 (2000) Ergonomic design of control centres - Part 8: Ergonomics
requirements for specific applications.

3.2 Key Societies and Centres


There are several main bodies worldwide that cover Human Factors professionals.

3.2.1 United Kingdom


The Ergonomics Society is the professional body within the UK for ergonomics and
Human Factors practitioners. Individual registered members are required to have
completed an accredited university degree and have at least three years professional
experience. The Society outlines a Code of Conduct with which all members are
required to comply. For further information see http://www.ergonomics.org.uk/

3.2.2 Europe
The Centre for Registration of European Ergonom ists (CREE) holds a similar
register. Individuals must have a broad-based ergonomics degree qualification, together
with further experience in the use and application of ergonomics in practical situations
over a period of at least two years. The European Ergonomist category is approximately
equivalent to the Ergonomic Society’s Registered Member grade. For further
information see http://www.eurerg.org/
The Hum an Factors and Ergonom ics Society, Europe Chapter, is organised to
serve the needs of the Human Factors profession in Europe. This is a sub-society of the
US-based Human Factors and Ergonomics Society. For further information about their
aims and roles see http://www.hfes-europe.org/
Other ergonomics and Human Factors societies exist throughout Europe. Further
information can be found at the following websites:
• Federation of European Ergonom ics Societies: http://www.fees-network.org/
• Irish Ergonom ics Society: http://www.ul.ie/~ies/
• Society for French Speaking Ergonom ists: http://www.ergonomie-self.org/
• Germ an Ergonom ics Society: http://www.gfa-online.de/englisch/english.php
• Dutch ergonom ics Society: http://www.ergonoom.nl/NVvE/en
• Italian Ergonom ics Society: http://www.societadiergonomia.it/

©OGP 50
RADD – Human factors in QRA

• Hellenic Ergonom ics Society: http://www.ergonomics.gr/index_en.htm


• Belgian Ergonom ics Society: http://www.besweb.be/
• Swiss Ergonom ics Society: http://www.swissergo.ch/en/index.php

3.2.3 Scandinavia
Ergonomics has a high profile in Scandinavian countries. There are several national
societies:
• Norwegian Ergonom ics Society: http://www.ergonom.no/ (Nowegian only)
• Swedish Ergonom ics Society: http://www.ergonomisallskapet.se/ (Swedish
Only)
• Finnish Ergonom ics Society: http://www.ergonomiayhdistys.fi/
Addresses and further details of how to contact these societies can be found at the
Nordic Ergonomics Society’s website
http://www.ergonom.no/Html_english/s02a01c01.html

3.2.4 United States and Canada


The Hum an Factors & Ergonom ics Society encourages education and training for
those entering the Human Factors and ergonomics profession and for those who
conceive, design, develop, manufacture, test, manage, and participate in systems. For
more information see http://hfes.org/
Association of Canadian Ergonom ists (Formerly the Human Factors Association
of Canada) http://www.ace-ergocanada.ca/

3.2.5 South America


• Argentinean Ergonom ics Society: www.geocities.com/CapeCanaveral/6616/
(Spanish only)
• Chilean Ergonom ics Society: http://sochergo.ergonomia.cl/ (Chilean Only)

3.2.6 Australia and New Zealand


The Ergonom ics Society of Australia (ESA) is the professional organisation of
Ergonomists in Australia. Its purpose is to promote the principles and practice of
ergonomics throughout the community. It has over 500 members. ESA is one of 36
federated societies worldwide that comprise the International Ergonomics Association
(IEA). See http://www.ergonomics.org.au/
New Zealand Ergonom ics Society (NZES) can be found at
http://www.ergonomics.org.nz/

3.2.7 Rest of the World


The International Ergonom ics Association is the federation of ergonomics and
Human Factors societies from around the world. The mission of IEA is to elaborate and
advance ergonomics science and practice, and to improve the quality of life by

51 ©OGP
RADD – Human factors in QRA

expanding its scope of application and contribution to society. The IEA is governed by
the Council with representatives from the federated societies. Day-to-day administration
is performed by the Executive Committee that consists of the elected Officers and
Chairs of the Standing Committees. See http://www.iea.cc/
Further websites available for the rest of the world include:
• The Hong Kong Ergonom ics Society: http://www.ergonomics.org.hk/
• Iranian Ergonom ics Society: http://www.modares.ac.ir/ies/
• Ergonom ics Society of Korean: http://esk.or.kr/(Korean Only)
• Ergonom ics Society of Taiwan: http://esk.or.kr/
• Ergonom ics Society of Thailand: http://www.est.or.th/index.html (Thai Only)
• Indian Society of Ergonom ics: http://www.ise.org.in/
• Ergonom ics Society of South Africa has its own website at
http://www.ergonomics-sa.org.za/

4.0 References & Bibliography


4.1 References
[1] HSE, 1999. Reducing error and influencing behaviour (HSG48). HSE Books.
[2] Christensen, JM. Human Factors definitions, Human Factors Society Bull., 31(3),
8-9.
[3] HSE, 2003. Development of Human Factors methods and associated standards for
major hazard industries, RR081/2003.
http://www.hse.gov.uk/research/rrhtm/rr081.htm
[4] HSE, 2002. Strategies to promote safe behaviour as part of a health and safety
management system, CRR430/2002.
http://www.hse.gov.uk/research/crr_htm/2002/crr02430.htm
[5] HSE, 2006. Managing shiftwork: health and safety guidance, HSG256, Sudbury,
Suffolk: HSE Books.
[6] HSE, 1997. Guidance on permit-to-work systems in the petroleum industry,
ISBN 0 7176 1281 3, Sudbury, Suffolk: HSE Books.
[7] OLF Guideline no. 088 Common model for work permits.
http://www.olf.no/guidelines/common-model-for-work-permits-article2954-
301.html
[8] HSE, 2003. Competence assessment for the hazardous industries. RR086/2003.
http://www.hse.gov.uk/research/rrhtm/rr086.htm
[9] HSE, 2007. Development of a working model of how Human Factors, safety
management systems and wider organisational issues fit together, RR543/2007.
http://www.hse.gov.uk/research/rrhtm/rr543.htm
[10] Stein, E.S. and Rosenberg, B, 1983. The Measurement of Pilot Workload, Federal
Aviation Authority, Report DOT/FAA/CT82-23, NTIS No. ADA124582, Atlantic City.
[11] Reason, J., 1990. Human Error, Cambridge: Cambridge University Press.
[12] Kirwan, B., 1992a. Human error identification in human reliability assessment.
Part 1: Overview of approaches. Applied Ergonomics, 23(5), 299-318.

©OGP 52
RADD – Human factors in QRA

[13] Spurgin, A.J., Lydell, B.D., Hannaman, G.W. and Lukic, Y., 1987. Human Reliability
Assessment: A Systematic Approach. In Reliability ‘87, NEC, Birmingham, England.
[14] Rasmussen, J., 1981. Human Errors. A Taxonomy for Describing Human Malfunction
in Industrial Installations, Risø National Laboratory, DK-4000, Roskilde, Denmark.
[15] Kirwan, B., 1994. Human reliability assessment. In J.R. Wilson and E.N. Corlett
(eds.), Evaluation of Human Work. London: Taylor and Francis, pp. 921-968.
[16] Gibson, W.H. and Megaw, T.D., 1999. The Implementation of CORE-DATA, a
Computerised Human Error Probability Database. HSE Contract Research Report
245/1999. http://www.hse.gov.uk/research/crr_pdf/1999/crr99245.pdf
[17] Bellamy, L.J., Wright, M.S. and Hurst, N.W., 1993. History and development of a
safety management system audit for incorporation into quantitative risk
assessment, International Process Safety Management Workshop, San Francisco,
22-24 September, AIChemE/CCPS.
[18] Bellamy, L.J. and Geyer, T.A.W., 1991. Organisational, Management and Human
Factors in Quantified Risk Assessment, HSE Contract Research Report 33/1991.
http://www.hse.gov.uk/research/crr_pdf/1999/crr99245.pdf
[19] Bellamy, L.J., Geyer, T.A.W., and Astley, J.A.A., 1989. Evaluation of the human
contribution to pipework and in-line equipment failure frequencies, HSE Contract
Research Report No. 89/15.
http://www.hse.gov.uk/research/crr_pdf/1989/crr89015.pdf
[20] Four Elements, 1993. Report No. 2258.
[21] Swain, A.D. and Guttman, H.E., 1983. A Handbook of Human Reliability Analysis
withEmphasis on Nuclear Power Applications. NUREG/CR-1278, USNRC,
Washington DC-20555.
[22] Bellamy, L.J., 1986. The Safety Management Factor: An Analysis of the Human
Error Aspects of the Bhopal Disaster, Safety and Reliability Society Symposium, 25
September , Southport, UK.
[23] Hurst, N.W., Bellamy, L.J. and Geyer, T.A.W., 1991. A classification scheme for
pipework failures to include human and sociotechnical errors and their
contribution to pipework failure frequencies, J. Haz. Mat., 26, 159-186.
[24] Danos W., and Bennett L.E., 1984. Risk Analysis of Crane Accidents, U.S.
Department of the Interior/Minerals Management Service, OCS Report MMS 84-
0056.
[25] Sutton R., and Towill D.R., 1982. A model of the crane operator as a man-
machine element, Proc. Second European Annual Conference on Human Decision
Making and Manual Control, pp25-42, June 2-4, University of Bonn, Poppelsdorfer
Schloss. Forschungsinstitut fur Anthropotechnik, FGAN/FAT, Federal Republic of
Germany: Wachtberg-Werhoven.
[26] Butler A.J., 1978. An investigation into crane accidents, their causes and repair costs,
Building Research Establishment Report CP75/78, Department of the
Environment.
[27] Wiken H., 1978. Offshore Crane Operations, Progress Report no 1, Study of offshore
crane casualties in the North Sea, Det Norske Veritas Technical Report 78-633.

53 ©OGP
RADD – Human factors in QRA

[28] Kariuki, G. & Löwe, K., 2004. Incorporation Of Human Factors In The Design Process
, guide prepared for PRSIM Focus Group 4, Institute for Plant and Process
Technology, Process Safety and Plant Technology, Technische Universität
Berlin, Germany.
[29] Hunns, DM and Daniels, BK, 1980. The Method of Paired Comparisons,
Proceedings 6th Symp. on Advances in Reliability Technology, Report NCSR R23 and
R24, UK Atomic Energy Authority.
[30] Williams, J.C., 1988. A data-based method for assessing and reducing human
error to improve operational experience, Proc. IEEE 4th Conference on Human
Factors in Power Plants, Monterey, CA, 6-9 June.
[31] SRD/Humphreys, P. (ed.), 1988. Human Reliability Assessors Guide, Safety and
Reliability Directorate Publication RTS 88/95Q, Warrington: UK Atomic Energy
Authority
[32] Muyselaar, A.J. and Bellamy, L.J., 1993. An audit technique for the evaluation
and management of risks, CEC DGXI workshop on Safety Management in the
Process Industry, October 7-8, Ravello, Italy.
[33] Jack M., King D., 1993. Practical validation of installation evacuation, escape and
rescue, (EER) systems, Response to incidents offshore, 8-9 June, Aberdeen, IBC
Technical Services.
[34] Stoll A.M. and Greene L.C., 1959. Relationship between pain and tissue damage
due to thermal radiation, J. Appl. Physiol., 14, 373.
[35] Sime, 1985a. Movement towards the unfamiliar: Person and place affiliation in a
fire entrapment setting, Environment and Behaviour, 17:6, 697-724.
[36] Sixsmith, A.J., Sixsmith, J.A. & Canter, D.V., 1988. When is a door not a door? A
study of evacuation route identification in a large shopping mall, in Safety in the
Built Environment, ed. Sime, J.D., 62-74, E&FN SPON, London.
[37] Horiuchi, S., Murozaki, Y. & Hokuso, A., 1986. A case study of fire and
evacuation in a multi-purpose office building, Osaka, Japan, in Fire Safety
Science: Proceedings of the first International Symposium, eds. C.E.Grant &
P.J.Pagni, Washington DC, Hemisphere Publishing Corp., Washington DC.
[38] Wood, 1972. The behaviour of people in fires, Fire Research Note 953.
Borehamwood: Fire Research Station. UK.
[39] Four Elements, 1993. Freefall versus davit launched lifeboats: Human Factors study,
Project Ref. 2334.
[40] Sanders, M.S. and McCormick, E.J, 1987. Human Factors in Engineering and
Design, 6th. ed., ch17, 486-517, McGraw-Hill International Editions.
[41] Brinkley, J.W, 1984. Personnel Protection concepts for advanced escape system
design, AGARD conference proceedings, Human Factors Consideration in High
Performance Aircraft, pp6-1 to 6-12.
[42] Nelson, J.K., Hirsch, T.J. and Phillips, N.S, 1989. Evaluation of Occupant
accelerations in lifeboats, J. Offshore Mechanics and Arctic Engineering, III, 344-
349.

©OGP 54
RADD – Human factors in QRA

[43] Landolt, J.P., Monaco, C., 1989. Seasickness in Occupants of Totally-Enclosed


Motor-Propelled Survival Craft (TEMPSC),
[44] Golden FstC. 1976. Hypothermia a Problem for North Sea Industries, J. Soc.
Occup. Med., 26, 85-88.
[45] Health and Safety at Work, 13:12, Croydon: Tolley Publishing Co Ltd..
[46] Robertson, D.H. and Simpson, M.E.. Review of Probable Survival Times for
Immersion in the North Sea, Offshore Technology Report OTO 95 038.
http://www.hse.gov.uk/research/otopdf/1995/oto95038.pdf
[47] Technica, 1987. The Performance of Attendant Vessels in Emergencies Offshore, A
study carried out for the UK Department of Energy, OTH 97 274.

4.2 Bibliography
American Conference of Governmental Industrial Hygienists, (1980) Hydrogen Sulphide
in Documentation of the Threshold Limit Values, 4th Edition, ACGIH, Cincinnati, p
225.Ahlborg, G., (1951) Hydrogen Sulphide Poisoning in Shale Oil Industry in Arfch.
Industrial Hygiene and Occupational Medecine, 3, p 247.
Bellamy, L.J., et al. (1990) Experimental programme to investigate informative fire warning
characteristics for motivating fast evacuation, Building Research Establishment, Garston,
Watford, U.K.
Bellamy, L.J., Geyer, T.A.W., and Astley, J.A.A. (1989) Evaluation of the human
contribution to pipework and in-line equipment failure frequencies. HSE Contract
Research Report No. 89/15.
Brabazon P.G., Gibson W.H., Tinline G., Leathley B.A., Practical Applications of Human
Factors Methods in Offshore Installation Design. Offshore South East Asia, 6-9
December, 1994
Brown W et al., The qualification of human variability and its effect on nuclear power
plant risk, Brookhaven National Laboratory, Upton, NY, 1990
Canter, D. (1980) (ed) Fires and Human Behaviour, Chichester: Wiley.
Canter, D. (1984) Studies of human behaviour in fire: empirical results and their implications
for education and design. Building Research Establishment, Garston, Watford, U.K.
Crossthwaite, P.J., Fitzpatrick, R.D., Hurst, N.W. Risk assessment for the siting of
developments near liquefied petroleum gas installations, IChemE Symposium Series 110
Dalkey, N. C. (1972. The Delphi method: An experimental study of group opinion. In N. C.
Dalkey, D. L. Rourke, R. Lewis, & D. Snyder (Eds.. Studies in the quality of life: Delphi and
decision-making (pp. 13-54. Lexington, MA: Lexington Books.
DeGroot, M. (1974), " Reaching a consensus", Journal of the American Statistical
Association, Vol. 69 No.345, pp.118-21.
Edelman, H. & Bichman, E. (1980) A model of behaviour in fires applied to a nursing home
fire in Fires and Human Behaviour (Ed. Canter, D.) 181-204, Chichester: Wiley.
Eisenberg et al., (1975) Vulnerability Model. A Simulation Systems for Assessing Damage
Resulting from Marine Spills. Nat. Tech. Service Report, AD-A015-245, Springfield, VA
Elkins, H.B., (1952) Hydrogen Sulphide in The Chemistry of Industrial Toxicology, New York:
John Wiley & Sons, p 95 & 232.

55 ©OGP
RADD – Human factors in QRA

Embrey, D.E. (1986. SHERPA - a systematic human error reduction and prediction
approach. Paper presented at the International Topical Meeting on Advances in Human
Factors in NuclearPower Systems, Knoxville, Tennessee.
Ergonomics, 33 (10/11), 1365-1375.
ESCAPE, DNV Technica
Evacuation Model, Railway Gazette International, Vol 149, no 10, October 1993, p. 713
Evans, C.L., 1967. The toxicity of Hydrogen Sulphide and other Sulphides in Journal of
Experimental Physiology, 52 (3), p 231.
Fahy R.F., EXIT89: an evacuation model for high-rise buildings. In: Fire Safety Science -
proceedings of the third international symposium, London. Elsevier, 1991, p 815-823,
ISBN 1851667199
FARLIFE, Four Elements, 1993
Fruin, J.J. (1970) Designing for pedestrians - A level of service concept. Ph.D. Dissertation,
The Polytechnic Institute of Brooklyn, June, 1970.
Gafafer, W.M. Ed. (1964) Hydrogen Sulphide, in Occupational Diseases: A Guide to their
Recognition, Public Health Service Publication. No. 1097, US Department of Health,
Education and Welfare, Washington, DC, p 163.
Gibson, H., Basra, G., and Kirwan, B. Development of the CORE-DATA database. Safety
& Reliability Journal, Safety and Reliability Society, Manchester, 19, 1, 6-20, 1999.
Grandjean, E & Kroemer, K.H.E. (1999. (5th Ed.) Fitting To The Task; A Textbook Of
Occupational Ergonomics. Taylor & Francis: London.
Haggard, H.W., 1928. The Toxicology of Hydrogen Sulphide, Journal of Industrial Hygiene,
7, p 113
Health and Safety Executive (1996. Collection of Offshore Human Error Probability Data -
Volume 1: Main Report; Volume 2: Appendices. Health & Safety Executive, London,
Offshore Technology Report - OTO 95 037.
Herd C.J., Jones R.H., Lewis K., Evacuation, escape and rescue analysis by integrated risk
assessment. In: Risk analysis in the offshore industry II, Aberdeen, 25-27 March 1991.
IBC Technical Services.
HFRG (1995. Improving compliance with safety procedures: reducing industrial
violations. HSE Books.
Himann, Cunningham, Rechnitzer & Paterson, 1988
Hollnagel, E. (1993. Human Reliability Analysis: Context and Control. London: Academic
Press.
HSE (1997. Successful Health and Safety Management (HSG65. HSE Books.
HSE (1998), Assessment principles for Offshore Safety Cases, HSG181, HSE Books,
Norwich.
HSE (2001), Human Factors for COMAH Safety Report Assessors, HID Central Division
Human Factors Team.
Human factors: Inspectors human factors toolkit.
http://www.hse.gov.uk/humanfactors/comah/toolkit.htm

©OGP 56
RADD – Human factors in QRA

Humphreys, P. (1988. Human reliability assessors guide: an overview. In B.A. Sayers


(Ed.), Human Factors and Decision Making: Their Influence on Safety and Reliability. London:
Elsevier Applied Science, pp. 71-86.
Humphreys, P. (Ed.) (1995. Human Reliability Assessors Guide: A Report By The Human
Factors In Reliability Group. SRD Association, Warrington.
Johnstone, R.T. and Saunders, W.B. (Eds.) (1960). Noxious Gases: Hydrogen Sulphide
(H2S) in Occupational Diseases and Industrial Medicine, W.B. Saunders, Philadelphia, p
115.
Jones, J.P., (1975) Hazards of Hydrogen Sulphide Gas, Selected Papers from the 23rd
Annual Gas Measurement Institute, 16.
Ketchell N., et al, When and how will people muster. In: Response to incidents offshore, 8-
9 June 1993, Aberdeen, IBC Technical Services
Kirwan, B & Ainsworth, L.K. (1992. A Guide To Task Analysis. Taylor & Francis: London.
Kirwan, B. (1988. A comparative evaluation of five human reliability assessment
techniques. In B.A. Sayers (Ed.), Human Factors and Decision Making: Their Influence on
Safety and Reliability. London: Elsevier Applied Science, pp. 87-109.
Kirwan, B. (1992. Human error identification in human reliability assessment. Part 1:
Detailed comparison of techniques. Applied Ergonomics, 23 (6), 371-381.
Kirwan, B. (1996. The validation of three Human Reliability Quantification techniques -
THERP, HEART and JHEDI: Part I - Technique descriptions and validation issues.
Applied Ergonomics, 27 (6), 359-373.
Kirwan, B. (1997. The validation of three Human Reliability Quantification techniques -
THERP, HEART and JHEDI: Part III - Practical aspects of the usage of the techniques.
Applied Ergonomics, 28 (1), 27-39.
Kirwan, B. (1997. Validation of Human Reliability Assessment techniques: Part 1 –
Validation issues. Safety Science, 27 (1), 25-41.
Kirwan, B. (1997. Validation of Human Reliability Assessment techniques: Part 2 –
Validation results. Safety Science, 27 (1), 43-75.
Kirwan, B. (1998. Human error identification techniques for risk assessment of high risk
systems - Part 1: review and evaluation of techniques. Applied Ergonomics, 29 (3), 157-
177.
Kirwan, B. (1998. Human error identification techniques for risk assessment of high-risk
systems - Part 2: towards a framework approach. Applied Ergonomics, 29 (5), 299-318.
Kirwan, B. Basra, G. Taylor-Adams, S.E, CORE-DATA: a computerised human error
database for humanreliability support., Human Factors and Power Plants, 1997. 'Global
Perspectives of Human Factors in Power Generation'., Proceedings of the 1997 IEEE
Sixth Conference, 1997, On page(s): 9/7-912
Kirwan, B., Gibson, H., Kennedy, R., Edmunds, J., Cooksley, G. And Umbers, I. (2004)
Nuclear Action Reliability Assessment (NARA): A data-based HRA tool. In Probabilistic
Safety Assessment and Management 2004, Spitzer, C., Schmocker, U., and Dang, VN
(Eds), London, Springer, pp 1206-1211.
Kirwan, B., Kennedy, R., Taylor-Adams, S., Lambert, B. (1997. The validation of three
Human Reliability Quantification techniques - THERP, HEART and JHEDI: Part II -
Results of validation exercise. Applied Ergonomics, 28 (1), 17-25.

57 ©OGP
RADD – Human factors in QRA

Kirwan, B., Scannali, S. and Robinson, L. (1996. Applied HRA: A case study. Applied
Ergonomics, 27 (5), 289 - 302.
Kisko T.M., Francis R.L., Noble C.R., EVACNET+ User’s Guide, Gainesville, Florida:
University of Florida Department of Industrial and Systems Engineering, April 1984
Kovac, J.G., Vaught, C., Branich Jr., M.J., Probability of making a successful mine escape
while wearing a self-contained self rescuer, Journal of the International Society for
Respiratory Protection, Vol 10, Issue 4.
Krockeide, G. (1988) An introduction to luminous escape systems in Safety in the Built
Environment (Ed. Sime, J.D.) p 134-146.
Meshkati, N., Hancock, P.A., Rahimi, M. and Dawes, S.M. (1995. Techniques in mental
workload assessment. In J.R. Wilson an E.N. Corlett, Evaluation of Human Work. London:
Taylor and Francis. Concise description of techniques for mental workload assessment.
MUSTER, DNV Technica.
Patty, F.A., Ed. (1963) Hydrogen Sulphide, in Industrial Hygiene and Toxicology, Volume 2
New York: Interscience.
Pauls, J. (1980) Building Evacuation: research findings and recommendations in Fires and
Human Behaviour (Ed. D. Canter), John Wiley & Sons, Chichester, p251-275.
Pheasant, S, Bodyspace: Anthropometry, Ergonomics and the Design of the Work, Second
Edition 1996
Poda, G.A., (1966) Hydrogen Sulphide can be Handled Safely in Arch. Environmental
Health, 12, p 795.
Reason, J. (1990. A systems approach to organisational error. Ergonomics, 38 (8), 1708-
1721.
Reason, J. (1999. Managing The Risks Of Organisational Accidents. Ashgate: USA.
Reidel, D. (1982) Risk analysis of Six Potentially Hazardous Industrial Objects in the
Rijnmond Area: A Pilot Study, A report to the Rijnmond Public Authority, Dordrecht ("The
COVO Study".
Senders, J.W. and Moray, N.P. (1991. Human Errors: Cause, Prediction, and Reduction.
Hillsdale, New Jersey: Lawrence Erlbaum.
Shepherd, A. (2001. Hierarchical Task Analysis. London: Taylor and Francis. A well-written
and illustrated guide to HTA including methodology and application to design,teams and jobs,
information and skill, training, support documentation and human resource management.
Shorrock, S.T. and Hughes, G.J. (2001. Let's get real: How to assess human error in
practice. IBC seminar on human error techniques, October 2001, London.
Shorrock, S.T., Kirwan, B., MacKendrick, H. and Kennedy, R. (2001. Assessing human
error in Air Traffic Management systems design: Methodological issues. Le Travail
Humain, 64 (3), 269-289.
Siegel, S. (1956. Nonparametric Statistics for the Behavioral Sciences. McGraw-Hill Book
Company, Inc., New York.
Taylor-Adams, S.T., and Kirwan, B. Human Reliability Data Requirements. International
Journal of Quality & Reliability Management, 12, 1 24-46, 1995.
Tong, D. & Canter, D. (1985) The decision to evacuate: A study of the motivations which
contribute to evacuation in the event of fire Fire Safety Journal, 9, 257-265.

©OGP 58
RADD – Human factors in QRA

US National Institute for Occupational Safety and Health (1977) Criteria for a
recommended standard occupational exposure to Hydrogen Sulphide, DHEW (NIOSH)
Publication Number 77-158.
Waagenaar, W.A. and Reason, J.T. (1990. Types and Tokens in Accident Causation.
Waters, T. (1988. Human Factors reliability benchmark exercise, report of the SRD
participation. In B.A. Sayers (Ed.), Human Factors and Decision Making: Their Influence on
Safety and Reliability. London: Elsevier Applied Science, pp. 87-109.
Whittingham, B. (1993) Human Factors in QRA - Data and Methodology. pp. 93-118 in
proceedings of the E&P Forum Workshop on Data in Oil and Gas Quantitative Risk
Assessments, December 1993, Report no. 11.7/205 Jan 1994.
Wickens, C. D. et al (1998. An Introduction to Human Factors Engineering. Longman: New
York.
Wickens, C.D. (1992. Engineering Psychology and Human Performance (Second Edition.
New York: Harper Collins. Contains chapter on attention, time-sharing and workload.
Williams, J.C. (1986. HEART - a proposed method for assessing and reducing human
error. In Ninth Advances in Reliability Technology Symposium, University of Bradford.
Williams, J.C. (1992. Toward an improved evaluation tool for users of HEART.
Proceedings of the International Conference on Hazard Identification, Risk Analysis,
Human Factors and Human Reliability in Process Safety, Orlando, February, Chemical
Centre for Process Studies (CCPS.
Wilson, J.R & Corlett, N.E. (1999. (2nd Ed.) Evaluation Of Human Work. Taylor & Francis:
London.
Wilson, J.R. and Corlett, E.N. (1995) (Eds. Evaluation of Human Work. London: Taylor and
Francis. A classic guide to Human Factors methodology. Highly comprehensive, covering all
aspects of Human Factors assessment methods. Includes a chapter on Task Analysis by
Stammers and Shepherd.
Wong, S. et al., Risk sensitivity to human error in the LaSalle PRA, NUREG CR/-5527,
U.S. Nuclear Regulatory Commission, Washington, DC., 1990
Yant, W.P., 1930. Hydrogen Sulphide in Industry: Occurrence, Effects and Treatment in,
American Journal of Public Health, 20, p 598.

59 ©OGP
Risk Assessment Data Directory

Report No. 434 – 6.1


March 2010

Ignition
probabilities
International Association of Oil & Gas Producers
RADD – Ignition probabilities

contents
1.0 Introduction ........................................................................ 1
2.0 Summary of Recommended Data ......................................... 1
2.1 Ignition Probability Curves ......................................................................... 1
2.2 Blowout Ignition Probabilities .................................................................. 16
3.0 Guidance on use of data .................................................... 17
3.1 General Validity.......................................................................................... 17
3.2 Alternative Approaches ............................................................................ 17
3.2.1 Releases addressed by datasheets in Section 2.0 ............................................ 17
3.2.2 Other releases ....................................................................................................... 20
3.3 Uncertainties .............................................................................................. 20
4.0 Review of data sources ...................................................... 20
5.0 Recommended data sources for further information ........... 22
6.0 References ......................................................................... 22

©OGP 1
RADD – Ignition probabilities

Abbreviations
FPSO Floating Production Storage and Offloading (Installation)
LPG Liquefied Petroleum Gas
NAP Normal Atmospheric Pressure
NUI Normally Unmanned Installation
QRA Quantitative Risk Assessment
UKOOA United Kingdom Offshore Operators Association

2 ©OGP
RADD – Ignition probabilities

1.0 Introduction
The data presented in section 2 provide estimates of the probabilities of hydrocarbon
releases igniting to result in an explosion and/or a sustained fire. These data may be
applied to any on the leak types described in the Process Release Frequencies
datasheet1.
The values presented relate to “total” ignition probability, which can be considered as
the sum of the probabilities of immediate ignition and delayed ignition. Immediate
ignition can be considered as the situation where the fluid ignites immediately on
release through auto-ignition or because the accident which causes the release also
provided an ignition source. Delayed ignition is the result of the build-up of a
flammable vapour cloud which is ignited by a source remote from the release point. It
is assumed to result in flash fires or explosions, and also to burn back to the source
of the leak resulting in a jet fire and/or a pool fire.
These probabilities are considered appropriate for use in QRA studies where a
relatively coarse assessment is acceptable. Section 3.2 refers to a more detailed
approach for QRAs where this is considered to be required.

2.0 Summary of Recommended Data


2.1 Ignition Probability Curves
Data presented in this section come in the form of 28 mathematical functions drawn
from the UKOOA look-up correlations (see section 4.0) which relate ignition
probabilities in air2 to release rates for typical scenarios both onshore and offshore.
The various scenarios are summarised in Table 2.1,

1
With the exception of “zero pressure” releases, where the limited inventory and hence cloud
size would result in a lower ignition probability than would be predicted using this approach.
2
Ignition probabilities in other atmospheres, e.g. oxygen enriched or chlorine, are outside the
scope of this datasheet.

©OGP 1
RADD – Ignition probabilities

Table 2.2 and Table 2.3. The functions themselves are given in both tabular and
graphical form in the data sheets which follow.
The curves of ignition probability vs. release rate comprise between two and four
sections, each a straight line when plotted on log-log axes.
These curves represent “total” ignition probability. The method assumes that the
immediate ignition probability is 0.001 and is independent of the release rate. As a
result, all the curves start at a value of 0.001 relating to a release rate of 0.1 kg/s.
Users of the data may wish to adopt this value and to obtain delayed ignition
probabilities by subtracting 0.001 from the total ignition probability, e.g. an ignition
probability value of 0.004 obtained from the look-up correlations can be considered as
an immediate ignition probability of 0.001 and a delayed ignition probability of 0.003.

2 ©OGP
RADD – Ignition probabilities

Table 2.1 Onshore Ignition Scenarios

Scenario
Look-up Release Type Application
No.
1 Pipe Liquid Industrial Releases of flammable liquids that do not have any significant flash fraction (10% or less) if
(Liquid Releases from onshore released from onshore cross-country pipelines running through industrial or urban areas.
pipeline in industrial area)
2 Pipe Liquid Rural Releases of flammable liquids that do not have any significant flash fraction (10% or less) if
(Liquid Releases from onshore released from onshore cross-country pipelines running through rural areas.
pipeline in industrial area)
3 Pipe Gas LPG Industrial Releases of flammable gases, vapour or liquids significantly above their normal (Normal
(Gas or LPG release from Atmospheric Pressure (NAP)) boiling point from onshore cross-country pipelines running
onshore pipeline in an through industrial or urban areas.
industrial area)
4 Pipe Gas LPG Rural Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
(Gas or LPG release from point from onshore cross-country pipelines running through rural areas.
onshore pipeline in a rural area)
5 Small Plant Gas LPG Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
(Gas or LPG release from small point from small onshore plants (plant area up to 1200 m2, site area up to 35,000 m2).
onshore plant)
6 Small Plant Liquid Releases of flammable liquids that do not have any significant flash fraction (10% or less) if
(Liquid release from small released from small onshore plants (plant area up to 1200 m2, site area up to 35,000 m2) and
onshore plant) which are not bunded or otherwise contained.
7 Small Plant Liquid Bund Rural Releases of flammable liquids that do not have any significant flash fraction (10% or less) if
(Liquid release from small released from small onshore plants (plant area up to 1200 m2, site area up to 35,000 m2) and
onshore plant where the spill is where the liquid releases from the plant area are suitably bunded or otherwise contained.
bunded)
8 Large Plant Gas LPG Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
(Gas or LPG release from large point from large onshore outdoor plants (plant area above 1200 m2, site area above 35,000
onshore plant) m2).
9 Large Plant Liquid Releases of flammable liquids that do not have any significant flash fraction (10% or less) if
(Liquid release from large released from large onshore outdoor plants (plant area above 1200 m2, site area above 35,000
onshore plant) m2) and which are not bunded or otherwise contained.
10 Large Plant Liquid Bund Rural Releases of flammable liquids that do not have any significant flash fraction (10% or less) if
(Liquid Released from large released from large onshore outdoor plants (plant area above 1200 m2, site area above 35,000
onshore plant where spill is m2) and where the liquid releases from the plant area are suitably bunded or otherwise
bunded) contained.

