SP-1258 - HSE Specification - Quantitative Risk Assessment (QRA)

Revision: Rev 3.
0
Petroleum Development Oman LLC Effective:July-2010
RESTRICTED Document ID: SP-1258

Jun-11 Filing Key: Business Control
Petroleum Development Oman L.L.C.
Technical Safety Engineering

Quantitative Risk Assessment
Specification
User Note:
A controlled copy of the current version of this document is on PDO’s EDMS. Before making
reference to this document, it is the user’s responsibility to ensure that any hard copy, or
electronic copy, is current. For assistance, contact the Document Custodian or the Document
Controller.
Users are encouraged to participate in the ongoing improvement of this document by providing
constructive feedback.
Please familiarise yourself with the

Document Security Classification Definitions
They also apply to this Document!
Revision: Rev 3.0
This page was intentionally left blank
Page 2 Quantitative Risk Assessment Specification Printed 09/06/11

The controlled version of this CMF Document resides online in Livelink®. Printed copies are UNCONTROLLED.
Revision: Rev 3.0
I Document Authorisation
Authorised For Issue

Revision: Rev 3.0

Revision: Rev 3.0
ii Revision History
The following is a brief summary of the 4 most recent revisions to this document. Details of all
revisions prior to these are held on file by the issuing department.
Version No. Date Author Scope / Remarks
Version 3.0 July 2010 Ahmed Al-Abri, MSE/45Q Updated to reflect Shell
Shepherd approach for sour
hydrocarbon developments.
New format.
Version 2.0 June 2002 Abi Blyth, OMC/32 Editorial changes. New format.
Version 1.0 May 2000 Nenad Mandich, CSM/11X Original document.

Revision: Rev 3.0
iii Related Business Process

Code Business Process (EPBM 4.0)
EP.17.03.05 Provide safety advice and services
Related Corporate Management Frame Work (CMF) Documents

The related CMF Documents can be retrieved from the Corporate Business Control
Documentation Register TAXI.

Revision: Rev 3.0
TABLE OF CONTENTS
I Document Authorisation ...................................................................................... 3
ii Revision History .................................................................................................. 5
iii Related Business Process .................................................................................. 6
Related Corporate Management Frame Work (CMF) Documents .......................... 6
1 Introduction .....................................................................................................10
1.1 Background ..................................................................................................10
1.2 Purpose .......................................................................................................10
1.3 Scope ..........................................................................................................10
1.4 Target Audience ...........................................................................................10
1.5 Roles and Responsibilities ............................................................................10
1.6 Review & Improvement .................................................................................11
1.7 Related Business Control Documents ...........................................................11
2 Quantitative Risk Assessment ........................................................................12
2.1 Study Purpose and Objectives ......................................................................12
2.2 Misuse of QRA .............................................................................................12
2.3 Timing of Study ............................................................................................13
2.4 Links to Other Activities ................................................................................13
3 Failure Case Selection ....................................................................................14
3.1 General ........................................................................................................14
3.1.1 Hazard Identification...........................................................................................14
3.1.2 How to Model Hazards .......................................................................................14
3.2 Specific Requirements ..................................................................................15
3.2.1 Hole Size Distribution .........................................................................................15
3.2.2 Meteorological Conditions ..................................................................................15
3.3 QA/QC .........................................................................................................15
4 Frequency Assessment...................................................................................16
4.1 Input Required..............................................................................................16
4.2.1 Leak Frequency and Parts Count .......................................................................16
4.2.2 Hole Size Distribution .........................................................................................16
4.2.3 Material selection ...............................................................................................16
4.2.4 Blowouts ............................................................................................................17
4.3 QA/QC .........................................................................................................17
5 Consequence Assessment .............................................................................18
5.1 Input Required..............................................................................................18

Revision: Rev 3.0
5.2.1 Sampling Time ...................................................................................................18

5.2.2 Surface Roughness............................................................................................19
5.2.3 Liquid / Vapour Phase - Export / Import ..............................................................19
5.2.4 Flammables / Thermal Radiation ........................................................................19
5.2.5 Toxic Effects ......................................................................................................20
5.2.6 Building Blast Resilience ....................................................................................20
5.3 QA/QC .........................................................................................................22
6 Impact Criteria .................................................................................................23
6.1.1 Flammable .........................................................................................................23
6.1.2 Toxic ..................................................................................................................23
6.1.3 Explosion ...........................................................................................................24
7 Risk Integration ...............................................................................................25
7.1 Input required ...............................................................................................25
7.2 Tools ...........................................................................................................25
7.3.1 Process Block and Point Source.........................................................................26
7.3.2 Area Receiver / Receptors .................................................................................26
7.3.3 Jet Footprint .......................................................................................................26
7.3.4 Height Above Ground .........................................................................................27
7.3.5 Ignition Probability ..............................................................................................27
7.3.6 Toxic Dispersion from Liquid Releases ...............................................................27
7.3.7 Prevention and Shutdown ..................................................................................27
7.3.8 Other Guidance..................................................................................................27
7.4 QA/QC .........................................................................................................28
8 Non-Process Hazards......................................................................................29
8.1.1 Land Transport Risk ...........................................................................................29
8.1.2 Air Transport Risk ..............................................................................................29
8.1.3 Occupational Risk ..............................................................................................29
9 Risk Criteria .....................................................................................................30
9.1.1 Location Specific Individual Risk (LSIR)..............................................................30
9.1.2 Individual Risk Per Annum (IRPA) ......................................................................30
9.1.3 Societal Risk (F-N Curves) .................................................................................31
9.1.4 Potential Loss of Life (PLL).................................................................................31
9.1.5 Land Use Planning .............................................................................................31
9.1.6 Simultaneous Operation – Toxic Sphere of Influence (SIMOPS) ......................... 32

Revision: Rev 3.0
9.1.7 Emergency Planning Zone (EPZ) .......................................................................32

10 Risk Reduction ................................................................................................33
11 Report Writing .................................................................................................35
11.1 Report Outline ..............................................................................................35
11.1.1 Summary ...........................................................................................................35
11.1.2 Introduction ........................................................................................................35
11.1.3 Methodology and Data Source ...........................................................................35
11.1.4 Hazard Identification...........................................................................................35
11.1.5 Consequence Assessment .................................................................................35
11.1.6 Frequency Assessment ......................................................................................35
11.1.7 Risk Assessment................................................................................................36
11.1.8 Recommendation ...............................................................................................36
11.1.9 References ........................................................................................................36
11.1.10 Appendices ....................................................................................................36
11.2 Additional Recommendations ........................................................................36
Appendices............................................................................................................38
Appendix 1, Glossary of Definitions, Terms and Abbreviations ...............................38
Appendix 2, Additional Guidance...........................................................................40
Appendix 3, Related Business Control Documents and References........................57

Revision: Rev 3.0
1 Introduction
1.1 Background
There are a number of different tools and techniques available within the Hazards and
Effects Management Process (HEMP) for the assessment and control of industrial risk.
These tools are not mutually exclusive, each having appropriate applications.
Management systems such as engineering codes, checklists and Process Safety
Management provide layers of protection against accidents. However, the potential for
serious incidents cannot be totally eliminated. One of the HEMP tools, Quantitative
Risk Assessment (QRA), is a valuable tool for determining the risk of the use, handling,
transport and storage of dangerous substances. This technique can be defined as the
formal and systematic approach to identifying hazards, potentially hazardous events,
and estimating likelihood and consequences to people, environment and assets, of
incidents developing from these events. The total process of risk analysis,
interpretation of results and recommendations of corrective actions is usually called
'Risk Assessment'.
If the results of a QRA in the decision-making process are to be used, they must be
verifiable, reproducible and comparable. These requirements necessitate QRAs made
on the basis of similar starting-points, models and basic data. Ideally, differences in
QRA results should only arise from differences in process and site specific information.
1.2 Purpose
The purpose of this specification is to define the correct method and practice of
conducting QRA, including the correct method and practice for conducting Physical
Effects Modelling (PEM). This specification is intended to minimise any common
inaccuracy or inconsistency when conducting QRA or a related study e.g. Fire, Gas and
Explosion Assessment (FGEA), taking into account the reliability and quality of the input
used for the QRA and the fact that the tools used are continuously being updated
1.3 Scope
This specification identifies the minimum requirements for completing a QRA study or
for completing physical effects modelling in support of the Hazards and Effects
Management Process.
1.4 Target Audience

The document is targeted at Technical Safety Engineers contributing to the QRA
studies and QRA and FGEA report end-users who use QRA results as the basis for
decisions on risk reduction options, concept options comparison and optimising the
layout of facilities and fields.
1.5 Roles and Responsibilities

Key roles and responsibilities could be summarised as below:
Project/Operation Manger:
• Review and approve risk levels and risk reduction options.
Field Development Technical Authority (TA):
• Provide urban planning information and field development plan.