©OGP 3
RADD – Ignition probabilities

Scenario
Look-up Release Type Application
No.
11 Large Plant Congested Gas Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
LPG point from large onshore plants (plant area above 1200 m2, site area above 35,000 m2), where
(Gas or LPG released from a the plant is partially walled/roofed or within a shelter or very congested.
large confined or congested
onshore plant)
12 Tank Liquid 300m x 300m Bund Releases flammable liquids that do not have any significant flash fraction (10% or less) if
(Liquid release from a large released from very large onshore outdoor storage area 'tank farm' (e.g. spill in a large multi-
confined or congested onshore tank bund over 25,000 m2 area).
plant) See curve No. 30 “Tank Liquid – diesel, fuel oil’ if liquids are stored at ambient conditions
below their flash point.
13 Tank Liquid 100m x 100m Bund Releases of flammable liquids that do not have any significant flash fraction (10% or less) if
(Liquid release from onshore released from onshore outdoor storage area 'tank farm' (e.g. spill in a large tank bund
tank farm where spill is limited containing four or fewer tanks, or any other bund less than 25,000 m2 area).
by small or medium sized bund) See curve No. 30 “Tank Liquid – diesel, fuel oil’ if liquids are stored at ambient conditions
below their flash point.
14 Tank Gas LPG Plant Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
(gas or LPG release from point from onshore outdoor storage tanks located in a 'tank farm' entirely surrounded by
onshore tank farm within the plants. For tank farms adjacent to plants use curve No. 15 “Tank Gas LPG Storage Industrial”
plant) or Curve No. 16 “Tank Gas LPG Storage Only Rural” look-up correlations. Releases from
process vessels or tanks inside plant areas should be treated as plant releases.
15 Tank Gas LPG Storage Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
Industrial point from onshore outdoor storage tanks located in a 'tank farm' adjacent to plants or
(Gas or LPG released from situated away from plants in an industrial or urban area.
onshore tank farm sited
adjacent to a plant or away from
the plant in an industrial area)
16 Tank Gas LPG Storage Only Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
Rural point from onshore outdoor storage tanks located in a 'tank farm' adjacent to plants or
(Gas or LPG released from situated away from plants in a rural area.
onshore tank farm sited
adjacent to a plant or away from
the plant in an industrial area)
Source: Energy Institute [1]

4 ©OGP
RADD – Ignition probabilities

Table 2.2 Offshore Ignition Scenarios

Scenario
Look-up Release Type Application
No.
17 Offshore Process Liquid Releases of flammable liquids that do not have any significant flash fraction (10% or less) if
(Liquid release from offshore released from within offshore process modules.
process module)
18 Offshore Process Liquid NUI Releases of flammable liquids that do not have any significant flash fraction (10% or less) if
(Liquid release from offshore released from within offshore process modules or decks on NUIs.
process area on NUI)
19 Offshore Process Gas Open Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
Deck NUI point from an offshore process weather deck/ open deck on NUIs. Can also be used for
(Gas release from offshore open/uncongested weather decks with limited process equipment on larger attended
process open deck area on NUI) integrated platforms.
20 Offshore Process Gas Typical Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
(Gas release from typical point from within offshore process modules or decks on integrated deck / conventional
offshore process module) installations). Process modules include separation, compression, pumps, condensate
handling, power generation, etc. If the module is mechanically ventilated or very congested –
see curve No. 22 “Offshore Process Gas Congested or Mechanical Vented Module”.
21 Offshore Process Gas Large Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
Module point from within large offshore process modules or decks on integrated deck / conventional
(gas release from typical installations (module greater than 1000 m2 floor area). Process modules include separation,
offshore process module) compression, pumps, condensate handling, power generation, etc. If the module is
mechanically ventilated or very congested – see curve No. 22 'Offshore Process Gas
Congested or Mechanical Vented Module'.
22 Offshore Process Gas Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
Congested or Mechanical point from within offshore process modules or decks on integrated deck / conventional
Vented Module installations: applies where the module is enclosed and has a mechanical ventilation system
(Gas released from a or is very congested (volume blockage ratio => 0.14 and less than 25% of area of the end
mechanically ventilated or very walls open for natural ventilation)
congested offshore process
module)
23 Offshore Riser Releases from offshore installation risers in the air gap area where there is little chance of the
(Gas release from typical release entering process areas on the installation (e.g. solid decks, wind walls). Applies to
offshore riser in air gap) partial flashing oil or gas releases.
May also be used for blowouts with well positioned diverters directing any release away from
the installation (see also curve No. 27 “Offshore Engulf – blowout riser”).

©OGP 5
RADD – Ignition probabilities

Scenario
Look-up Release Type Application
No.
24 Offshore FPSO Gas Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
(Gas release from offshore point from within offshore process modules or decks on FPSOs. See curve No. 25 “offshore
FPSO process module) FPSO Gas Wall” if the release is from an area downwind of a transverse wall across the FPSO
deck.
25 Offshore FPSO Gas Wall Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling
(Gas release from offshore point from within offshore process modules or decks on FPSOs. This correlation applies if
FPSO process module behind a the release is from an area downwind of a transverse wall across the FPSO deck.
transverse solid wall)
26 Offshore FPSO Liquid Releases of flammable liquids that do not have any significant flash fraction (10% or less) if
(Liquid release from typical released from within offshore process modules or decks on FPSOs
offshore FPSO process
module)
27 Offshore Engulf – blowout – Releases from drilling or well working blowouts or riser failures under open grated deck
riser areas where the release could engulf the entire installation and reach into platform areas:
(Major release which can engulf applies to partial flashing oil or gas releases. (see also curve No. 23 “Offshore Riser” for riser
an entire offshore installation) releases and blowouts with divertors)
Source: Energy Institute [1]
Note. Curve Nos. 28 and 29 related to Cox, Lees and Ang formulation which were included in the document for comparison

Table 2.3 Special (Derived) Ignition Scenarios

Scenario Look-up Release Type Application


No.
30 Tank Liquid – diesel fuel oil Releases of combustible liquids stored at ambient pressure and at temperatures below their
(Liquid Release from onshore flash point (e.g. most gas, oil, diesel and fuel oil storage tanks) from onshore outdoor storage
tank farm of liquids below their area “tank farm”. This look-up correlation can be applied to releases from tanks and low
flash point, e.g. diesel or fuel pressure transfer lines or pumps in the tank farm/ storage area. However, it should not be
oil) used for high-pressure systems (over a few barg): in these situations use curve No. 12 “Tank
Liquid 300m x 300m Bund” or curve No. 13 “Tank Liquid 100 x 100m Bund”
Source: Energy Institute [1]

6 ©OGP
RADD – Ignition probabilities

Data Sheet 1: Scenarios 1 – 4

©OGP 7
RADD – Ignition probabilities

Data Sheet 2: Scenarios 5 – 7

8 ©OGP
RADD – Ignition probabilities

Data Sheet 3: Scenarios 8 – 11

©OGP 9
RADD – Ignition probabilities

Data Sheet 4: Scenarios 12, 13 & 30

10 ©OGP
RADD – Ignition probabilities

Data Sheet 5: Scenarios 14 – 16

©OGP 11
RADD – Ignition probabilities

Data Sheet 6: Scenarios 17 & 18

12 ©OGP
RADD – Ignition probabilities

Data Sheet 7: Scenarios 19 – 22

©OGP 13
RADD – Ignition probabilities

Data Sheet 8: Scenarios 24 – 26

14 ©OGP
RADD – Ignition probabilities

Data Sheet 9: Scenarios 23 & 27

©OGP 15
RADD – Ignition probabilities

Notes:
1. A flammable substance above its auto-ignition temperature is likely to ignite on
release and should be modelled as having an ignition probability of one.
2. Very reactive substances are unlikely to found in oil and gas processing
operations but if present it is suggested that the values given in the look-up
correlations are doubled, subject to a maximum of 1. Such substances include
hydrogen, acetylene, ethylene oxide and carbon disulphide.
3. High flash point (>55°C) liquids stored at or near ambient conditions are
significantly less likely to ignite than suggested in the look-up correlations. It is
suggested that an ignition probability from the look-up correlations is multiplied by
a factor of 0.1 subject to a minimum of 0.001 and taking account of the 0.001
immediate ignition probability.
4. For liquids with flash fractions above 10% it is suggested that the ignition
probability is estimated by combining the relevant liquid ignition probability with a
suitable gas/LPG ignition probability. The appropriate release rates should be
obtained from the flash fraction, e.g. a 10 kg/s release with a 20% flash fraction
should give rise to an equivalent 2 kg/s gas release and 8 kg/s liquid release.
The two probabilities can be combined using the following equation;

Alternatively the higher of the two ignition probabilities can be used on the basis
that the areas covered by the liquid and gas are likely to have considerable
overlap.
5. Since the correlations are based on typical combinations of ignition sources, it
follows that they should not be used in situations where particularly strong
sources such as fired heaters are present. In this case the full UKOOA ignition
model is more appropriate.

2.2 Blowout Ignition Probabilities


An alternative to the blowout ignition probabilities given by the UKOOA look-up
correlations can be obtained from Scandpower’s interpretation of the blowout data
provided by SINTEF 2. This is given in Table 2.4. The most significant category is that
for deep blowouts which indicates an early ignition probability of 0.09. For the
purposes of QRA studies this can be taken as occurring immediately on release. The
report also gives a delayed ignition probability of 0.16 although all of these are taken
to occur more than one hour after the start of the release. Conservatively, this could
be taken as occurring shortly after the initial release and result in an explosion.

Table 2.4 Ignition Probabilities for Blowouts and W ell Releases on


Platform s

Release Type Early ignition Delayed Very Delayed


(< 5 min) ignition ignition (> 60 min)
(5 – 60 min)
Shallow Gas Blowout 0.07 0.11 0.07
Deep Blowout 0.09 - 0.16
Deep Well Release 0.03 - -

16 ©OGP
RADD – Ignition probabilities

3.0 Guidance on use of data


3.1 General Validity
The correlations are considered to provide an acceptable approach for use in typical
QRA studies. For more detailed analysis it is recommended that the full spreadsheet
UKOOA ignition model is used so that the specific circumstances with regard to
layout and ignition sources can be more accurately represented.
The correlations were developed for UKOOA member companies with the intention of
providing representative probabilities for installations operating in UK waters. They
may be applied to the analysis of hydrocarbon releases in other regions which comply
with recognised industry good practice, as it is applied in the UKCS.
The forward to the Energy Institute report states that the model and look-up
correlations “are not suited to the ignition probability assessment of refrigerated
liquefied gases, vapourising liquid pools, sub-sonic gas releases, or non-momentum
driven releases, such as those following catastrophic storage vessel failure.”
Despite this note, flashing liquid releases are covered by a number of the correlations
and analysts may further modify them by combining them with a gas or LPG ignition
probability in suitable proportions as suggested in note 4 of section 2.1. Atmospheric
storage tanks are dealt with in the Storage Incident Frequencies data sheet. Low
momentum and sub-sonic gas releases are uncommon in process systems. An
approach to the scenarios for which the correlations are not valid is suggested in
Section 3.2.2.
3.2 Alternative Approaches
3.2.1 Releases addressed by datasheets in Section 2.0
The initial task for the analyst is to determine which of the scenarios given in Table 2.1
to

©OGP 17
RADD – Ignition probabilities

Table 2.2 and Table 2.3 best matches the scenario under consideration. There may be
situations where the scenario under consideration lies between two of the described
scenarios, in which case the analysts may attempt to interpolate between two curves.
The data presented in the tables in Section 2.0 can be used in three ways:
1. Estimate from the graphs
2. Obtain probability based on the tabulated values
3. Use values in Table 3.1 to calculate the probability. Note that, in interpolating
between the data points, it is necessary to take logarithms of the release rate and
probabilities, interpolate between these to find the logarithm of the required
probability and then obtain the value itself, i.e.:

where Pign is the required ignition probability corresponding to release rate Q


is the ignition probability at a release rate of Qlower (the lower bound of
the relevant curve section), and
is the ignition probability at a release rate of Qupper (the upper bound of
the relevant curve section)
The third of these options is the recommended approach and the analyst may find it
convenient to construct a spreadsheet or some other computer programme to carry
this out.
The data used to generate the lines on the graphs in the datasheets (Section 2.1) are
shown in Table 3.1. This has been derived from Table 2.9 in the Institute of Energy
report 1, which provides further explanation on the derivation of the lines. This
specifies the release rates and ignition probabilities relating to each of the points
bounding the segments as indicated in Figure 3.1. Some information on the timing of
ignitions is also available in 1.

Figure 3.1 Typical Ignition Probability Curve

18 ©OGP
RADD – Ignition probabilities

A more accurate assessment may be obtained by the use of the full UKOOA ignition
model which is described in 1. This has been implemented in a spreadsheet tool
which is made available on a CD which accompanies the report. This allows the user
to input specific data relating to release conditions, platform layout and ignition
sources. However, this requires more effort on the part of the analyst and the
availability of more installation specific data compared with the relative ease with
which the look-up functions can be used.

©OGP 19
RADD – Ignition probabilities

Table 3.1 Data for Look-up Correlations

Point 1 Point 2 Point 3 Point 4


Scenario Type Release Probability Release Probability Release Probability Release Probability
No. rate rate rate rate
1 Pipe Liquid Industrial 0.1 0.001 70.00 0.07
2 Pipe Liquid Rural 0.1 0.001 0.30 0.00 70.00 0.01
3 Pipe Gas LPG Industrial 0.1 0.001 1000.01 1.00
4 Pipe Gas LPG Rural 0.1 0.001 10.00 0.00 23408.55 1.00
5 Small Plant Gas LPG 0.1 0.001 1.00 0.00 3.00 0.01 498.99 0.60
6 Small Plant Liquid 0.1 0.001 1.00 0.00 100.00 0.10
7 Small Plant Liquid Bund Rural 0.1 0.001 1.00 0.00 8.05 0.01
8 Large Plant Gas LPG 0.1 0.001 1.00 0.00 260.00 0.65
9 Large Plant Liquid 0.1 0.001 1.00 0.00 109.99 0.13
10 Large Plant Liquid Bund Rural 0.1 0.001 1.00 0.00 42.49 0.05
Large Plant Congested Gas
11 0.1 0.001 1.00 0.00 70.00 0.43 325.03 0.70
LPG
12 Tank Liquid 300x300 Bund 0.1 0.001 1.00 0.00 7.00 0.00 519.62 0.12
13 Tank Liquid 100x100 Bund 0.1 0.001 1.00 0.00 7.00 0.00 49.03 0.02
14 Tank Gas LPG Plant 0.1 0.001 1.00 0.00 102.84 1.00
Tank Gas LPG Storage Only
15 0.1 0.001 1.00 0.00 100.00 0.23 988.11 1.00
Industrial
Tank Gas LPG Storage Only
16 0.1 0.001 1.00 0.00 10.00 0.02 52551.35 0.50
Rural
17 Offshore Process Liquid 0.1 0.001 100.00 0.02
18 Offshore Process Liquid NUI 0.1 0.001 24.73 0.01
Offshore Process Gas Open
19 0.1 0.001 1.00 0.00 31.42 0.03
Deck NUI
20 Offshore Process Gas Typical 0.1 0.001 3.00 0.01 37.01 0.04
Offshore Process Gas Large
21 0.1 0.001 5.00 0.03 30.00 0.05
Module
Offshore Process Gas
22 Congested or Mechanically 0.1 0.001 1.00 0.01 92.63 0.04
Vented Module
23 Offshore Riser 0.1 0.001 38.27 0.03
24 Offshore FPSO Gas 0.1 0.001 1.00 0.00 50.00 0.15
25 Offshore FPSO Gas Wall 0.1 0.001 0.30 0.00 10.00 0.15
26 Offshore FPSO Liquid 0.1 0.001 100.00 0.03
Offshore Engulf – Blowout -
27 0.1 0.001 100.00 0.10
Riser
Tank Liquid - Diesel and
30 Fuel Oil 0.1 0.001 1.00 0.00 7.00 0.00 25.55 0.00
20 ©OGP
RADD – Ignition probabilities

3.2.2 Other releases


As noted in Section 3.1, the UKOOA ignition model cannot be considered valid for all
types of release. In particular, it does not refrigerated releases that form evaporating
liquid pools.
Analysis of these and the other scenarios referred to there may require a more
fundamental treatment by calculating likely cloud sizes for the given release, material
and weather conditions and estimating the number and strength of ignition sources
which the flammable part of the cloud may reach. There is no generally recognized
method for determining ignition source strength for use in QRAs. Some values are
given in the “Purple Book” [3] but these are estimates based on engineering judgment
and do not have any more scientific basis.

3.3 Uncertainties
The assessment of ignition probability is subject to a large degree of uncertainty. The
spreadsheet model produced under phase I of the joint industry project is itself
subject to uncertainties in the analytical approach taken and in the data used. The
adoption of the lookup correlations based on this model introduces more
uncertainties because a compromise has to be made in selecting the most appropriate
curve and these curves themselves are approximations to the curves produced by the
model itself.
Ignition probabilities are influenced by design layout, the number and separation of
ignition sources, the quality of maintenance of equipment, and thereby the control of
ignition sources.
Despite these uncertainties, the approach is considered to be an advance on other
formulations which relate ignition probability to release rate only with no regard for
the presence of ignition sources, the nature of the fluids or the layout of the plant.

4.0 Review of data sources


The data presented in Section 2 are largely a reproduction of data from the Energy
Institute Research Report [1], published on behalf of the joint industry project
sponsors UKOOA (Now Oil and Gas UK), the HSE and the Energy Institute. The report
reviews existing models and develops a new model which could be applied to both
onshore and offshore scenarios. The work was undertaken in two phases. The first
phase involved developing a model for assigning ignition probabilities in QRA studies
and to further the understanding of scenario specific ignition probabilities. The work
was undertaken by AEA Technology (now ESR Technology) and co-ordinated by a
joint industry steering group drawn from UKOOA member representatives, the HSE
and consultants working in the field of onshore and offshore QRA.
The report summarised the current status of knowledge and research in the field of
ignition probability estimation in support of QRA. It evaluated this, together with the
usefulness of the UK HSE’s hydrocarbon release database as a basis to develop an
improved ignition model for use in QRA. The end result is a spreadsheet model for
estimating the ignition probability of process leaks offshore and also attempts to
include the capability to assess the ignition probability of most typical onshore
hydrocarbon leak scenarios. The spreadsheet attempts to model the ignition

©OGP 21
RADD – Ignition probabilities

probability by considering the size of the gas cloud which would be formed by the
release and taking into account the number and type of ignition sources which the
cloud, at sufficient concentration, might reach. As a result of the complexity of the
model, users are required to obtain and enter a significant amount of data relating to
the platform configuration and the distribution of ignition sources.
Having completed the work to establish a model, a second phase was commissioned
to consider representative scenarios which would generate look-up correlations which
could be used in QRA studies without the need for the user to gather the data required
for the full model. The following summarises the release types considered.
• Gas releases
• LPG (flashing liquefied gas) releases
• Pressurised liquid oil releases – leading to a spray release with flashing/
evaporation/ aerosol formation
• Low pressure liquid oil releases – leading to a spreading pool only (no aerosol
formation or flashing)
• Release rates from 0.1 to 1000 kg/s – (graphs shown in the data sheets are
extended to 10000 kg/s where the probability function does not reach a maximum
below 1000 kg/s)

The configurations considered are given in Table 2.1 to Table 2.3.


A large number of analyses were carried out to produce graphs of ignition probability
against release rate. Figure 4.1 shows a typical set of curves.
In the final stage of the process, groups of similar curves were considered and
grouped into the scenarios listed in Table 2.1 to Table 2.3. These scenarios were then
examined and a representative curve assigned to them. These curves consist of
between two and four segments each of which appears as a straight line when plotted
on logarithmic axes. It is these curves which are depicted in the data sheets.

Figure 4.1 Exam ple of Ignition Probability Curve Calculated by UKOOA


ignition m odel

Source: Energy Institute [1]

22 ©OGP
RADD – Ignition probabilities

Prior to the introduction of the UKOOA ignition model approach outlined above, the
formulation attributed to Cox, Lees and Ang 4 was widely used. This gained
acceptance largely because of the proportion of analysts using it rather than because
of the rigour of the theory underlying it. Ignition probabilities predicted by this
method were in excess of what was found to occur in practice and this was partly
responsible for instigating the work which resulted in the UKOOA ignition model.
References in this report to “UKOOA (spreadsheet) model” and “UKOOA look-up
correlations” relate respectively to the output from the two phases of the project [1].

5.0 Recommended data sources for further information


For further information, on the ignition probability curves presented in this document,
the Energy Institute report 1 should be consulted.

6.0 References
1. Ignition Probability Review, Model Development and Look-Up Correlations, Research
Report published by the Energy Institute, January 2006. ISBN 978 0 85293 454 8
2. Scandpower Risk Management AS 2006. Blowout and Well Release Frequencies –
Based on SINTEF Offshore Blowout Database, 2006, Report No. 90.005.001/R2.
3. Guidelines for quantitative risk assessment (Purple book), Part 1, Establishment,
CPR18 E, Committee for the Prevention of Disasters (CPR), National Institute of
Public Health and Environment (RIVM), Ministry of Transport, Public Works &
Water Assessment Management, AVIV Adviserend Ingenieurs Save Ingenieurs
(Adviesbureau), 1999.
4. Cox, Lees and Ang, 1991. Classification of Hazardous Locations, Rugby: Institution
of Chemical Engineers, ISBN 0 85295 258 9.

©OGP 23
Risk Assessment Data Directory

Report No. 434 – 7


March 2010

Consequence
modelling
International Association of Oil & Gas Producers
RADD – Consequence modelling

contents
1.0 Scope and Definitions ........................................................... 1
2.0 Summary of Recommended Approaches ................................ 1
2.1 Release modelling .......................................................................................... 3
2.1.1 Simple approaches to release modelling................................................................. 4
2.1.2 Software for release modelling ................................................................................. 6
2.1.3 Modelling Releases from Buried Pipelines.............................................................. 7
2.2 Dispersion and ventilation modelling ........................................................... 7
2.2.1 Simple approaches to dispersion modelling........................................................... 9
2.2.2 Software for dispersion modelling ......................................................................... 11
2.2.3 CFD for ventilation and dispersion modelling....................................................... 12
2.3 Fire and thermal radiation modelling.......................................................... 13
2.3.1 Simple approaches to fire and thermal radiation modelling................................ 14
2.3.2 Software for fire and thermal radiation modelling ................................................ 20
2.3.3 CFD for fire and thermal radiation modelling ........................................................ 20
2.4 Explosion modelling..................................................................................... 22
2.4.1 Simple approaches to explosion modelling .......................................................... 23
2.4.2 Software for explosion modelling........................................................................... 23
2.4.3 CFD for explosion modelling .................................................................................. 24
2.5 Smoke and gas ingress modelling.............................................................. 24
2.5.1 Simple approaches to smoke and gas ingress modelling ................................... 25
2.5.2 Software for smoke and gas ingress modelling.................................................... 26
2.5.3 CFD for smoke and gas ingress modelling ........................................................... 27
2.6 Toxicity modelling ........................................................................................ 27
2.6.1 Simple approaches to toxicity modelling .............................................................. 29
2.6.2 Software for toxicity modelling............................................................................... 29
2.6.3 CFD for toxicity modelling....................................................................................... 29
3.0 Guidance on use of approaches ........................................... 29
3.1 General validity ............................................................................................. 29
3.2 Uncertainties ................................................................................................. 30
3.3 Choosing the right approach for consequence modelling ....................... 30
3.4 Geometry modelling for CFD ....................................................................... 31
4.0 Review of data sources ....................................................... 32
5.0 Recommended data sources for further information ............ 32
6.0 References .......................................................................... 32
6.1 References for Sections ‎2.0 to ‎4.0 .............................................................. 32
6.2 References for other data sources.............................................................. 34

©OGP
RADD – Consequence modelling

Abbreviations:
BLEVE Boiling Liquid Expanding Vapour Explosion
CFD Computational Fluid Dynamics
CHRIS Chemical Hazards Reference Information System
CSTR Continuous Stirred Tank Reactor
CV Control Volume
DAL Design Accidental Load
DNV Det Norske Veritas
EU European Union
FV Finite Volume
HSE (UK) Health and Safety Executive
HVAC Heating, Ventilation and Air Conditioning
IDLH Immediate Danger to Life and Health
JIP Joint Industry Project
LDx Lethal Dose resulting in fatalities to x% of population
LFL Lower Flammable Limit (also known as Lower Explosive Limit, LEL)
LPG Liquefied Petroleum Gas
MSDS Material Safety Data Sheet
PDR Porosity, Distributed Resistance
QRA Quantitative Risk Assessment (sometimes Analysis)
SLOD Significant Likelihood of Death
SLOT Specified Level Of Toxicity
SVP Saturated Vapour Pressure
TNO Nederlandse Organisatie voor Toegepast Natuurwetenschappelijk
Onderzoek
(Netherlands Organization for Applied Scientific Research)
TR Temporary Refuge
UVCE Unconfined Vapour Cloud Explosion
VCE Vapour Cloud Explosion

©OGP
RADD – Consequence modelling

1.0 Scope and Definitions


Consequence modelling refers to the calculation or estimation of numerical values (or
graphical representations of these) that describe the credible physical outcomes of loss
of containment scenarios involving flammable, explosive and toxic materials with
respect to their potential impact on people, assets, or safety functions.
This datasheet presents (Section 2.0) recommended approaches to consequence
modelling for accidental releases of hazardous materials, with the potential to cause
harm to people, damage to assets and impairment of safety functions, from offshore
and onshore installations.
Consideration of environmental impacts is excluded, although the recommended
approaches to release modelling (in particular for liquids) may be applied to estimate
potential quantities of hydrocarbon spilt.
This datasheet is not intended to be a textbook of consequence modelling theory but
rather to indicate the consequence phenomena that need to be considered and to
provide guidance on modelling that is fit for purpose.

2.0 Summary of Recommended Approaches


This section addresses the following consequences of a loss of containment incident:
1. Release (discharge)
2. Dispersion in air and water
3. Fire and thermal radiation
4. Explosion
5. Smoke and gas ingress
6. Toxicity

Figure 2.1 illustrates and develops the relationship between many of these.
For each topic, guidance is given on some or all of the following possible approaches:
• Simple correlations or formulae
• General purpose consequence modelling software (see below)
• CFD (Computational Fluid Dynamics – see below)

Whichever approach is adopted, it should be used with an understanding of its range of


validity, its limitations, the input data required, the valid results that can be obtained, the
results’ sensitivity to the different input data, and how the results can be verified.

©OGP 1
RADD – Consequence modelling

Figure 2.1 Consequence Phenom ena and their Interrelationship

General Purpose Consequence Modelling Software


The main commercial general purpose consequence modelling packages are:
• CANARY, from Quest (http://www.questconsult.com/canary.html)
• EFFECTS, from TNO
(www.tno.nl/content.cfm?context=markten&content=product&laag1=186&laag2=267
&item_id=739)
• PHAST, from DNV
(http://www.dnv.com/services/software/products/safeti/SafetiHazardAnalysis/index.a
sp)
• TRACE, from Safer Systems (www.safersystem.com)

These model most of the consequences set out above apart from smoke. However, they
are designed for onshore studies and not all of the models included will be appropriate
for offshore use, in particular in enclosed modules. The sections below give guidance
on the appropriate use of these models.
In addition, there are freeware packages that can be downloaded for the internet but
these do not come with any training or support, or with any guarantee of code quality;

2 ©OGP
RADD – Consequence modelling

the commercial packages listed above do include these and come from reputable
organizations with quality management systems.
In addition, freeware “calculators” may be found for specific consequences (e.g.
BLEVE) but these suffer the same disadvantages listed above for general consequence
modelling.

Com putational Fluid Dynam ics


Computational Fluid Dynamics (CFD) can be used to obtain numerical solutions for
ventilation, dispersion and explosion problems for both offshore platforms and onshore
plants. CFD simulations are becoming increasingly common as the computing power of
standard desktop computers grows. The NORSOK standard Z-013 [21] specifies use of
CFD in its probabilistic approach to explosion risk assessment. The objective of the
probabilistic assessment is to generate realistic (representative) overpressures for an
area based on probabilistic arguments. Ventilation, gas leaks, dispersion as well as gas
explosions are considered by establishing probable explosion scenarios, performing
explosion simulations and establishing probability of exceedance curves.
The application of CFD for gas explosion studies is common for offshore platforms and
is increasingly used onshore in cases where the explosion risk is significant and a
better description of the physics is required in order to give a more robust estimate of
the risk.
CFD simulations essentially solve the conservation equations for mass, momentum and
enthalpy in addition to the equations for concentration and flammable gas effects. The
equations are generally closed using the κ−ε turbulence model. Most of the
commercially available CFD packages (see below) are based on the Finite Volume (FV)
method which uses an integral form of the conservation equations. Essentially, the
solution domain is subdivided into a number of control volumes (CV) at the centroid of
which lies a computational node where the variable values are calculated. The
conservation equations are applied to each CV and interpolation is used to express
variable values at the CV surface in terms of the centre values.
The most widely used commercially available CFD packages are:
• AutoReaGas, from Century Dynamics
(http://www.ansys.com/Products/autoreagas.asp)
• CFX, from ANSYS, Inc. (http://www.ansys.com/products/cfx.asp)
• FLUENT, now also from ANSYS, Inc. (http://www.fluent.com/)
• EXSIM, from EXSIM Consultants AS (http://www.exsim-consultants.com/)
• FLACS, from GexCon (http://www.gexcon.com/index.php?src=flacs/overview.html)
• Kameleon FireEx, from ComputIT (http://www.computit.no/)

2.1 Release modelling


Release modelling – also called discharge or source term modelling – is mainly used to
determine the rate at which a fluid is released to the environment in a loss of
containment incident, together with the associated physical properties (e.g.
temperature, momentum).
A simple approach is to calculate the initial rate and to assume that this is constant over
time. This is often used for studies of onshore facilities, especially where the offsite
risk is the motivation for the study.

©OGP 3
RADD – Consequence modelling

A more sophisticated approach is to model the time dependence of the release rate.
This is often used for studies of offshore facilities, where the time dependence has a
significant impact on the likelihood, in particular, of the initial event escalating. The
modelling required is more complex but avoids certain issues that arise when initial rate
modelling is used:
• Initial rate modelling can lead to over-prediction of the flammable/explosive mass in
a vapour cloud
• Initial rate modelling can lead to over-prediction of the size of a jet fire over time but
under-predict its duration or the time for which it exceeds a critical length (e.g. to
other equipment)
• Initial rate modelling can lead to over-prediction of the impact of toxic gas or smoke
effects

In general, time dependence should be explicitly modelled in offshore studies, where


the impacts over relatively short distances (tens of metres) and over time periods up to
the required endurance times of the TR (Temporary Refuge) and other safety functions,
which may be of the order of 1 hour, are of concern. Time dependence is less often
modelled in onshore studies, where the impacts over relatively long distances
(hundreds of metres to a few kilometres) and over time periods up to that required for
effective emergency action to commence. An exception to this is the modelling of
cross-country pipeline ruptures, for which time dependence may be important.

2.1.1 Simple approaches to release modelling


Where gas or non-flashing liquid would be released from an orifice, simple formulae
exist to calculate the initial rate, in particular Bernoulli’s equation for liquids (strictly,
incompressible fluids).
Some example release rates are shown in Figure 2.2, Figure 2.3 and Figure 2.4 for
selected representative materials. These were obtained using DNV’s PHAST software.
Equations for modelling time-varying releases of gas, including blowdown, are given in
the CMPT Guide to quantitative risk assessment for offshore installations [1]. This also
includes a simple method for calculating the flash fraction of a liquid such as
unstabilized crude.
Modelling releases from ruptured pipelines is rather more complex as the pipeline
pressure decreases away from the release point over time and so the flow rate
decreases with time, especially for gases. It is therefore normal to use software tools
for discharge modelling.

4 ©OGP
RADD – Consequence modelling

Figure 2.2 Release Rates for Natural Gas at 20°C

Figure 2.3 Release Rates for Propane at 20°C

Note: at 1 barg and 5 barg the releases are vapour; at higher pressures they are two-phase.