Revision: Rev 3.0
Production Technologist:
• Provide wells design information.
• Estimate blow-out flow rates.
• Provide reservoir fluid composition temperature and pressure.
Technical Safety Engineer:
• Develop QRA Terms of Reference (TOR) in accordance with this specification.
• Coordinate and/or execute TOR.
• Ensure QA/QC checks defined in this specification are carried out by an
approved TA in line with DCAF and SP-2061.
• Arrange peer review at direction of Technical Safety Engineering TA-1.
• Incorporate QRA results in documented ALARP demonstration and track
recommendations to closure.
Process/Concept Engineer:
• Provide Equipment List, PEFS and Heat and Mass Balance data.
Piping (Static Mechanical) Engineer/Concept Engineer:
• Provide layout information and drawings.
OR&A Engineer:
• Provide Operation Philosophy and manning distribution for facility.
• Review QRA assumptions against basis for Reliability and Availability Modelling
(RAM).
1.6 Review & Improvement

Any user of this specification who identifies a mistake, confusing entry, omission or area
for improvement is requested to notify the document authority.
This specification shall be reviewed at least every four years. However changes to the
current version may be made in less than four years as the need arises depending upon
the issue of new and relevant safety legislation, learning from process safety incidents,
joint industry research projects and or major organisational changes in PDO.
1.7 Related Business Control Documents

Code Document Title
CP-122 Health, Safety and Environment Management System
CP-117 Project Engineering Code of Practice
SP-1075 Fire and Explosion Risk Management
SP-1127 Layout of Plant Equipment and Facilities
SP-1190 Design for Sour Service Specification
SP-2062 Specification for HSE Cases

Revision: Rev 3.0
2 Quantitative Risk Assessment
2.1 Study Purpose and Objectives

Quantitative Risk Assessment allows for the comparison of risk reduction options for a
particular hazard on an equivalent basis, as well as allowing for the comparison of risks
that are generated from separate and unique hazards.
At the concept stage the QRA study is conducted to evaluate risk tolerability, compare
the risk between different concept options along with optimising the plant layout and
facility siting options.
At Front End Engineering and Design (FEED) and Detailed Design stage, the QRA
study further evaluates risk tolerability and risk reduction options during design. QRA at
this stage is mostly employed to evaluate the sum of all risks for all hazards at a facility.
This gives an indication of the overall risk for that facility, while the sum of all risks in
each particular area of the facility gives an indication as to which locations or equipment
sections are the most hazardous. Therefore, the effectiveness of the each risk
reduction measures can be evaluated against each other.
2.2 Misuse of QRA

The common misuse of QRA is summarized below [2]:
• Reducing risk rather than proving acceptability, where the QRA is used to
prove that deviation from company standards and practices is acceptably safe.
The QRA should be used to assess the risk and decide on the ALARP
application and demonstration.
• Reducing risk to ALARP rather than to a fixed level. The principle of
acceptability safe might be misleading to believe that the risk should be
reduced to a fixed level between unacceptable and acceptable level. The risk
reduction should be driven towards ALARP region.
• Representing reality rather than force fitting into a rigid model. It is
important that the modelling should not be forced into a preconceived model
template structure, but that each study should be modelled to include all areas
which impact the risk levels.
• Comparing like with like. The right boundaries should be drawn around the
options available so that one is comparing like with like.
• QRA specialists must not work in isolation. This might result into QRA
which has little relationship with reality and therefore the study will then be of
little value. It is imperative that the relevant personal / disciplines are involved
throughout the study to ensure that the right assumptions are being made and
are correctly used. It is also essential that any assumptions made in a QRA
study of new projects are carried through into the HSE Case and Asset
Reference Plan.
• Handling data. There are various sources of data; however, not all are reliable.
When the reliability or applicability of the available data is in question it is
important that this is highlighted. For data which has a significant impact on the
risk picture, a separate study should be made to evaluate the probable range of
uncertainty. Sensitivity runs should then be carried out to test the robustness of
the analysis.
• Using the correct level of detail. The right level of detail should be selected
to identify and evaluate the risk and events associated with the operation under
the study.

Revision: Rev 3.0
2.3 Timing of Study

QRA can be performed in all project phases. However, the scope for identification of
effective safety improvements and the implementation is greatest during conceptual and
Front End Engineering and Design (FEED). The following summarize the Opportunity
Realisation Process (ORP) phases and QRA scope for each phase:
• Select Phase. The scope of the QRA during concept selection is to identify
major risk contributors and effective safety measures and to aid in the selection
of the lowest HSE risk or ALARP development option. QRA provides input to
the facility siting and layout activities and the facility FGEA.
• Define Phase. The scope of QRA during FEED is primarily to support the
layout development, to assist with final major decision making with respect to
design options, and to provide a basis for further design optimisation during
completion of FEED to reduce risk to ALARP. In addition, QRA is used to
confirm to senior management and shareholders that tolerable risk levels have
been achieved.
• Execute Phase. The scope of QRA during the detailed design phase is
typically limited to updating the FEED QRA report to reflect the final Approved
For Construction (AFC) design. However, QRA has also been used to evaluate
the comparative risk of emerging design options that require conceptual or
front-end decisions, to support assessments of proposals for simultaneous or
concurrent operations (SIMOPs), and to finalise Emergency Response Plans
(ERPs).
• Operation Phase. The study can be used to assist in the identification of high
risk areas, the ranking of risk reduction measures and identify the need for
modifying the operating philosophy. In addition, a QRA study should be carried
out when plant modifications are planned which will result in significant risks
during construction and/or which are expected to significantly increase the risk
level during operations. QRA is also used to evaluate the risk from emerging
industry learning such as the siting of portable buildings at process facilities,
and to assess the risk from plant integrity issues.
2.4 Links to Other Activities

The QRA is related to other activities such as HAZID, facility siting and layout, FGEA,
ALARP demonstrations, ERPs and SIMOPs plans. The QRA uses the HAZID study as
an input to identify the scenarios to be assessed. The QRA results are used to support
the ALARP demonstration, which may be contained or summarised in the HSE Case.
In addition, the QRA may be used as input to facility siting and layout activities, as input
to FGEA studies, to define the extent of emergency scenarios in ERPs, and assess the
controls required in SIMOPs plans for large number group of people carrying out
activities such as construction near to process facilities.

Revision: Rev 3.0
3 Failure Case Selection
3.1 General
The failure case selection process involves two stages. First, Hazard Identification
(HAZID) and secondly the definition of the hazardous scenarios for modelling in QRA.
3.1.1 Hazard Identification

Hazards should be identified carefully to be then considered for failure case selection.
There are several standards and assessment techniques to identify hazards for
example, outputs from HAZOP and HAZID (Hazard Identification) can be used to
establish the list of Hazards to be considered in the QRA. It is important to include all
the credible hazards with a potential fatality consequence and not just the major ones.
3.1.2 How to Model Hazards

The categories of failure cases should include process and non-process hazards such
as transport and occupational risk. The process hazards such as flammable
hydrocarbon gas are modelled as shown in the event tree below. Scenarios such as
BLEVE and jet fire from flammable liquids shall be considered accordingly. The cases
shall be selected to specifically reflect the process facility being developed. Non-
process hazards should be treated as fatality rates [Ref 3].
Figure 1: represent the possible accident scenarios

resulted from a loss of containment [Ref 3]

Revision: Rev 3.0
3.2 Specific Requirements
3.2.1 Hole Size Distribution

In failure case selection, the range of the selected hole leak sizes shall cover the full
range of possible leaks from very small to very large. For process piping and
equipment, five hole sizes shall be used: 2mm, 7mm, 22mm, 70mm and 150mm. See
section 4.2.2 [Ref 1].
3.2.2 Meteorological Conditions

In failure case selection, the weather condition shall be taken into consideration prior to
physical effects modeling. In general, the atmospheric stability conditions and the wind
speed are the two main imperative aspects related to the dispersion consequence
modeling. In terms of atmospheric stability classes, according to the Pasquill-Gifford
Scale, there are six:
• Class A, very unstable. This represents the class of atmospheric condition
where there is great amount of mixing.
• Class B, unstable. This represents the class of atmospheric condition where
there is sufficient amount of mixing.
• Class C, slightly unstable. This represents the class of atmospheric conditions
where there is some amount of mixing.
• Class D, neutral. This represents the class of atmospheric condition where
there is a right amount of mixing. This is one of the atmospheric class
conditions used for consequence meddling. This is to account for the average
condition where the atmosphere class is predicted to be in.
• Class E, stable. This represents the class of atmospheric condition where there
is almost no mixing.
• Class F, very stable. This represents the class of atmospheric condition, where
the mixing is assumed to be negligible. This class of atmospheric stability is
considered as the worse case and it is used for consequence modeling.
For consequence modeling, generally, a minimum of two wind speeds are to be
considered, representing both, worst-case (low wind-speed) and most-likely (moderate
wind speed) conditions. It is recommended to use class F, 2 m/s (F2) (still, night) and
class D, 5 m/s (D5) (average winds, daytime) stability/wind speed combinations for any
QRA [Ref 1].
For risk assessment using Shell Shepherd, the meteorological data including wind
speed, wind direction, stability and frequency distribution shall be used. Summarized
data representing the North and the South of Oman is attached in Appendix 2 (A2.7).
This data is summarized to be easily input to Shepherd as 12 sectors. However, these
data should be used only as guideline in the absence of any data or updated
meteorological data available at the time of the study.
3.3 QA/QC
Verify that all severity four or five hazards identified in the HAZID are addressed by
either specific failure cases or general fatal accident rates.
Verify that hole size distribution and meteorological conditions are adequately reflected
in the failure case selection for process hazards.