©OGP 5
RADD – Consequence modelling

Figure 2.4 Release Rates for Kerosene-type Liquid at 20°C (density = 714
kg/m 3 )

2.1.2 Software for release modelling


There is a range of software tools available that include release modelling. As with all
software, its range of validity and limitations need to be understood. For example, the
thermodynamics of mixtures may be modelled by an “average” equivalent pure
component. However, as computer power increases, this limitation is increasingly
being eliminated in favour of full multicomponent thermodynamics.
Software can model some or all of the following:
• Time-dependent releases, including inflow, isolation and blowdown
• Flashing liquid releases
− Releases that flash in the atmosphere as they are released
− Releases from vessels containing liquid that flashes as the pressure decreases
• Releases from vessels of different shapes and orientations
• Releases from long pipelines
These models are generally appropriate for use onshore and offshore.
When the fluid after release is two-phase, the modelling needs to predict the liquid
droplet size so that the amount of liquid that rains out (falls to the ground or water
surface) can be calculated as part of the dispersion modelling (Section 2.2).
SPT Group’s OLGA software (http://www.sptgroup.com/products/olga) can be used to
model time dependent releases from pipeline networks and includes multiphase flow
capability.
It should be noted that a release from a high pressure reservoir will normally be quite
complex with sonic flow, expansion and compression shocks. In safety studies, this

6 ©OGP
RADD – Consequence modelling

complex outflow is often not calculated and the boundary conditions for the jet are
given at surrounding pressure. Both the specified momentum and the temperature
(density) of this jet may be important for the dispersion simulation and thereby the
resulting gas cloud size. Often this boundary condition is specified as pure gas at sonic
velocity at surrounding pressure or lower. This is not conserving momentum and
should not be used when momentum is important for dispersion.

2.1.3 Modelling Releases from Buried Pipelines


Following a full bore rupture there will be flow from both sides of the break. The
consequences of a full bore rupture of a buried pipeline can be modelled as follows:
1. Initial high flow rate: consider immediate ignition as a fireball, using mass released
up to the time when this mass equals the fireball mass giving the same fireball
duration.
2. Ensuing lower flow rate(s): model dispersion and delayed ignition with low
momentum (velocity) as the flows from both sides of the break are likely to interact.

The following figure illustrates a possible simplification into quadrants of release


directions for a leak from a buried pipeline. The text beside suggests an approach to
modelling these for medium and large leaks, based on these having sufficient force to
throw out the overburden (and even concrete slabs, if placed on top).
1. Vertical release. Model as vertical release
(upwards) without modification of normal discharge
modelling output, i.e. full discharge velocity.
2, 3. Horizontal release. Model at angle of 45°
upwards with velocity of 70 m/s.
4. Downward release. Model as vertical release
(upwards) with low (e.g. 5 m/s) velocity to reflect loss of
momentum on impact with ground beneath.

For small horizontal or downward leaks, the force exerted by the flow is unlikely to
throw out the overburden, hence the flow will only slowly percolate to the surface. The
following approach is suggested for all release directions:
• Calculate discharge rate as normal.
• Remodel release with a very low pipeline pressure (1 barg for operating pressure
>10 barg, 0.1 barg for operating pressure < 10 barg), to simulate diffusion through
the soil, with the hole size modified to obtain the same discharge rate as above.

2.2 Dispersion and ventilation modelling


Dispersion modelling is used to determine how the fluid released spreads in the
environment: usually air but also water1.
• Onshore, dispersion is usually modelled for releases into the open air
• Offshore, modelling dispersion within an enclosed module is usually required;
modelling underwater releases (e.g. pipeline and flowline failures) is often also
needed.

1
Dispersion in soil is considered in environmental rather than safety risk studies and is outside
the scope of this datasheet.

©OGP 7
RADD – Consequence modelling

When a release is in the open air, several mechanisms may cause it to disperse. These
are illustrated in Figure 2.5. Not all releases go through all phases. A gas release on an
offshore platform may go directly from turbulent jet to passvie dispersion. A release
from a stack may be passive from the stack tip. The vapour in a release of refrigerated
LPG will be dense from the start.

Figure 2.5 Mechanism s of Atm ospheric Dispersion of Vapour

A vapour release inside an enclosed volume (a module of an offshore installation or a


building onshore) will mix with the air flowing through the volume. On offshore facilities
with enclosed modules, what is required for fire and explosion calculations is first of all
the size of the flammable/explosive cloud within the module. Onshore, the vapour cloud
may emerge from a vent or stack, already partially diluted, and then disperse in the
environment.
When the release is wholly or partially liquid, typically this will fall onto a solid surface
or through a grated deck to the sea below; on a solid surface it will spread out to form a
pool. At the same time, some of this liquid may vaporize, adding to any vapour in the
initial release, and will disperse in the atmosphere, as illustrated in Figure 2.6.
Dispersion modelling thus frequently has to be able to model all of these phenomena, in
addition to addressing the different mechanisms of atmospheric dispersion. The

8 ©OGP
RADD – Consequence modelling

relationship between many of these phenomena and mechanisms is illustrated in Figure


2.1.

Figure 2.6 Pool Vaporisation

2.2.1 Simple approaches to dispersion modelling


Very little dispersion modelling can validly be done using simple formulae. That which
can is as follows:
1. Passive (“Gaussian”) dispersion
2. Gas build-up in enclosed volumes
− Using a Continuous Stirred Tank Reactor (CSTR) model, when it is acceptable to
assume a uniform concentration throughout the volume (e.g. as source term for a
release from a vent or stack, or calculating toxic impact for people indoors)
− To calculate the quantity of flammable gas, for explosion modelling (see Section
2.4)
3. Oil pool spreading
4. Gas releases subsea.
The equations for passive dispersion, 1, can be found in standard texts on atmospheric
dispersion. The equations for 2 (CSTR model) and 3 are given in [1].
Two simplified methods have been developed to calculate the quantity of flammable gas
in an enclosed volume such as an offshore module (2). Section 4.2.3.1 of [2] presents a
simple equation valid when the ventilation flow field is close to uniform. A workbook
approach to estimating the flammable volume produced by a gas release [3, 4] has been
developed as part of the JIP on Gas Build Up from High Pressure Natural Gas Releases in
Naturally Ventilated Offshore Modules, sponsored by 10 operators and the UK HSE.
For gas releases subsea (4), a common assumption is that the diameter of the plume at
the sea surface is 20% of the water depth at the release point, regardless of the gas flow

©OGP 9
RADD – Consequence modelling

rate. This diameter together with the gas flow rate can then be used as input to a
Gaussian plume model.
Some example dispersion modelling results (distances to LFL) are given in Figure 2.7
and Figure 2.8. These were obtained using DNV’s PHAST software.

Figure 2.7 Dispersion Distances to LFL for Vapour Releases at 20°C

Note: “F1.5” refers to F stability, 1.5 m/s wind speed; “D5” refers to D stability, 5 m/s
wind speed.

10 ©OGP
RADD – Consequence modelling

Figure 2.8 Dispersion Distances to LFL for Two-Phase Propane Releases at


20°C

Note: “F1.5” refers to F stability, 1.5 m/s wind speed; “D5” refers to D stability, 5 m/s
wind speed.

2.2.2 Software for dispersion modelling


Atmospheric dispersion modelling software mainly divides into:
• “Box” models, which calculate vapour cloud dimensions and concentrations from
bulk properties.
• CFD models, which divide the “computational domain” representing the space
through which the fluid disperses, into small volume elements where physical
properties are calculated explicitly.
In general, plume models do not allow for the influence of terrain, assuming a flat,
unobstructed surface. Plume models cannot model well the near field characteristics of
dispersion within a congested or confined area such as an offshore module or the
middle of a process unit. However, for “far field” (i.e. in open areas) dispersion and
when numerous release cases need to be run, plume models are ideal.
The software used needs to be selected with an understanding of the phenomena
(identified in Section 2.2) likely to occur for the cases being modelled, to ensure that the
software can adequately model them. For example:
• A Gaussian plume model would not be appropriate for a gas release under pressure,
which will initially disperse as a turbulent jet (see Figure 2.5)
• For releases of pressurised LPG, rain-out and re-evaporation may need to be
modelled.
The results from dispersion modelling need to be examined to ensure they are sensible,
i.e. that they match expectations about their behaviour.

©OGP 11
RADD – Consequence modelling

FLOWSTAR, a model developed by CERC (www.cerc.co.uk/software/flowstar.htm) for


calculating profiles of the mean airflow and turbulence in the atmospheric boundary
layer, can calculate plume trajectory and spread in complex terrain and over variable
surface roughness. It is limited to passive dispersion (i.e. it cannot be used when fluid
momentum or density is significant) but its ability to model air flow over hilly terrain
may be useful. It is part of the widely accepted ADMS (Atmospheric Dispersion
Modelling System) suite of programs for air pollution modelling.
Other software packages such as CALPUFF and INPUFF are available, which are
especially suitable for mid- and far-field applications and for long (> 1 hour duration)
releases, however potential users should be aware of their limitations. HGSYSTEM
(www.hgsystem.com) is also well known as a freely available set of DOS-based
dispersion models.

2.2.3 CFD for ventilation and dispersion modelling


CFD’s main application in dispersion modelling for QRA is in explosion analysis, of
which ventilation and dispersion simulations are an important part.
In explosion analysis for offshore installations, the objective of the ventilation
simulations is to generate a ventilation distribution in terms of rate, direction and
probability. Based on this information, representative wind conditions are selected for
the dispersion simulations. The NORSOK Z-013 standard [21] recommends that at least
8 wind directions are considered for the ventilation simulations. Only one wind speed is
necessary as it is generally assumed that the ventilation rate for a wind direction is
proportional to the wind speed so that ventilation rates can be linearly scaled with wind
speeds. Also, the number of simulations may be reduced from symmetry
considerations.
The objective of the dispersion simulations in explosion analysis is to identify credible
size, concentration and location of gas clouds and establish how the flammable gas
clouds varies with the hazardous leak location, external wind speed and direction and
leak direction. Those representative gas clouds are subsequently used in the explosion
studies.
Generally, the number of parameters that can be varied is high (leak
locations/rates/directions, wind conditions) and it is unrealistic to simulate all possible
combinations so that a selection must be made. The NORSOK probabilistic approach
[21] recommends that at least 3 leak points with 6 jet directions and 1 diffuse leak
should be evaluated. At least one of the scenarios needs to consider leak orientation
against prevailing ventilation direction. It is, however, possible to reduce the number of
dispersion simulations based on symmetry considerations and the physics of the
problem.
Additionally, not all the identified scenarios (after consideration of symmetry and
engineering judgement) need to be simulated. The ‘frozen cloud’ concept can be used to
estimate the results of the scenarios not simulated. This is an assumption that gas
concentration scales with the leak rate and the inverse of the ventilation. The results
from the scenarios not simulated can then be obtained by altering the gas concentration
field in all control volumes by a constant factor. It is expected [26] that this assumption
will be reasonable in a ventilation dominated region (as opposed to a fuel dominated
region).

12 ©OGP
RADD – Consequence modelling

Although the NORSOK approach is for offshore installations, a similar approach can be
applied to explosion analysis for onshore installations. CFD modelling of ventilation
and dispersion is also useful for evaluating optimal geometry layout and location of gas
detectors [22,23]. CFD has also found some application in modelling dispersion in
complex topography (e.g. along a pipeline route), although it is not cost-effective to use
it routinely to model explicitly all scenarios typically represented in a QRA.

2.3 Fire and thermal radiation modelling


Fire modelling is typically used to calculate the flame dimensions for 2 purposes:
• As input to a thermal radiation model
• To determine whether a flame can reach a target for escalation (e.g. other
equipment)
It is important to understand the type of fire that can occur:
• Flash fire – an ignited vapour plume, whose dimensions are typically determined
directly from the dispersion modelling as the distance to LFL
• Jet fire – an intense, highly directional fire resulting from ignition of a vapour or
two-phase release with significant momentum
• Pool fire – from an ignited liquid pool2 or sea surface gas pool resulting from a
subsea gas release (e.g. from a pipeline or wellhead)
Offshore installations often have grated decks, so a liquid spill will fall through the
grating onto the sea surface. If ignited, the resulting sea fire may engulf one or more
legs of the installation as well as risers and conductors.
• Boilover – when a full surface fire occurs in an oil storage tank, heat will slowly
conduct downwards to any layer of water in the bottom of the tank; this will then
vaporise and the resulting expansion will hurl boiling oil upwards out of the tank.
• Fireball/BLEVE
Strictly, a BLEVE (Boiling Liquid Expanding Vapour Explosion) is simply explosively
expanding vapour or two-phase fluid. A BLEVE results from a “hot rupture” of a
vessel typically containing hydrocarbons such as LPG3, stored and maintained as a
liquid under pressure, due to an impinging or engulfing fire. A flammable material
will be ignited immediately upon rupture by the impinging/engulfing fire and will
burn as a fireball.
A fireball would also result from immediate ignition of a release resulting from cold
catastrophic rupture of a pressurised vessel.
The initial phase of a gas pipeline rupture should also be modelled as a fireball.
• Crater Fire – from ignition of a release from a buried pipeline. For vertical and
horizontal releases (see Section 2.1.3), the corresponding jet fire can be modelled.
For downward releases, the hole size corresponding to the low release velocity can
be taken as the diameter of a gas pool burning as a pool fire.

2
Note that it is not the liquid that burns but rather the vapour above it. The heat of the flame
vaporises the liquid beneath to provide the fuel supply.
3
BLEVEs of hydrocarbons up to butane or perhaps pentane are credible. A BLEVE of a vessel
containing a toxic material such as chlorine stored as a liquid under pressure is also credible
and should be considered if relevant. BLEVEs of heavier hydrocarbons such as crude oil or
petroleum do not occur.

©OGP 13
RADD – Consequence modelling

An appropriate model for the type of fire that could result from ignition of the release
being considered can be selected. This will also depend on the time/location of ignition:
for example, for a high momentum vapour release, ignition close to the source will
result in a jet fire; ignition at a point away from the source will result in a flash fire or
explosion (see Section 2.4), which may also burn back to a jet fire.
Whatever model is selected, the following parameters of the flame have to be
calculated:
• Flame dimensions
• Surface emissive power (not for a flash fire)
• Fireball only: duration (and possibly lift-off)

2.3.1 Simple approaches to fire and thermal radiation modelling


Some simple models for calculating flame dimensions are given in the sub-sections
below. Calculation of thermal radiation received by a target (e.g. a person) is not
straightforward, although an approximation can be used for a fireball due to its
spherical symmetry (see Section 0), and is best done using software. The simple flame
size models below are therefore best used either when only the flame dimensions are
required or to provide direct input to a flame radiation model.

2.3.1.1 Jet Fire


A simple correlation for the length L (m) of a jet flame due to Wertenbach [5]:
L = 18.5 Q0.41 [Q = mass release rate (kg/s)]
A generalised formula for different fuel types is [6]:
L = 0.00326 (Q Hc)0.478 [Hc = heat of combustion (J/kg)]
Based on calculations using the Chamberlain model [7], the following rough
relationships for distance along the flame axis to various thermal radiation levels have
been calculated:
• 37.5 kW/m2: 13.37 Q0.447
• 12.5 kW/m2: 16.15 Q0.447
• 5.0 kW/m2: 19.50 Q0.447

Some example jet fire thermal radiation results for horizontal releases are presented in
Figure 2.9 and Figure 2.10. These were obtained using DNV’s PHAST software, which
used the Chamberlain model [7].

14 ©OGP
RADD – Consequence modelling

Figure 2.9 Jet Fire Therm al Radiation Distances at Ground Level for
Propane Releases at 1 m Elevation

Figure 2.10 Jet Fire Therm al Radiation Distances at Ground Level for
Releases at 10 m Elevation

©OGP 15
RADD – Consequence modelling

2.3.1.2 Pool Fire


The diameter of an equilibrium pool fire (i.e. where all the fuel is being consumed as it is
released) is easily calculated by equating the mass release rate over the pool surface
with the burning rate. Burning rates for typical materials are given in Table 2.1.
The pool diameter D (m) is given by:

(assuming constant thickness of the pool)

Table 2.1 M ass Burning Rates for Selected Materials (29] unless indicated)

M aterial Mass Burning Burning velocity


Rate (kg/m 2 s) (m m /s)
Gasoline 0.05 0.07
Kerosene 0.06 0.07
Crude oil 0.05 0.07
Hexane1 0.08 0.11
Butane 0.08 0.13
LNG 0.14 on land [30] 0.242
0.24 on water [30] 0.422
LPG 0.11 on land 0.21
0.22 on water 0.42
Notes
1. Condensate may be taken as similar to hexane.
2. Calculated from mass burning rate using typical density of 450 kg/m3

Note that a pool fire’s size may be constrained by a bund (dike) or drainage, and also
that process areas are often constructed with the floor sloping towards a drain. In both
cases, the resulting pool will not be circular. For modelling thermal radiation from the
fire, most models assume the pool is circular with the diameter of the fire corresponding
to the surface area of the pool.
The flame length and tilt angle of a pool fire can be simply calculated using the Thomas
correlation [8]. Other models are referred to in [1].
Some example pool fire thermal radiation results are presented in Figure 2.11 and
Figure 2.12. These were obtained using DNV’s PHAST software.

16 ©OGP
RADD – Consequence modelling

Figure 2.11 Liquid Propane Pool Fire Therm al Radiation Distances at


Ground Level

Figure 2.12 Kerosene-type Liquid Pool Fire Therm al Radiation Distances at


Ground Level

2
Note: The shape of the curves for 12.5 kW/m is explained by the decreasing flame surface
emissive power with increasing pool diameter.

©OGP 17
RADD – Consequence modelling

2.3.1.3 Boilover
Boilover can be modelled as a pool fire with:
• Diameter equal to the tank diameter
• A height of 5 times the tank diameter
• Flame thermal emissive power = 150 kW/m2
However, a boilover also results in considerable rainout of burning hydrocarbon liquid
over a wide area, posing additional risk to people; this may also ignite hydrocarbon
vapours above neighbouring tanks.

2.3.1.4 Compartment Fire


For a fire inside an enclosed volume such as an offshore module, the fire size and
properties (in particular, smoke toxicity) depend on two factors:
• Whether the fire is large enough to impinge on a wall or ceiling
• Whether the fire is fuel- or ventilation-controlled4.
Figure 2.13 shows a procedure to determine the model required for a gas or 2-phase
release. A similar approach can be taken for a liquid release.
Lees [9, pp16/286ff] suggests possible approaches and other models for compartment
fires. Although written as applying to fires inside buildings, the text can also be applied
offshore.

4
In the former case there is an adequate supply of air to ensure complete combustion of the fuel;
in the latter case the ventilation is limited and the fuel is not fully combusted.

18 ©OGP
RADD – Consequence modelling

Figure 2.13 Procedure for Fire Model Selection (Gas or 2-phase Release)

Note: in a highly confined volume with limited ventilation (e.g. a platform leg), even a small fire
may be ventilation controlled.

2.3.1.5 Fireball/BLEVE
Several models for fireball duration and diameter have been developed. Most are simple
correlations between these quantities and fireball mass5. One model is due to Prugh
[10]:

Diameter, D (m): D = 6.48 M0.325 [M = fireball mass (kg)]


0.26
Duration, td (s): td = 0.825 M
Height of fireball centre, h (m): h = 0.75 D

Surface emissive power, q (kW/m2):

[P < 6 MPa; P is vapour pressure (MPa) at which failure occurs.]

5
When the release is two-phase, the fireball may not consume all the liquid. One possible
assumption is that the fireball mass is calculated assuming 3 × the adiabatic flash fraction at the
burst pressure, constraining this to be ≤ 1.0.

©OGP 19
RADD – Consequence modelling

Radiation received, I (kW/m2): I = q F τ

F = view factor: [x = distance (m) along ground]

τ = transmissivity:

2.3.2 Software for fire and thermal radiation modelling


The software packages listed in Section 2.0 model the fire types listed in Section 2.3,
apart from compartment fires. They will model the flame dimensions and orientation,
and thence the thermal radiation received.
For a compartment fire, if the fire inside the module is a diffusive fire smaller in volume
than the module, it can be modelled as a pool fire with the dimensions suggested in
Section 2.3.1.4; the surface emissive power can be taken to be the same as that of the
unimpinged jet fire.

2.3.3 CFD for fire and thermal radiation modelling


CFD models can be used to determine the fire loading on critical areas on both offshore
structures and onshore plants. The Oil and Gas UK guidance [24] provides a state-of-
the-art review of CFD fire modelling. In particular, it is stated that although CFD models
provide a more realistic representation of the flow physics, there are uncertainties
associated with modelling turbulent flow and combustion as well as in definition of fire
source and ambient conditions. Commonly used software for fire modelling include
Kameleon FireEx and CFX. Kameleon FireEx is typically used for fire modelling on
offshore platforms and onshore plants; CFX is more commonly for low geometry
scenarios, e.g. fire and smoke modelling in tunnels.
For CFD fire modelling, it may be best to reduce the size of the problem by modelling
only a subset of the installation. Otherwise, the run times for the analyses would be very
long. The procedure for running the fire analyses can be summarised in the following
steps:
1. Define leak size and select realistic leak locations;
2. Select leak directions. Typically, the analyses are run for up to 6 leak directions;
3. Run the fire simulations for different leak rates for each leak location and direction
until steady state conditions are reached.
Huser [25] describes a probabilistic procedure for the design of process against fires
using CFD modelling. The probabilistic assessment provides a Dimensioning Accidental
Load (DAL) fire that is used for design of the structure and allows for the development
of a consistent methodology (similar to explosion approach) for calculating fire loads.
The methodology is illustrated in Figure 2.14.

20 ©OGP
RADD – Consequence modelling

Figure 2.14 Probabilistic Procedure for Establishing Dim ensioning


Accidental Load (DAL) Fire and Mitigating Measures (from [25])

[25] has shown that for CFD simulations of jet fires the following parameters are
important (i.e. resulting in more than 20% variation in the heat loads when all other
parameters are kept constant):
• Initial leak rate and leak profile
• Leak and fire location

©OGP 21
RADD – Consequence modelling

• Jet direction
• Dynamic development of fire
• Geometry layout and
• Deluge
The probabilistic approach can be used to generate a fire exceedance curve from which
the DAL fire can be obtained.

2.4 Explosion modelling


For QRA and associated studies, explosions are usually taken to mean vapour cloud
explosions (VCEs). However, other types of explosion are possible (see Figure 2.1):
• Condensed phase explosions
• Dust explosions
• Runaway reactions
In addition, BLEVEs and vessel bursts generate overpressures that may be significant.
However, this section focuses on VCEs.
Huge advances in understanding and modelling of VCEs have been made in the last
decade since the Spadeadam tests. For offshore, the NORSOK standard Z-013 [11] has
established a comprehensive but computationally demanding approach to explosion
modelling, requiring use of an advanced CFD tool. Whilst originally developed
specifically for platforms in Norwegian waters, this approach is being adopted in other
areas of the North Sea. Although CFD models cannot yet be incorporated directly within
(offshore) QRAs, output from QRA is increasingly expected to be used in them.
Onshore, CFD is less well established in QRA whilst the application of simpler models
available in general purpose software is becoming more sophisticated and considered
fit for purpose. However, where design or layout decisions may critically depend on
explosion risks, use of CFD for specific scenarios would give additional robustness to,
and confidence in, the results. Another issue where CFD would assist is where terrain
effects are important, for example if a facility is built on a slope or at the foot of a hill: in
this case dispersion would be significantly modified compared with that which would
result over flat ground.
The recent advances in understand of explosions referred to above mean that the
previous classification of VCEs as unconfined, semi-confined or confined can now be
considered over-simplistic. It would be better to talk about degrees of confinement and
congestion6. TNO’s Multi-Energy model [12], discussed further in Section 2.4.2, allows
for 10 levels of confinement/congestion, ranging from the equivalent of a UVCE
(Unconfined Vapour Cloud Explosion) through to highly confined/ congested volumes
such as can be found in a densely packed process area of an onshore plant. In this and
similar models, some assessment or assumption needs to be made outside of the
model as to the maximum overpressure. In CFD modelling, the distinction between
levels of confinement/ congestion disappears since the geometry is defined and the
software itself calculates the maximum overpressure.

6
Confinement should be thought of as a solid barrier preventing flame acceleration in a certain
direction; congestion as a porous barrier, or set of discrete obstructions, inducing turbulence in
the flow and modifying (increasing) flame acceleration in a certain direction.

22 ©OGP
RADD – Consequence modelling

2.4.1 Simple approaches to explosion modelling


Historically, simple “TNT equivalence” models have been used for modelling explosion
overpressures from unconfined VCEs (UVCE) onshore. However, these require the
explosive mass to be calculated: as this is an output from dispersion modelling, manual
calculation of explosion overpressures is not likely to be undertaken.
Another old approach for onshore QRA [13] calculates the distance to specified levels
of damage directly from the explosion energy by a simple correlation. Again, this
requires the explosive mass to be calculated.

2.4.2 Software for explosion modelling


2.4.2.1 Onshore explosions
General purpose consequence modelling software (see list in Section 2.0) includes
either of both of two well established explosion models: the TNO Multi Energy model
[12] and the Baker Strehlow or Baker Strehlow Tang model [14].
In the Multi Energy m odel, a vapour cloud is divided into the regions of congestion,
or “blast sources”, they may enter and fill (or partially fill). Each of these blast sources
is treated independently of the others. The material and the volume of the cloud within
the blast source are used to calculate the explosion energy. A confined explosion
strength is assigned to the blast source by the analyst: this strength corresponds one
of 10 lines on a graph of peak side-on overpressure vs. scaled distance from the source.
The 10 lines represent a range of maximum overpressures (at the source) ranging from
0.01 to 13 bar. Selecting the correct confined explosion strength for a given situation
(e.g. a specific process unit on a refinery) is far from straightforward, although generally
no. 7 or 8 is used for process units. Guidance [15] has been developed to assist this,
although even with this it is strongly recommended to call upon experienced personnel
to make the assessment.
In the Baker Strehlow Tang model the analyst selects instead the material reactivity
(high, medium, or low), flame expansion (number of directions in which the flame can
expand), obstacle density (high, medium, or low), and ground reflection factor (1 for air
burst, 2 for ground burst and hence ground reflection). This has two advantages over
the Multi Energy model:
• Materials of different reactivities can be adequately represented
• Selection of flame expansion and obstacle density is simpler
As in the Multi Energy model, the overpressure vs. scaled distance is a set of curves (in
this case 11) that span the range of input selections.
These models are appropriate for use in studies of onshore facilities including marine
terminals.

2.4.2.2 Offshore explosions


For offshore installations, non-CFD software has been used to estimate maximum
overpressures in modules using relatively simplified methods that nevertheless take
account of the broad features of module geometry. For example, DNV have used their
programs COMEX and NVBANG in numerous studies, however these programs are not
available commercially and are not recommended for non-specialists in explosion
modelling.
However, in offshore applications the maximum overpressure itself is usually not used
directly in the risk calculations. Rather, it represents the worst case combination of
module fill, release location and ignition location. In a real situation, this combination is

©OGP 23
RADD – Consequence modelling

unlikely to be achieved and a lower overpressure will be reached. Of direct concern is


the likelihood of an explosion that will result in equipment escalation or breaching of the
TR wall, for example. This requires a probabilistic approach to estimate the likelihood
of any given explosion overpressure being exceeded at a specific location. This is the
approach set out in the NORSOK standard Z-013 [11]. CFD modelling is used to model
explosion overpressures for a number of scenarios. The results are then combined with
leak frequencies, ignition data and wind probabilities in another software package (e.g.
DNV’s EXPRESS) to develop overpressure exceedence probability curves for use in the
QRA. The same approach can be used for more specific design problems, for example
designing an ESD or deluge system to withstand the drag forces likely to result from an
explosion.
This approach requires considerable investment of effort to obtain useful and robust
results. Previous, more simplified methods have the appearance of being less costly to
achieve the same end. However, the initially more costly NORSOK approach [11] can be
used to cost-optimise the design of a module for explosions, eliminating the need for
excessive and hence costly conservatism (i.e. over-engineering).

2.4.3 CFD for explosion modelling


The representative gas clouds from the CFD dispersion analysis (see Section 2.2.3) can
be ignited and explosion analysis carried out. The Oil and Gas UK guidance [24] reports
that it is not recommended to use dispersed non-homogeneous and turbulent gas
clouds in CFD explosion simulations due to the lack of testing/validation for this
application. Instead, an equivalent quiescent stoichiometric gas cloud, that gives similar
overpressures to the non-homogeneous and turbulent clouds, has to be calculated.
As an example of how this can be done, the FLACS software automatically calculates a
parameter (referred to as “Q5”) that converts the non-homogeneous cloud into an
equivalent quiescent gas cloud. It should be noted that the duration of the equivalent
gas cloud may be shorter than the non-homogeneous one resulting in a difference in
the structural response.
The explosion simulations should be carried out for various gas cloud sizes and
shapes, gas cloud locations and ignition locations. For each gas cloud size, the gas
cloud location and ignition location should be varied. In particular, it is important to
locate the clouds close to critical and congested areas of equipment and piping.
The ignition location will also have a strong impact on the explosion loads. Generally,
the CFD analyses are run with two different locations namely ignition location at centre
of cloud and at edge of cloud. Depending on the geometry and layout, edge ignition will
sometimes produce the higher (than central ignition) explosion overpressures due to
the increased flame distance.
Results in terms of explosion overpressures can be output at monitor points at pre-
defined locations and drag forces can be obtained for design of critical equipment and
piping.
2.5 Smoke and gas ingress modelling
Modelling of smoke and gas ingress to the TR or living quarters usually forms part of an
offshore QRA and could also be used in onshore studies. More generally, modelling of
smoke generation and dispersion can be useful to determine the likelihood of escape
routes being impaired or of people out-of-doors being overcome by smoke.
Smoke and gas ingress modelling has up to 4 stages:
Source Term → Dispersion → Ingress → Effects

24 ©OGP
RADD – Consequence modelling

The source term comes from the release rate modelling (Section 2.1): directly for gas
and from suitable ratios of (mass of smoke) / (mass of hydrocarbon released).
Dispersion can be modelled as suggested in Section 2.2. Since smoke’s largest
constituent is nitrogen (i.e. the unburnt part of the air involved in combustion), one
approach used has been to model the smoke as hot, dense nitrogen, giving it a
molecular weight and temperature equal to those estimated for the combustion gases.
However, the high temperature invariably results in a rapidly rising smoke plume that
doesn’t match experience. For example, photographs of smoke from the Piper Alpha
disaster show the plume travelling almost horizontally. One possible reason is that the
soot particles in the smoke increase the plume’s density. Hence this approach is not
recommended for 3D results. However, it may be used to determine the smoke
concentration at a given distance horizontally from the release point, assuming as a
worst case that this is the centreline concentration.

2.5.1 Simple approaches to smoke and gas ingress modelling


The CMPT Guide to quantitative risk assessment for offshore installations [1] provides data
and references on smoke generation, composition, dispersion, visibility reduction,
ingress to TR and impact.
A series of linked models has been used in offshore QRAs for BP and other operators:
• Smoke generation:
− Composition from [16]: see Table 2.2
− Depends on fuel (light = gas, heavy = condensate/oil)
− Depends on whether fire is fuel-controlled, ventilation-controlled or in between
these.

Table 2.2 Sm oke Com position Data

Fire Area Type Component Fuel Type*


Light Heavy
a) Fuel Controlled Carbon Monoxide (ppm) 400 800
Carbon Dioxide (%) 10.9 11.8
Oxygen (%) 0 0
Smoke Temperature (°C) 1,000 1,000
Particulates (dB/m) 15 47
b) Ventilation Controlled Carbon Monoxide (ppm) 30,000 31,000
Carbon Dioxide (%) 8.2 9.2
Oxygen (%) 0 0
Smoke Temperature (°C) 600 600
Particulates (dB/m) 29 70
* The light composition is used for gas jet fires. The heavy composition is used for
condensate fires.

Dispersion: based on a dilution factor, which is a function of fuel burn rate and of
distance from source (does not take into account wind speed or the presence of
barriers).
• Figure 2.15 shows dilution factors, based on calculations using FLACS [17], for
different release rates.
• Smoke Ingress:

©OGP 25
RADD – Consequence modelling

− CO and CO2 build-up in the module are calculated using a CSTR model, taking as
input the smoke concentration immediately outside the TR and the TR’s
ventilation rate
− The CO2 concentration calculation also includes exhaled CO2 from personnel
inside
− The internal temperature is also calculated based on heat generated by TR
occupants

Figure 2.15 Sm oke Dilution Factors

• Smoke effects/toxicity
− Based on dose relationships given in [18]
− Considers toxicity of CO; effects of CO2, lack of oxygen and high air temperature;
visibility reduction

For gas ingress a set of dilution factors is used, equivalent to but different from those
used for smoke. A CSTR model is used for gas ingress, and fatalities in the TR are
assumed to occur if the gas concentration exceeds 60% of LFL.