Revision: Rev 3.0
4 Frequency Assessment
4.1 Input Required

The consequence/risk modelling should be based on the piping and equipment of the
process/operation being studied. This will involve obtaining the following as an input:
• The number of equipments along with failure frequency of each equipment type
to generate the leak frequency of process under study.
• The tagged and numbered equipment list should be made available. This is
due to the fact that the level of modelling should be carried to an equipment
level.
• The number of equipment and the associated fittings, instruments, flanges and
valves should be determined. Generic process unit level parts count at the
concept phase where the PEFs are not developed yet, should be completed by
adapting parts count data from other similar projects or process units. At more
detailed stages of the project such as FEED and detailed design, the equipment
parts count shall be based on the PEFS, in which the associated fittings,
instruments, flanges and valves can be counted manually along with their sizes
if applicable.
4.2.1 Leak Frequency and Parts Count

As described above, at the early stages of the project, such as prior to concept
selection, where an adequate level of equipment detail is not developed yet, it is
recommended to use frequency data from similar projects. For example, for sour
facilities, it is recommended to use Harweel Phase 2A/B QRA frequency estimates
presented in Appendix 2 (A2.5). These parts counts are based on detailed design level
definition.
Once the details of the equipment are developed and with the availability of PEFs, parts
count for the equipment shall be generated using the parts count ruleset presented in
Appendix 2 (A2.4) and benchmarked against a similar project (e.g. Harweel 2A/B).
However, the basis behind each set of data should be quality checked, particularly
when AFC status PEFs are not available. Before AFC status PEFs are available, the
parts count should be adjusted based on a careful inspection of the Harweel 2A/B
equipment count.
4.2.2 Hole Size Distribution

As specified earlier, the hole size distribution for piping and equipment shall be based
on five discrete hole sizes: 2mm, 7mm, 22mm, 70mm and 150mm. However, in cases
such as failure of high discharge pressure compressor with small inventory, mass
release from large hole sizes (150mm and 70mm) generated by physical effects
modeling software such as Shell FRED tends to give very high values which do not
realistically represent the release as it is limited to the compressor inflow mass rate.
Combining the inlet pressure with the realistic hole size (e.g. 22mm) can represent
releases reflecting the inflow mass flow rate. See section 7.3. for further guidance.
4.2.3 Material selection

Detailed historical leak frequency data by material is not available in sufficient sample
sizes. However material selection can have a clear impact on loss of primary
containment risk, as can be illustrated by the example of comparing carbon steel with
Glass Reinforced Epoxy (GRE). Without historical data, the failure frequency is usually

Revision: Rev 3.0
assumed to be the same. However, the failure modes of the materials are considerably
different with carbon steel being subject to corrosion and GRE more vulnerable to
catastrophic failure due to mechanical impact. A study to highlight the difference on
failure frequency and mode of failure should be conducted to help understand the
difference in risk when deciding between the two. Release frequencies may be
modified based on a demonstrated and quantified understanding of the failure modes.
4.2.4 Blowouts
Frequencies of blowouts and well releases should be based on the SINTEF Offshore
Blowout Database version 2008. A summary of the Blowout and Well Release
Frequencies is attached in Appendix 2 (A2.6). For Emergency Planning Zone (EPZ)
modelling resulted from a well blow-out, see section 9.1.7.
4.3 QA/QC
As part of the QA/QC procedure, the equipment list and PEFS should be signed off by
the process / concept engineer. In addition, the leak frequency/part count should be
checked against a similar project data (e.g. Harweel 2A/B) by the reviewing
independent Technical Safety Engineer.

Revision: Rev 3.0
5 Consequence Assessment
5.1 Input Required

In order to carry out a reliable consequence assessment, it is important to ensure the
reliability of the input data. This includes process conditions such as temperature and
pressure. In addition, the fluid composition should be defined on either the mass
fraction or mole fraction basis. Therefore, the heat and material balance should be
made available. The metrological data should be updated and made available.
Shell FRED shall be used as the primary physical effects modelling tool. It enables the
user to run failure cases such as BLEVE, explosion, tank top fires, etc. Other software
or methodologies may be used following consultation with the Technical Safety
Engineering TA-1.

The following are some specific inputs and applications which are usually ambiguous in
the physical effects modelling process and could have impact on the results and the
assessment:
5.2.1 Sampling Time

Part of the dispersion assessment is to define the sampling time as either instantaneous
or averaged over a short time period (i.e. 10 minutes). When looking at flammable
effects (e.g. fire), it is recommended to use instantaneous sampling time as the
flammable effects might be sudden and takes only small fraction of time.
For toxic effects, there is slightly different approach. The instantaneous option should
be used when looking at the instantaneous effects such as knock down effect or
immediate death at high toxic concentration (e.g. > 650 ppm for H 2 S). When looking at
lower concentrations and far-field effects (e.g. like the case for emergency response
planning, SIMOPs contour) 10 minute average sampling time should be used [Ref 3].

Revision: Rev 3.0
5.2.2 Surface Roughness

The surface roughness value to be used as an input for cloud dispersion modeling
should be selected carefully. Below is default assumption for the surface roughness to
be used.
Table 1: Represents guideline on using the surface

roughness values for physical effects modelling
Roughness, m Description Comments
0.0001 Quiet sea, sand Used for transport on water.
0.001 Short grass Used for transport on land.
0.03 Fairly level grass plains Used for transport on land.
0.1 Farmland, isolated trees, Also process sites.
houses
0.3 Many trees, hedges, few Also process sites.
buildings
1 Industrial area, village Care needed to account for
topography for near ground
releases.
3 Centre of cities Don't use for dense gas dispersion.
As shown on the table 1 above, the value of 0.001 and 0.1 are most representative of
PDO facilities which are located in a desert environment. However, the value of 0.001
represents only the desert environment which surroundings the facility. The value 0.1
represents only the area covered by process units on plot. Therefore, for on-plot
modeling, value of 0.1 is recommended whereas for off-plot modeling a value of 0.001
is recommended where it is applicable.
5.2.3 Liquid / Vapour Phase - Export / Import

The composition of fluid at each equipment shall be assessed to determine which
phase (liquid or vapour or mixture) the leak will be in. This depends mainly on the
process condition and the fluid compositions. Once the fluid composition is defined, the
fluid can be exported from Shell FRED to Shepherd to be used for risk assessment
modeling.
However, a mixture fluid (either vapour or liquid) for flammables exported from FRED
cannot be imported to Shepherd. For the majority of releases this will be acceptable
when looking at vapour and liquid fractions in a mixed fluid in facility piping and
equipment. However, this should be reconsidered when looking at real 2-phase flows in
pipelines and flowlines.
When looking at separate phases, if the split between liquid/vapour is not apparent
(such as concept phase) a straight forward 50:50 frequency approach should be used
(e.g. inlet separator).
5.2.4 Flammables / Thermal Radiation

According to Ref 4 (Appendix V), the following thermal radiation levels shall be used for
physical effects modeling for initial screening criteria:
• 5 kW/m2 is taken as the limiting radiation intensity for escape actions lasting
more than a few minutes. This could be used to assess impact on emergency
escape route by thermal radiation taken 1 kW/m2 as background solar radiation.
For Shell Shepherd modeling, the default values should be used:

• Radiation level ≥ 50kW/m2: Probability of mortality = 1.0

Revision: Rev 3.0
•
2
Radiation level 10 to 50kW/m : Probability of mortality = 0.7
As general initial screening criteria for flammable gas dispersion:

• 0.5LFL (outdoor level of concern for open areas), e.g. exposure of personnel
working outside and permanent ignition sources.
• 0.4LFL (outdoor level of concern for building gas ingress) e.g. building/siting
new buildings near existing processing facilities to assess personal risk [Ref
14].
5.2.5 Toxic Effects

The toxicity levels for Hydrogen Sulphide (H 2 S) which are of interest when carrying out
a QRA are:
• 0.13 ppm – noticeable odor [Ref 13]
• 10 ppm – 8 hour TWA [Ref 13]
• 100 ppm – ERCB Emergency Planning Zone end-point (60 minutes exposure),
see section 9.1.7 [Ref 5].
• 300 ppm – SIMOPs planning for 30 minutes exposure [Ref 6].
• 650 ppm – concentration lethal to 1% of target population (LC1) for personnel
trained and equipped with H 2 S monitors and escape sets. See section 6.1.2 for
more details on toxic levels to be modeled [Ref 6].
Time to protect from toxic cloud should be evaluated from the physical effects modeling.
The modeling gives an indication of how fast a toxic cloud travels over a certain
distance. In the Shell FRED software, this can be determined in the Plume Data
(AEROPLUME DATA) option or using the plume travel time option.
For Sulphur Dioxide (SO 2 ), which results from H 2 S combustion (e.g. during well test,
flaring), the levels of concern are:
• 1 ppm - unpleasant odour
• 2 ppm - 8 hour TWA (Ref 13)
• 100 ppm - the NIOSH IDLH
Environmental air emission standards are presented in SP-1005 and the compliance of
flare and vent stack air emissions to SP-1005 should be modelled using appropriate
software i.e. CERC ADMS or EPA AERMOD.
5.2.6 Building Blast Resilience

DEP 34.17.10.30 [Ref 7] sets the following general building explosion overpressure
protection requirements:
• 50 mbar (5 kPa) – screening level for resilience in the structure and structure
components shall be provided. Laminated safety glass shall be used and the
2
pane area shall be < 1 m . Blast resistant doors shall be used.
• 200 mbar (20 kPa) – screening level for enhanced resilience in the structure
and structure components shall be provided. Laminated safety glass shall be
2
used and the pane area shall be < 1 m . Enhanced blast resistant doors shall
be used.
• 450 mbar (45 kPa) – screening level for blast resistance shall be required for
structure and structure components. Laminated safety glass and catch bars
2
shall be used and the pane area shall be < 0.25 m . Enhanced blast resistant
doors shall be used.
• 650 mbar (65 kPa) – upper limit for blast resistant buildings.

Revision: Rev 3.0
For Occupied Building Risk Assessments (OBRAs), building construction can be

simplified into eight building types as shown in Table 2.1.
Table 2.1: Building types [8]

Shell building type Description
B1 Wood, temporary buildings, trailers
B2 Steel frame with metal siding
B3 Brick/un-reinforced masonry (load bearing wall)
B4 Steel or concrete frame with masonry fill or cladding
B5 Blast resistant ( reinforced concrete)
B6 Brick/moderately reinforced masonry- load bearing
B7 Steel frame building with pre-cast walls and concrete roof
Custom type-specify the design free field overpressure at
B8
100ms pulse duration
Each building type has unique resistance to blast damage. The blast damage levels
are given below in table 2.2.
Table 2.2: Blast damage level by building type

Continuous
Discrete
damage level Brief
damage Full description
range. Interface Description
level
values
Minor Onset of visible damage. Building is
1 0 to 1.5
damage reusable following an explosion
Localised building damage. Building
performs function and can be used;
Moderate however, major repairs are required
2A 1.5 to 2.25
damage to restore integrity of structural
envelope. Total cost of repairs is
moderate.
Widespread building damage.
Building cannot be used until major
Moderate
2B 2.25 to 2.75 repairs are completed. Total cost of
damage
repairs is significant, approaching
replacement cost of building.
Building has lost structural integrity
and may collapse due to
Major environmental conditions (i.e. wind,
3 2.75 to 3.5
damage snow, rain). Total cost of repairs
exceeds replacement cost of
building.
Building fails completely. Repair is
4 3.5 to 4.5 Collapse
not feasible
5 Above 4.5 Annihilation Occupant survival is not possible
The following range of fatality rates (per building occupant) is based on the discrete
building-damage levels as listed in the table 2.2. The terms “fatality rate” “vulnerability”
and “occupant vulnerability” are used interchangeably in this context. These are given
in table 2.3.

Revision: Rev 3.0
Table 2.3: Shows the vulnerability dependence on

damage thresholds
Damage level Vulnerability including Vulnerability excluding
interface window breakage window breakage
1/2A 0.01 0
2A/2B 0.1 0.05
2B/3 0.3 0.3
3/4 0.6 0.6
4/5 1.0 1.0
The significance of the two sets of values is that, for lower damage levels, most of the
causalities result from window breakage. For fatalities of the types that would be
analysed using the techniques described here, it is likely that hazards due to window
breakage would be mitigated. In that case, it is recommended to use the rightmost
column, otherwise the values in the middle column should be used.
It is helpful to have a continuous vulnerability function of damage. Such a function that
is consistent with that data in the table 2.3 above. This is illustrated in figure 2.1, see
Appendix 2 (A2.1).
5.3 QA/QC
Process data such as temperature, pressure and compositions of the streams should
be signed off by process / concept engineer. Meteorological data to be signed off by
XTO discipline. The overall reliability of physical effects modelling should be checked
by a competent user of the software used in the study. As part of the QA/QC it is
recommended to import a Process Flow Diagram (PFD) into Shell FRED and check
against the streams by placing each release event on the right stream. This QA/QC
process is illustrated in Figure 2.
Figure 2: Illustrating the use of PFD as QA/QC for

consequence modelling in FRED

Revision: Rev 3.0
6 Impact Criteria

The following impact criteria are to be used in the QRA for determining the risk of
fatality.
6.1.1 Flammable
People:
• Use Shepherd in built lethality criteria for flash fires and explosions (based
on fireball rather than overpressure). Refer to the technical guideline of
Shepherd [Ref 9].
Equipment
Escalation from jet fires can be assessed at three levels as follows:
• For initial layout consequence analysis, depending on the prevention and
isolation philosophy details, FRED can be used to determine the jet flame
from a medium hole size 22 mm using the operating pressure. The jet
flame for such hole size tend to relatively maintain its length even after 10
minutes.
• In a more detailed assessment escalation from fires to process equipment /
-4
buildings, it is recommended to use 10 /yr flame impingement contour after
10 minutes combined de-pressuring and leak as a screening criteria for
failure of pipe / vessel supports, piping, process equipment, and piloted
building ignition.
• At the most detailed level of assessment, a comparison can be made of the
decreasing Ultimate Tensile Strength (UTS) of a steel pipe or vessel under
thermal load against the variable hoop stress, which would be affected by
the heating up of the fluid and depressuring / evacuating liquids. The
methodology to be followed for any assessment of this complexity should
be discussed with Technical Safety Engineer TA-1.
6.1.2 Toxic
The version of Shepherd which shall be used as risk integration for a high pressure high
H 2 S concentration sour hydrocarbon development is (2.1.2). This version has built in
toxic ellipse scenario calculations linked internally with FRED to determine the ellipse
properties and dimensions. Thus, the model could be used per the following criteria:
• For Individual risk (e.g. production / maintenance / wells workers), to use
LC1 = 650ppm LC50 = 1000 ppm LC100 = 1320 ppm [Ref 6]. These set of
values can be set in FRED and equivalent concentrations of H2S in the
mixture is set as fatality in Shepherd to enable toxic risk integrations.
Illustration is shown in figure 3.

Revision: Rev 3.0
Equivalent
concentration
of H2S to set
LC
Figure 3: Illustration of the concentration setting in

Shepherd
6.1.3 Explosion
For direct human explosion impact, value of 0.2 bar resulted into 100% fatality shall be
used [Ref 4].

Revision: Rev 3.0
7 Risk Integration
7.1 Input required

The risk assessment should be processed and presented so that it is easy and clear to
understand. The assessment shall use the facility layout. In addition, it shall take into
account both the operation and maintenance philosophy. In general, the following data
is required prior to the assessment:
• Updated site layout.
• Operating and maintenance philosophy.
• Personnel distribution across site. This is to investigate the risk level and
assessment for individuals across the site (e.g. IRPA, PLL …etc).
7.2 Tools
Shell Shepherd software tool shall be used as the risk integration model. The latest
version of Shepherd (2.1.2) has the feature of integrating the risk linked internally to
FRED. This presents the risk as fatality level (see section 6.1.2) rather than integrating
the risk using the TNO probit which was the case in the previous versions of Shepherd.
The latest version provides relatively clearer and more accurate toxic risk at higher
concentrations (e.g. LC50 and LC100) compared with previous versions.
Integrating the toxic risk using the TNO probit by specifying the LC1 using time
exposure with previous versions of Shepherd would under predict the toxic risk for
higher concentrations (e.g. LC50 and LC100) and is not accepted practice. See the
figure 4 below.
Figure 4: Illustrate the setting the values of the LC

according the time of exposure value selected in
Shepherd version 2.0

Revision: Rev 3.0
7.3.1 Process Block and Point Source

It is recommended to use “point source” rather than “process block” as it is a more
flexible way to build the risk integration model in Shepherd. The model detail is at an
equipment level rather than a process area level.
The point source approach will require one point source input for flammables and one
for toxic. However, when two phases are present, point sources will need to be created
for both vapour phase and liquid phase meaning there can be up-to four inputs for each
isolatable section.
Figure 5: Illustrate the use option of both “point

source” and process block
7.3.2 Area Receiver / Receptors

With Shepherd version 2.0 the LSIR can be found from the results by ‘CTL+ ‘right click’
giving the LSIR at that point only. In order to display LSIR values in the report, receiver
should be selected but this is for a single point only.
In the updated version of Shepherd 2.1 the ‘area receiver’ tool which can be defined as
an area of concern, when integrated, the function will display the minimum, maximum
and average LSIR within the defined area. This is useful when looking the maintenance
or construction (i.e. SIMOPS) activities. The average value should be considered.
7.3.3 Jet Footprint

The risk integration models tend to represent the plume dispersion footprint as a
triangle, which under-predicts the risk in the near field and over-predicts the far field
risk. Representing plume dispersion footprint as a triangle is not accepted practice

Revision: Rev 3.0
when modelling toxicity impact. As a result, it is important to input the information of

distance to maximum width and maximum width of the jet footprint (Jet footprint
properties). However, with Shepherd 2.1.2, the toxic ellipse properties (e.g. length and
width) are transferred from FRED directly.
7.3.4 Height Above Ground

The interpretation of the height of a dispersed plume above the ground can be a
misleading; therefore the exact definition and dimension should be clarified. According
to FRED (displaying as a summary of the dispersion) the height above the ground (m) is
the height from the end point of the plume to the ground whereas it may be incorrectly
interpreted the height measured from the lowest point of the plume. Clarification and
reference should be made to which point the height is being measured.
7.3.5 Ignition Probability

The current philosophy is to use Cox, Lee and Ang ignition probability based on the
mass flow rate. This is shown in the table below.
Table 3: Ignition Probabilities

Mass Ignition Ignition Fraction Delayed Immediate Delayed Immediate
flow prob prob delayed ignition ignition ignition ignition
(kg/s) gas liquid prob gas prob liquid
gas liquid
<1 0.01 0.01 0.04 0.0004 0.0096 0.0004 0.0096
50 0.07 0.03 0.12 0.0084 0.062 0.0036 0.26
>50 0.3 0.08 0.3 0.09 0.21 0.024 0.56
The ignition probability model IP is under study to propose replacing Cox, Lee and Ang
ignition probability which has the shortfall of not realistically representative for very high
mass flow rate [Ref 10].
7.3.6 Toxic Dispersion from Liquid Releases

The toxic risk from a liquid phase should be included, where concentration >1000 ppm
H 2 S in the fluid.
7.3.7 Prevention and Shutdown

The risk integration tool (Shepherd) gives the option of defining the prevention and
shutdown features during the release event. However, it is recommended to ignore this
option to account for the worse case and also the fact that the flammable or toxic effect
might be immediate which does not allow the activation of such protection measures.
7.3.8 Other Guidance

There are several common errors that Shepherd users tend to commit. Some of these
are:
• Single hole size/hole size distribution: the option of single hole should be ticked
to account only for the five defined hole sizes (2mm, 7mm, 22mm, 70mm and
150mm).
• Ignore to un-ticked the option of update leak frequency from site. This tends to
create frequency update every time the integration is run. Therefore, it should
be ensured that this option is always un-ticked.