2.5.2 Software for smoke and gas ingress modelling


For smoke dispersion in the open, general purpose consequence modelling software
such as the packages listed in Section 2.0 is sometimes used. However, the validity of
this approach and its superiority to the simple approach described in Section 2.5.1 are
uncertain.
For smoke and gas build-up within modules, multizone models such as COMIS can be
used. Multizone modelling involves solving mass balance equations for the flow
between different zones, thus allowing for partitioning due to smoke barriers, walls
between rooms, etc. Multizone models were developed primarily to predict airflow in
buildings, but they are also capable of predicting the transient transport of

26 ©OGP
RADD – Consequence modelling

contaminants such as smoke. The method is applied by considering a building as being


divided into a number of zones (typically rooms) that are physically separated from one
another. As with the CSTR model, each zone is treated as fully mixed. The rate at which
air flows between zones is governed by the pressure difference and the modelled
connection (i.e. doors, ducts etc.) between the rooms. Multizone models have some of
the characteristics of both CFD and the CSTR model; conceptually the approach lies
between the two in terms of resolution and complexity.
2.5.3 CFD for smoke and gas ingress modelling
CFD modelling can be used to provide a detailed prediction of the smoke distribution in
TR or living quarters. The effect of heat sources due to people and computing
equipment can be included in the analysis. However, smoke modelling using CFD can
be quite difficult due to the variability and uncertainty in the boundary conditions [26]. A
recent article by O’Donnell et. al. [27] provides a comparison of different approaches to
smoke modelling namely the CSTR model, a multizone model and a CFD model. CFX
and Kameleon FireEx can be used to carry out detailed CFD smoke modelling.
The smoke and gas dilution factors used in the models described in Section 2.5.1 were
determined using FLACS, a CFD package. This or another CFD package could be used
directly to model smoke dispersion from a source in the same way as described in
Section 2.2.3 for gas dispersion modelling in general. However, the approach described
in Section 2.5.1 has generally been accepted as fit for purpose in QRAs.
CFD is more likely to be useful in design, for example in locating HVAC air intakes to
minimise the likelihood of smoke ingress. Although best practice is to place them on
the TR face away from potential smoke sources (i.e. fires), flow around bluff bodies
results in zones of recirculation and hence of enhanced smoke concentration.

2.6 Toxicity modelling


The toxic effects of a material may be acute (resulting from accidental exposure to a
high concentration over a short period of time) or chronic (resulting from continuous
exposure to a lower concentration over a long period of time, as a result of routine
emissions or a small, undetected leak). Different toxic materials have different
physiological effects: they may inhibit respiration (causing asphyxiation) through
inhalation, they may affect the central nervous system, they may be ingested or
absorbed through the skin. For the purposes of this datasheet, the discussion is limited
to acute effects and it is not necessary to consider the nature of the physiological
effects. The discussion addresses toxicity on the basis of dose-response relationships
(see below).
Offshore, besides smoke (as discussed in Section 2.5), toxic modelling is usually limited
to the effects of sour gas, i.e. H2S.
Onshore, besides H2S (in onshore hydrocarbon production, transport and processing),
other toxic materials are potentially of concern. Toxic consequences are invariably
bound up with toxic effects: that is, a model for toxicity is a model for lethality or lesser
effects.
Toxicity data is typically encountered in two forms when required for QRA: specified
concentrations such as the IDLH (Immediate Danger to Life and Health), or
concentration-lethality levels for different species such as rats. Such data can be found
in Material Safety Data Sheets (MSDS) or online reference sources such as CHRIS
www.chrismanual.com.

©OGP 27
RADD – Consequence modelling

For QRA, a dose-response relationship is often used that relates the lethality to the dose
received at a point. At its simplest, the dose is given by (concentration × time),
assuming the concentration remains constant over time. However, for many materials,
the effect of concentration is magnified and, for concentration C and exposure time t,
the relevant dose A is given by:

Note that the exponent n is not necessarily an integer.


In its regulatory work the UK HSE (e.g. 19] uses two values of A:
• SLOT (Specified Level Of Toxicity) Dangerous Toxic Load: the dose that results in
highly susceptible people being killed and a substantial portion of the exposed
population requiring medical attention and severe distress to the remainder
exposed. It represents the dose that will result in the onset of fatality for an
exposed population (commonly referred to as LD1 or LD1-5)
• SLOD (Significant Likelihood Of Death): is defined as the dose to typically result in
50% fatality (LD50) of an exposed population and is the value typically used for
group risk of death calculation onshore.
Values of the SLOT and SLOD for selected materials are given in Table 2.3. As can be
seen in the final column, values of “n” for these materials range from 1 to 4.

Table 2.3 SLOT & SLOD Values for Selected Materials

Substance SLOT SLOD “n”


8 9
Ammonia 3.78 × 10 1.09 × 10 2
Carbon monoxide 40125 57000 1
5 5
Chlorine 1.08 × 10 4.84 × 10 2
12 13
Hydrogen sulphide 2.0 × 10 1.5 × 10 4
6 7
Sulphur dioxide 4.66 × 10 7.45 × 10 2
Hydrogen fluoride 12000 41000 1
5
Oxides of nitrogen 96000 6.24 × 10 2
Note: these values are based on concentration in ppm, time in minutes.

As stated above, the LD50 is often used in risk calculations. The HSE’s approach allows
for calculation of the LD50 for any exposure duration.
The most sophisticated approach to determining toxicity adopts the same approach to
calculating the dose but allows the lethality to be calculated for any given concentration
and duration of exposure. This is the “probit”. A probit value Pr is calculated (for a
constant release rate and hence concentration7) as:

where “a”, “b” and “n” are all material specific constants (“n” is the same as above).
These constants have been published for many commonly encountered materials in a
number of sources [e.g. 9,20]. A table relating lethalities to probits can be found in
many places e.g. [9].

7 n
For a time varying release rate and hence concentration, the (C t) can be replaced by an integral
over time.

28 ©OGP
RADD – Consequence modelling

2.6.1 Simple approaches to toxicity modelling

The toxic dose should always be calculated using the relationship discussed in
the text preceding this sub-section. It therefore requires results from dispersion
modelling (Section 2.2) together with the exposure time. Calculation of the LD50 using
the HSE approach described in the text preceding this sub-section is recommended as
the best simple approach and will be sufficient for many purposes.

2.6.2 Software for toxicity modelling


The software listed in Section 2.0 will calculate probits for toxic materials and thence
the lethality level as a function of distance from the release point or as contours of
different lethalities overlaid on a plan or map. In this way the lethality at any point can
be determined for a given wind direction.

2.6.3 CFD for toxicity modelling


CFD will provide as output the concentration at any point. This could be used together
with a SLOT/SLOD value or probit to calculate lethality at that point. Contour plots of
toxic lethality are not available from CFD software but could probably be generated from
tabular output.

3.0 Guidance on use of approaches


3.1 General validity
The approaches described in Section 2.0 are based on published sources that are
widely known and accepted.
All modelling of physical phenomena is imperfect. Any use of software must be within
the limitations set out for the software, and even then the analyst must carry out a
reality check on the results. For example: a jet fire model applied to a large, high
pressure gas release will predict a jet flame several hundreds of metres long; the
analyst must consider whether this is credible, or whether the flame will impinge on an
obstruction within this distance.
Depending on the application, a simple model may be fit for purpose, or detailed
modelling (e.g. using CFD) may be required. Whilst it may be considered desirable to
use CFD as much as possible, the resources (time, trained personnel, and budget)
required to use it effectively are rarely available; hence it is usually used to address
specific problems or to provide results for a limited set of scenarios that can be applied
or extrapolated to all the scenarios being modelled in a QRA.
In the early stages of design, the detailed design information required for CFD to give
accurate predictions of overpressures is not available and hence decisions based on
CFD results may result in under-design for the potential overpressures.

©OGP 29
RADD – Consequence modelling

3.2 Uncertainties
All modelling suffers from uncertainties. For a given set of input (initial) conditions, it is
unlikely exactly to match the physical outcome that would result in reality from the
same initial conditions. Indeed, numerous physical realisations of the same release
would give different results, whereas consequence modelling software gives the same
result each time8. Sources of uncertainty in consequence modelling for QRA include
the following:
• A QRA only models a limited range of cases, so the conditions of an actual release
are unlikely to match exactly any of the cases modelled in a QRA
• Ambient conditions (wind speed, wind direction) do not stay constant over the
duration of a release as is modelled
• Box models for dispersion, and models of equivalent complexity for other
phenomena, cannot deal with solid or porous barriers (buildings, process units,
bund walls, etc.)
• CFD cannot model sub grid scale turbulence (see Section 0)

3.3 Choosing the right approach for consequence modelling


As set out in Section 2.0, whilst simple models are available for some consequences,
and a range of numerical results for some consequences are given there, some
consequence modelling requires the use of either general purpose or CFD software. To
decide which is the best approach it is necessary to decide:
• What is the scope of the study?
• What is the required depth of the study?
• How many release scenarios will be modelled?
• Who will carry out the study?
• Will the analysis need to be updated in the future, or the results interrogated? If so,
who will do this?
If the scope is a full, detailed QRA, then most or all of the 6 steps described in Section
2.0 will need to be undertaken. This means that the output from one step of the analysis
will become the input to the next step, and it is important to make the links between the
steps as straightforward and robust as possible. This in turn suggests that general
purpose consequence modelling software where the transitions from one model to the
next are automated is preferable to using a mixture of models from different sources
(perhaps with some implemented in spreadsheets, others coded). However, in this case
the automated transitions may be “black box”-like and so the analyst needs to
understand fully how these work to ensure that the results represent physical reality.
(For example, that a modelled jet fire is a credible outcome.)
If a coarse QRA of a simple installation is to be undertaken, a simpler approach may be
acceptable. This could use the correlations given or referred to in Section 2.0, or the
consequence results presented in that section.

8
Monte Carlo modelling could be used to vary slightly the input parameters but this does not
appear to be done routinely. Another type of dispersion modelling, “random walk modelling”,
likewise does not appear to be used for QRA.

30 ©OGP
RADD – Consequence modelling

For a QRA of an offshore installation with enclosed modules, use of CFD for explosion
modelling is now routinely used. For a new installation, it will almost certainly have to
be used in order to design for explosions. For an existing installation, explosion
modelling predating the Blast and Fire Engineering for Topside Structures JIP will probably
have been revised using CFD. Thus it is likely that the necessary CFD modelling will
have been done, or at least that the geometry model has been built and it will be
relatively straightforward to obtain any additional results required.
For QRAs of onshore installations, use of the TNO Multi Energy Model or the Baker
Strehlow Tang model (see Section 2.4.2.1) is strongly recommended over use of earlier
VCE models.
For problems of a more limited nature, in particular decisions about significant
investment in relation to fire or explosion and especially in relation to offshore
structures, it is advisable to use CFD in order to maximise the robustness of the
analysis and the confidence in the results.
CFD modelling requires considerable experience and expertise to use effectively. It is
rare for a risk analyst skilled in all aspects of QRA to possess the required degree of
specialist expertise. CFD analysis should therefore be assigned or contracted to
personnel with the required expertise.

3.4 Geometry modelling for CFD


Generally, the numerical grid in CFD models is not fine enough to resolve the smaller
items of equipment and pipe work which are responsible for a large part of the
turbulence generated during an explosion. Most of the software (FLACS, EXSIM,
AutoReaGas) uses a so-called distributed porosity concept (Porosity, Distributed
Resistance (PDR) model) to account for the objects which cannot be represented by the
grid. The porosity model is used to calculate the turbulence source terms due to those
small items and the flame speed enhancement arising from flame folding in the sub grid
wake.
Explosion relief panels and yielding walls can also be represented by modifying the
porosity in the region where they occur.
It is important that all the geometric details are properly represented in a CFD model due
to their importance in pressure build-up. The particular areas where gas explosion
analyses are carried out must be modelled with a high degree of accuracy. In the early
design stages, no detailed description of the geometry exists and this may pose a
problem with regard overpressure prediction. There are two ways in which this problem
can be circumvented namely by applying a factor for equipment growth to account and
by adding anticipated congestion to obtain final expected object density and
distribution.
The Oil and Gas UK guidance [24] reports on a detailed investigation of a typical North
Sea integrated deck platform which showed that, for good prediction of overpressures,
definition of all major equipment, boundaries (decks, TR), all piping with diameters >
0.2 m, and primary/ secondary structures with cross-section dimensions > 0.13 m is
required.
In addition, it is important to define the CFD grid to extend quite a large distance from
the area of interest to avoid too strong influence from open boundaries.

©OGP 31
RADD – Consequence modelling

4.0 Review of data sources


Key general sources for suitable consequence modelling methods are the Guide to
quantitative risk assessment for offshore installations [1] and Lees’ Loss Prevention in the
Process Industries [9]. These have been supplemented by more specific published
papers and books as listed in Section 6.1: all of these are believed to have found wide
acceptance in the QRA community including with regulatory authorities.
The general purpose software packages listed in Section 2.0 are all commercially
available. Validation data for them, if required, should be sought from the software
providers. The EU SMEDIS project [28] in particular has compared the leading
dispersion models with results from experimental measurements.
The basis of the suggested approach to modelling releases from buried pipelines
(Section 2.1.3) is confidential work carried out by DNV on behalf of clients (personal
communication). No published methodology has been found.
The basis of the suggested approach to modelling boilover (Section 2.3.1.3) is the Dyfed
Fire Brigade video of the Amoco Milford Haven refinery tank fire. The flames from the
boilover reached a height of 3000 feet, or about 10 times the tank diameter; however,
they were not continuous or constant to this height over a typical period of interest, and
were partly obscured by smoke. Hence a height of 5 times tank diameter appears
reasonable.
For explosion modelling, FLACS and AutoReaGas have been extensively validated
against experimental data, in particular from the Phase 2 and Phase 3 JIP Blast and Fire
Engineering for Topside Structures experiments carried out at Spadeadam and elsewhere.
FLACS is also currently being validated for hydrogen as part of the EU HySafe
programme. Details of FLACS and AutoReaGas validation are available on their
respective websites (see Section 2.0).

5.0 Recommended data sources for further information


For further information, the data sources referenced in Sections 2.0 to 4.0 should be
consulted. Some additional references are given in Section 6.2.
On the subject of subsea releases, two major reports 32], [33] were published in 2007
and 2008 and should be consulted if detailed information is required (i.e. if subsea
releases appear to pose a significant risk).

6.0 References
6.1 References for Sections 2.0 to 4.0
1. Spouge, J, 1999. A guide to quantitative risk assessment for offshore installations, CMPT
publication no. 99/100, ISBN 978-1-870553-36-0 / 1 870553 36 5. Now available from
the Energy Institute www.energyinst.org.uk.
2. Czujko, J (ed.), 2001. Design of Offshore Facilities to Resist Gas Explosion Hazard
Engineering Handbook, Sandvika: CorrOcean ASA.
3. BP Amoco, CERC and BG Technology, 2000. Workbook on Gas Accumulation in a
Confined and Congested Area, Joint Industry Project Gas Build Up from High Pressure
Natural Gas Releases in Naturally Ventilated Offshore Modules. [Believed to be
available only to sponsors but summarised in the following reference.]
4. Cleaver, R P and Britter, R E, 2001. A Workbook Approach to Estimating the Flammable
Volume Produced by a Gas Cloud, Paper R416, FABIG Newsletter: Issue 30, 5-7.

32 ©OGP
RADD – Consequence modelling

5. Wertenbach, H G, 1971. Spread of Flames on Cylindrical Tanks for Hydrocarbon Fluids,


Gas and Erdgas 112.
6. API, 1982. Guide for Pressure Relieving and Depressuring Systems, American
Petroleum Institute, Recommended Practice RP 521, 2nd ed.
7. Chamberlain, G A, 1987. Developments in Design Methods for Predicting Thermal
Radiation from Flares, Chem Eng Res Des 65.
8. Thomas, P H, 1963. The Size of Flames from Natural Fires, 9th Intl. Combustion
Symposium, Combs Inst. Pittsburgh, PA, pp.844-859.
9. 2005. Lees’ Loss Prevention in the Process Industries, 3rd. ed., Mannan, S, ed., Oxford:
Elsevier Butterworth – Heinemann.
10. Prugh, R W, 1994. Quantitative evaluation of fireball hazards, Process Safety Progress
13(2), 83-91.
11. Procedure for probabilistic explosion simulation, NORSOK Standard Z-013 Rev.2
Annex G.
12. TNO 1997. Methods for the calculation of physical effects due to releases of hazardous
materials (liquids and gases) [the “Yellow Book”], eds: van den Bosch, C J H and
Weterings, R A P M, Chapter 5: Vapor Cloud Explosions, Mercx, W P M and van den
Berg, A C.
13. TNO 1979. Methods for the Calculation of the Physical Effects of the Escape of
Dangerous Material, [the “Yellow Book”], Chapter 4: Vapour Cloud Explosions,
Wiekema, B J.
14. Tang, M J, and Baker, Q A, 1999. A New Set of Blast Curves from Vapour Cloud
Explosion, Proc. Safety Progress 18(4), 235-240.
15. Mercx, W P M et al., 1998. Application of correlations to quantify the source strength of
vapour cloud explosions in realistic situations. Final report for the project: ‘GAMES’, HSE
and TNO, http://www.hse.gov.uk/research/crr_pdf/2001/crr01318.pdf.
16. SINTEF 1992. Handbook for Fire Calculations and Fire Risk Assessment in the Process
Industry.
17. FLACS, V8 (version 8), 2003, see www.gexcon.com.
18. Purser, D, 1992. Toxic Effects of Fire Cases, Conf. on Offshore Fire and Smoke
Hazards, Aberdeen.
19. HSE 2006. Indicative Human Vulnerability to the Hazardous Agents Present Offshore for
Application in Risk Assessment Of Major Accidents, SPC/Tech/OSD/30.
http://www.hse.gov.uk/foi/internalops/hid/spc/spctosd30.pdf.
20. CPD 1992. Methods for the determination of possible damage to people and objects
resulting from releases of hazardous materials [the”Green Book”], Committee for the
Prevention of Disasters caused by Dangerous Substances / TNO, The Hague:
Directorate-General of Labour of the Ministry of Social Affairs and Employment.
21. Norwegian Technology Centre, 2001. Risk and Emergency preparedness analysis,
NORSOK Z-013, http://www.standard.no/imaker.exe?id=1503.#
22. Huser, A., Oliveira, L F, Rasmussen, O, and Dries, J V D, 2002. Explosion risks in
large and widespread process areas, ERA Conference, November.
23. Huser, A, Oliveira, L F, and Dalheim, J, 2004. Cost optimisations of gas detector
systems, Proc. OMAE04, 23rd International Conference on Offshore Mechanics and Arctic
Engineering, June.

©OGP 33
RADD – Consequence modelling

24. Oil and Gas UK & HSE, 2007. Fire and Explosion Guidance, publication no. EHS24.
Available from Oil and Gas UK http://www.ukooa.co.uk/ukooa/.
25. Huser, A, 2006. Probabilistic procedure for design of process areas against fires,
FABIG Newsletter 44. Available from FABIG www.fabig.com.
26. Talberg, O, Hansen, O R, Bakke, J R, and Wingerden, K. Application of a CFD-based
probabilistic explosion risk assessment to a gas-handling plant, conference paper
available from CMR-Gexcon http://www.gexcon.com/download/ERA_00-Paper.pdf.
27. O’Donnell, K, Deevy, M, and Garrard, A, 2007. Assessment of mathematical models
for prediction of smoke ingress and movement in offshore installations, FABIG
Newsletter 48. Available from FABIG www.fabig.com.
28. Daish, N C, Britter, R E, Linden, P F, Jagger, S F, and Carissimo, B, 1999. Scientific
Model Evaluation techniques applied to dense gas dispersion models in complex
situations, Intl Conf. on Modelling the Consequences of Accidental Releases of
Hazardous Materials, CCPS, San Francisco, California, September 28 – October 1.
29. Mudan, K S, and Croce, P A, 1988. Fire Hazard Calculations for Large Open
Hydrocarbon Fires, Fire Protection Engineering, Section 2 Chapter 4, Society of Fire
Protection Engineers, National Fire Protection Association.
30. Cleaver P, & Johnson, M, 2004. LNG Behaviour, Fire and Blast Issues related to LNG,
FABIG Technical Review Meeting, London & Aberdeen, October 6 – 7.

6.2 References for other data sources


31. CCPS 1994. Guidelines for Evaluating the Characteristics of Vapour Cloud Explosions,
Flash Fires and BLEVES, New York: American Institute of Chemical Engineers.
32. Fanneløp, T K, and Bettelini, M, 2007. Very Large Deep-Set Bubble Plumes From
Broken Gas Pipelines, Report No. 6201, Project No. 99B43, Petroleum Safety Authority
Norway.
33. Tveit, O J, and Huser, A, 2008. Risiko knyttet til gassutslipp under vann. Videreføring
2007, Spredning over havet, Petroleum Safety Authority Norway.

34 ©OGP
Risk Assessment Data Directory

Report No. 434 – 8


March 2010

Mechanical
lifting
failures
International Association of Oil & Gas Producers
RADD – Mechanical lifting failures

Contents:
1.0 Introduction .......................................................................... 1
1.1 Application ...................................................................................................... 1
1.2 Definitions ....................................................................................................... 1
2.0 Summary of Recommended Data ............................................ 1
3.0 Guidance on use of data ........................................................ 3
3.1 General validity ............................................................................................... 3
3.2 Uncertainties ................................................................................................... 3
3.3 Use of the Data................................................................................................ 4
3.4 Consequence Analysis of Objects Dropped Into the Sea........................... 4
3.5 Kinetic energy ................................................................................................. 6
4.0 Review of data sources ......................................................... 7
5.0 References ............................................................................ 8

©OGP
RADD – Mechanical lifting failures

Abbreviations:
BOP Blowout Preventer
DNV Det Norske Veritas
HSE (UK) Health and Safety Executive
QRA Quantitative Risk Assessment (sometimes Analysis)
UKCS United Kingdom Continental Shelf
WOAD World Offshore Accident Databank

©OGP
RADD – Mechanical lifting failures

1.0 Introduction
1.1 Application
This datasheet presents information on the frequency of dropped objects resulting from
the failure of lifting devices on offshore installations. Specifically it includes dropped
load frequencies for the following types of lifting equipment:
1. Main cranes
2. Drilling derrick
3. Other devices
The data are derived from offshore operating experience in the UKCS over the period
1980 to 1999. The data are intended to be applied in quantifying the risks from lifting
operations worldwide. Consideration should be given to factoring the data up or down
where there is reasonable justification that the management of lifting operations is
significantly poorer or safer that UKCS operations.

1.2 Definitions

• Dropped loads Refers to loads (objects) either unintentionally released from


a lifting device or else swinging and impacting some part of
the installation structure (or vessel, if the lift is to/from a
vessel).
• Lifting devices Main crane, derrick main hoisting assembly, and other lifting
devices (see below).
• Other lifting BOP cranes, gantry cranes, tuggers, and a range of portable
devices devices, e.g winches, sling blocks, wirelines.
• Mobile The data for mobile installations are gathered almost entirely
Installations from experience in the operation of mobile offshore drilling
units (MODUs). These include semi-submersibles, jackups,
and drill ships.
• Fixed The data for fixed installations are gathered from a range of
Installations types of production installation ranging from integrated
platforms to wellhead platforms. The data also include
experience from FPSOs (floating production, storage and
offloading vessels) and FSUs (floating storage units).
“Main cranes” and “drilling derrick” referred to in Section 1.0 are considered self
explanatory.

2.0 Summary of Recommended Data


Dropped object probabilities per lift on offshore installations are tabulated below for
mobile installations and fixed installations, for different load weights and by lifting
device (main crane, drilling derrick, or other device).
The data represent the probability of a dropped object per lift. Estimation of the
dropped object frequency combines the probability of a dropped object per lift with the
number of lifts carried out (for example, per year if the annual risk is required).
Note that, for drops from the main crane, in general the frequency in the Total column is
not the sum of the Installation, Sea and Vessel drop frequencies in the same row
because not all main crane lifts are between vessel and installation (some are across

©OGP 1
RADD – Mechanical lifting failures

the installation). Each frequency in the Total column is calculated from the total number
of lifts, whereas the Sea and Vessel frequencies are calculated from the number of
external lifts (between installation and vessel) only.
Of the reported events on which the probabilities tabulated below are based, 10% of
dropped objects on mobile installations and 20% of dropped objects on fixed
installations resulted in all or part of the lifting device falling (see Section 1.2 above for
the definition of “lifting device”).

Dropped Object Probabilities for Mobile Units (per lift)

Load Lifting Drop Onto: Total


Weight device Installatio Sea Vessel
n
-5 -6 -5 -5
<1 te Main crane 3.2 × 10 8.8 × 10 1.1 × 10 4.1 × 10
-5 -7 -8 -5
Drilling 1.7 × 10 7.3 × 10 6.1 × 10 1.8 × 10
Derrick
-5 -5 -5
Other Device 8.6 × 10 1.1 × 10 0* 9.7 × 10
-6 -6 -6 -6
1 – 20 te Main crane 3.1 × 10 2.0 × 10 3.0 × 10 5.4 × 10
-6 -7 -6
Drilling 3.6 × 10 4.6 × 10 0* 4.0 × 10
Derrick
-6 -6 -5
Other Device 7.6 × 10 2.9 × 10 0* 1.1 × 10
-5 -6 -6 -5
20 – 100 te Main crane 1.2 × 10 7.1 × 10 9.5 × 10 2.0 × 10
-6 -6
Drilling 1.8 × 10 0* 0* 1.8 × 10
Derrick
-6 -6
Other Device 1.9 × 10 0* 0* 1.9 × 10
-4 -4
>100 te Main crane 2.8 × 10 0* 0* 2.8 × 10
-3 -3 -3
Drilling 4.7 × 10 1.4 × 10 0* 6.1 × 10
Derrick
-4 -4 -4
Other Device 4.9 × 10 2.4 × 10 0* 7.3 × 10
-6 -6 -6 -5
All Main crane 8.5 × 10 3.3 × 10 4.6 × 10 1.2 × 10
-5 -7 -8 -5
Drilling 1.1 × 10 6.7 × 10 3.0 × 10 1.1 × 10
Derrick
-5 -6 -5
Other Device 4.5 × 10 6.5 × 10 0* 5.2 × 10
-5 -6 -7 -5
Total All 1.2 × 10 1.4 × 10 9.4 × 10 1.4 × 10

2 ©OGP
RADD – Mechanical lifting failures

Dropped Object Probabilities for Fixed Installations (per lift)


Load Lifting Drop Onto: Total
Weight device Installatio Sea Vessel
n
-5 -6 -5 -5
<1 te Main crane 3.8 × 10 6.9 × 10 1.1 × 10 4.5 × 10
-5 -7 -7 -5
Drilling 1.7 × 10 1.2 × 10 1.2 × 10 1.7 × 10
Derrick
-4 -6 -7 -4
Other Device 1.0 × 10 4.2 × 10 6.1 × 10 1.0 × 10
-6 -6 -6 -6
1 – 20 te Main crane 4.7 × 10 1.7 × 10 5.1 × 10 7.9 × 10
-6 -7 -6
Drilling 2.7 × 10 1.5 × 10 0* 2.9 × 10
Derrick
-5 -7 -5
Other Device 1.4 × 10 0* 7.4 × 10 1.5 × 10
-5 -6 -5 -5
20 – 100 te Main crane 1.0 × 10 6.2 × 10 1.6 × 10 2.0 × 10
-6 -6
Drilling 1.2 × 10 0* 0* 1.2 × 10
Derrick
-5 -5
Other Device 2.6 × 10 0* 0* 2.6 × 10
-5 -5
>100 te Main crane 9.3 × 10 0* 0* 9.3 × 10
Drilling 0* 0* 0* 0
Derrick
-4 -4
Other Device 6.1 × 10 0* 0* 6.1 × 10
-5 -6 -6 -5
All Main crane 1.0 × 10 2.8 × 10 6.4 × 10 1.5 × 10
-6 -7 -8 -6
Drilling 9.6 × 10 1.2 × 10 6.1 × 10 9.7 × 10
Derrick
-5 -6 -7 -5
Other Device 5.7 × 10 2.0 × 10 5.8 × 10 6.0 × 10
-5 -7 -6 -5
Total All 1.4 × 10 8.8 × 10 1.6 × 10 1.6 × 10

• In both of the above tables, either there are no recorded incidents, or the incident is
not credible. If the analyst believes it is credible, then a suitable frequency could be
obtained by pro rating a non-zero frequency, e.g. using the “All” frequencies.

3.0 Guidance on use of data


3.1 General validity
The frequencies given are based on analysis of offshore lifting operations on the UK
continental shelf (see Section 4.0). They may be applied to lifting operations in other
offshore regions which comply with recognised industry good practice, as it is applied
in the UKCS.
The data for dropped objects from derricks may be applied to onshore drilling
operations where these are similar to offshore drilling activities and equipment. The
data for dropped objects from main cranes and other lifting devices are not applicable
to onshore lifting operations because the equipment used is unlikely to be similar to
that used offshore.

3.2 Uncertainties
Sources of uncertainties in the data include statistical variation and the similarity
between the operations and equipment under analysis and those represented by the
database.

©OGP 3
RADD – Mechanical lifting failures

The calculated frequencies are derived from 1637 dropped object events in a total
experience of 3063 installation-years. This implies a total of about 111 million lifting
operations. For fixed platforms there were 690 dropped objects in 1857 platform years,
for mobile installations 947 events in 1206 installation-years experience. Therefore the
statistical uncertainty in the overall frequencies is relatively small. Some of the specific
risks are calculated from the experience of a small number of representative dropped
object accidents and correspondingly the uncertainty in the risk will be more significant.
The risks with the higher uncertainty are those with the lower likelihoods shown in
Section 2.0.
The data in the database reflect lifting equipment in operation in the UKCS. While there
is a degree of variation in the equipment used in the UKCS, it is similar in that the vast
majority is maintained and operated in accordance with international certification and
UK legal requirements. Competence requirements for operations and maintenance
personnel are generally enforced, and all operations are conducted in accordance with
documented procedures reflecting good industry practice. Where operations outside
the UK can be assumed to follow a similar standard of operation and maintenance, it is
reasonable to assume the data are valid for assessment of the dropped object risks.

3.3 Use of the Data


The dropped object probability values are an input to QRA and are used to calculate the
frequency of the initiating event for dropped object risks. The consequence of dropped
objects depends on the impact energy and the people, equipment and structures
impacted by the objects dropped.
For an object falling through air, the impact energy is calculated as the product of the
mass of the object, the height and acceleration due to gravity (≈ 10 m/s2). Generally,
people struck by falling objects can be assumed to be fatally injured, and objects
striking hydrocarbon equipment will cause a hydrocarbon release. Damage to
structures or other equipment struck by dropped objects may require a specific
assessment of the resistance of the object impacted and/or the potential for a release
from live equipment struck. However, incidents involving hydrocarbon releases are
already included in the hydrocarbon release frequencies, so such an assessment is only
recommended where the analyst identifies a particular vulnerability to dropped objects,
or a stand-alone dropped objects study is being carried out.

When using dropped object risks in a total risk assessment for a facility, the risks to
people from dropped objects may also be included in the statistical data on
occupational accidents. Where this is the case, it is appropriate to disregard the
calculated dropped object risk for immediate fatalities.
In the event of a dropped object, the lifting equipment will be out of service until the
incident can be investigated and any repair can be implemented. An operational risk
assessment should take account of this. Even for minor dropped objects with no
apparent damage, equipment downtime will be of the order of several days. In the event
of a fatality or major equipment damage, the equipment is likely to be out of service for
several weeks.

3.4 Consequence Analysis of Objects Dropped Into the Sea


The calculation of the consequences of objects dropped into the sea is more complex.
For heavy lifts (e.g. BOP or xmas tree) over the sea it is standard practice that these are
not carried out over vulnerable subsea equipment. Thus care is required in assessing

4 ©OGP
RADD – Mechanical lifting failures

whether a dropped BOP or other heavy load can cause damage to subsea equipment or
if the precautions carried out are adequate. For other lifts, the following approach can
be followed to calculate locations at risk from dropped object impact.
Heavy, dense objects (such as BOPs) can be assumed to fall vertically and will damage
any infrastructure immediately beneath the drop site. Some other objects, such as pipe
sections and scaffolding poles, may travel a significant horizontal distance through the
water as they descend. The following model is taken from a DNV Recommended
Practice [4].
The analysis assumes that the excursion made by a dropped object can be represented
by a normal distribution:

where x is the horizontal excursion and δ the standard deviation. The standard
deviation is sensitive to the weight and shape of the object, and the water depth (d). The
derivation of δ is given by:

Here α is the spread in the descent angle given in Table 3.1.

Table 3.1 Calculation of Descent Angles

Case Object Shape Weight Descent


Description Angle
(tonnes) Spread
(deg)
1 <2 15
2 Flat/long shaped 2–8 9
3 >8 5
4 <2 10
5 Box/round shaped 2–8 5
6 >8 3
7 Box/round shaped >> 8 2

The probability that the object lands within a horizontal distance, r, of the drop point is
given by the equation:

When considering object excursion in deep water the spreading of long/flat objects,
cases no. 1 to 3, will increase down to a depth of approximately 180 m. Below this depth
spreading does not increase significantly and may conservatively be set to be vertical.
For a riser, any vertical sections will complicate the hit calculations. One way of
calculating the probability of hit to a riser is to:
1. Split the riser into different sections (normally into vertical section(s) and horizontal
section(s)), and
2. Calculate the hit probability of these sections at the respective water depths. The
final probability is then found as the sum of all the probabilities for the different
sections.
The effect of currents will become more pronounced in deep water. The time for an
object to hit the seabed will increase as the depth increases. This means that any

©OGP 5
RADD – Mechanical lifting failures

current may increase the excursion (in one direction). At 1000 m depth the excursion is
found to increase 10 to 25 metres for an average current velocity of 0.25 m/s and up to
200 m for a current of 1.0 m/s.
The effect of currents may be included if one dominant current direction can be
identified. This may be applicable for rig operations for shorter periods, for example
during drilling, completion and intervention/construction above subsea wells. However,
for a dropped object assessment on a fixed platform, seasonal changes in current
directions may be difficult to incorporate.
When establishing a "safe distance" away from activities the effect of currents should
be included. A conservative object excursion should be determined, including
consideration of the drift of the objects before sinking, uncertainties in the navigation of
anchor handling vessel, etc.