Revision: Rev 3.0
• Jet flame length for the exported flammable fluids in Shepherd tends to
calculate higher values than the one in FRED. User define option can be used
specify the length as given in FRED.
7.4 QA/QC
Part of the QA/QC of the risk assessment process is to manage and control the
reliability and the quality of the input to the modelling tool. The site layout or the plot
plan used as background map for the risk integration modelling should be signed off by
concept or project piping engineer. The operation data should be signed off by the
project operation support engineer. The risk modelling should be carried out by a
competent Shepherd modeller and it should be checked by independent model
reviewer.

Revision: Rev 3.0
8 Non-Process Hazards

The following fatality rates should be used for various non-process hazards. [Ref 1]
8.1.1 Land Transport Risk

E&P Forum gives a fatality rate for Oman. However, a PDO safety report on risk of
driving vs. flying indicates that road safety in Oman is worse than PDO. Based on PDO
safety statistics, the fatality rate for PDO on various road types is as follows (Ref 18).
Table 4: Road Fatality Rates

PDO Bus Fatalities PDO Light Vehicle Fatalities
Road Type
per 108 person-Kms per 108 person-Kms
Blacktop 0.16 1.05
Graded Road 0.43 1.42
These rates are to be used for risk calculations in PDO operations.
8.1.2 Air Transport Risk

-8
The fatality rate of 147.36 per 10 flights as per the PDO report on safety of flying vs.
driving (see Reference 8) is to be used in PDO risk assessments for air operations (the
data is based on UK CAA data for F-27's).
8.1.3 Occupational Risk

Occupational risk (for workers) is the risk of fatality due to accidents such as slips, trips,
falls, electrocution, dropped object impact, etc. Occupational risks do not include
exposure to hydrocarbon hazards, but are “inherent” risks associated with the job task.
They must be considered in addition to major hydrocarbon risk in a QRA study.
Occupational risk of fatality is assumed from Reference 1. For site personnel under
-8
normal operations, the “energy and water” industry employee average of 3.4 x 10
fatalities per exposed work hour is applied to determine occupational risk. For
-8
construction crews, an average occupational risk of 4.6 x 10 fatalities per exposed
work hour is applied, from Reference 1.
This corresponds with data presented in Reference 10, which displays average “small
-5 -5
individual risk” (i.e. occupational risk) as between 6 x 10 and 7 x 10 fatalities per
annum for onshore E&P workers.

Revision: Rev 3.0
9 Risk Criteria
9.1.1 Location Specific Individual Risk (LSIR)

LSIR assumes that the individual is at a location 24 hours and 365 days a year.
Practically, this cannot be used for risk based decisions as it does not take into account
the manning distribution around the site. However, LSIR, which is presented by
Shepherd results, can be used as initial guideline to highlight which process block/unit
has the highest risk level. In addition, LSIR is used to calculate the IRPA values from
the manning distribution.
9.1.2 Individual Risk Per Annum (IRPA)

IRPA is the probability of fatality for an individual in any one calendar year by a
particular set of hazards. The individual risk calculation takes account of the fact that
people move from one place to another. The value is derived by taking into account
LSIR values and the time spent by individuals on site per year.
IRPA is required for risk tolerability assessment and quantitative ALARP demonstration.
IRPA
Intolerable Adopt alternative lower risk
Region solution
10-3/yr
10-4/yr
Tolerable Reduce risk to ALARP

Region -5
10 /yr
-6
10 /yr
Acceptable Manage for continuous

Region improvement
Figure 6: Tolerability triangle

Revision: Rev 3.0
9.1.3 Societal Risk (F-N Curves)

F-N curves can be used to assess societal risk and are usually presented on log-log
plots with the x-axis representing the scale of the consequence in terms of the number,
N, of fatalities (or, less commonly, some other type of harm) and the (y-axis)
representing the likelihood (expected frequency), F of N fatalities (i.e. N or more
fatalities).
A guideline tolerability threshold for Societal Risk can be taken from the UK HSE
Publication Reducing Risks, Protecting People’ (R2P2) [Ref11] which states: “that, for
any single industrial installation, “the risk of an accident causing the death of 50 or more
people in a single event should be regarded as intolerable if the frequency is estimated
to be more than one in five thousand per annum”. Refer to Appendix 2 (A2.2) for
additional guidance.
Currently, as most of PDO’s installations are at remote areas, no detailed assessment
is normally required for public risk. The only population of concern could be camp
occupants. The location of the camp and the risk of the people become more critical in
sour hydrocarbon developments, where the far-field effects of a loss of containment can
cover an extensive area. Risk to people could be assessed by initial screening using
the EPZ distance to locate the camp from the source of the hazards. This is also
applicable to section 9.1.5. See section 9.1.7
9.1.4 Potential Loss of Life (PLL)

The PLL per year is determined by summing the product of the fatal accident rate and
the exposure hours for any number of incidents that could occur in a typical operation.
The PLL per year statistic is typically determined to show the potential in lives lost for
specific operations that may include a number of hazardous events (such as drilling a
well). Multiplying the PLL per year by the expected lifetime of a facility gives a Lifetime
PLL by which the overall number of fatalities incurred by the facility, over its entire
operational period, can be estimated.
Since PLL is a function of population, it cannot be used as a guideline for comparison of
risk tolerability. However, Lifetime PLL is the means by which risk reduction measures
can be assessed by using Cost-Benefit Analysis. PLL per year should be presented as
a measure to compare the relative degree of “safety”, expressed as potential loss of life
for different options or developments. This should be used in conjunction with IRPA
levels. [Ref 1]
9.1.5 Land Use Planning

Land Use Planning (LUP) can be used for assessing the risk from process facilities
near to locations permanently used members of the public. LUP typically uses a three-
zone system: ‘Inner’ (IZ), ‘Middle’ (MZ) and ‘Outer’ (OZ). The zones are normally
determined by a detailed assessment of the risks and/or hazards of the installation
which takes into account the following factors:
• The hazard ranges and consequences of the toxic and/or flammable
substances present; and
• The volume of those substances for which the site has consent and the method
of storage.
The risks and hazards from the major hazard are greatest in the Inner Zone and hence
the restrictions on development are strictest. The sizing is as follow:
• The boundary between the inner (IZ) and middle zones (MZ) corresponds to an
individual risk of dangerous dose or worse of 10 chances per million per year
-5
cpm (1 x10 per year).
• The boundary between the middle (MZ) and outer zones (OZ) corresponds to
an individual risk of dangerous dose or worse of 1 cpm (1 x10-6 per year)

Revision: Rev 3.0
• The outer edge of the outer zone (OZ) is set at an individual risk of dangerous
-7
dose or worse of 0.3 cpm (3 x10 per year)
The definition of ‘’public’’ are individuals that do not receive direct benefits from the
operation of PDO and risk tolerability should be set lower than for workers.
For the details of how to use the LUP system, see Appendix 2 (A2.3).
9.1.6 Simultaneous Operation – Toxic Sphere of Influence (SIMOPS)

The definition of SIMOPs is when two activities are undertaken simultaneously under
different control systems in overlapping spheres of influence or hazards zones. To
define the extent of the hazard zone or sphere of influence from an operation or activity
-4
with a high toxic risk, the 300 ppm H 2 S end point with 10 per year frequency is used in
PDO sour projects.
The SIMOPS risk assessment could be implemented in Shepherd by setting the
equivalent concentration of 300 ppm in Shepherd (see figure 3 and section 6.1.2). It
should be noted that the 300 ppm criteria is assuming 30 minutes exposure limit,
therefore the 10 minutes sampling time option in FRED should be selected. This is
-4
currently best representing the 300 ppm 10 per year criteria. The contour is then
determined for each scenario by selecting “Frequency of having toxic gas above LC
(which is set as concentration equivalent to 300 ppm) from Shepherd evaluated
scenarios.
9.1.7 Emergency Planning Zone (EPZ)

The Emergency Planning Zone (EPZ) is a geographical area surrounding a well,
pipeline, or facility containing hazardous product that requires specific emergency
response planning. EPZs are typically defined by the worst credible case
consequences for a given process hazard.
Generally, the level which should be selected for emergency planning purpose should
be based on no fatality outcomes for all groups of people.
For facilities with high pressure high concentration Hydrogen Sulphide hazards, the 100
ppm H 2 S end point (for 60 minutes) for worse case consequence shall be used to
determine the extent of the EPZ. The current practice for sour EPZs is use the
ERCBH2S model developed by the Energy Resources Conservation Board of Alberta
(ERCB) [Ref 5].
9.1.8 Building Risk

Building Risk is the ‘explosion risk’ to a hypothetical individual in the building, if
occupied by the person 40 hours per week (taken as a nominal 100 % occupancy).
Occupied company buildings located on or adjacent to process facilities shall be sited
-5
where the calculated Building Risk is less than or equal to 1 x 10 / year using the Shell
Shepherd tool.
Building Risk acceptance criteria applies to both temporary and permanent buildings.
See also SP-1127.

Revision: Rev 3.0
10 Risk Reduction
Part of the ALARP demonstration process will involve assessing and evaluating the
magnitude of the risk reduction that can be provided by a proposed option. Along with
the benefit; the technical feasibility, cost and effort of the proposed risk reduction option
should also be assessed.
The quantified risk reduction considered within the scope of a QRA study should be
limited to options that can be reasonably evaluated by QRA. These are broadly
inherent safety options as shown in table 5, but may also include some engineered and
procedural controls. As many of the risk reduction options would involve changes to the
process design, facility layout, safeguarding, or operations philosophy, the
brainstorming of QRA risk reduction options should involve a multi-disciplinary team.
Identified options should be ranked on quantitative risk reduction against cost and effort
of implementing.
A common practice is to use the Boston Square approach to represent the risk
reduction against feasibility. An example is shown below:
Low
Dilute Acid
Gas
Acid Gas
intake control Fixed Air
System
Feasibility
Leak Path
Reduction
High 10% 20% 100%

Risk Reduction
Figure 7: Boston Square example for identified risk

reduction measures
Cost-Benefit Analysis may also be used as part of the ALARP demonstration,

particularly when the cost of implementing an option is very high. See Appendix 2
(A2.8) for a general discussion on CBA.

Revision: Rev 3.0
Table 5: Example Inherent Safety Risk Reduction

Options
Principle Summary Example of QRA Risk Reduction
Minimise Reducing the amount of • Reducing tankage capacity
hazardous material present at any
one time
Substitute Replacing one material with • Substituting flammable and
another of less hazard combustible fluids with non-
flammable alternatives
Moderate Reducing the strength of an effect • Reducing operating pressures
to reduce physical effects
• Reducing the concentration of
toxic chemicals in process fluids
to reduce toxic chemical
dispersion distances and effects
Simplify Designing out problems rather • Leak path reduction by reducing
than adding additional equipment equipment, fittings, flanges, etc.
or features to deal with them. • Leak path reduction by
Only fitting options and using selecting equipment that has
complex procedures if they are fewer leak paths than a
really necessary standard design
• Relying on material selection
rather than dehydration, which
will in turn reduce the
equipment count by eliminating
the need for a dehydration
package
Error Equipment and processes can be • Leak frequency reduction by
Tolerance designed to be capable of selecting materials that have
withstanding possible faults or fewer / less likely failure modes
deviations from design • Eliminating fixed ignition
sources to reduce ignition
probability
• Operating below auto-ignition
temperature to reduce ignition
probability
• Reducing congestion or
improving ventilation of process
units to reduce potential
explosion overpressures
Limit Designing and locating equipment • Optimising layout to mitigate
Effects so that the worst possible escalation of fire and explosion
condition gives less danger, e.g. events
gravity will take a leak to a safe • Increasing separation distances
place, the use of bunds between hazards and targets
• Providing secondary
containment and hazardous
drains to minimize effective
flammable pool sizes or running
pool fires

Revision: Rev 3.0
11 Report Writing
11.1 Report Outline

The outline provided below is a sequence of ‘subjects’ to be considered in any report
produced (e.g. a complete report, a single section or a sub-statement) on a QRA.
Charts and tables are useful eye-catching methods of highlighting results, especially for
the target audience of managers and executives that will be making decisions based on
the QRA. Remember that “a picture is worth a thousand words”. [Ref 1]
11.1.1 Summary
A summary is considered as a synopsis and a structured guide for the reader. Do not
confuse Summary with Introduction. A ‘Summary’ is a short, connected account of
the essential features including conclusions. Detail is excluded. An ‘Introduction’
announces the destination and prepares the reader for the journey. It states the
results/conclusions and recommendations, if any. In some cases a separate Executive
Summary may be merited. This can be a stand-alone document or precede the
‘Contents’. Its purpose is to address key issues and advantages for the benefit of the
client’s Executives, i.e. the decision-makers.
11.1.2 Introduction
This section should define why the QRA has been undertaken, generally what it aims to
achieve with the client’s needs emphasised. The scope, objectives and the basis of the
study clearly need to be identified. The introduction leads into the main body of the
report.
11.1.3 Methodology and Data Source

This section details how the report was compiled and a brief description of the
methodology used for the analysis with a particular overview if any changes have been
made to the approach to Hazard Identification, Consequence Assessment, Failure
Frequency and Probability Estimation, and Risk Analysis taken in this specification.
Sources of data should be clearly identified so that the analysis is reproducible from the
base data if necessary. All assumptions, including operating philosophy and any
modelling simplifications should be thoroughly discussed with those responsible for that
aspect of the design or operation.
11.1.4 Hazard Identification

This section should present the hazards that were identified as a part of the process
and the means by which the task was completed (HAZID, HAZOP, etc.), unless they
have already been described in the methodology section. The personnel that
participated in hazard identification should be noted.
11.1.5 Consequence Assessment

The results of the consequence assessment should be presented along with example
outputs of the method used. The means by which losses are defined should be detailed
(costs, environmental damage, etc.) where these are not obvious or where they differ
from standard values due to the specific details of the site or incident.
11.1.6 Frequency Assessment

Provide details of any rule sets developed, explain the logic behind different failure
mechanisms, details of the logic behind the event trees and fault trees analyses if used,
etc.

Revision: Rev 3.0
11.1.7 Risk Assessment

This section should provide the specific risk statistics that have been derived to present,
rank and evaluate the hazards that were evaluated (IRPA, PLL, FAR, etc). It should
also summarise what options have been evaluated and the criteria by which the
statistics will be ranked (cost benefit analysis, etc). The characterisation of risk is the
main purpose of the report, so the reader should be taken back to the original objectives
and how they have been fulfilled.
11.1.8 Recommendation
A QRA may or may not include recommendations depending on how the exercise is
scoped. If recommendations are made, they should be confined strictly to the scope of
the work. Additional findings and recommendations that are arrived at during the
course of the exercise should be addressed separately from the QRA report.
11.1.9 References
Provide a list of all references used for the study so that results and conclusions are
fully traceable and auditable.
11.1.10 Appendices
This is optional as it contains relevant, but often extensive and detailed information or
data that might make the reader lose interest if it were presented in the main body of
the report. Where the QRA may be read by a wide variety of engineers, it can be
beneficial to place the detailed technical analysis for, frequency assessment,
consequence modelling and fatality assessment in the Appendices, such that the main
body of the report remains readable from a non-QRA viewpoint. In addition, it may
contain:
• Process streams including composition, pressure, temperature with the Heat
and Mass balance.
• Equipment list with respect to process streams and leak frequency.
• Risk plots around the process.
11.2 Additional Recommendations

Data should be labelled according to application in the consequence modelling (FRED)
and risk modelling (Shepherd). The models (Consequence and Risk) should be
presented in as detailed level as possible (e.g. equipment level) and not combined in
one event. Tables which contains the modelled scenario along with the data (e.g.
process conditions compositions, streams numbers, frequency … etc) used. Any
assumptions should be clearly stated along with the justifications.

Revision: Rev 3.0

Revision: Rev 3.0
Appendices
Appendix 1, Glossary of Definitions, Terms and Abbreviations
Acronym Definition
ALARP As Low As Reasonably Practicable
BA Breathing Apparatus
BLEVE Boiling Liquid Expanding Vapour Explosions
CAM Congestion Assessment Method
E&P (EP) Exploration and Production
ERP Emergency Response Plan
ESD Emergency Shut Down
F/N Frequency / Number of Fatalities
FAR Fatal Accident Rate
FEED Front End Engineering and Design
FERM Fire and Explosion Risk Management
FRED Fire, Release, Explosion and Dispersion (software)
H2S Hydrogen Sulphide
HAZID Hazard Identification
HC Hydrocarbon
HEMP Hazard Effect Management Process
HSE Health, Safety and Environment
ICAF Implied Cost to Avert a Fatality
IPF Instrumentation Protective Function
IRPA Individual Risk Per Annum
LC Lethal Concentration
LFL Lower Flammable Limit
LPG Liquefied Petroleum Gas
LSIR Local Specific Individual Risk
OBRA Occupied Building Risk Assessment
OREDA Offshore Reliability Database
ORP Opportunity Realisation Process
PDO Petroleum Development Oman
PLL Potential Loss of Life
ppm(v) Parts Per Million (by Volume)
QRA Quantitative Risk Assessment
Risk The total process of risk analysis, interpretation of results and
Assessment recommendations of corrective action.
SGS Shell Global Solution

Revision: Rev 3.0
SIEP Shell International Exploration and Production

SIMOPS Simultaneous Operation
SO2 Sulphur Dioxide
SRTCT Shell Research Technology Centre Thornton
STEL Short Term Exposure Limit
TLV (-TWA) (-C) Threshold Limit Value (- Time Weighted Average) (- Ceiling)
UFL Upper flammable limit
UK United Kingdom

Revision: Rev 3.0
Appendix 2, Additional Guidance
A2.1 Building Impact Criteria

The following figures illustrate the continuous vulnerability function of damage for
buildings exposed to explosion overpressures.
Figure A2.1: Vulnerability as a function of damage
Figure A2.2: Pressure based vulnerability curves for building types

Revision: Rev 3.0
Level 4 corresponds to collapse of the building. This can be survivable by a significant

minority of the occupants, or may be so severe that it is not survivable at all. Level 5
described as “building annihilation”, corresponds to the level of damage where occupant
survival is highly unlikely.
For all building types, except B5 for which there are insufficient data or B8 which by
definition can only have overpressure damage at 100 ms pulse duration, the damage
level can also be expressed in terms of a pressure-impulse (PI). Using the
damage/vulnerability relationships in figure 2.1 and assuming a triangular pressure
pulse, the vulnerability can be plotted as a function of overpressure and blast duration.
A2.2 Societal Risk

If the chosen criterion point (say that given in the HSE publication “Reducing Risk
Protecting People” [Ref11] – of 50 or more people being killed at a chance of 1 in 5000
per year) is placed on a log-log graph, a line can be drawn through it (as shown below)
to provide a comparison line against which the actual F-N curve from the installation
can be compared. One simple approach is then to see if the actual curve lies above the
criterion line at any point - if so then this could be considered unacceptable. However,
one must ask whether the actual curve must be below the criterion line at all points? Or
can some excursions above the line be allowed, if these are ‘balanced’ by places where
the curve is below the criterion line (see example below)? There is no universal
agreement on this.
Figure A2.3: Example of F-N curve and criterion line
The following factors define the criterion line for the F-N curve:
• Anchor point: provide some guidelines regarding the boarder of acceptability or
social risk.
• Gradient this is usually -1 according to the UK HSE.