3.5 Kinetic energy


A dropped object from a crane and hitting the topsides will have a kinetic (impact)
energy Ek given by:
Ek = m.g.h
where: Ek = kinetic energy at impact (J)
m = mass of the object (kg)
g = gravitation acceleration (9.81 m/s2)
h = height from release point to point of impact (m)
The maximum impact force depends on the object itself and the orientation when
hitting, and can be found from structural collapse calculations. The impact resistance of
structures can be found from deterministic structural strength calculations.
The kinetic energy of a dropped object on subsea installations depends on the velocity
through the water, the shape of the object and the mass in water. After approximately 50
- 100 metres, a sinking object will usually have reached its terminal velocity.
The terminal velocity is found when the object is in balance with respect to gravitation
forces, displaced volume and flow resistance. When the object has reached this
balance, it falls with a constant velocity, its terminal velocity. This can be expressed by
the following equation:

where: m = mass of the object (kg)


g = gravitation acceleration (9.81 m/s2)
V = volume of the object (the volume of the displaced water) (m3)
ρwater = density of water (typically 1025 kg/m3 for the North Sea)
CD = drag coefficient of the object
A = projected area of the object in the flow-direction (m2)
vT = terminal velocity through the water (m/s)
The kinetic energy of the object, ET, at the terminal velocity is:

Combining these to equations gives the following expression for the terminal energy:

6 ©OGP
RADD – Mechanical lifting failures

In addition to the terminal energy, the kinetic energy that is effective in an impact, EE,
includes the energy of added hydrodynamic mass, EA. The added mass may become
significant for large volume objects such as containers. The effective impact energy
becomes:

where ma is the added mass (kg).


Tubulars are assumed to be waterfilled unless it is documented that the closure is
sufficiently effective during the initial impact with the surface, and that it will continue to
stay close in the sea.
Intact, sealed containers may not sink at all.
The drag and added mass coefficients are dependent of the geometry of the object. The
drag coefficients will affect the objects terminal velocity, while the added mass only has
influence as the object hit something and is brought to a stop. Table 3.2 gives typical
values of these coefficients.

Table 3.2 Drag and Added Mass Coefficients

Object Case Description Cd Cm


(as Table 3.1)
1,2,3 Slender shape 0.7 - 1.5 0.1 - 1.0
4,5,6,7 Box shaped 1.2 - 1.3 0.6 - 1.5
All Misc. shapes (spherical to 0.6 - 2.0 1.0 - 2.0
complex)

It is recommended that a value of 1.0 is initially used for Cd, after which the effect of a
revised drag coefficient should be evaluated.
Small equipment items (fittings, scaffolding clamps, etc.) are unlikely to do any damage
to subsea equipment if they fall into the sea.

4.0 Review of data sources


The recommended probabilities of dropped objects presented in Section 2.0 have been
calculated by combining recorded incidents of dropped objects from the WOAD [1] and
the UK HSE’s ORION databases with data on the number of lifts carried out.
The incidents have been analysed by DNV and full reports are available in HSE research
reports [2] and [3].
The numbers of lifts per year for mobile installations (Table 4.1) are based on observed
data collected for DNV by a drilling contractor. The number of lifts per year on fixed
installations (Table 4.2) are estimated by interpretation of the data on mobile
installations combined with reasonable assumptions and consequently should be
treated with more caution. The numbers of “installation years” represented by the
ORION and WOAD data are provided by the HSE from primary records.
The experience data for mobile installations were collected over the period 1980 to 1998;
those for fixed installations were collected over the period 1991 to 1999.
Of the main crane lifts, 46% were to or from a supply vessel and 54% were across the
installation. Of the lifts to and from supply vessels, 75% were of containers, baskets
and tanks; the remainder were casing, drillpipe, collars, etc.

©OGP 7
RADD – Mechanical lifting failures

Table 4.1 Observed Frequencies of Lifting Operations on Mobile


Installations

Lifting Device Lifts per Year


Main Crane 24,480
Drilling Derrick 28,670
Other Lifting Device 3,650
Total 56,800

Table 4.2 Calculated Frequencies of Lifts using Main Crane on Fixed


Installations (per year)

Type of installation Lifts to / from Internal Lifts


Vessels
Fixed (no drilling) 5520 8,674
Fixed (drilling for 6 months / 8400 10,937
year)
Wellhead platform 552 867

The UK HSE has also published accident data for more recent period up to and
including 2004/2005 [5, 6. 7] These data have not been subjected to the same detailed
statistical analysis as the data presented in this report and for this reason the more
recent experience is not included here. However a review of the data over the period
1980 to 2005 shows that although there is considerable variation from year to year, the
average frequency of dropped objects per installation-year remains approximately
constant. This is consistent with the observation that the technology and lifting
procedures used on offshore installations have not changed to any great extent over the
period the data were collected.

5.0 References
1. DNV, 2006. WOAD, Worldwide Offshore Accident Databank, version 5.0.1.
2. DNV, 1999. Accident statistics for mobile offshore units on the UK continental shelf in
1980-98, HSE Offshore Technology Report OTO 2000/091 / DNV Report No. 99-2490.
3. DNV, 2002. Accident statistics for fixed offshore units on the UK Continental Shelf 1991-
1999, HSE Offshore Technology Report OTO 2002/012.
4. DNV, 2002. Risk Assessment of Pipeline Protection, Recommended Practice No. DNV-
RP-F107 (amended).
5. HSE, 2006. Offshore Injury, Ill Health and Incident Statistics 2004/2005 (provisional data),
HID Statistical Report HSR 2005 001.
6. HSE, 2005. Accident statistics for Floating Offshore Units on the UK Continental Shelf
1980-2003, Research Report 353, prepared by Det Norske Veritas for the Health and
Safety Executive.
7. HSE, 2005. Accident statistics for Fixed Offshore Units on the UK Continental Shelf 1980 –
2003, Research Report 349, prepared by Det Norske Veritas for the Health and Safety
Executive.

8 ©OGP
Risk Assessment Data Directory

Report No. 434 – 9


March 2010

Land
transport
accident
statistics
International Association of Oil & Gas Producers
RADD – Land transport accident statistics

contents
1.0 Scope and Application ........................................................... 1
2.0 Summary of Recommended Data ............................................ 1
2.1 Road and rail users......................................................................................... 1
2.2 Dangerous Goods Transport ......................................................................... 4
3.0 Guidance on use of data ........................................................ 5
3.1 General validity ............................................................................................... 5
3.2 Uncertainties ................................................................................................... 5
3.2.1 Road and Rail User Casualty Frequencies .............................................................. 5
3.2.2 DG Transport .............................................................................................................. 5
3.3 Application of frequencies to specific locations ......................................... 5
3.3.1 Road and Rail Transport............................................................................................ 6
3.3.2 Dangerous Goods Transport .................................................................................... 6
4.0 Review of data sources ......................................................... 7
4.1 Basis of data presented ................................................................................. 7
4.1.1 Road Transport........................................................................................................... 7
4.1.2 Rail Transport ............................................................................................................. 8
4.1.3 Dangerous Goods Transport .................................................................................. 10
4.2 Other data sources ....................................................................................... 10
4.2.1 Road Transport......................................................................................................... 10
4.2.2 Rail Transport ........................................................................................................... 11
4.2.3 Dangerous Goods Transport .................................................................................. 11
5.0 Recommended data sources for further information ............ 12
6.0 References .......................................................................... 12

©OGP
RADD – Land transport accident statistics

Abbreviations:
ACDS Advisory Committee on Dangerous Substances
BLEVE Boiling Liquid Expanding Vapour Explosion
DfT Department for Transport
DG Dangerous Goods
DNV Det Norske Veritas
ECMT European Conference of Ministers of Transport
E&P Exploration and Production
ERA European Railway Agency
EU European Union
FEMA Federal Emergency Management Agency
FRA Federal Railroad Administration
GB Great Britain
HGV Heavy Goods Vehicle
IRF International Road Federation
KSI Killed or Seriously Injured
LGV Light Goods Vehicle
LPG Liquefied Petroleum Gas
mm millimetre
OECD Organisation for Economic Co-operation and Development
OG&P Oil and Gas Producers
ORR Office of Rail Regulation
QRA Quantitative Risk Assessment
RSSB Rail Safety and Standards Board
UIC International Union of Railways
UK United Kingdom
US(A) United States (of America)
(V) km (Vehicle) kilometre

©OGP
RADD – Land transport accident statistics

1.0 Scope and Application


This datasheet provides information on land transport accident statistics for use in
Quantitative Risk Assessment (QRA). The datasheet includes guidelines for the use of
the recommended data and a review of the sources of the data. Most of the data concern
motor vehicles and rail transport, although some data for cyclists are also presented.
Data excludes pedestrians; if this is needed local data will need to be examined.
The data in this sheet are intended for two main uses:
• Assessing the risk of transporting personnel; data relating to the frequency of
fatalities and serious injuries to road and rail users are presented.
• Assessing the risks of transporting Dangerous Goods (DG); data on the frequency of
releases of hazardous materials from rail and road tankers are presented.
In the sections below the following definitions are used:
• Seriously Injured: Any person not killed, but who sustained an injury as result of an
accident, normally needing medical treatment.
• Killed: Any person killed immediately or dying within 30 days as a result of an
accident.
• Road Injury Accident: Any accident involving at least one road vehicle in motion on
a public road or private road to which the public has right of access, resulting in at
least one injured or killed person.

2.0 Summary of Recommended Data


It is best to try and obtain local data where possible. In the absence of local data the
following data can be used.
2.1 Road and rail users
The recommended frequencies and associated data are presented as follows:
• Road user (Table 2.1, Table 2.2, and Table 2.3)
• Rail user (Table 2.4)

©OGP 1
RADD – Land transport accident statistics

Table 2.1 Road Accident Fatality and Injury Rates, Selected Countries, All
Vehicles All Rates in deaths or injuries per 10 9 vehicle kilom etres

Country Year Traffic Frequency of Injury Rate Fatality Rate


9 9
Volume Accidents per 10 vehicle per 10 vehicle
9
10 vehicle kilo- Resulting in kilometres kilometres
metres Injury
9
per 10 vehicle
kilometres
Europe
Austria 2004 47.8 892.0 1168.0 18.4
Belgium 2004 93.5 520.5 673.7 12.4
Denmark 2005 45.5 118.9 144.7 7.3
Estonia 2005 8.1 288.1 366.6 20.8
Finland 2005 51.6 136.0 174.0 7.3
France 2005 547.6 154.3 197.2 9.7
Latvia 2005 10.2 439.2 550.7 43.5
Lithuania 2005 8.5 796.1 995.4 90.7
Romania 2004 67.9 101.1 82.4 35.6
Slovenia 2005 11.1 928.4 1289.1 23.2
Sweden 2005 73.8 245.3 358.7 6.0
Switzerland 2005 59.9 362.6 446.9 6.8
Turkey 2005 61.1 8732.2 2520.8 74.0
United Kingdom 2005 493.5 402.7 549.2 6.5
Africa
Egypt, Arab Rep. 2004 28.7 72.5 264.9 46.0
Ghana 2001 15.3 1022.9 472.5* 81.1
Senegal 2000 4.0 1497.9 1114.6* 161.0
South Africa 2005 123.4 1067.9 1597.5 116.0
America
Colombia 2004 15.6 14696.9 - 351.6
Mexico 2005 91.0 323.9 354.7 51.8
United States 2005 4794.3 386.8 563.0 9.1
Asia/ Middle East
Armenia 2005 0.4 2978.4 4027.2 703.7
Bahrain 2002 5.3 308.9 540.0 15.2
China, HK 2005 10.8 1392.8 1763.3 14.0
Israel 2005 41.1 413.5 863.5 10.9
Japan 2004 781.7 1218.1 - 10.9
Korea, Rep. 2005 314.9 680.1 1086.8 20.2
Kyrgyz Republic 2005 10.2 365.4 449.3 87.8
Mongolia 2002 2.3 2897.3 2148.8* 178.8
Singapore 2005 13.8 486.6 596.8 12.6
Ukraine 2005 14.0 3319.7 3999.1 516.3
Oceania
New Zealand 2005 40.6 266.1 355.8 9.9
* These appear to be incorrect values as the injury rate should be higher than the injury accident
rate in the previous column.

2 ©OGP
RADD – Land transport accident statistics

Table 2.2 Recom m ended Road Accident Fatality/Injury Rates:


Rates by Road Class, Road User Type, Injury Severity
All Rates in deaths or injuries per 10 9 vehicle kilom etres

Road User Urban roads Rural Roads Motorways All Roads


Death Seriou Death Seriou Death Seriou Death Seriou
s s s s
Injury Injury Injury Injury
Pedal Cycle 24 490 58 520 - - 32 500
Motor Cycle 65 1220 200 1220 51 300 120 1140
Car 2 28 7 44 2 9 4 31
Bus or Coach 4 110 3 29 41 11 4 75
LGV 11 6 1 11 1 5 1 8
HGV 11 11 2 17 1 7 1 12
All Vehicles 3 51 8 52 2 10 5 44

In some circumstances a QRA may require road user casualty rates in different units
which take more account of the specific numbers of passengers being transported.
Thus Table 2.3 presents recommended road user casualty rates per billion passenger
kilometres.

Table 2.3 Recom m ended Road Accident Fatality/Injury Rates:


Rates by Road User Type, Injury Severity All Rates in deaths or injuries per 10 9
passenger kilom etres

Road User Death KSI*


Pedal Cycle 36 684
Motor Cycle 111 1360
Car 2.7 31
Bus or 0.3 11
Coach
LGV/ HGV 0.9 11
* KSI = Killed or Seriously Injured

The values in Tables 2.2 and 2.3 are based on UK data and considered representative of
developed countries with good road safety records. The values from Table 2.1 can be
used to generate appropriate modification factors for the rates in Tables 2.2 and 2.3
when applied in different countries. Clearly in any specific situation there will be a
number of factors which will influence accident rates such as driver experience, age,
etc. No data has been found which could represent these influences explicitly.

Table 2.4 Recom m ended Rail Accident Fatality/Injury Rates


All Rates in deaths or injuries per billion passenger kilom etres

Vehicle Type Death Injury


Rail 0.4 15

1
See footnote 3 on page 7 for explanation of data derivation

©OGP 3
RADD – Land transport accident statistics

These rail accident data are considered representative of developed countries. In less
developed parts of the world the accident rates may be larger, but no data sources have
been found to enable them to be quantified.

2.2 Dangerous Goods Transport


The data below refers to releases while in transit, not during loading or unloading.

Table 2.5 Recom m ended Rail Tanker Release Frequencies

TANKER TANK SHELL PUNCTURE EQUIPMENT LEAK


TYPE (per loaded tank wagon (per loaded tank wagon
km) hour)
-8
Motor spirit 6.3 × 10 -
-9 -10
LPG 2.5 × 10 8.3 × 10
-9 -9
Ammonia 2.5 × 10 1.3 × 10
-10 -9
Chlorine 9.0 × 10 3.1 × 10

90% of the punctures are taken to be 50 mm diameter holes, the remaining 10%
catastrophic ruptures. The lower chlorine release frequencies are due to higher level of
engineering controls, and possibly safer procedural controls related to handling and
route management. Data on the causal breakdown of the release frequencies is not
available; both internal causes and causes external to the tanker are reflected in the
overall frequencies.

Table 2.6 Recom m ended Flam m able Liquid Road Tanker Release
Frequencies

SPILL SIZE RELEASE


FREQUENCY
(per loaded vehicle
km)
-9
5 - 15 kg 6.0 × 10
-8
15 - 150 kg 2.6 × 10
-9
150 - 1500 kg 7.0 × 10
-8
> 1500 kg 2.1 × 10
-8
TOTAL 6.0 × 10

Table 2.7 Recom m ended LPG Road Tanker Release Frequencies (not
cylinders)

FAILURE CASE RELEASE


FREQUENCY
(per loaded vehicle
km)
-12
BLEVE 2.7 × 10
-9
Cold rupture* 2.6 × 10
-8
Large* liquid space leak 1.8 × 10
-9
Large* vapour space leak 2.1 × 10
* Rupture modelled as instantaneous release and large leak modelled as 50 mm diameter hole

4 ©OGP
RADD – Land transport accident statistics

3.0 Guidance on use of data


3.1 General validity
If transport risk is a relatively small contribution to an overall risk study, the data above
may be sufficient. However, if transport risk is the object of the study, local data
become very important.
As discussed below in Section 3.3, it is strongly recommended that local data sources
on accidents and transport risk are obtained. This is because there can be large local
variations. In recommending the data in Tables 2.5 to 2.7 on DG transport, there is an
implicit assumption that tanker equipment is built to recognised international standards
and operated in line with relevant national DG regulations.

3.2 Uncertainties
3.2.1 Road and Rail User Casualty Frequencies
Due to the relatively large number of road traffic casualties (see Table 4.1 below), the
statistical uncertainties associated with the values in Table 2.2 and Table 2.3 are small
compared to the variations between countries.
In contrast, national statistics for rail passenger fatalities are generally very low.
However, low frequency but high consequence events can have a very large effect on
average passenger risk levels. Thus it is important to consider data over a reasonably
long time period. The data from Table 2.4 are based on British data 1996-2005 which
includes a number of major rail accidents; thus it is considered to be representative
with respect to such events.
Uncertainties for road and rail user casualty rates will be dominated by local variations.
Even within geographically close countries, such as within the EU, variations can be
large (see Section 4.0).
A further source of transport uncertainty arises from use of frequency units (e.g. per
vehicle km or per passenger km). The relative risk of various transport modes can be
highly dependent on the frequency units adopted. Thus, it is recommended that any
conclusions are tested for their sensitivity to units (see Table 2.2 and Table 2.3).

3.2.2 DG Transport
The frequency of releases of hazardous material during transport is much lower than
the frequency of road traffic accidents. Hence the statistical uncertainty will be larger,
similar to typical major hazard QRA uncertainties. In addition, these frequencies will be
influenced by local variations in road and rail accident rates. Thus, local data should be
obtained wherever practicable.

3.3 Application of frequencies to specific locations


This datasheet contains global data plus more detailed national data. When using these
data, it should be realised that they may not be directly applicable to the specific
location under study.
It is therefore strongly recommended that local data sources on accidents and transport
risk from governmental or other national or regional institutions are obtained before
using the data given in this sheet.
Should these local data not be accessible, or their reliability/applicability be uncertain,
then the data in this data sheet could be used after factoring for local circumstances.

©OGP 5
RADD – Land transport accident statistics

However, data which have been adjusted to allow for local circumstances should always
be used with caution.

3.3.1 Road and Rail Transport


In assessing the risks of personnel transport the following steps are recommended:
1. Obtain local data if practicable.
2. If not, use the data in Tables 2.1 to 2.4. For road risks the casualty frequencies can
be adjusted for location using the factors suggested in Section 2.0 and presented in
more detail in Section 4.0 below. Some location specific data for rail are also
presented in Section 4.0, but it is unclear if the variations are real or are a feature of
definitions and reporting criteria.
3. Analyse the proposed personnel journey patterns in terms of vehicle types, road
types, vehicle kilometres and/ or passenger kilometres (for rail only passenger
kilometres are required).
4. Multiply the frequencies from steps 1 or 2 with the journey pattern data in step 3 to
obtain overall personnel transport risks. Conduct sensitivity tests using the different
units in Table 2.2 and Table 2.3 (if relevant) and alternative data sources discussed
in section 4.02.
Example: estimate the fatality rate per year for an operation involving 30
personnel being transported 4 times a month by bus/ coach along 300km of
m otorway grade road in North Africa.
Assuming local data specific to this type of operation are not available steps 2 to 4 are
illustrated below.
• From Table 2.2 for bus/coach the fatality rate is 4 × 10-9 per vehicle-km. This is
based on UK data. From Table 2.1 the overall fatality rates in Egypt are 7.1 times
greater than UK. This is taken as an appropriate multiplication factor. Thus the
fatality rate is 28.4 × 10-9 per vehicle-km.
• Based on the example information above the number of vehicle-kms per year is 300
× 4 × 12 = 14,400.
• Thus the annual predicted fatality rate would be 28.4 × 10-9 × 14,400 = 4.1 × 10-4.
Using the data from Table 2.3 which gives a fatality rate per passenger-km gives a
fatality rate per year of 9.2 × 10-4.

3.3.2 Dangerous Goods Transport


In assessing the DG transport release frequencies the following steps are
recommended:
1. Obtain local data if practicable.
2. If not, use the data in Tables 2.5 to 2.7 and adjust the release frequencies for location
using fault tree analysis, expert judgements (e.g. based on relative transport
accident rates), or other appropriate methods.
3. Analyse the proposed DG transport patterns in terms of transport mode (rail/ road),
wagon/ vehicle kilometres, loaded tanker hours, etc.

2
While there is uncertainty concerning the location variations in the rail data, as noted above,
the location specific data may be used in sensitivity testing.

6 ©OGP
RADD – Land transport accident statistics

4. Multiply the frequencies from steps 1 or 2 with the DG transport data in step 3 to
obtain overall release frequencies.
Example: Estimate the frequency per year of large vapour space leaks in an
LPG operation that involves 5 tankers operating each 7 times a week on a
200km route fully loaded.
Assuming local data specific to this type of operation are not available steps 2 to 4 are
illustrated below.
• From Table 2.7 the large vapour space leak frequency is 2.1 × 10-9 per loaded
vehicle-km. Assume that expert judgement concludes that this frequency is
appropriate.
• Based on the example information above the number of loaded vehicle-kms per year
is 5 × 7 × 52 × 200 = 364,000.
• Thus the estimated annual leak frequency is 2.1 × 10-9 × 364,000 = 7.6 × 10-4.

4.0 Review of data sources


4.1 Basis of data presented
4.1.1 Road Transport
Table 2.1 is based on the International Road Federation’s (IRF) 2007 report [10]. For all
countries except Turkey, the most recent year’s data presented in this report is taken as
representative and presented in Table 2.1 (2005 data for Turkey appears to have an error
in the injury rate). This report also provides accident rates per 100,000 head of
population for a wider range of countries. The data in this table can be compared for
trends to the data in the previous Technical Note for E&P Forum which used the IRF’s
1994 report [3].
Table 2.2 and Table 2.3 are based on British data from the Department for Transport’s
2006 report [1]3. Table 4.1 shows the number of fatalities per vehicle type for 2006 on
which the casualty rates are based.

Table 4.1 GB Num bers of Fatalities 2006: Num bers by Road User Type &
Severity

Road User Death KSI*


Pedal Cycle 153 2568
Motor Cycle 634 6992
Car 2580 26713
Bus or Coach 122 1260
LGV 280 2322
HGV 419 2119
All vehicles 3172 31845
* KSI = Killed or Seriously Injured
[1] also provides a much greater range of data including trends over time, accident rates
as a function of age, gender, alcohol levels etc.
One of the E&P Forum (as was) member companies collected statistical data in the
1990s from which accident rates for desert driving conditions can be calculated. This

3
In Table 2.1 in 2006 there were no fatalities on urban roads for LGVs and HGVs and no fatalities
on motorways for bus/ coach. For these cells of the table, the recommended fatality rates have
been set to the “All Roads” value. In Table 2.2 the rates are based on 1996-2005 data; as no
separate value for HGV is given in Ref. [1] it has been set at the LGV value.

©OGP 7
RADD – Land transport accident statistics

data covers a period between 1992 and 1994. The derived desert driving accident and
fatality rates are shown in Table 4.2 below and relate to company and contractor work
related accidents.

Table 4.2 Desert Driving Accident and Fatality Rates

Year Road Traffic Road Traffic Injuries Fatalities Fatality Rate


(108 V km) Accidents (per 108 V km)
1992 0.79 137 56 4 5.1

1993 0.89 135 42 2 2.3

1994 0.86 111 26 0 0.0

The downward trend in the fatality rate was considered to be the result of improved
induction training, the fitting of roll-over bars and speed governors to all LGVs and the
near 100% usage of seat-belts. This needs to be taken into account when applying the
rates for desert driving at other locations. Deriving an average over the 3 years of 2.4
fatalities per 108 vehicle kilometres, this is approximately 5 times higher than the
average all-vehicle GB fatality rate.

4.1.2 Rail Transport


Table 2.4 is based on British data from 1996 to 2005 [1].
In analysing rail casualty data, care needs to be taken to distinguish casualties caused
in train incidents, non-train incidents and vandalism/ suicide. Overall fatality numbers
are dominated by the latter category. In addition, statistics may include passengers,
staff and “others” (third parties who were neither passengers nor staff, but who were
killed or injured due to rail related activity).
Also there is the need to allow for low frequency but high consequence events which
are characteristic of rail operations. A national railway may experience several years of
very few fatalities and then have one event which kills many tens of people.
It is often difficult to determine what has been included in summary statistics. Table 2.4
above is a subset of DfT data comparing various transport modes. It is averaged over
10 years and therefore takes account of low frequency/ high consequence events (e.g.
Ladbroke Grove, where there were 31 fatalities). The casualty rates relate just to train
passengers, but from all accident causes not only train accidents such as collisions,
derailments, fires etc.
Further details of UK rail accident rates are provided in the UK Office of Rail Regulation
Annual reports [4]. These split out incidents involving passengers, staff and members of
the public, and provide train incident rates, as well as other accident categories such as
trespass and vandalism.
The GB data is considered representative of average EU data. Figure 4.1 below is taken
from the RSSB strategic plan [5] and compares UK passenger fatality rates against the
25 EU countries’ averages. The UK values are shown to be consistent with the EU
values except in years when there are major UK disasters. If the major disasters were to
be averaged over a few years, there would be an even closer match.
In recent years the European Railway Agency has begun to collect statistics from all the
European countries. The 2004-2005 Rail Statistics are summarised in Figure 4.2 below
[6]. These data would appear to indicate significant differences between EU countries.
However, there is a need to be cautious. The variation could be because of inconsistent
reporting criteria or it could reflect low frequency/ high consequence events affecting a

8 ©OGP
RADD – Land transport accident statistics

few countries in the time period 2004-2005. Given this uncertainty no potential
modification factors are suggested in this datasheet.

Figure 4.1 Com parison between GB and EU Average Rail Fatality Rate [5]

Figure 4.2 EU States Rail Fatality Rate [6]

©OGP 9
RADD – Land transport accident statistics

US data from the Federal Railroad Administration [7] for 2006 indicates 2 passenger
fatalities in 16,211,393,401 passenger miles = 0.08 fatalities per billion passenger km.
This is also consistent with UK data for 2004-2005.

4.1.3 Dangerous Goods Transport


Tables 2.5 to 2.7 present a selection of available data suitable for use only where
transport risks form a small contribution to a process QRA. They should not be used for
transport QRA without detailed consideration of the applicability of the data. In
particular local variations in transport accident rates should be analysed.

4.1.3.1 Rail Tankers


The Advisory Committee on Dangerous Substances (ACDS) of the UK Health & Safety
Commission produced a report in 1991 [8] which provides a detailed QRA of road and
rail transport of motor spirit, LPG, ammonia and chlorine in Great Britain, including
puncture frequencies based on modified UK experience and equipment leak frequencies
based on fault tree analysis.
[8] estimated frequencies of tank shell punctures and equipment leaks from tank
wagons carrying dangerous goods, based on modified UK data (Table 2.5). The
punctures are taken to be 50 mm diameter holes (90%) or catastrophic ruptures (10%).

4.1.3.2 Liquid Tankers


The best available estimate of leak frequencies from tankers carrying non-pressurised
liquids is also given by [8], based on spills from UK motor spirit tankers (Table 2.6).

4.1.3.3 LPG Road Tanker Leak Frequencies


A DNV Technica report [9] compared various sources of leak frequency data for LPG
road tankers, and developed a fault tree model to take account of the main influences.
Table 2.7 gives the failure case frequencies for a tanker with passive fire protection,
based on Hong Kong road traffic accident rates.

4.2 Other data sources


4.2.1 Road Transport
The International Road Federation in Geneva collects world road statistics including
data on road accidents from a large number of countries [10]. The data include the
annual number of accidents, annual number of injured and killed people as well as the
number of injury accidents, persons injured or killed per 100 million vehicle kilometres
(108 V km).
The Organisation for Economic Co-operation and Development (OECD) maintains road
safety statistics [2]. It presents international fatality information for different road types.
The OECD website [2] also presents injury rates and fatalities per 100,000 of the
population.
The European Conference of Ministers of Transport [11] gives death rates and casualty rates per capita
and per vehicle for European countries and Australia, Canada, Japan, Russia and USA. However, it does
not have any estimates of vehicle-km.
Davies & Lees [12] give a variety of accident statistics for heavy goods vehicles, drawn
mainly from national accident statistics.

10 ©OGP
RADD – Land transport accident statistics

Koornstra [24] presents a passenger transport model which includes road transport
risk. Reference risks are first determined based on data from the original 15 EU
countries. Multiplication factors are then developed relating road fatality risks to the
Gross National Income per person (GNI/p) and plotted on a graph with a fitted function.
Corrections are made for estimated underreporting. The report notes a rather wide
scatter of fatality rates for individual countries about the curve. For certain countries
there is a difference between the predicted and reliably established risks (where country
specific data exists). Thus the report proposes an additional multiplication factor where
there are strong indications that a country is relatively less safe or relatively safer than
other countries with a comparable GNI/p level. Finally a multiplication factor for road
type proportions is proposed based on the variation in risk that is seen on different road
types. In principle this method can estimate road transport risks for any country in the
world and could be useful when country specific data is not available. The reference
risks are consistent with those presented in this report.

4.2.2 Rail Transport


A Statistical Analysis of Fatal Collisions and Derailments of Passenger Trains on British
Railways [13] provides a detailed analysis of the comparative safety of different designs
of passenger carriage on British Railways, including accidents per passenger mile and
fatalities per accident.
Frequency of Railway Accidents in the German Federal Railways Network: Goods Traffic and
Shunting Operations [14] provides a detailed analysis of accident frequencies and
involvement probabilities for wagons in goods trains in Germany.
Light Rail Accidents in Europe and North America [15] has a detailed comparison of
accident frequencies on light rail systems in different countries.
The report by Koornstra [24] also includes rail transport risk. Reference risks are
determined based on data from the original 15 EU countries. Multiplication factors are
again developed relating rail fatality risks to the Gross National Income per person
(GNI/p). However there is less country data than for road fatalities on which to base
these multiplication factors. Thus, as with road, the report proposes using an
additional multiplication factor where there are strong indications that a country is
relatively less safe or relatively safer than other countries with a comparable GNI/p
level.
Further international information on rail transport safety is available from International
Union of Railways (UIC) at http://www.uic.asso.fr/.

4.2.3 Dangerous Goods Transport


There are a large number of other data sources with information relevant to DG
transport, but generally they are older or less generally applicable than the values given
in Section 2.0.
The Federal Emergency Management Agency (FEMA) [16] provides information for
explosive, flammable and otherwise dangerous chemicals. It presents failure rates
which originate from several sources. The age of the background data and the
individual sources may no longer reflect the reliability of transport vehicles on the roads
and railways today because of stricter safety regulations for both vehicles and materials
transportation. The individual sources contain information about accident rates for
trucks used in the petroleum industry and for transporting bulk hazardous materials
([17] to [23]).

©OGP 11
RADD – Land transport accident statistics

5.0 Recommended data sources for further information


For further information, the data sources used to develop the release frequencies
presented in Section 2.0 and discussed in Sections 3.0 and 4.0 should be consulted.
The references used for the recommended data in Section 2.0 are shown in bold in
Section 6.0.

6.0 References
[1] Departm ent for Transport 2006. Road Casualties Great Britain 2006
http://www.dft.gov.uk/162259/162469/221412/221549/227755/rcgb2006v1.pdf
[2] OECD, International Traffic Safety Data and Analysis Group
http://cemt.org/IRTAD/IRTADPublic/we2.html
[3] International Road Federation (IRF) 1994. World Road Statistics 1980-1993
[4] Office of Rail Regulation (ORR) 2006. Annual Report on Railway Safety
2005. http://www.rail-reg.gov.uk/upload/pdf/296.pdf
[5] UK Rail Safety and Standards Board (RSSB) 2007. The Railway Strategic Safety Plan
2008-2010.
[6] European Railway Agency (ERA) 2006. A Summary of 2004-2005 EU Statistics on
Railway Safety.
http://www.era.europa.eu/public/Documents/Safety/Safety_Performance/07-
05%20ERA-Report2.pdf
[7] US Federal Railroad Administration website:
http://safetydata.fra.dot.gov/OfficeofSafety/
[8] ACDS 1991. M ajor Hazard Aspects of the Transport of Dangerous
Substances, Advisory Com m ittee on Dangerous Substances, Health &
Safety Com m ission, HMSO.
[9] DNV Technica 1996. Quantitative Risk Assessment of the Transport of
LPG and Naphtha in Hong Kong - Methodology Report, Report for
Electrical & Mechanical Services Departm ent, Hong Kong Governm ent,
Project C6124.
[10] International Road Federation 2007. The IRF W orld Road Statistics
2007, Data 2000-2005.
[11] ECMT 1998. Statistical Report on Road Accidents 1993/1994, European Conference of
Ministers of Transport, OECD, Paris.
[12] Davies, P.A. & Lees, F.P. 1992. The Assessment of Major Hazards: The Road
Transport Environment for Conveyance of Hazardous Materials in Great Britain, J.
Haz. Mat., 32, 41-79.
[13] Evans, A.W. 1997. A Statistical Analysis of Fatal Collisions and Derailments of
Passenger Trains on British Railways: 1967-1996, Proc. Inst. Mech. Eng., 211 Part F.
[14] Fett, H-J & Lange, F 1992. Frequency of Railway Accidents in the German Federal
Railways.
[15] Walmsley, D.A. 1992. Light Rail Accidents in Europe and North America, Research
Report 335, Transport & Road Research Laboratory, Crowthorne, UK
[16] Federal Emergency Management Agency. Handbook of Chemical Hazard Analysis
Procedures, available from Federal Emergency Management Agency, Publications
Office, 500 C Street, SW, Washington, DC 20472
[17] American Petroleum Institute 1983. Summary of Motor Vehicle Accidents in the
Petroleum Industry for 1982.
[18] Dennis, A.W. et al. 1978 Severities of Transportation Accidents Involving Large
Packages, Sandia Laboratories, NTIS SAND-77-0001.
[19] Rhoads, R.E. et al. 1978 An Assessment of the Risk of Transporting Gasoline by Truck,
prepared by Pacific Northwest Laboratory for the U.S. Department of Energy, PNL-
2133.

12 ©OGP
RADD – Land transport accident statistics

[20] Smith, R.N. and E.L. Wilmot 1982. Truck Accident and Fatality Rates Calculated from
California Highway Accident Statistics for 1980 and 1981, prepared by Sandia National
Laboratories for the U.S. Department of Energy, SAND-82-7066.
[21] National Safety Council. 1988 Accident Facts.
[22] Ichniowski T. 1984 New Measures to Bolster Safety in Transportation, Chemical
Engineering, pp. 35-39.
[23] Urbanek, G.L. and E.J. Barber 1980. Development of Criteria to Designate Routes for
Transporting Hazardous Materials, prepared by Peat, Marwick, Mitchell and Co. for
the Federal Highway Administration, NTIS PB81-164725.
[24] Koornstra, M.J. 2008. A Model for the Determination of the Safest Mode of Passenger
Transport between Locations in any Region of the World. Report for Shell International
Exploration and Production B.V.

©OGP 13
Risk Assessment Data Directory

Report No. 434 – 10


March 2010

Water
transport
accident
statistics
International Association of Oil & Gas Producers
RADD – Water transport accident statistics

contents
1.0 Scope and Application ........................................................... 1
1.1 Scope ............................................................................................................... 1
1.2 Application ...................................................................................................... 1
1.3 Definitions ....................................................................................................... 1
2.0 Summary of Recommended Data ............................................ 2
2.1 Personnel Risk ................................................................................................ 3
2.2 Vessel Accident Frequencies ........................................................................ 3
2.3 Oil Spill Frequencies ...................................................................................... 4
3.0 Guidance on use of data ........................................................ 5
3.1 General validity ............................................................................................... 5
3.2 Uncertainties ................................................................................................... 5
3.3 Application of frequencies to specific locations ......................................... 5
3.3.1 Personnel Risk ........................................................................................................... 6
3.3.2 Ship Accidents and Oil Spill Frequencies ............................................................... 6
4.0 Review of data sources ......................................................... 6
4.1 Basis of data presented ................................................................................. 6
4.1.1 Personnel Transport .................................................................................................. 6
4.1.2 Vessel Incidents and Accidents.............................................................................. 10
4.1.3 Oil Spills .................................................................................................................... 12
4.2 Other data sources ....................................................................................... 13
4.2.1 Personnel Transport ................................................................................................ 13
4.2.2 Vessel Casualties ..................................................................................................... 15
4.2.3 Oil Spills .................................................................................................................... 15
4.2.4 Dangerous Goods Transport .................................................................................. 15
5.0 Recommended data sources for further information ............ 16
6.0 References .......................................................................... 16

©OGP
RADD – Water transport accident statistics

Abbreviations:
ACDS Advisory Committee on Dangerous Substances
BSP Brunei Shell Petroleum
CALM Catenary Anchor Leg Mooring
DNV Det Norske Veritas
E&P Exploration and Production
ERRV Emergency Response & Rescue Vessel
FAR Fatal Accident Rate
GB Great Britain
GT Gross Tonnage
IR Individual Risk
LMIS Lloyd’s Maritime Information Services
MBC Marine Breakaway Coupling
MSMS Marine Safety Management System
NPC National Ports Council
OGP Oil and Gas Producers
P&I Protection & Indemnity
QRA Quantitative Risk Assessment
SAFECO Safety of Shipping in Coastal Waters
SMS Safety Management System
SPM Singe Point Mooring
SSB Sarawak Shell Berhad
UK(CS) United Kingdom (Continental Shelf)
USCG United States Coast Guard

©OGP
RADD – Water transport accident statistics

1.0 Scope and Application


1.1 Scope
This datasheet provides information on water transport accident statistics for use in
Quantitative Risk Assessment (QRA). The data sheet includes guidelines for the use
of recommended data and a review of the sources of the data.
The data in this sheet are intended for three main uses:
• Assessing the risk of personnel on board vessels;
• Assessing the frequencies of vessel/ship accidents;
• Assessing the frequencies of oil spills.

Relevant personnel are crew boat passengers being transported to offshore facilities
and crew who work on vessels. The main focus in terms of vessel types is on supply
vessels, stand-by vessels (now commonly known within the UK as Emergency
Response & Rescue Vessels (ERRV)), crew vessels, anchor handling vessels, diving
support vessels and tankers. Drilling rigs, flotels, and production and storage vessels
are not included.

1.2 Application
This datasheet contains global data plus more detailed regional/national data where
relevant or where available. When using these data, it should be noted that they may
not be directly applicable to the specific location under study. Guidance on using
location specific data is given in Section 3.3.
The data presented are applicable to activities in support of operations within
exploration for and production of hydrocarbons.

1.3 Definitions
The primary source of ship accident data is the ship casualty database maintained by
Lloyd’s Maritime Information Services (LMIS). Loss frequencies can be obtained by
combining with fleet data from the Lloyd’s Register annual World Fleet Statistics [1].
These sources cover all self-propelled sea-going merchant ships over 100 GT.
Accidents to the ship are defined in terms of the following severity categories:

• Incidents Any event reported to LMIS and included in the


database. This is usually because the event may
involve some cost to the shipowner and may lead to an
insurance claim. In this analysis, the term “incident” is
taken to include serious casualties, while the term
“non-serious incident” excludes serious casualties.
Incidents are only recorded in the LMIS database for
tankers and passenger ships.
• Serious casualties Incidents involving total loss (see below); breakdown
resulting in the ship being towed or requiring
assistance from ashore; flooding of any compartment;
or structural, mechanical or electrical damage requiring
repairs before the ship can continue trading.

©OGP 1
RADD – Water transport accident statistics

• Total loss Where the ship ceases to exist after a casualty, either
due to it being irrecoverable (actual total loss) or due to
it being subsequently broken up (constructive total
loss). The latter occurs when the cost of repair would
exceed the insured value of the ship.

Incidents in the LMIS database are categorised according to the following codes:
• Collision Striking or being struck by another ship, whether under
way, anchored or moored. This excludes striking
underwater wrecks.
• Contact Striking or being struck by an external object, but not
another ship or the sea bottom. It includes striking
offshore rigs/platforms, whether under tow or fixed.
• Foundered Sinking due to rough weather, leaks, breaking in two
etc, but not due to other categories such as collision
etc.
• Fire/explosion Where the fire/explosion is the first event reported, or
where fire/explosion results from hull/machinery
damage. In other words, it includes fires due to engine
damage, but not fires due to collision etc.
• Hull/m achinery dam age Where the hull/machinery damage is not due to other
categories such as collision etc. Also termed
“Structural failure” in sections below.
• W ar loss/dam age Includes damage from all hostile acts.
• W recked/stranded Striking the sea bottom, shore or underwater wrecks.
Also termed “Grounding” in sections below.
• Miscellaneous Events not classified due to lack of information or not
included above, e.g. oil spill, flooding.

Personnel risks are presented as Fatal Accident Rates (FAR), defined as fatalities per
108 exposed hours.

2.0 Summary of Recommended Data


The recommended frequencies and associated data are presented as follows:
• Personnel Risk (Section 2.1) – relevant personnel are crew boat passengers being
transported to offshore facilities and crew who work on vessels.
• Vessel Accident Frequencies (Section 2.2)
• Oil Spill Frequencies from tankers and during transfer operations (Section 2.3)

2 ©OGP
RADD – Water transport accident statistics

2.1 Personnel Risk


The recommended FAR for marine personnel (boat crew) is 3.
Where crew boats are used to transport other personnel to and from offshore
facilities, the risk to these offshore personnel can be expressed as follows:
FAR (fatalities per 108 exposed hours) = 30 + 26/Transit time per journey (hours).
Section 3.3.1 illustrates the use of this FAR format1.
These fatality rates for offshore personnel could be up to three times higher in certain
parts of the world. For seafarers not directly connected to the offshore industry the
fatality rates in some parts of the world could be a factor of up to 40 higher than the
FAR of 3.

2.2 Vessel Accident Frequencies


Table 2.1 Vessel Accident Frequencies (per ship year)

Vessel/Accident Type Total Loss Serious Casualty


per ship year per ship year
-3 -3
All Sea-Going merchant ships > 100 3.0 × 10 9.3 × 10
GT
-3 -2
Oil Tankers 1.9 × 10 1.1 × 10
-4 -3
Tanker fire/explosion 7.2 × 10 2.6 × 10

Table 2.2 Causal Breakdowns for Total Losses

Accident Type % of Total Losses

Foundered 48
Missing 1
Fire/Explosion 14
Collision 12
Wrecked/Stranded 18
Contact 2
Other 5
TOTAL 100

1
1. It is important to note that this equation comprises 2 elements: one for the actual transit
(30) + one for embarking and disembarking (26/Transit time). The first of these is
8
proportional to the transit time per journey; as the FAR is defined to be per 10 exposed
hours, it is constant. The second is proportional to the number of journeys made, which is
8
inversely proportional to transit time for a fixed total time exposure (i.e. 10 hours).

©OGP 3
RADD – Water transport accident statistics

2.3 Oil Spill Frequencies


Table 2.3 Oil Tanker Oil Spill Frequencies

ACCIDENT TYPE OIL SPILL OIL SPILL RATE AVERAGE OIL


FREQUENCY (tonnes per ship SPILL SIZE
(spills per ship year) (tonnes)
year)
-3
Collision 1.5 × 10 4.49 2922
-4
Contact 7.2 × 10 0.11 148
-4
Fire/explosion 5.1 × 10 1.52 2973
-5
War Loss 5.1 × 10 0.001 27
-3
Structural failure 1.3 × 10 5.68 4435
-3
Transfer spill 1.7 × 10 0.23 133
-4
Unauthorised discharge 5.1 × 10 0.21 408
-4
Grounding 5.6 × 10 5.20 9227
-3
TOTAL 6.9 × 10 17.43 2522

Table 2.4 Offshore Crude Loading Spills (non-CALM system s)

SPILL SOURCE MEAN SIZE FREQUENCY


SIZE RANGE (spills per
(barrels) (barrels) cargo)
-2
Storage on platform 121 0.1 to 4000 1.1 × 10
2 -4
Pipeline to loading facility 19 NA 3.0 × 10
-3
Loading buoy or facility 946 0.25 to 9400 3.0 × 10
-3
Transfer hose and coupler 78 0.5 to 500 4.1 × 10
-4
Tanker 4 2 to 5 6.0 × 10
-2
TOTAL 237 0.1 to 9400 1.9 × 10

The following frequencies are given for pollution events during loading at Single Point
Moorings (SPM; all categories including CALM included) in relation to Marine
Breakaway Couplings (MBC):
• 1 event (tanker breakout or surge event) every 3,518 operating days without MBC
• 1 event every 5,621 operating days with MBC
• Spill quantity with MBC fitted is 1/35 that without MBC
Note that ‘operating days’ refers to the number of days a tanker occupies the SPM.
Typically a shuttle tanker loading operation lasts less than 24 hours; it is suggested
that operating days be used as a surrogate for number of cargoes loaded.

2
Only one event, hence no range

4 ©OGP
RADD – Water transport accident statistics

3.0 Guidance on use of data


3.1 General validity
If transport risk is a relatively small contribution to an overall risk study, the data
above may be sufficient. However, if transport risk is the object of the study, local
data become very important. It is strongly recommended that local data sources on
accidents and transport risk are obtained. This is because there can be large local
variations.

3.2 Uncertainties
With respect to the personnel risk values in Section 2.1, the main uncertainties are
associated with estimating the exposed populations for each type of worker. These
population uncertainties could lead to a factor of 2 in the uncertainty in the frequency
estimates. Other factors which are relevant are the uncertainty in trends with time, the
differences between different types of vessel (e.g. supply, standby, anchor handling
etc.) and the uncertainties due to different locations around the world.
Concerning vessel accident frequencies in Section 2.2, there are uncertainties over
when a vessel loss is defined as a total loss. Statistics dealing with total loss of
vessels may give lower figures for the latest years due to the fact that not all vessels
will be written off immediately after an accident. In some cases, the vessel may be
categorised as ‘out of service’, and after some time a decision to write it off or bring it
back in service will be made. There is a lack of consistency as to the year the vessel
may be written off; i.e. the year when the accident took place or the year when the
decision was made. In some cases the source may change the rules as to which year
the vessel will be classified as total loss without correcting the previous data.
Attempts have been made to take account of this in the analysis below. The total
population with regard to vessels is also difficult to assess. Most statistics available
have been collected and registered with regard to the flag, and not the region where
the vessels were sailing or where the accident took place. Worldwide frequencies
have been used to overcome these problems.
Oil spills not resulting from ship damage (e.g. transfer spills) are not covered
comprehensively in the LMIS database. Reporting of oil spills could be variable
especially for smaller spills. North Sea data which are considered better reported than
world averages have been used to try and reduce reporting uncertainty on transfer
spills.

3.3 Application of frequencies to specific locations


This datasheet contains global data plus more detailed regional data where relevant.
When using these data, it should be realised that they may not be directly applicable
to the specific location under study. It is therefore strongly recommended that local
data sources on accidents and transport risk from governmental or other national or
regional institutions are obtained before using the data given in this sheet.
Should these local data not be accessible, or their reliability/applicability be uncertain,
then the data in this data sheet could be used after factoring for local circumstances.
However, data which have been adjusted to allow for local circumstances should
always be used with caution: the assumptions made are likely to be judgemental and
hence may reduce the reliability of the adjusted data vis–à-vis reality. Each
assumption shall be clearly documented so that an audit trail is maintained.

©OGP 5
RADD – Water transport accident statistics

3.3.1 Personnel Risk

The Boat Crew FAR in Section 2.1 can be used in just the same way as all the other
FAR data in these OGP datasheets.
The FAR equation for transferring other personnel by crew boats in Section 2.1 can be
understood through the following example. Assume a transit time of 1.5 hours. The
FAR from Section 2.1 can be used to generate an individual risk per journey as
follows:
IR per journey = FAR × 10-8 × Transit time per journey (hours)
= (30 + 26/1.5) ×10-8 × 1.5 = 7.1×10-7

Hence the expression for IR per journey can be generalised to:


IR per journey = 2.6 x 10-7 + 3.0 × 10-7 × Transit time (hours)

For the example journey above, with a transit time of 1.5 hours the individual risk is
again 7.1 × 10-7 per journey.
Location adjustments can make use of worldwide FAR data shown in Table 4.3 below.
The data presented below in Section 4.1.1.2 are not sufficient to distinguish between
transfers from shore to shore, shore to offshore and offshore to offshore.

3.3.2 Ship Accidents and Oil Spill Frequencies

The accident and spill rates in Sections 2.2 and 2.3 can be applied directly in generic
risk assessments. Ship accident rates could however be dependent on factors such
as location/ route, flag, ship operator SMS. If a detailed marine QRA is being
undertaken the data would need to be reviewed for local relevance.

4.0 Review of data sources


4.1 Basis of data presented
4.1.1 Personnel Transport
4.1.1.1 Marine Personnel Associated with Offshore Industry
Table 4.1 presents an analysis of fatalities on vessels operating on the UKCS [2].

Table 4.1 Location of Fatal Marine Related Accidents on UKCS, 1977-96

Location Events Fatalities


Single point mooring 2 4
Barge 5 5
Diving support vessel 9 10
Supply vessel 13 14
Stand-by vessel / ERRV 3 4
Anchor handling vessel 3 3

6 ©OGP
RADD – Water transport accident statistics

Based on these numbers of fatalities and estimates of offshore workforce together


with a consideration of trends with time, [2] made an estimate of an FAR of 3 for boat
crew working on the UKCS. Note that there is significant uncertainty on the
percentage of the workforce in the various occupations and hence this FAR is
probably +/- a factor of 2. There was insufficient exposure data in [2] to distinguish
between crew in the different locations in Table 4.1.

4.1.1.2 Crew Boat Transfers


The only data available on experience with crew boats is for Brunei Shell Petroleum
(BSP) and Sarawak Shell Berhad (SSB) in Malaysia [3].

Operator 1 (Asia Pacific region) Experience


Operator’s crew boat experience during 1971-91 has been estimated as:
40,000 boat hours in transit
88,000 boat stages
There were on average 7.3 passengers on each boat stage, giving passenger
experience of:
292,000 passenger hours in transit
644,000 passenger transfer stages
Here, a stage consists of an embarkation and a disembarkation. In this period there
have been no fatalities on crew boats at all. Recent information indicates that
between 1991 and 2008 there have also been no fatalities.

Operator 2 (Asia Pacific region) Experience


Operator’s crew boat experience prior to 1991 amounted to at least:
2,000,000 passenger hours
2,000,000 passenger transfer stages
As with Operator 1, Operator 2 had no fatalities associated with crew boats in that
period. Recent information indicates that between 1991 and 2008 Operator 2
experienced one crew member fatality but no passenger fatalities.
Given the limited size of these datasets they have been combined.

Crew Boat Accident Frequencies


Where no accidents have occurred, the frequency may be estimated using statistical
techniques based on the Poisson distribution. The most likely frequency is equivalent
to assuming that 0.7 accidents have occurred to date, i.e. that the operation is 70% of
the way to its first accident. The confidence interval on this value is of course very
wide.
Since accidents in transit (such as the boat sinking) arise from different mechanisms
than accidents in transfer (such as crew members being crushed while transferring), it
may be appropriate to assume that both parts of the operation are independent and
70% of the way to an accident. This is pessimistic (for crew boats) and requires
careful sensitivity-testing.

©OGP 7
RADD – Water transport accident statistics

The above approaches yield accident frequency estimates for crew boats as given in
Table 4.2 based on prior 1991 data. The 90% confidence intervals are also shown. The
recent information indicates a further 17 years of operations by Operators 1 and 2
(referred to above) with no passenger fatalities. Thus as a sensitivity test one could
half the values given below assuming that the marine operations have maintained
their pre-1991 volume. Such a test would be within the 90% confidence band below.
However, given that a significant event could cause multiple passenger fatalities it is
recommended to maintain the values below as cautious best-estimates.

Table 4.2 Crew Boat Accident Frequencies (1971-1991)

Fatalities in Transit Fatalities in Transfer


(Per Passenger Hour) (Per Passenger Transfer
Stage)
-8 -8
Lower 5% value 2.2 × 10 1.9 × 10
-7 -7
Best estimate 3.0 × 10 2.6 × 10
-6 -6
Upper 5% value 1.3 × 10 1.1 × 10

4.1.1.3 Other Seafarers


[4] provides fatality rates for seafarers on UK merchant vessels and compares these
to other merchant fleets. For 1996-2005 there were 32 fatalities in accidents on UK
vessels:
• 23 personal occupational accidents while on duty
• 8 off duty personal accidents
• 1 in a shipping accident (an explosion)
These numbers exclude deaths due to disease, suicide and unexplained events (e.g.
disappeared overboard).
The 32 fatalities equate to a rate of 11 fatalities per 100,000 seafarer-years (see Table
4.3 under UK 1996-2005). Assuming an average of 4000 hours onboard a vessel per
seafarer year this equates to a FAR of 3. Table 4.3 indicates that this value is near the
bottom of the range of surveyed fleets; values up to a factor 40 higher would be
appropriate for other parts of the world.

8 ©OGP
RADD – Water transport accident statistics

Table 4.3 Seafarer Fatal Accident Rates (from [4])

Merchant Fleet Time No. of deaths Fatal Accident rate


Period from (per 100,000 seafarer-
accidents years)
India 1990-1996 282 426
Hong Kong 1990-1995 68 253
Singapore 1984-1989 101 162
Greece 1990-1994 339 162
West Germany 1960-1972 820 148
Norway 1990-1994 156 102
Poland 1985-1994 49 100
Singapore 1990-1995 98 99
West Germany 1974-1976 - 92
Denmark 1996-2005 72 90
Poland 1996-2005 52 84
Poland (2 main companies) 1990-1995 35 80
Poland 1960-1999 412 72
UK seafarers in non-UK fleets 1986-1995 63 66
Belgium 1996-2005 3 63
Denmark 1986-1993 63 62
Japan 1990-1994 121 58
Hong Kong 2000-2005 44 56
UK 1976-1985 407 53
Hong Kong 1980-1989 36 48
Isle of Man 1988-2005 33 44
Netherlands 1990-1994 15 39
Germany 1990-1994 35 39
UK 1986-1995 100 39
Sweden 1984-1988 27 37
Canada 1996-2005 16 22
France 1990-2004 6 20
India 1996-2005 26 18
Spain 1990-1994 7 16
Sweden 1996-2005 19 13
UK 1996-2005 32 11
Australia 1990-1994 3 10
Sweden 1990-1994 9 10

4.1.1.4 Effect of Location

Overall FARs in exploration and production for oil & gas world-wide have been
produced by OGP [5], The ratios of offshore FARs in the different areas are
considered to be a suitable basis for modifying the fatality rates for marine personnel
associated with the offshore industry above. Table 4.4 has the relevant values from
the “Occupational Risk” datasheet. For other seafarers the values in Table 4.3 can be
used.

©OGP 9
RADD – Water transport accident statistics

Table 4.4 FAR Multiplication Factors Offshore for Different Regions

Personne Africa Asia/ Europ FSU Middle North South


l Austr- e East America Americ
alasia a
All 1.22 0.56 1.05 0.69 0.82 1.52 0.92
Company 1.00 0.72 2.94 0.00 0.00 0.47 0.00
Contract 1.17 0.53 0.88 0.68 0.84 1.86 1.10
or

4.1.2 Vessel Incidents and Accidents


The most readily available analysis of accidents is in the Lloyd’s Register annual
World Casualty Statistics. This gives the total losses in the current year and several
previous years. Loss frequencies can be obtained by combining with fleet data from
the Lloyd’s Register annual World Fleet Statistics. These sources cover all self-
propelled sea-going merchant ships over 100 GT.
Figure 4.1 shows the total loss frequency for all ships over 100 GT world-wide
between 1974 and 1998. It shows a generally declining trend. Some of the fluctuations
can be attributed to the Iran-Iraq War (1980-88, with particular effects on shipping in
1982) and the Gulf War in Kuwait in 1991.
Based on this graph and allowing for the under-reporting effect of the last two years a
total loss frequency of 3.0 × 10-3 per ship year has been estimated; this is the
recommended value given in Section 2.2. Data for 1999 and 2000 gives total loss rates
of 1.5 × 10-3 and 1.9 × 10-3 per ship year respectively. This indicates a potentially
reducing loss rate with time which could be used as a sensitivity test.

Figure 4.1 Trend in Total Loss Frequency for All Ships

10 ©OGP
RADD – Water transport accident statistics

LMIS also provides information related to specific ship types. Based on the worldwide
LMIS database from 1992-1997 [6] made an estimate for oil tankers of a total loss
frequency of 1.9 × 10-3 per ship year. Of this fire/ explosion caused total losses with a
frequency of 7.2 × 10-4 per ship year. The serious casualty rates in Section 2.0 also
come from this source.
In terms of the impact of fleet on these rates, Table 4.6 (from [4]) can be used to derive
modification factors. Fatal casualty rates per ship year can be derived for each of the
fleets in Table 4.6. The maximum rate is 3.0 per 1000 ship years for Cambodia and 0.1
per 1000 ship years for UK and The Netherlands. The average rate is 0.8 per 1000 ship
years. Thus a modification range of a factor of 4 above the world average and a factor
of 8 lower than the world average is judged reasonable.
The effect of ship age is illustrated in Figure 4.2 below for oil tankers [6]. The effects
are expressed as the ratio of the frequency for specific age groups to the average
frequency for the whole fleet. The graph plots these ratios on a base of ship age,
using the mid-point of each group, and plotting the ratio for the 25+ age group at 27.5
years. This shows the pattern of low frequencies early in the ship’s life, rising in mid-
life and declining for older ships. This reduction for older ships is attributed to a
higher fraction of older ships being laid-up or used for storage, and hence being less
exposed to hazards.

Figure 4.2 Effect of Oil Tanker Age on Accident Frequencies

[6] also reviewed the impact of size on oil tanker accident rates, but did not find a
significant effect.

©OGP 11
RADD – Water transport accident statistics

4.1.3 Oil Spills


4.1.3.1 Tankers
The oil spill data in Table 2.3 is based on a database of worldwide oil spills for 1992-
94. They are assumed to refer to spills over 1 tonne, but it is likely that the spill
frequency is under-estimated for smaller spill sizes. Figure 4.3 shows a frequency
size curve for the spills based on 1992-97 data.

Figure 4.3 Frequency Size Curve for Oil Spills from Oil Tankers (1992-
1997)

4.1.3.2 Offshore Loading


Release or spill into the sea from vessels engaged in the offshore activities may have
as its source spills during oil lifting/loading, accidental discharges overboard or
ruptured tanks. Most reporting systems of accidental release or spill into the sea have
few details of the unit involved or the cause of the accident. No reliable data has been
found on accidental discharges or ruptured tanks. However, one study [7] on
lifting/loading has been identified. It is based on UK offshore loading from 1975-93. It
was noted that pollution incidents associated with lifting should be grouped
according to the lifting system; and the study mainly covers non-CALM (Catenary
Anchor Leg Mooring) systems, as the CALM system was a first generation system and
have been phased out. This data forms the basis for Table 2.4.
More recent data have been published by OCIMF 15. In 2006 OCIMF conducted a
survey of member companies operating offshore terminals to collect information on
MBC operating experience. The information given in Section 2.3 is based on survey
returns from 9 operating companies representing 125,561 tanker/SPM operating days.

12 ©OGP
RADD – Water transport accident statistics

4.2 Other data sources


4.2.1 Personnel Transport
Passenger casualty data from the Department for Transport’s 2006 report [8] for UK
registered merchant vessels gives a fatality rate of 0.3 per billion passenger
kilometres and Killed or Seriously Injured (KSI) of 43 per billion passenger kilometres.
This is based on 1996-2005 averages. It could be used as a sensitivity test for crew
boat passenger transport.
The Department for Transport’s website (www.dft.gov.uk) contains a table from its
Marine Accident Investigation Board showing the number of injuries from 1991 to 2004
on UK flagged vessels recorded by the Marine Accident Investigation Board as
"Associated with Offshore Industry". This is shown in Table 4.5. As above there is a
problem with exposed population; no data is given that would enable FARs or injury
rates to be estimated.
[4] also contains data about seafarer fatalities arising only from shipping casualties,
i.e. not including personal accidents, from merchant fleets around the world. These
are shown in Table 4.6.

Table 4.5 Injuries on UK flagged vessels Associated with Offshore


Industry (1991-2004)

Injury Type Total Number


of Injuries
Amputation of hand/ fingers/ toe 5
Bruising 49
Burns/ scalds – other 3
Chemical poisoning/ burns from contract or inhalation 4
Concussion/ unconsciousness due to head injury 7
Crush injury 32
Cuts/ wound/ lacerations 51
Death - confirmed 6
Dislocations 10
Eye injuries 5
Fracture – of the skull/ spine/ pelvis/major bone in arm or leg 31
Fracture – other 60
Hypothermia – body temperature too cold 4
Other 27
Strains – other strains/ sprains/ torn muscles/ ligaments 40
Strains – strained back 40
Unknown 38
Total 412

Koornstra [14] presents a passenger transport model which includes maritime


transport risk. Reference risks for ferries and cargo/ passenger ships are first
determined based on data from ships using European waters. Reference risks for
hopper and supply boats are based on assumptions about how they compare to
ferries and cargo/ passenger ships. Multiplication factors are then developed relating
maritime fatality risks to the Gross National Income per person (GNI/p). The report
proposes using an additional multiplication factor where there are strong indications
that a trip by a particular ship in a specific region is relatively less safe or relatively
safer than comparable ships in other countries with a comparable GNI/p level.

©OGP 13
RADD – Water transport accident statistics

Table 4.6 Fatalities Arising From Ship Casualties (from [4])

Merchant Fleet No. of deaths (Corresponding No. of cargo Mortality rate


from no. of shipping ships in from shipping
shipping casualties) 2000 casualties per
casualties 1,000 ship-
(1996-2005) years (1996-
2005)
Cambodia 76 (10) 335 22.7
Taiwan 54 (4) 370 14.6
Cyprus 154 (19) 1373 11.2
South Korea 116 (16) 1123 10.3
Syria 22 (5) 219 10.0
St Vincent 105 (21) 1147 9.2
Belize 98 (21) 1107 8.9
India 61 (6) 745 8.2
Indonesia 143 (16) 1924 7.4
Panama 393 (62) 5713 6.9
Honduras 61 (14) 899 6.8
PR China 175 (18) 2604 6.7
DIS (Denmark) 31 (7) 491 6.3
Malta 89 (18) 1452 6.1
Malaysia 40 (3) 768 5.2
Singapore 68 (11) 1677 4.1
Thailand 19 (4) 489 3.9
Turkey 38 (13) 1047 3.6
Antigua & Barbuda 27 (4) 756 3.6
Hong Kong 16 (5) 448 3.6
Ukraine 20 (5) 582 3.4
Greece 34 (11) 1055 3.2
Isle of Man 7 (2) 218 3.2
Vietnam 19 (6) 616 3.1
Norway 18 (5) 604 3.0
Bahamas 34 (11) 1157 2.9
Liberia 44 (10) 1523 2.9
Marshall Islands 8 (3) 291 2.7
Philippines 30 (7) 1093 2.7
Azerbaijan 6 (1) 228 2.6
Romania 5 (3) 219 2.3
UAE 7 (1) 337 2.1
Vanuata 5 (2) 248 2.0
Norway 10 (4) 648 1.5
Russia 36 (10) 2417 1.5
France 4 (1) 280 1.4
Italy 11 (5) 897 1.2
Egypt 4 (2) 353 1.1
Iran 4 (1) 369 1.1
USA 18 (8) 2412 0.7
Spain 2 (2) 334 0.6
Japan 28 (13) 5689 0.5
Canada 2 (1) 145 0.5
Germany 3 (3) 708 0.4
Netherlands 3 (1) 903 0.3
UK 0 (0) 811 0.0

14 ©OGP
RADD – Water transport accident statistics

4.2.2 Vessel Casualties


The Safety of Shipping in Coastal Waters (SAFECO) Project [9] provides an analysis of
the LMIS database, giving frequencies of serious casualties for each major ship type,
based on the period 1991-95.
The UK Protection & Indemnity (P&I) Club produces a Major Claims Analysis,
examining the causes of third-party claims over $100,000. A summary is on the P&I
Club website www.ukpandi.com. It gives the number and value of claims, broken
down by claim type, claim value, ship type, incident cause, ship age, flag etc. No
population data is available.
The Swedish Club website www.swedishclub.com includes a brief analysis of claims
on hull & machinery and P&I insurance. It gives the number and average cost of
claims, broken down by claim type. It also gives information on the number of vessels
insured.

4.2.3 Oil Spills


The US Coast Guard maintains a Marine Safety Management System (MSMS) database
of oil and chemical spills in US waters reported under the Federal Water Pollution
Control Act. It includes spills into navigable inland waters and the sea up to 12 miles
from the shore, and also spills threatening this area. It covers ships, pipelines and
installations. It gives comprehensive coverage of spills since 1973, but also includes
some earlier accidents.
The USCG website www.uscg.mil/hq/g-m/nmc/response/stats/aa.htm gives summary
statistics on the number and quantity of oil and chemicals spilled, broken down by
spill size band, oil type, location, water body and source. The annual data mentions
the largest individual incident in each year and its size. The database covers a wide
variety of installations and marine environments. The summary statistics do not allow
simultaneous breakdowns (say, for oil tankers in the Great Lakes), and no population
data is available. As a result, no use is apparent for the internet data at present. USCG
might give more useful results on request from the database itself.