Revision: Rev 3.0
The table below provides some guidelines (based on the modern development of UK,
Netherlands (NL) and Hong Kong (HK) for the Anchor point and gradient for the F-N
criterion line [Ref 15]:
Table A2.1: F-N criterion line parameters
Country of Anchor Slope of F- Criteria level and number of Zones
reference point (F,N) N criteria
line
ACDS UK (500, 2× 10- -1 3- intolerable, ALARP and negligible.
1991 4)
Upper limit of ‘’Negligible’’ is 1,000 lower.
NL 1996 (10, 10-5) -1 3- unacceptable, ALARP and
acceptable.
Acceptable limits 100 times lower
HK 1995 (10, 10-4) -2 2- Social risk to be reduced, ALARP
The figure below illustrates the use of F-N criteria line, applying anchor point and slope
Figure A2.4: Example of F-N curve and criterion bands
A2.3 Land Use Planning

The method by which the zone sizes are established depends on the type of site. For
some sites a ‘risk based’ approach is used, whereby the zone boundaries correspond to
different values of the risk of an individual receiving a ‘dangerous dose’ or worse.
Below is an illustration of the three zones used for LUP and their individual risk
associated with it:

Revision: Rev 3.0
-5
1 x10 /
year
1 x10-6/
year
3 x10-7/
year
Figure A2.5: Land use planning contours
There are 4 sensitivity levels:

• Level 1 – Workplaces providing for less than 100 occupants in each building
and less than 3 occupied storeys e.g. Offices, factories, warehouses, haulage
depots, farm buildings, non-retail markets, builder’s yards
• Level 2 – Developments for use by the general public e.g.
o Housing developments up to and including 30 dwelling units and at a
density of no more than 40 per hectare
o Hotels, accommodation centres, camping sites, etc. of up to 100 beds
o Dual carriageways (note: single carriageway roads are sensitivity level
1)
o Developments for indoor use by the general public where total floor
space is from 250 m2 up to 5000 m2, including restaurants, shops and
small retail developments, community buildings, health centres,
mosques, adult education centres, sports and leisure centres, transport
stations, etc.
o An outdoor development for use by the general public where people will
predominantly be outdoors and not more than 100 people will gather at
the facility at any one time.
• Level 3 – Developments for use by vulnerable people e.g.

Revision: Rev 3.0
o Hospitals, convalescent homes, nursing homes, nurseries, schools and

academies for children up to school leaving age.
• Level 4 – Very large and sensitive developments i.e. large examples of Level 3
and large outdoor examples of Level 2 developments.
Having determined which zone the development falls into and also the sensitivity level
of the development, the following matrix is used to decide the type of advice.
Table A2.2: Development level of sensitivity and zone
Level of Sensitivity Development in Development in Development in
Inner Zone Middle Zone Outer Zone
1 DAA DAA DAA
2 AA DAA DAA
3 AA AA DAA
4 AA AA AA
DAA = Don’t Advise Against development.

AA = Advise Against development

Revision: Rev 3.0
A2.4 Leak Frequency Estimation and Parts Count Methodology

Below are the standard parts count spreadsheet format and taxonomy. These should
be used and adapted accordingly to estimate the leak frequency.
Table A2.3: Parts count spreadsheet format
Results Hole mm 2 7 22 70 150
Freq/yr 0.00E+00 0.00E+00 0.00E+00 0.00E+00 0.00E+00
ISO ID xxx Operating xxx

Pressure
Object xxx Phase xxx
(Liquid/Gas
)
Parts Count ID xxx Stream xxx
Number
Diameter Number of Number of Valves Number Length

instrument of of
small bore Flanges Pipes
Manual Actuated
per item per item per flange per meter
face
<1/2"
1/2" < 1"
>1"
1" < 2"
2" < 3"
3" < 11"
>11"
Number
Compressors Per Item
centrifugal
Compressors Per Item
reciprocating
Fin fan coolers Per Item
Heat exchangers HC Per Item
in shell
Heat exchangers HC Per Item
in tube
Pressure vessel Per Item
Pumps centrifugal Per Item
Pumps reciprocating Per Item
Pipeline onshore / Per m
steel length
Pig Per Item
launchers/receivers
Wellheads Per Item
Xmas trees Per Item
Riser flexible Per Riser
Riser steel Per Riser
Pipeline subsea Per m
flexible length
Pipeline subsea steel Per m
length

Revision: Rev 3.0
TAXONOMY DESCRIPTION FOR EACH COMPONENT

TOTAL FREQUENCY PER RELEASE HOLE SIZE
UNITS / RELEASE
EQUIPMENT NAME TAXONOMY DESCRIPTION FREQ. 2 mm 7 mm 22 mm 70 mm 150 mm
YEAR
COMPRESSORS / The compressor itself, but excluding all valves,
Per Item 5.89E-03 3.11E-03 1.40E-03 1.04E-03 3.53E-04 0.00E+00
CENTRIFUGAL piping, flanges, instruments and fittings beyond
the first flange and excluding the first flange itself.
COMPRESSORS / One compressor comprises all stages on the
Per Item 5.13E-02 4.01E-02 6.38E-03 3.66E-03 8.09E-04 3.02E-04
RECIPROCATING same shaft.
The fin fan cooler itself, excluding all valves,

FIN FAN COOLERS Per Item piping, flanges, instruments and fittings beyond 2.01E-03 1.37E-03 3.25E-04 3.01E-04 1.17E-05 0.00E+00
Per
FLANGES / D < = 1" (per flange) Flange 2.41E-05 1.40E-05 4.52E-06 5.65E-06 0.00E+00 0.00E+00
Face
Per
FLANGES / 1" < D < = 2" (per
Flange 2.41E-05 1.40E-05 4.52E-06 5.45E-06 2.01E-07 0.00E+00
flange)
Face
HCR data is per flange face. Flanged joints
Per comprise 2 flanges normally; spectacle blinds and
FLANGES / 2" < D < = 3" (per
Flange orifice plates count as 3. Screwed joints count as 2.41E-05 1.40E-05 4.52E-06 5.05E-06 6.04E-07 0.00E+00
flange)
Face 2 flanges. Clamp (Grayloc) and Hammer union
(Chicksan) joints also count as 2 flanges.
Per
FLANGES / 3" < D < = 11" (per
Flange 3.60E-05 2.49E-05 3.24E-06 4.72E-06 1.22E-06 1.96E-06
flange)
Face
Per
FLANGES / D > 11" (per flange) Flange 8.48E-05 5.86E-05 7.63E-06 1.11E-05 2.88E-06 4.61E-06
Face
The heat exchanger itself, but excluding all valves,
HEAT EXCHANGERS / HC IN piping, flanges, instruments and fittings beyond
Per Item 3.15E-03 1.83E-03 5.90E-04 5.55E-04 7.99E-05 1.03E-04
SHELL the first flange and excluding the first flange itself.
Shell side includes shell and tube side includes

Revision: Rev 3.0
tube header. Releases are external only.

HEAT EXCHANGERS / HC IN
Per Item 2.26E-03 1.31E-03 4.23E-04 3.99E-04 5.73E-05 7.40E-05
TUBE
INSTRUMENTS / SMALL BORE

Per Item 4.04E-04 2.35E-04 1.15E-04 5.43E-05 0.00E+00 0.00E+00
CONNECTIONS / D <= 1/2"
One Instrument could comprise the instrument
INSTRUMENTS / SMALL BORE itself, plus up to 2 valves, up to 4 flanges, 1 fitting,
Per Item 4.04E-04 2.35E-04 8.83E-05 8.05E-05 0.00E+00 0.00E+00
CONNECTIONS / 1/2" < D <= 1" and associated small bore piping (1"or less). Sizes
represent the maximum bore of the fittings.
INSTRUMENTS / SMALL BORE
Per Item 4.04E-04 2.35E-04 8.83E-05 7.99E-05 6.74E-07 0.00E+00
CONNECTIONS / D > 1"
The pig launcher itself, but excluding all valves,

PIG LAUNCHERS / RECEIVERS /
Per Item piping, flanges, instruments and fittings beyond 3.77E-03 1.72E-03 4.38E-04 9.00E-04 2.44E-04 4.73E-04
ALL
Transmission pipeline only. Components (valves,

etc.) should be recorded separately as should
PIPELINE / ONSHORE / STEEL / Per m
process piping. Data is based on onshore steel 1.70E-07 2.13E-08 2.13E-08 7.00E-08 3.12E-08 2.63E-08
ALL length
gas transmission pipelines over 15 bar outside
installation fences, but used also for oil pipelines.
Per m
PIPING / STEEL / D < = 1" 1.08E-04 6.24E-05 2.02E-05 2.52E-05 0.00E+00 0.00E+00
length
Per m
PIPING / STEEL / 1" < D < = 2" 1.08E-04 6.24E-05 2.02E-05 2.43E-05 8.99E-07 0.00E+00
length
Per m Piping metres length excluding valves, flanges,
PIPING / STEEL / 2" < D < = 3" 1.08E-04 6.24E-05 2.02E-05 2.26E-05 2.70E-06 0.00E+00
length and instrument fittings.
Per m
PIPING / STEEL / 3" < D < = 11" 3.70E-05 2.55E-05 3.32E-06 4.85E-06 1.26E-06 2.01E-06
length
Per m
PIPING / STEEL / D > 11" 3.96E-05 2.74E-05 3.57E-06 5.20E-06 1.35E-06 2.15E-06
length