4.2.4 Dangerous Goods Transport


The National Ports Council [10] analysed incidents in 10 UK ports, obtaining incident
frequencies. The ports were categorised as river (e.g. Thames, Medway, Mersey,
Tees), estuarine (Southampton, Harwich and Milford Haven) and open sea (Swansea
only). The analysis included many minor incidents, including 33% that caused no
appreciable damage and 54% slight damage such as minor dents or split harbour
facing timbers. Hence only about 13% of the incidents would be comparable with the
LMIS incident category.
The Advisory Committee on Dangerous Substances (ACDS) of the UK Health & Safety
Commission produced a report in 1991 [11] which incorporates a detailed QRA
conducted by DNV Technica of risks to people ashore from tankers and liquefied gas
carriers in ports, including frequency data based on LMIS and NPC.
AEA Technology published an analysis of Incident Probabilities on Liquid Gas Ships
[12] using data from the LMIS database for 1975-87. This gives means and confidence
limits for incident frequencies broken down by gas carrier type, size and age, and by
year and cause of the incident, and expressed as frequencies per ship year and per
voyage. It covers all reported incidents, but also identifies serious casualties.

©OGP 15
RADD – Water transport accident statistics

AEA Technology published an analysis of Marine Incidents in Ports and Harbours in


Great Britain [13] using data gathered directly from the ports for 1988-92. It gives
incident frequencies broken down by port type, ship type, and by severity and cause
of the incident, expressed as frequencies per ship visit.

5.0 Recommended data sources for further information


For further information, the data sources used to develop the frequencies presented in
Section 2.0 and discussed in Section 4.0 should be consulted. The references used
for the recommended data in Section 2.0 are shown in bold in Section 6.0.

6.0 References
1. Lloyd’s Register 2005: W orld Fleet Statistics 2004, Lloyds Register –
Fairplay Lim ited, also corresponding annual reports for 1996-2003 data.
2. CMPT 1998: A Guide to Quantitative Risk Assessment of Offshore
Installations, Centre for Marine and Petroleum Technology, London.
3. Spouge, J.R., Sm ith, E.J. & Lewis, K.J. 1994: Helicopters or Boats - Risk
Managem ent Options for Transport Offshore, SPE Paper No 27277,
Conference on Health, Safety & Environm ent in Oil & Gas Production,
Society of Petroleum Engineers, Jakarta.
4. Roberts, S.E. & W illiam s, J. C. 2007: Update of Mortality for W orkers in
the UK Merchant Shipping and Fishing Sectors, Report for the Maritim e
and Coastguard Agency and the Departm ent for Transport, Research
Project 578.
5. OGP, 2007. Safety perform ance indicators – 2006 data, Report No.
391. Also corresponding reports for 2001-2005 data.
http://www.ogp.org.uk/Publications/index.asp
6. DNV 2001: Formal Safety Assessment of Tankers for Oil, Project
C383184/4.
7. E&P Forum 1996: Quantitative Risk Assessment Datasheet Directory, E&P
Forum Report No 11.8/250.
8. Department for Transport 2006: Road Casualties Great Britain 2006,
http://www.dft.gov.uk/162259/162469/221412/221549/227755/rcgb2006v1.pdf.
9. DNV 1997, SAFECO, WP III.2, Statistical Analysis of Ship Accidents, Technical Report
97-2039.
10. NPC 1976: Analysis of Marine Incidents in Ports and Harbours, National Ports Council,
London.
11. ACDS 1991: Major Hazard Aspects of the Transport of Dangerous Substances,
Advisory Committee on Dangerous Substances, Health & Safety Commission,
HMSO.
12. Borrill, E., Gould, J.H., Blything, K.W. & Lelland, A.N. 1994: Incident Probabilities on
Liquid Gas Ships, AEA Report AEA/CS/HSE R1014.
13. Robinson, R.G.J. & Lelland, A.N. 1995: Marine Incidents in Ports and Harbours in
Great Britain, 1988-1992, Report AEA/CS/HSE-R1051, AEA Technology.
14. Koornstra, M.J. 2008. A Model for the Determination of the Safest Mode of Passenger
Transport between Locations in any Region of the World. Report for Shell International
Exploration and Production B.V.
15. OCIMF 2008. Information Paper, Marine Breakaway Couplings, Oil
Com panies International Marine Forum .

16 ©OGP
Risk Assessment Data Directory

Report No. 434 – 11.1


March 2010

Aviation
transport
accident
statistics
International Association of Oil & Gas Producers
RADD – Aviation transport accident statistics

contents
1.0 Scope and Application ........................................................... 1
1.1 Scope ............................................................................................................... 1
1.2 Application ...................................................................................................... 1
1.3 Definitions ....................................................................................................... 1
2.0 Summary of Recommended Data ............................................ 2
2.1 Helicopter Transport....................................................................................... 2
2.2 Fixed Wing Aircraft Transport ....................................................................... 4
3.0 Guidance on use of data ........................................................ 6
3.1 General validity ............................................................................................... 6
3.2 Uncertainties ................................................................................................... 6
3.3 Application of frequencies to specific locations ......................................... 6
3.3.1 Helicopter Risk ........................................................................................................... 7
3.3.2 Fixed Wing Aircraft Risk............................................................................................ 8
4.0 Review of data sources ......................................................... 9
4.1 Basis of data presented ................................................................................. 9
4.1.1 Helicopter Transport .................................................................................................. 9
4.1.2 Fixed Wing Aircraft Transport................................................................................. 15
4.2 Other data sources ....................................................................................... 18
4.2.1 Helicopter Transport ................................................................................................ 18
4.2.2 Fixed Wing Aircraft Transport................................................................................. 18
5.0 Recommended data sources for further information ............ 18
6.0 References .......................................................................... 19
6.1 Helicopter References .................................................................................. 19
6.2 Fixed Wing Aircraft References................................................................... 19
6.3 Other References .......................................................................................... 20
Appendix I – Statistical Methods .................................................... 21

©OGP
RADD – Aviation transport accident statistics

Abbreviations:
CAA (UK) Civil Aviation Authority
DNV Det Norske Veritas
E&P Exploration and Production
FAR Fatal Accident Rate
GoM Gulf of Mexico
ICAO International Civil Aviation Organisation
IR Individual Risk
MTOW Maximum Take Off Weight
NATS National Air Traffic Services
OGP Oil and Gas Producers
POB Personnel On Board
PLL Potential Loss of Life
QRA Quantitative Risk Assessment
SMS Safety Management System

TO/L Take-Off and Landing


UK(CS) United Kingdom (Continental Shelf)
WAAS World Aircraft Accident Summary

©OGP
RADD – Aviation transport accident statistics

1.0 Scope and Application


1.1 Scope
This datasheet provides information on aviation transport accident statistics for use in
Quantitative Risk Assessment (QRA). The data sheet includes guidelines for the use
of recommended data and a review of the sources of the data.
The data in this sheet are intended for two main uses:
• Assessing the risk of helicopter transport;
• Assessing the risk of fixed wing transport.

1.2 Application
This datasheet contains global data plus more detailed regional/national data where
relevant or where available. When using these data, it should be noted that they may
not be directly applicable to the specific location under study. Guidance on using
location specific data is given in Section 3.3.

1.3 Definitions
The data presented in Section 2.0 are for persons travelling by air during take-off,
flight and landing. They exclude risks to persons on the ground: ground staff,
flight/cabin crew and passengers boarding/leaving the air transport. Helicopter
transport risks also exclude non transport activities such as search and rescue
missions and winching.
Transport risks to persons are presented as:
• Individual Risk (IR): risk per year of fatality to a specific individual
• Fatal Accident Rate (FAR): risk of fatality per 108 exposed hours1
The following are used in the risk models presented in Sections 2.0 and 3.0:
• Probability of fatal accident Probability that an accident results in at least
one fatality
• Probability of death in fatal accident Probability of death for one individual
on board aircraft/helicopter involved in fatal
accident

1
It should be noted that FARs are convenient for describing the risk in individual activities
(e.g. working on the drill floor, flying in a helicopter). Unlike individual risks per year, they do
not require any assumptions about what the individual does for the rest of the year. However,
they may be misleading because they represent a rate of risk per unit time in the activity. FAR
values for offshore workers are typically based on 26 weeks’ exposure per year (for a 2 weeks
on, 2 weeks off rota pattern), equivalent to 4380 hours per person per year; the corresponding
helicopter transport exposure is of the order of 30 hours per year. Hence, in contrast to
individual risks per year, FARs cannot sensibly be added together. Whereas FAR values are in
the range 144 to 815 for offshore transport (see Table 2.3), the total FAR in offshore activities
may be only 10 to 20. Adding these values would give a misleading impression of the relative
contribution of helicopter risk to the overall risk. Although it may still be a significant
contributor to the total IR and PLL, it should be judged in the context of those measures, and
the helicopter FAR value should not be added to the FAR values from other risks. However, it
may be compared with FAR values for other modes of transport (e.g. fixed wing aircraft.)

©OGP 1
RADD – Aviation transport accident statistics

Data for the following helicopter activities are presented in Sections 2.1 and 4.1.1:
• Offshore (all offshore helicopter activity)
• Seism ic (onshore seismic surveys)
• Geophysical (onshore geophysical activity)
• Pipeline (onshore pipeline surveys and support)
• Other (all other onshore activity, e.g. crew changes, rig moves, non seismic
external loads)

2.0 Summary of Recommended Data


The recommended frequencies and associated data are presented as follows:
• Helicopter Transport (Section 2.1)
• Fixed Wing Aircraft Transport (Section 2.2)

2.1 Helicopter Transport


The following model is recommended.
Individual risk (IR) per journey = In-flight IR + Take-off & landing (TO/L) IR
In-flight IR = Accident frequency in-flight (per hour) ×
Flight time (hours) ×
Probability of fatal accident ×
Probability of death in fatal accident
TO/L IR = Accident frequency in TO/L (per flight stage) ×
No of flight stages per journey ×
Probability of fatal accident ×
Probability of death in fatal accident

Wherever possible, local (country/regional or air transport operator) data should be


used (but see Section 3.3.1). Where these are not available, the frequencies and
probabilities recommended for use in this model are set out in Table 2.1 (offshore
transport) and Table 2.2 (other activities). The basis for the values in these tables is
set out in Section 4.1.1. No trend over time can be identified in the 9 years’ data
analysed.

2 ©OGP
RADD – Aviation transport accident statistics

Table 2.1 Offshore Helicopter Transport Flight Accident Data for


Risk Estim ation Model

Region Flight Frequency unit Probability Probability


Phase of Fatal of Death in
Accident Fatal
Accident
-6
North Sea In-flight 8.5 × 10 per flight 0.20 0.85
hour
-7
Take-off & 4.3 × 10 per flight 0.17 0.48
Landing stage
-6
Gulf of In-flight 8.5 × 10 per flight 0.33 0.59
Mexico hour
-6
Take-off & 2.7 × 10 per flight 0.24 0.49
Landing stage
-6
Rest of World In-flight 8.5 × 10 per flight 0.74 0.87
hour
-6
Take-off & 2.7 × 10 per flight 0.24 0.49
Landing stage

Table 2.2 Other Activities Helicopter Flight Accident Data for Risk
Estim ation Model

Activity Flight Frequency unit Probability Probability


Phase of Fatal of Death in
Accident Fatal
Accident
-5
Seismic In-flight 4.1 × 10 per flight 0.26 0.54
hour
-5
Take-off & 1.8 × 10 per flight 0.15 0.74
Landing stage
-5
Geophysical In-flight 1.1 × 10 per flight 1.00 0.86
hour
-6
Take-off & 8.8 × 10 per flight 0.16 0.34
Landing stage
-5
Pipeline In-flight 6.3 × 10 per flight 0.36 0.62
hour
-5
Take-off & 2.6 × 10 per flight 0.25 0.47
Landing stage
-5
Other In-flight 4.1 × 10 per flight 0.26 1.00
hour
-5
Take-off & 1.8 × 10 per flight 0.15 0.33
Landing stage

©OGP 3
RADD – Aviation transport accident statistics

Table 2.3 gives FAR values for helicopter transport.

Table 2.3 Estim ated FAR Values for Helicopter Transport

Activity Region FAR


Offshore Transport North Sea 144
Gulf of Mexico 454
Rest of World 815
All 509
Seismic All 5268
Geophysical All 4792
Pipeline All 8883
Other All 2487
All except Offshore Transport All 3670

2.2 Fixed Wing Aircraft Transport


Table 2.4 presents basis accident, individual risk and FAR data.

Table 2.4 Average W orldwide W estern Jet Data (excluding hostile attacks
and personal accidents 1 )

Measure Value

2 -7
Fatal accident frequency per flight 6.2 × 10
2 -7
Fatal accident frequency per flight hour 3.4 × 10
-7
Individual risk per person flight 4.1 × 10
-7
Individual risk per person flight hour 2.3 × 10
FAR 23
Notes
1. Such as ground crew fatal injuries, slips, trips and falls.
2. Defined as fatality within 30 days of the accident. Excludes
fatal illnesses on board aircraft.

There appears to be a downward trend in accident frequencies of 4.5% a year [10].


Hence, as these values are based on 1990-2002 data (see Section 4.1.2), for 2008 a
modification factor of 0.58 (4.5% decrease/year × 12 years since the mid-point of the
dataset) could be used.
A number of other factors could have an impact on the accident frequencies. The
tables below address:
• the type of accident considered (Table 2.5);
• the operating region/location (Table 2.6);
• the type of operation – scheduled, cargo etc. – (Table 2.7); and
• the type of aircraft used (Table 2.8).

4 ©OGP
RADD – Aviation transport accident statistics

Table 2.5 M ultiplication Factors for Accident Frequencies

Frequency Type Modification Factor

Frequency of fatal accidents including hostile 1.15


acts and personal accidents
Frequency of ICAO defined accidents (i.e. 3.53
involving substantial damage to the aircraft
and/or serious/fatal injury to people)
Frequency of hull loss (i.e. events where the 1.37
aircraft is missing or damaged beyond economic
repair)

Table 2.6 M ultiplication Factors for Operating Regions

Operating Region (Operator Domicile) Modification Factor


Western Europe, North America and Australasia 0.36
Middle East and Asia (excluding China) 1.8
Latin America 2.4
Eastern Europe (including Russia), Africa and 3.9
China

Table 2.7 M ultiplication Factors for Types of Operation

Operation Modification Factor


Scheduled passenger (e.g. major airlines) 0.83
Non-scheduled passenger (e.g. charter flights) 2.1
Scheduled cargo (e.g. UPS, FedEx, DHL etc) 2.0
Non-scheduled cargo 5.3

Table 2.8 M ultiplication Factors for Types of Aircraft

Aircraft Type Modification


Factor
First generation Western jets (e.g. B707, DC-8)* 11.8
Second generation Western jets (e.g. B727, DC-9, F28)* 1.25
Early widebody Western jets (e.g. B747, DC-10)* 2.24
Current Western jets (e.g. B757/767/777, A330/340, F100)* 0.65
Eastern built jets (e.g. Il76, Tu154) 2
Executive jets (e.g. Citation, Gulfstream, Learjet) 13
Early turboprops first delivered before 1970 (e.g. BAe 748, 4
F27)
Modern turboprops first delivered since 1970 (e.g. DH-8, 1.2
F50)
Piston-engine aircraft (e.g. Islander, Cessna 150, PA28) 19
* See Section 4.1.2.4 for a full list of aircraft types covered by these definitions.

©OGP 5
RADD – Aviation transport accident statistics

3.0 Guidance on use of data


3.1 General validity
If transport risk is a relatively small contribution to an overall risk study, the data
above may be sufficient. However, if transport risk is the object of the study or is
believed to be significant, local data become very important. It is strongly
recommended that local data sources on accidents and transport risk are obtained
wherever possible (but see Section 3.3.1). This is because there can be large local
variations. In the absence of local data, the data presented in Section 2.0 can be used.
3.2 Uncertainties
With respect to the helicopter accident data in Section 2.1, the main uncertainties
arise from the relatively limited number of fatal accidents that have occurred in the
regions mentioned in Table 2.1, and from the small numbers of flights and of fatal
accidents in some of the activities mentioned in Table 2.2. These are discussed
further in Section 4.1.1.
The data presented in Section 2.1 are based on information provided to OGP by OGP’s
members, and may not be representative in all geographical areas.
Variations may exist between different helicopter types: this is examined in Section
4.1.1. It is suggested there that there are no significant systematic variations in
accident rates between different helicopter types but it may be desirable to use type
specific data where available, at least as a sensitivity.
Regarding the fixed wing aircraft accident frequencies in Section 2.2, there are
significant uncertainties concerning the modification factors. It is preferable to
incorporate them in the analysis by some means rather than to use the basis
frequencies (Table 2.4) without modification for the specific situation addressed by
the QRA. The available data (see Section 4.1.2) do not permit rigorous analysis of the
all the factors involved and of possible correlations between them. Two possible
approaches may be adopted:
1. As a simple approach, it could be assumed that the above sets of modification
factors are independent and can be combined to estimate the risks in specific
cases. However, many of the factors could be correlated. For example, much of the
observed downward trend in accident frequency has resulted from the introduction
of current generation aircraft, which have been used mainly for scheduled
passenger services in Western countries. Meanwhile, older jets are used mainly in
developing countries and for cargo operations. Hence, the combination of factors
will tend to over-estimate the effects in cases where several factors all increase or
reduce the risk.
2. An alternative approach would be to select what are judged the most significant
issues and just use one or two modification factors. This is illustrated below in
Section 3.3.

3.3 Application of frequencies to specific locations


This datasheet contains global data plus more detailed regional data where available.
When using these data, it should be realised that they may not be directly applicable
to the specific location under study. It is therefore strongly recommended that local
data sources on accidents and transport risk be obtained before using the data given
in this sheet (but see Section 3.3.1). Local sources could include governmental or

6 ©OGP
RADD – Aviation transport accident statistics

other national or regional institutions, or the facility operator's or local air transport
operator's data.
Should local data not be available, or their reliability/applicability be uncertain, then
the data in this datasheet could be used after factoring for local circumstances.
However, data which have been adjusted to allow for local circumstances should
always be used with caution: the assumptions made are likely to be judgemental and
hence may reduce the reliability of the adjusted data vis-à-vis reality. Each
assumption should be clearly documented so that an audit trail is maintained.
3.3.1 Helicopter Risk
In Sections 3.1 and 3.3 the use of local data wherever possible is recommended.
However, the number of fatal accidents is relatively small. It is therefore
recom m ended that local accident frequencies, where available, are
com bined with the generic probabilities given in Section 2.1.
The following example illustrates how the data in Section 2.1 can be used to estimate
helicopter transport annual risks.
A North Sea installation crew member works 2 weeks on, 2 weeks off. The flight from
the heliport to their installation is in 2 stages (i.e. via another installation) and the total
time in the air is 1 hour. Their IR would be calculated as follows.
Total flight stages = 13 offshore trips/year × 2 flights/trip × 2 stages/flight = 52 stages/year
Total flight time = 13 offshore trips/year × 2 flights/trip × 1 hour/flight = 26 hours/year
In-flight IR = Accident frequency in-flight (8.5 × 10-6 per flight hour) ×
Flight time (26 hours/year) ×
Probability of fatal accident (0.20) ×
Probability of death in fatal accident (0.85)
-5
= 3.8 × 10 per year
TO/L IR = Accident frequency in TO/L (1.0 × 10-5 per flight stage) ×
No of flight stages (52/year) ×
× Probability of fatal accident (0.17) ×
× Probability of death in fatal accident (0.48)
-5
= 4.2 × 10 per year
Total IR = 3.8 × 10-5 + 4.2 × 10-5 per year = 8.0 × 10-5 per year

The annual PLL (Potential Loss of Life) from helicopter transport for the installation
can be calculated with the following additional information.
The platform POB is 48. 2 crews operate back-to-back. Helicopter transport is
provided by the S-76, which has a passenger capacity of 12. Hence each crew change
requires 4 helicopter flights.
Total PLL = Total IR × no. of crews × flights/crew × passengers/flight
=8.0 × 10-5 per year × 2 × 4 × 12 = 7.7 × 10-3

©OGP 7
RADD – Aviation transport accident statistics

However, it should be noted that in practice not all personnel visiting a platform work
exactly 2 weeks on, 2 weeks off. Additional personnel may be flown out for specific
tasks lasting perhaps just a few days; there may be visitors to the platform, perhaps
arriving and departing within the same day. Hence true risk estimates may vary
between individuals.

3.3.2 Fixed Wing Aircraft Risk


To illustrate how the fixed wing data in Section 02.2 could be used, four examples are
set out below.
1. Worldwide average individual risks travelling on Western Jet in 2008
Basic FAR = 23
Trend factor × 0.58 (see Section 2.2)
Current FAR = 13

2. Scheduled passenger jet flight in Western Europe, N. America, Australasia


Basic FAR = 23
Scheduled passenger × 0.83 (from Table 2.7)
Operating Region × 0.36 (from Table 2.6)
Local FAR =7
N.B. Modification factors are based only on accident rates and not accident
consequences (probability of fatality in an accident) as the latter show relatively small
variations. In the above calculation the trend factor is not used, as the use of modern
aircraft has been widespread in these regions for some time.

3. Worldwide average individual risks travelling on Non scheduled passenger


flight in 2008
Basic FAR = 23
Trend factor × 0.58 (see Section 2.2)
Non scheduled passenger × 2.1 (from Table 2.7)
Current Local FAR = 28

4. Specific individual risks travelling on Non scheduled passenger flight in older


style of aircraft in Middle East
Basic FAR = 23
Non scheduled passenger × 2.1 (from Table 2.7)
Operating Region × 1.8 (from Table 2.6)
Specific Local FAR = 87

Sensitivity tests can involve applying extra (or fewer) modification factors to obtain
realistic ranges. For example in example 4 above, no trend factor was applied as older

8 ©OGP
RADD – Aviation transport accident statistics

aircraft were being assessed; however, if it were considered that operational


standards were equivalent to today’s standards the trend factor could be applied (×
0.58) leading to a FAR range of 50 to 87.

4.0 Review of data sources


4.1 Basis of data presented
4.1.1 Helicopter Transport
4.1.1.1 Principal Analysis
The main source of data is the annual reports produced by OGP [1][2][3][4][5][6][7][8]
for each year 1998 to 2006 apart from 1999. These have been supplemented by
operational data for 1999 and more detailed accident information provided on behalf
of OGP [9].
The operational data are presented by region for offshore activities and aggregated
worldwide for other activities.
The detailed accident data give: date, helicopter operator, activity, helicopter model
and type (see Section 4.1.1.2), country, nos. of passenger and crew injuries and
fatalities, flight phase, and a brief description of the accident cause. They do not give
the number of passengers carried on the flight.
Table 4.1 and Table 4.2 summarise the operational and accident data for offshore
transport and other activities respectively. These form the basis of the analysis
presented in this datasheet.
Table 4.3 and Table 4.4 present the raw analysis of the data given in Table 4.1 and
Table 4.2 respectively. It will be noted that in some cases entries appear as 0.
Furthermore, given the limited accident data, it can be questioned whether the
differences between regions for offshore helicopter transport, and between activities
for other activities, are statistically significant. Figure 4.1 shows the accident
frequencies for offshore activities by region and overall, with error bars showing 90%
confidence limits (see Appendix I). From this it was concluded as follows:
• The difference in in-flight accident frequencies between the three regions is not
statistically significant, so the overall value has been substituted in Table 2.1 for
the region specific values in Table 4.3.
• The difference in take-off/landing accident frequencies between the GoM and
Other regions is not statistically significant, so the overall value for these two
regions has been substituted in Table 2.1 for the region specific values in Table
4.3.

©OGP 9
RADD – Aviation transport accident statistics

Table 4.1 Sum m ary of Offshore Operational and Accident Statistics 1998-2006

North Sea Flight Hours Take-Offs and Landings Accidents by heli type Fatals by heli type
Flight Accidents SE Fatal Fatalitie
Phase SE LT MT HT SE LT MT HT LT MT HT s SE LT MT HT s
In-flight 0 414 341,470 971,320 - - - - 10 0 0 3 7 2 0 0 2 0 18
Take-off - - - - - - - - 1 0 0 0 1 0 0
Landing - - - - - - - - 0 0 0 0 0 0 0
TO/L - - - - 0 456 1,284,244 1,066,270 1 0 0 0 1 0 0 0 0 0 0

GoM Flight Hours Take-Offs and Landings Accidents by heli type Fatals by heli type
Flight Accidents SE Fatal Fatalitie
Phase SE LT MT HT SE LT MT HT LT MT HT s SE LT MT HT s
In-flight 2,598,714 285,614 719,222 95,609 - - - - 36 30 2 4 0 12 10 1 1 0 27
Take-off - - - - - - - - 14 13 1 0 0 3 3 0 0 0 6
Landing - - - - - - - - 21 18 1 2 0 4 4 0 0 0 7
TO/L - - - - 9,812,645 942,850 1,542,599 159,899 35 31 2 2 0 7 7 0 0 0 13

Other Flight Hours Take-Offs and Landings Accidents by heli type Fatals by heli type
Flight Accidents SE Fatal Fatalitie
Phase SE LT MT HT SE LT MT HT LT MT HT s SE LT MT HT s
In-flight 401,561 117,569 2,127,399 464,692 - - - - 23 3 1 16 3 17 3 1 11 2 99
Take-off - - - - - - - - 8 2 2 2 2 2 1 0 1 0 13
Landing - - - - - - - - 15 1 0 11 3 5 0 0 3 2 12
TO/L - - - - 2,482,319 240,428 5,334,178 832,160 23 3 2 13 5 7 1 0 4 2 25

SE = Single Engine; LT = Light Twin; MT = Medium Twin; HT = Heavy Twin

10 ©OGP
RADD – Aviation transport accident statistics

Table 4.2 Sum m ary of Other Operational and Accident Statistics 1998-2006

Seismic Flight Hours Take-Offs and Landings Accidents by heli type Fatals by heli type
Flight Accidents SE Fatal Fatalitie
Phase SE LT MT HT SE LT MT HT LT MT HT s SE LT MT HT s
In-flight 317,127 7,071 67,927 6,029 - - - - 18 17 0 1 0 5 4 0 1 0 7
Take-off - - - - - - - - 13 11 0 2 0 2 1 0 1 0 5
Landing - - - - - - - - 11 11 0 0 0 1 1 0 0 0 1
TO/L - - - - 1,221,253 9,046 146,785 9,072 24 22 0 2 0 3 2 0 1 0 6

Geophysica Accidents by heli type


l Flight Hours Take-Offs and Landings Fatals by heli type
Flight Accidents SE Fatal Fatalitie
Phase SE LT MT HT SE LT MT HT LT MT HT s SE LT MT HT s
In-flight 68,988 8,485 8,580 2,232 - - - - 1 1 0 0 0 1 1 0 0 0 2
Take-off - - - - - - - - 0 0 0 0 0 0 0 0 0 0 0
Landing - - - - - - - - 0 0 0 0 0 0 0 0 0 0 0
TO/L - - - - 63,881 6,815 6,028 2,633 0 0 0 0 0 0 0 0 0 0 0

Pipeline Flight Hours Take-Offs and Landings Accidents by heli type Fatals by heli type
Flight Accidents SE Fatal Fatalitie
Phase SE LT MT HT SE LT MT HT LT MT HT s SE LT MT HT s
In-flight 183,288 6,832 25,312 6,138 - - - - 14 11 0 1 2 5 2 0 1 2 16
Take-off - - - - - - - - 1 1 0 0 0 1 1 0 0 0 1
Landing - - - - - - - - 7 5 0 1 1 1 0 0 1 0 4
TO/L - - - - 189,149 8,144 96,940 18,385 8 6 0 1 1 2 1 0 1 0 5

Other Flight Hours Take-Offs and Landings Accidents by heli type Fatals by heli type
Flight Accidents SE Fatal Fatalitie
Phase SE LT MT HT SE LT MT HT LT MT HT s SE LT MT HT s
In-flight 175,687 21,465 99,741 131,271 - - - - 16 11 1 3 1 4 2 1 0 1 28
Take-off - - - - - - - - 5 4 0 0 1 1 1 0 0 0 3
Landing - - - - - - - - 12 8 1 1 2 2 0 0 1 1 2
TO/L - - - - 292,044 24,774 396,507 158,576 17 12 1 1 3 3 1 0 1 1 5

SE = Single Engine; LT = Light Twin; MT = Medium Twin; HT = Heavy Twin

©OGP 11
RADD – Aviation transport accident statistics

Table 4.3 Offshore Transport Flight Accident Data

Region Flight Frequency unit Probability Probability


Phase of Fatal of Death in
Accident Fatal
Accident
North Sea In-flight 8.5 × 10-6 per flight 0.20 1.00
hour
Take-off & 4.3 × 10-7 per flight 0 0
Landing stage
Gulf of In-flight 9.7 × 10-6 per flight 0.33 0.59
Mexico hour
Take-off & 2.8 × 10-6 per flight 0.20 0.53
Landing stage
Rest of In-flight 7.4 × 10-6 per flight 0.74 0.87
World hour
Take-off & 2.6 × 10-6 per flight 0.30 0.48
Landing stage

Table 4.4 Other Activities Flight Accident Data

Activity Flight Frequency unit Probability Probability


Phase of Fatal of Death in
Accident Fatal
Accident
Seismic In-flight 2.7 × 10-5 per flight 0.28 0.54
hour
Take-off & 1.0 × 10-5 per flight 0.13 0.74
Landing stage
Geophysical In-flight 1.1 × 10-5 per flight 1.00 0.86
hour
Take-off & 0 per flight 0 0
Landing stage
Pipeline In-flight 6.3 × 10-5 per flight 0.36 0.62
hour
Take-off & 2.6 × 10-5 per flight 0.25 0.47
Landing stage
Other In-flight 3.7 × 10-5 per flight 0.25 1.00
hour
Take-off & 1.9 × 10-5 per flight 0.18 0.33
Landing stage

12 ©OGP
RADD – Aviation transport accident statistics

Figure 4.1 Offshore Helicopter Accident Frequencies

No accidents on take-off and landing have occurred during geophysical activities


(Table 4.4); an accepted statistical technique of assuming 0.7 accidents to date (see
Appendix I) has been applied.
The significance of statistical differences in accident frequencies has been analysed
for other activities in similar manner to that above for offshore transport, as shown in
Figure 4.2. From this it was concluded that:
• The differences in in-flight and take-off/landing accident frequencies between
Seismic and Other activities (i.e. apart from pipeline and geophysical activities) is
not statistically significant, so the overall values for these two activities have been
substituted in Table 2.2 for the activity specific values in Table 4.4.
Similar analysis can be applied to the fatal accident probabilities and the fatalities/fatal
accident fractions. Addressing first the zeroes in Table 4.3 and Table 4.4:
• For take-off/landing accidents in the North Sea, the longer-term UK averages
based on CAA accident and exposure data have been used in Table 2.1.
• The same has been done for the fatality rate in fatal in-flight accidents in the
North Sea.
• For take-off/landing accidents in geophysical activities, the averages for all
non offshore transport activities have been used in Table 2.2.
Next, considering the significance of statistical differences, it was concluded that:
• The differences in fatal accident probabilities for in-flight and take-off/landing
accidents during Seismic and Other activities are not statistically significant, so
the overall value for these two activities has been substituted in Table 2.2 for the
activity specific values in Table 4.4.
Apart from the above exceptions, the values in Table 2.1 and Table 2.2 are the same as
those in Table 4.3 and Table 4.4.

©OGP 13
RADD – Aviation transport accident statistics

Figure 4.2 Other Activities Helicopter Accident Frequencies

4.1.1.2 Effect of Helicopter Type


Helicopters are categorised as:
• SE (Single Engine), e.g. AS350B Squirrel
• LT (Light Twin), e.g. Eurocopter AS355
• MT (Medium Twin), e.g. Sikorsky S-76A
• HT (Heavy Twin), e.g. SA332 Super Puma
The OGP data enable comparisons to be made between these 4 categories. The
accident frequencies are shown in Figure 4.3. From this it would be reasonable to
conclude that there are no significant differences in accident frequencies for the
different helicopter types (although the in-flight frequency for SE helicopters and take-
off/landing frequency for MT helicopters could be considered to be significantly
different to the overall frequencies for the other types.) Hence no variation by
helicopter type is suggested.

14 ©OGP
RADD – Aviation transport accident statistics

Figure 4.3 Helicopter Accident Frequencies by Type (all activities)

SE = Single Engine; LT = Light Twin; MT = Medium Twin; HT = Heavy Twin

4.1.2 Fixed Wing Aircraft Transport


4.1.2.1 Large Western Jets
4.1.2.1.1 Fatal Accident Frequencies
The values in Section 2.2 are taken from [10], which uses the Airclaims World Aircraft
Accident Summary (WAAS) [11] as the primary data source. This was checked for
omissions using data from Boeing [12] and the websites PlaneCrashInfo
(www.planecrashinfo.com/) and Aviation Safety Network (http://aviation-
safety.net/statistics/). There are relatively few convenient sources of flight exposure
data. The main ones are reviewed by NATS [13]. The most convenient source is
Boeing [12], which covers large Western passenger jets (defined below).
[10] summarises 148 fatal accidents on Large Western Commercial Jets, 1990-2002. Of
these 19 were either hostile acts or personal accidents. Thus the total was 129
excluding these events.
During 1990-99 there were 157.5 million departures [12]. Departures in the subsequent
3 years have been reported as 18.14, 16.88 and 16.52 million [12], giving a total of
209.05 million during 1990-2002. The number of flight hours in the Boeing data during
1990-2002 has been estimated as 380 million. This gives an average flight length of
380/209 = 1.82 hours. This value has increased during the period, and appears to be
approximately 2.0 hours in 2002. This is significantly higher than the standard value of
1.5 hours quoted by Boeing [12], which seems to be based on much older data.
Based on the 129 fatal accidents and the exposure data above the Fatal accident
frequency per flight = 6.2 × 10-7 and the Fatal accident frequency per aircraft flight hour
is 3.4 × 10-7 as shown in Table 2.4.
The individual risk values in Table 2.4 are derived from the same data sources. The
relevant data are shown in Table 4.5.

©OGP 15
RADD – Aviation transport accident statistics

Table 4.5 Individual Risks on Large W estern Com m ercial Jets, 1990-2002

Individual Risk per flight Individual Risk per flight


hour
Fatalities 8213
10 10
Exposure 2.0 × 10 person flights 3.6 × 10 person flight hours
-7
Risk -7 2.3 × 10 per person flight hr
4.1 × 10 per person flight
FAR = 23

4.1.2.1.2 Aircraft Accident Frequencies


“Aircraft accidents” are events causing substantial damage to the aircraft or
serious/fatal injury to people. The Boeing database [5] for 1959-2002 includes 1337
aircraft accidents, of which 509 were fatal, i.e. 2.63 accidents per fatal accident. For
1993-2002 there were 385 accidents, of which 109 were fatal, i.e. 3.53 accidents per
fatal accident. This trend probably reflects improved reporting, so the more recent
number is used in Table 2.5.

4.1.2.1.3 Hull Loss Frequencies


“Hull losses” (also known as “total losses”) are events where the aircraft is missing,
inaccessible or damaged beyond economic repair.
The Boeing database [12] for 1959-2002 includes 695 hull losses, compared to 509
fatal accidents, i.e. 1.37 hull losses per fatal accident.

4.1.2.2 Impact of Operating Regions


[14] gives fatal accident frequencies for all commercial aircraft over 5700 kg MTOW
during 1980-2001 broken down by operator domicile. This data is used to develop the
modification factors summarised in Section 02.2.
It should be noted that local air traffic control is not a significant primary cause of
accidents (see e.g. [15]) and that the operator domicile dominates any geographic
factors.

4.1.2.3 Impact of Types of Operations


[16] presents frequencies of hull loss and/or fatal accidents on Western jets and
turboprops over 5700 kg MTOW world-wide during 1970-99 for different types of
operator:
• Major operators, with large jet fleets, mainly scheduled passenger.
• Integrators, with large scheduled cargo fleets (e.g. UPS, FedEx, DHL).
• Supplemental air carriers, with mainly commuter turboprops.
• Ad-hoc operators, with mainly unscheduled charter flights.
This shows that unscheduled (i.e. ad-hoc) passenger operations have an accident
frequency 2.5 times higher than scheduled (i.e. other) passenger operations. These
values have been used to derive the modification factors in Table 2.7.

16 ©OGP
RADD – Aviation transport accident statistics

4.1.2.4 Impact of Aircraft Type


The Boeing analysis includes hull loss frequencies for individual jet types. In most
cases the differences are either not statistically significant or reflect operating
features specific to the aircraft type (e.g. higher rates per departure for short-haul
types).
Boeing also groups the aircraft by generation, as follows:
• First generation – B707/720, DC-8.
• Second generation – B727, B737-100/200, DC-9, BAC 1-11, F-28.
• Early widebody - B747-100/200/300/SP, DC-10, L-1011, A300
• Current – B717, B737-300 and later, B747-400, B757/767/777, MD-11/80/90, A300-
600, A310/319/320/321/330/340, F-70, F-100, BAe 146, RJ-70, RJ-85, RJ-100.
The different rates Boeing derived have been used to derive the first 4 values in Table
2.8.
[14] shows the fatal accident frequency for Eastern built aircraft (jets and turboprops
over 5700 kg MTOW) roughly equal to that of Western built aircraft during 1980-89. The
difference appeared to widen in about 1990, and during the period 1990-2001 the fatal
accident frequency for Eastern built aircraft has been approximately a factor of 2
higher than for Western built aircraft.
Business (or executive) jets are used for business or private transport, typically less
than 20 tonnes. They include Bombardier (Canadair) Challenger and Learjet. [13]
estimates a first-world airport-related crash frequency for executive jets of 2.2 crashes
per million movements, a factor of 15 higher than for Western jets (excluding first
generation jets) on scheduled passenger services. Since scheduled passenger
services have a modification factor of 0.83 compared to the basis dataset (Table 2.7),
the appropriate modification factor for executive jets is 15 × 0.83 = 13.
[13] categorises Western airliner turboprops as follows:
• Early turboprops (T2) first delivered before 1970 – BAe 748, Vanguard, Viscount,
Convair 540/580/600/640, Dart Herald, DH Twin Otter, Fairchild F27, FH227,
Fairchild Metro, Fokker F27, Gulfstream 1, Hercules, Electra, Skyvan.
• Other turboprops (T1) first delivered in or after 1970 – ATR 42, ATP 72, BAe ATP,
Jetstream 31/41, DH Dash 7/8, Do 228/328, EMB 110/120, Fokker F50, Saab
340/2000, Shorts 330/360.
Airport-related crash frequencies on Western airliner turboprops over 5700 kg MTOW
on scheduled passenger services during 1979-97, for first-world and world-wide, are
shown in [6] enabling the modification factors in Table 2.8 to be derived.
[6] estimates a UK airport-related crash frequency for piston-engine aircraft in
commercial use during 1985-97 of 3.27 crashes per million movements, 22 times
higher than for Western jets (excluding first generation jets) on scheduled passenger
services in the first world. This was assumed applicable to all piston-engine
operations in the UK. Since scheduled passenger services have a modification factor
of 0.83 compared to the basis dataset, the appropriate modification factor is 22 × 0.83
= 19 (see Table 2.8).

©OGP 17
RADD – Aviation transport accident statistics

4.2 Other data sources


4.2.1 Helicopter Transport
DNV has carried out a more detailed analysis of UK helicopter accident rates for one
OGP member based on data for the years 1970-2006 using the UK Civil Aviation
statistical reports up to the last year of their publication (2002 data) and for 2003
onwards by direct request to the CAA for the accident data. The CAA’s exposure data
is tabulated by helicopter model as “Public Transport Air Taxi Operations”, which
cover mainly but not exclusively offshore transport operations.
DNV has previously analysed data for Norway, Denmark and The Netherlands. The
analysis was based on a combination of CAA and OGP data, which can be obtained by
country.
DNV also analysed Gulf of Mexico data in more detail. Gulf of Mexico helicopter
accident statistics were obtained from WAAS [11] and the NTSB accident database
[18]; flight exposure data was obtained from OGP.
As an example of using operator specific data, DNV estimated historical accident
frequencies in one company’s offshore operations. Its experience prior to 1993
amounted to approximately 56,000 flying hours and 105,000 flight stages [19]. In that
time there were 2 crashes, one of which was on landing and one on flight. There were
no fatalities. This gives accident frequencies as follows:

At the time of the analysis, these accident frequencies were not significantly different
from the frequencies for other regions. Note that, compared with the exposure and
accident statistics given in Table 4.1 and SE = Single Engine; LT = Light Twin; MT =
Medium Twin; HT = Heavy Twin
Table 4.2, the numbers of flights and accidents are small, giving wide confidence
limits on the results.

4.2.2 Fixed Wing Aircraft Transport


[20] derived individual risks on UK airlines doing international flights 1975-92 as a
FAR of 15.
[21][21] studied annual individual risk for workers in the USA during 1979-83 which
gave 9.0 × 10-4 for pilots and 1.6 × 10-4 for stewardesses. The difference between the
figures for pilots and stewardesses may result from the inclusion of general aviation
pilots.

5.0 Recommended data sources for further information


For further information, the data sources used to develop the frequencies presented in
Section 2.0 and discussed in Section 4.0 should be consulted. The references used
for the recommended data in Section 2.0 are shown in bold in Section 6.0.

18 ©OGP
RADD – Aviation transport accident statistics

[22] provides an interesting model for comparing risks of using different transport
modes. However, it does not present any advantages or improved data analysis
compared with those presented in the preceding sections (and in the datasheets Land
Transport Accident Statistics and Water Transport Accident Statistics).

6.0 References
6.1 Helicopter References
[1] OGP 1999. Safety performance of helicopter operations in the oil & gas
industry 1998, Report No. 6.83/300. http://www.ogp.org.uk/pubs/300.pdf
(No report published with 1999 data; see [9].)
[2] OGP 2002. Safety performance of helicopter operations in the oil & gas
industry: 2000 data, Report No. 6.61/333.
http://www.ogp.org.uk/pubs/333.pdf
[3] OGP 2003. Safety performance of helicopter operations in the oil & gas
industry: 2001 data, Report No. 341.
http://www.ogp.org.uk/pubs/341.pdf
[4] OGP 2004. Safety performance of helicopter operations in the oil & gas
industry: 2002 data, Report No. 354.
http://www.ogp.org.uk/pubs/354.pdf
[5] OGP 2005. Safety performance of helicopter operations in the oil & gas
industry: 2003 data, Report No. 366.
http://www.ogp.org.uk/pubs/366.pdf
[6] OGP 2006. Safety performance of helicopter operations in the oil & gas
industry: 2004 data, Report No. 371.
http://www.ogp.org.uk/pubs/371.pdf
[7] OGP 2007. Safety performance of helicopter operations in the oil & gas
industry: 2005 data, Report No. 401.
http://www.ogp.org.uk/pubs/401.pdf
[8] OGP 2007. Safety performance of helicopter operations in the oil & gas
industry: 2006 data, Report No. 402.
http://www.ogp.org.uk/pubs/402.pdf
[9] OGP, private com m unication, 2008. Helicopter operational data for
1999; additional data on helicopter accidents.

6.2 Fixed Wing Aircraft References


[10] DNV 2004. Aircraft Accident Risks, Technical Note T25
[11] Airclaim s 2003. W orld Aircraft Accident Sum m ary 1990-2002, CAP 479,
Airclaim s Ltd, London (updated annually).
[12] Boeing 2003. Statistical Summary of Commercial Jet Airplane
Accidents, W orldwide Operations, 1959-2003, Boeing Com m ercial
Airplanes Group, Seattle, W A, USA (updated annually).
[13] NATS 2000. A Methodology for Calculating Individual Risk due to
Aircraft Accidents Near Airports, P.G. Cowell et al, R&D Report 0007,
National Air Traffic Services Ltd, London.
[14] IVW 2002. Civil Aviation Safety Data 1980-2001, Inspectie Verkeer en
W aterstaat, Hoofddorp, Netherlands.
[15] Eurocontrol, 2005. ATM Contribution to Aircraft Accidents / Incidents,
Review and Analysis of Historical Data, SRC Docum ent 2, 4 th ed.
http://www.eurocontrol.int/src/gallery/content/public/documents/deliverables/srcdoc2_e40_ri_web.
pdf

©OGP 19
RADD – Aviation transport accident statistics

[16] Roelen, A.L.C., Pikaar, A.J. & Ovaa, W ., 2000. An Analysis of the
Safety Performance of Air Cargo Operators, Report NLR-TP-2000-210,
National Aerospace Laboratory.
[17] CAA, UK Airline Statistics, Table 1 13 Public Transport Air Taxi Operations:
http://www.caa.co.uk/default.aspx?categoryid=80&pagetype=88&pageid=1&sglid=1
[18] NTSB. Accident Database and Synopses, 1962-present; query using
http://ntsb.gov/ntsb/query.asp
[19] Spouge, J.R., Smith, E.J., & Lewis, K.J., 1994. Helicopters or Boards – Risk
Management Options for Transport Offshore, SPE Paper No. 27277, Conf. on Health,
Safety & Environment in Oil & Gas Production, Jakarta, Society of Petroleum
Engineers.
[20] Collings, H., 1994. Comparative Accident Rates for Passengers by Model of
Transport – A Re-Visit, in Transport Statistics Great Britain 1994, Department of
Transport, London: HMSO.
[21] Leigh, J.P., 1995. Causes of Death in the Workplace, Quorum Books, Westport
CT, USA.

6.3 Other References


[22] Koornstra, M.J., 2008. A Model for the Determination of the Safest Mode of
Passenger Transport between Locations in any Region of the World, Report for Shell
International Exploration and Production B.V.

20 ©OGP
RADD – Aviation transport accident statistics

Appendix I – Statistical Methods


I.1 Outline
Historical frequencies are estimated from experience of actual events and associated
exposure. In simple terms, the event frequency is given by:

The events may be accidents of a particular type, minor incidents with the potential to
lead to an accident, component failures or near misses. Examples are pipe leaks,
pump trips, ship collisions, lightning strikes, etc.
The associated exposure is a measure of size of the population from which the events
have been recorded. This is usually a number of items and/or a number of years. Both
the accident experience and the exposure must be comprehensive collections from
the same population.

I.2 Frequency Estimates


The observed events are used to estimate an underlying event frequency (or failure
rate), which can never be known exactly since the experience is limited. Normally the
event frequency F is calculated directly from the number of events N and the exposure
period Y as:

This is a simple and convenient estimate, but may be an under-estimate if there are
few or no failures in the observed period. A more conservative estimate, which
assumes that a further failure was about to occur when the end of the period was
reached, is:

However, this is not normally used in QRA since it appears counter-intuitive, and is a
negligible correction for large numbers of failures.

I.3 Frequency Estimates with No Failures


Where there have been no failures in the observed period, the above approach may
still be used, assuming a failure was about to occur at the end of the observed period.
A slightly less conservative (and more intuitively reasonable) estimate of the
underlying frequency is given by the 50% confidence limit on the true mean of a
Poisson distribution when no failures have been observed (also equal to the 50%
point on a chi-square distribution with 1 degree of freedom). This is:

In colloquial terms, this assumes that the system was '70% of the way to its first
failure' at the end of the observed period, or that '0.7 events' occurred in the period.

©OGP 21
RADD – Aviation transport accident statistics

It might be thought that the 95% confidence limit would be more appropriate for a
cautious best-estimate than the 50% limit. However, this would result in a frequency
equivalent to 3 events having occurred in the observed period (see below), which is
usually considered excessively conservative.

I.4 Confidence Limits on Frequency Estimates


Statistical confidence limits may be attached to the frequency estimate, which reflect
the uncertainty in estimating the underlying frequency from a small sample of events.
Techniques for calculating confidence limits are presented in [23] and [24]. For QRA, a
90% confidence range is usually adequate, extending between a lower (5%) and an
upper (95%) confidence limit, defined in terms of a chi-square distribution as follows:

These imply a 90% chance that the true frequency lies within the stated range, a 5%
chance of it being lower than the lower limit, and a 5% chance of it being above the
upper limit. The upper limit as defined above takes account of the possibility that the
next event was about to occur when the end of the period was reached.
When no failures have occurred, the confidence limits cannot be expressed as
fractions of the mean (since this is zero). However, using a consistent approach, the
90% confidence range on the number of failures is then 0.05 to 3.0, with the 50%
confidence value being 0.7 as above.
These confidence ranges only take account of uncertainty due to estimating the
frequency from a small number of random events, assuming the underlying frequency
is constant. They do not take account of numerous other sources of uncertainty, such
as incomplete event data, inappropriate measures of exposure, trends in the
frequency etc. Therefore, the total uncertainty in the frequency may be much higher
than indicated, and the confidence limits estimated above may be misleading.

I.5 References
[23] Lees, F.P., 1996. Loss Prevention in the Process Industries, 2nd. ed., Oxford:
Butterworth-Heinemann.
[24] CCPS, 1989. Chemical Process Quantitative Risk Analysis, Centre of Chemical
Process Safety, New York: American Institute of Chemical Engineers.

22 ©OGP
Risk Assessment Data Directory

Report No. 434 – 12


March 2010

Occupational
risk
International Association of Oil & Gas Producers
P ublications

Global experience
The International Association of Oil & Gas Producers has access to a wealth of technical
knowledge and experience with its members operating around the world in many different
terrains. We collate and distil this valuable knowledge for the industry to use as guidelines
for good practice by individual members.

Consistent high quality database and guidelines


Our overall aim is to ensure a consistent approach to training, management and best prac-
tice throughout the world.
The oil and gas exploration and production industry recognises the need to develop consist-
ent databases and records in certain fields. The OGP’s members are encouraged to use the
guidelines as a starting point for their operations or to supplement their own policies and
regulations which may apply locally.

Internationally recognised source of industry information


Many of our guidelines have been recognised and used by international authorities and
safety and environmental bodies. Requests come from governments and non-government
organisations around the world as well as from non-member companies.

Disclaimer
Whilst every effort has been made to ensure the accuracy of the information contained in this publication,
neither the OGP nor any of its members past present or future warrants its accuracy or will, regardless
of its or their negligence, assume liability for any foreseeable or unforeseeable use made thereof, which
liability is hereby excluded. Consequently, such use is at the recipient’s own risk on the basis that any use
by the recipient constitutes agreement to the terms of this disclaimer. The recipient is obliged to inform
any subsequent recipient of such terms.
This document may provide guidance supplemental to the requirements of local legislation. Nothing
herein, however, is intended to replace, amend, supersede or otherwise depart from such requirements. In
the event of any conflict or contradiction between the provisions of this document and local legislation,
applicable laws shall prevail.

Copyright notice
The contents of these pages are © The International Association of Oil and Gas Producers. Permission
is given to reproduce this report in whole or in part provided (i) that the copyright of OGP and (ii)
the source are acknowledged. All other rights are reserved.” Any other use requires the prior written
permission of the OGP.
These Terms and Conditions shall be governed by and construed in accordance with the laws of Eng-
land and Wales. Disputes arising here from shall be exclusively subject to the jurisdiction of the courts of
England and Wales.
RADD – Occupational risk

contents
1.0 Scope and Definitions ........................................................... 1
1.1 Application ...................................................................................................... 1
1.2 Definitions ....................................................................................................... 1
2.0 Summary of Recommended Data ............................................ 2
2.1 Fatal Accident Rates....................................................................................... 2
2.2 Causes of Fatal Accidents ............................................................................. 3
3.0 Guidance on use of data ........................................................ 5
3.1 General validity ............................................................................................... 5
3.2 Uncertainties ................................................................................................... 5
3.3 Risk calculation for QRA................................................................................ 5
4.0 Review of data sources ......................................................... 5
5.0 Recommended data sources for further information .............. 6
6.0 References ............................................................................ 7
6.1 References for Sections 2.0 to 4.0 ................................................................ 7
6.2 References for other data sources................................................................ 7

©OGP
RADD – Occupational risk

Abbreviations:
CMPT Centre for Marine and Petroleum Technology
CS Continental Shelf
DNV Det Norske Veritas
E&P Exploration and Production
FAR Fatal Accident Rate
FSU Former Soviet Union
IRPA Individual Risk Per Annum
LTIF Lost Time Injury Frequency
OGP International Association of Oil & Gas Producers
OSHA (US) Occupational Safety and Health Administration
QRA Quantitative Risk Assessment (sometimes Analysis)
UK United Kingdom
UKCS United Kingdom Continental Shelf

©OGP
RADD – Occupational risk

1.0 Scope and Definitions


1.1 Application
This datasheet presents (Section 2.0) occupational risks in the global E&P (Exploration
& Production) industry, for both onshore and offshore facilities.
The occupational risks include transport risks, which are often analysed separately in
QRAs. Some indication is given as to how the occupational risks presented can be
adjusted to remove transport risks.

1.2 Definitions
Fatality risks are presented in terms of the FAR (Fatal Accident Rate). This is defined
as:
FAR = number of fatalities per 108 exposed hours.
• Onshore, “exposed hours” are working hours.
Onshore work [1]: All activities and occupations that take place within a land
mass, including those in swamps, rivers and lakes. Activities in bays, major inland
seas, or in other inland seas directly connected to oceans are counted as offshore
(see below).
• Offshore, “exposed hours” are sometimes defined (e.g. by OSHA) as offshore
working hours only (12 hours per day), elsewhere (e.g. Norway) as all hours spent
offshore (24 hours per day). The offshore FAR values presented in Section 2.0 are
for working hours only.
Offshore work [1]: All activities and occupations that take place at sea, including
major inland seas (e.g. Caspian Sea) and other inland seas directly connected with
oceans. Includes transportation of people and equipment from shore to the
offshore location either by vessel or helicopter.
Factors are given to modify the overall fatality risks presented for different functions:
Exploration, Drilling and Production, defined as follows in [1]:
Exploration: Geophysical, seismographic and geological operations, including
their administrative and engineering aspects, construction, maintenance, materials
supply, and transportation of personnel and equipment; excludes drilling.
Drilling: All exploration, appraisal and production drilling and workover as well as
their administrative, engineering, construction, materials supply and
transportation aspects. It includes site preparation, rigging up and down and
restoration of the drilling site upon work completion. Drilling includes ALL
exploration, appraisal and production drilling.
Production: Petroleum and natural gas producing operations, including their
administrative and engineering aspects, minor construction, repairs, maintenance
and servicing, materials supply, and transportation of personnel and equipment. It
covers all mainstream production operations including wireline. It does not cover
production drilling and workover.

©OGP 1
RADD – Occupational risk

2.0 Summary of Recommended Data


It is recommended, wherever possible, to use local operator specific data for
occupational risk (see Section 5.0). Where these are not available, the data presented
below can be used.
2.1 Fatal Accident Rates
Table 2.1 presents overall worldwide FAR values by work location (onshore/offshore) for
all personnel and separately for company employees and contractors. Note that these
values include fatalities due to air and land transport incidents, except where indicated.
Table 2.2 presents modification factors that can be used to factor the values in Table 2.1
for different functions: exploration, drilling, production and offshore catering/stewards
(but see also Table 2.4 for drilling FAR values). Table 2.3 gives multiplication factors for
different regions of the world that can be applied to the worldwide FAR values given in
Table 2.1 to obtain region-specific FAR values. Note that the values presented in Table
2.1 and Table 2.3 are based on data published by OGP and the data presented in Table
2.4 are based on data published by IADC: see Section 3.1 regarding their validity.

Table 2.1 Overall W orldwide FAR Values

Personnel All
Events Onshore Offshore
Locations
All* 4.44 4.71 3.56
Excl. Air
4.16 - -
All Personnel Transport†‡
Excl. Land
N/A 3.13 N/A
Transport†
Com pany
All* 2.08 2.24 1.37
Em ployees
Contractors All* 5.34 5.74 4.15
* See Section 4.0 for definition of ‘All’.

These values are given as often air and land transport are analysed separately in a QRA.

No separate values are given for onshore and offshore as the relative contributions to each
cannot be determined from the data.

Table 2.2 Modification Factors for Specific Functions

Function Modification Factor


W orldwide North
Onshore & Sea
Offshore Offshore
Exploration 1.1 -
Drilling 1.1 1.6
Production 0.7 1.6
Offshore 0.1 0.1
Catering/Stewards

2 ©OGP
RADD – Occupational risk

Table 2.3 Multiplication Factors for Different Regions 1 (Apply to Table 2.1
FAR Values)

Personne Locatio Africa Asia/ Europ FSU Middle North South


l n Austr- e East America America
alasia
All Onshore 1.54 0.36 0.71 1.38 0.98 0.74 0.86
Offshore 1.22 0.56 1.05 0.69 0.82 1.52 0.92
All 1.49 0.40 0.79 1.42 0.98 0.90 0.88
Company Onshore 1.19 0.29 0.75 2.14 1.19 0.41 0.64
Offshore 1.00 0.72 2.94 0.00 0.00 0.47 0.00
All 1.17 0.35 1.14 2.25 1.15 0.41 0.55
Contract Onshore 1.46 0.35 0.93 1.28 0.94 0.97 0.82
or
Offshore 1.17 0.53 0.88 0.68 0.84 1.86 1.10
All 1.42 0.39 0.81 1.32 0.95 1.17 0.88

Table 2.4 FAR Values for Personnel Engaged in Drilling Operations

Country/Region FAR values


Onshore Offshore Com bined
USA 16.10 7.30 13.17
Canada 18.68 0.00 12.19
Central / South America 5.53 5.13 5.41
Europe 3.68 2.21 2.45
Africa 7.11 6.06 6.49
Middle East 3.08 5.44 3.69
Asia Pacific 6.53 5.96 6.17
Industry Average - - 7.53

For the UK and Norway Continental Shelfs (offshore), Alberta, Canada (onshore), and
the USA (oil and gas extraction), the following FAR values are available. Note that these
exclude helicopter accidents and are based on 2000 working hours per year.
UKCS: FAR = 3.78 Norway: FAR = 0.94 Alberta: FAR = 8.26 USA: FAR = 11.42

2.2 Causes of Fatal Accidents


Figure 2.1 shows the proportions of fatal accidents due to different causes. They apply
to the FAR value in Table 2.1 for all events, all locations (i.e. onshore and offshore).
Transport fatalities account for almost 24% of the total. Figure 2.2 shows the causal
breakdown excluding transport (air and vehicle incidents) and unknown causes.

1
Note that, as these are ratios of FAR values rather than absolute values, the ‘All’ values do not
necessarily lie between the corresponding ‘Onshore’ and ‘Offshore’ values.

©OGP 3
RADD – Occupational risk

Figure 2.1 Causes of Fatal Accidents

Figure 2.2 Causes of Fatal Accidents, excluding Transport and Unknown

4 ©OGP
RADD – Occupational risk

3.0 Guidance on use of data


3.1 General validity
The occupational risk values given in Table 2.1 and Table 2.3 can be applied to E&P
facilities worldwide or in the specific regions presented in Table 2.3. However, they are
based on data provided to OGP by OGP’s members, and may not be representative in all
geographical areas.
The occupational risk values given in Table 2.4 for personnel engaged in drilling
operations are based on data provided to IADC by IADC’s members. If drilling
operations are undertaken by a contractor that is not a member of IADC, the values in
Table 2.4 may not be applicable.

3.2 Uncertainties
The data presented in Section 2.0 are in the main based on that obtained by OGP from
its members. OGP’s reports [1] do not discuss data quality, i.e. whether the data from
each of the members and the countries where each member operates are subject to
consistent reporting criteria and verification. Discrepancies may also occur in that not
all companies report contractor hours. A further consideration is that the data do not
reflect non OGP members and so may not be representative of the industry as a whole.
The overall size of the database, as regards both working hours and fatalities, is
sufficiently large (see Section 4.0) that the statistical uncertainties associated with the
FAR values in Table 2.1 are small compared to the variations between regions and
operators. Uncertainties are dominated by local variations. Even within geographically
close countries, such as within the EU, variations can be large. Hence, as discussed in
Section 5.0, it is preferable wherever possible to use local operator specific data.

3.3 Risk calculation for QRA


In QRAs, risks are frequently calculated and presented in terms of Individual Risk Per
Annum (IRPA). FAR values therefore need to be converted to IRPA values using actual
work pattern data. For example:
• Working 2000 hours per year:

• Offshore, as personnel are exposed to risk whilst off shift and in the TR, their risks
are sometimes presented on the basis of 24 hours per day exposure whilst offshore.
In this case, the contributions from the on shift and off shift FAR values need to be
summed. The off shift FAR value for all workers can be estimated by applying the
factor given in Table 2.2 for catering/stewards to the appropriate FAR value in Table
2.1.

4.0 Review of data sources


The principal source of the data presented in Section 2.0 is the data published by OGP
[1] for the period 2002-6. During this period, the worldwide FAR has been roughly
constant, and significantly lower than in the 1990s. It is therefore believed that it is
reasonably representative of current occupational risks. The data for the individual
years (both exposure and fatalities) have been summed over the 5-year period to
calculate the FAR values given in Section 2.1.

©OGP 5
RADD – Occupational risk

The database from which the OGP reports [1] are drawn contains records of incidents
resulting in 532 fatalities over 12 × 109 working hours during that period. Fatalities due
to all causes are included, including vehicle incidents and air transport as well as being
struck, explosion/burn, electrical, drowning, falls, and ‘caught between’.
Fatality rate data are available going back to 1997, facilitating trend analysis. In the
most recent report, the data have been contributed by 41 companies representing
activities in 84 countries. Data quality is not discussed in the OGP reports and hence
judgment as to its completeness cannot be presented here. However, from a review of
other potential sources and bearing in mind that activities of OGP members extend
worldwide, this is believed to be the most comprehensive source.
To determine the modification factors by function for the North Sea (Table 2.2), more
local sources [2],[3],[4] were compared and approximate averages taken. The same
value for offshore catering/stewards is also suggested for Worldwide use; the other
factors in Modification Factors for Specific Functions come from the OGP data.
The United Kingdom and Norway Continental Shelf FAR values are given in [5]. They
are for the period 2001 to the first half of 2007. The Alberta FAR can be calculated from
data given in [6]. The USA oil and gas extraction FAR was calculated from data given in
[7]: these data give fatalities per 100,000 employees and it is necessary to make an
assumption about annual working hours per employee: for consistency with the OGP
data, 2000 hours were assumed.

5.0 Recommended data sources for further information


Lost time injury frequencies (LTIFs) for specific countries are given in the OGP reports
[1], however there is no breakdown by company/contractor, onshore/offshore or
function. It might be thought that the FAR/LTIF ratio could be used as a surrogate either
to obtain country specific FAR values or to obtain a more detailed breakdown of LTIF
values. However, a review of the data shows a wide variation in that ratio such that this
would be an unreliable approach.
Country specific data are available from some statutory authorities (see Section 6.2 for
references and URLs):
• UK
• Norway
• Denmark
• Netherlands
• USA
• Canada

As most operators maintain incident databases (data from which have been gathered
into the OGP database [1]), it may be preferable to use operator specific data. However,
if these have not been analysed in a form suitable for QRA, the values presented in
Section 2.0 can be used. In any case, these should be used as to validate any operator
specific risks calculated.

6 ©OGP
RADD – Occupational risk

6.0 References
6.1 References for Sections 2.0 to 4.0
[1] OGP, 2007. Safety performance indicators – 2006 data, Report No. 391. Also corres-
ponding reports for 2001-2005 data. http://www.ogp.org.uk/Publications/index.asp.
[2] Spouge et al., 1999. A Guide to Quantitative Risk Assessment for Offshore Installations,
App. XIV, ISBN 1 870553 365, Publication 99/100, Centre for Marine and Petroleum
Technology (CMPT). Now available from the Energy Institute:
http://www.energyinst.org.uk/index.cfm?PageID=5.
[3] DNV, 2000. Occupational Risks for Workers on Offshore Installations, Revision 0, report
for BP Amoco, DNV Order No. 30400100.
[4] BP, 2003. Occupational Risk for Offshore Workers, Rev 0, BP Report No. D/UTG/051/03.
[5] Petroleum Safety Authority Norway, 2008. Risk Levels in the petroleum industry –
Summary Report Norwegian Continental Shelf 2007, Ptil-08-03:
http://www.ptil.no/getfile.php/PDF/Summary_rep_2008.pdf.
[6] Alberta Employment, Immigration and Industry, 2007. Lost-Time Claims, Disabling
Injury Claims and Claim Rates, Upstream Oil and Gas Industries 2002 to 2006.
http://employment.alberta.ca/documents/WHS/WHS-PUB_oid_2006_oil_and_gas.pdf
[7] Bureau of Labor Statistics, 2007. Census of Fatal Occupational Injuries (CFOI):
http://www.bls.gov/iif/oshwc/cfoi/CFOI_Rates_2006.pdf. Previous years’ reports can
be found at: http://www.bls.gov/iif/oshcfoil.htm.

6.2 References for other data sources


UK
http://www.hse.gov.uk/offshore/statistics/hsr0607.pdf (2006/7; earlier years also
available)

Norway
[5] above: follow link to The Trends in Risk Levels report 2006; summary report in
English; the full report is only in Norwegian, available via the following link:
http://www.ptil.no/nyheter/risikonivaaet-2007-god-utvikling-men-flere-alvorlige-hendelser-article4466-24.html

Denm ark
http://www.ens.dk/graphics/Publikationer/Olie_Gas_UK/Oil_and_Gas_Production_in_De
nmark_2006/html/chapter05.htm

Netherlands
http://www.sodm.nl/data/jvs/jvs2006_eng.pdf: see Appendix F.

USA
http://www.mms.gov/incidents/IncidentStatisticsSummaries.htm#2006-2010:
presentation of
inform-ation lacks exposure data. Also available to purchase: API - Survey on
Petroleum Industry Occupational Injury and Illness Report:
http://www.api.org/ehs/health/measuring/index.cfm

©OGP 7
Risk Assessment Data Directory

Report No. 434 – 13


March 2010

Structural
risk for
offshore
installations
International Association of Oil & Gas Producers
RADD – Structural risk for offshore installations

contents
1.0 Scope and Definitions ........................................................... 1
1.1 Application ...................................................................................................... 1
2.0 Summary of Recommended Data ............................................ 2
2.1 Worldwide (including UKCS) Structural Failure Frequencies .................... 2
2.1.1 All Unit Types ............................................................................................................. 2
2.1.2 Fixed Units .................................................................................................................. 2
2.1.3 Non Fixed Units .......................................................................................................... 3
2.2 UKCS Structural Failure Frequencies........................................................... 3
2.2.1 Fixed Units .................................................................................................