Revision: Rev 3.0
The pressure vessel itself including attached

nozzles/ branches and man-ways, but excluding
PRESSURE VESSEL / ALL (Exc
Per Item all valves, piping, flanges, instruments and fittings 1.23E-03 3.81E-04 2.95E-04 4.52E-04 6.12E-05 3.90E-05
'OTHER')
beyond the first flange and excluding the first
flange itself.
PUMPS CENTRIFUGAL / ALL Per Item The pump itself, but excluding all valves, piping, 2.79E-03 1.88E-03 4.77E-04 3.75E-04 4.41E-05 1.65E-05
flanges, instruments and fittings beyond the first
PUMPS / RECIPROCATING / ALL Per Item flange and excluding the first flange itself. 3.64E-03 2.11E-03 6.98E-04 6.23E-04 9.21E-05 1.19E-04
VALVES ACTUATED / D < = 1" Per Item 4.54E-04 2.63E-04 8.49E-05 1.06E-04 0.00E+00 0.00E+00
VALVES ACTUATED / 1" < D <=
Per Item 4.54E-04 2.63E-04 8.49E-05 1.02E-04 3.78E-06 0.00E+00
2"
VALVES ACTUATED / 2" < D <=
Per Item Each Valve consists of the body, stem and packer, 4.54E-04 2.63E-04 8.49E-05 9.48E-05 1.13E-05 0.00E+00
3"
but excludes flanges, controls, and
VALVES ACTUATED / 3" < D < = instrumentation. Interfaces for valves should be
Per Item 5.15E-04 3.55E-04 4.63E-05 6.75E-05 1.75E-05 2.80E-05
11" selected at valve connections according to normal
specification break conventions, and only whole
VALVES ACTUATED / D > 11" Per Item numbers of components should be counted. It is 6.52E-04 4.50E-04 5.86E-05 8.54E-05 2.21E-05 3.54E-05
VALVES MANUAL / D < = 1" Per Item not normally allowable to count 1/2 valves, 5.04E-05 2.92E-05 9.43E-06 1.18E-05 0.00E+00 0.00E+00
however valves should not be double counted in
VALVES MANUAL / 1" < D < = 2" Per Item two inventories. 5.04E-05 2.92E-05 9.43E-06 1.14E-05 4.20E-07 0.00E+00
VALVES MANUAL / 2" < D < = 3" Per Item 5.04E-05 2.92E-05 9.43E-06 1.05E-05 1.26E-06 0.00E+00
VALVES MANUAL / 3" < D < = 11" Per Item 9.45E-05 6.52E-05 8.49E-06 1.24E-05 3.21E-06 5.13E-06
VALVES MANUAL / D > 11" Per Item 4.58E-04 3.17E-04 4.12E-05 6.01E-05 1.56E-05 2.49E-05
WELLHEADS / ALL Per Item Joint between xmas tree and the well itself. 1.48E-03 8.58E-04 2.78E-04 2.97E-04 2.59E-05 2.36E-05
Entire unit including valves, flanges, rams etc.
down to the wellhead connection and up to the
first flange, but excluding all piping, valves and
XMAS TREES / ALL Per Item 3.53E-03 2.04E-03 6.63E-04 7.07E-04 6.16E-05 5.61E-05
fittings beyond the first flange (e.g. flowlines or
choke/kill connection) and excluding the flange
itself.

Revision: Rev 3.0
A2.5 Harweel Leak Frequencies by Process Unit

Below is the leak frequencies used for Harweel Phase 2A/B development. These are
based on PEFs detailed parts counts [Ref 16].
Table A2.4: Harweel 2A/B total release frequencies
Overall leak frequencies
Description 2mm 7 mm 22 mm 75 mm 150 mm
Rabab Bulk Pig Receiver 1.24E-02 2.43E-03 3.37E-03 6.65E-04 1.10E-03
Dafaq Bulk Pig Receiver 1.03E-02 1.95E-03 2.85E-03 5.98E-04 9.97E-04
Sakhiya West Bulk Pig Receiver 1.62E-02 2.72E-03 3.98E-03 8.91E-04 1.47E-03
Zalzala Bulk Pig Receiver 1.23E-02 2.21E-03 3.23E-03 7.02E-04 1.16E-03
Production manifold 2.84E-02 4.63E-03 6.18E-03 1.25E-03 1.88E-03
Rabat separator vapour 1.61E-02 3.15E-03 3.99E-03 6.87E-04 9.98E-04
Rabat separator liquid 9.22E-03 1.95E-03 2.33E-03 3.22E-04 4.59E-04
Inlet facilities/manifold 1.05E-01 1.90E-02 2.59E-02 5.12E-03 8.06E-03
1st stage separator vapour 1.11E-02 2.25E-03 2.88E-03 4.83E-04 6.93E-04
1st stage separator liquid 8.75E-03 1.80E-03 2.19E-03 3.19E-04 4.50E-04
2nd stage separator vapour 8.86E-03 1.97E-03 2.49E-03 3.89E-04 5.02E-04
2nd stage separator liquid 2.34E-03 4.80E-04 5.76E-04 8.27E-05 1.23E-04
3rd stage separator vapour 8.16E-03 1.87E-03 2.34E-03 3.58E-04 4.52E-04
2nd stage pre-heater E-2201
1.75E-02 3.20E-03 3.92E-03 8.03E-04 1.22E-03
A/B
3rd stage separator liquid 6.82E-03 1.27E-03 1.59E-03 2.66E-04 4.01E-04
Two separator trains 1.27E-01 2.57E-02 3.20E-02 5.40E-03 7.69E-03
Vapour manifold 100 bar ex
1.53E-02 2.38E-03 3.25E-03 6.79E-04 1.05E-03
separator
60 bar liquid manifold 4.12E-02 9.84E-03 1.22E-02 1.30E-03 1.57E-03
60 bar gas manifold 4.89E-03 9.30E-04 1.16E-03 1.86E-04 2.80E-04
25 bar vapour manifold 8.40E-03 1.40E-03 1.83E-03 3.65E-04 5.52E-04
Low pressure vapour manifold 3.44E-02 6.69E-03 8.49E-03 1.50E-03 1.83E-03
2nd stage booster compressor
1.41E-02 3.16E-03 4.10E-03 5.37E-04 6.87E-04
KO V-3104
9.59E-03 2.68E-03 2.54E-03 3.87E-04 5.63E-04
K-3102
1.31E-02 2.72E-03 3.04E-03 3.59E-04 4.40E-04
aftercooler E-3102
3rd stage booster compressor
9.43E-03 2.33E-03 2.98E-03 3.51E-04 4.18E-04
KO V-3106
1.02E-02 2.76E-03 2.66E-03 4.14E-04 6.04E-04
K-3103
1.11E-02 2.11E-03 2.35E-03 3.11E-04 4.14E-04
aftercooler E-3103
Flash train 2/3 st compressor 3.61E-01 7.72E-02 9.46E-02 1.39E-02 1.85E-02
1st stage booster compressor
1.12E-02 2.97E-03 3.60E-03 4.68E-04 4.02E-04
KO V-3102
1st stage booster compressor
1.06E-02 2.88E-03 2.80E-03 4.31E-04 6.09E-04
K-3101
Stabilizer offgas compressor K-
8.49E-03 2.46E-03 2.30E-03 3.47E-04 4.97E-04
4101
Vapour comp KO drum V-4102 1.28E-02 3.25E-03 3.93E-03 5.50E-04 5.04E-04
Sweet gas glycol contactor C-
1.77E-02 4.82E-03 5.59E-03 5.49E-04 6.46E-04
5501
Mercury removal V-5510 2.97E-02 6.23E-03 8.15E-03 1.22E-03 1.63E-03

Revision: Rev 3.0

Export gas/Condensate E-
2.05E-02 5.18E-03 5.69E-03 8.03E-04 9.19E-04
5504
Export gas E-5505 3.73E-03 9.12E-04 9.64E-04 1.44E-04 2.09E-04
Export gas/Condensate V-
6.71E-03 2.00E-03 2.48E-03 2.27E-04 1.92E-04
5503
Turboexpander K-5552 1.19E-02 3.03E-03 3.08E-03 4.90E-04 7.05E-04
Cold condensate flash drum
8.13E-03 2.26E-03 2.74E-03 2.67E-04 2.94E-04
V-5504
Condensate flash drum V-
1.40E-02 3.53E-03 4.42E-03 6.15E-04 6.61E-04
5505
Salalah pig/metering 1.57E-02 2.74E-03 3.95E-03 8.40E-04 1.39E-03
1st compressor/booster
1.71E-01 4.23E-02 4.97E-02 6.95E-03 8.65E-03
glycol etc
Stab preflash drum V-4101
3.61E-03 9.66E-04 1.23E-03 1.73E-04 2.11E-04
Vapour
Stab preflash drum V-4101
1.58E-02 3.45E-03 3.67E-03 5.13E-04 6.64E-04
Liquid
Stab column vapour 1.49E-02 3.33E-03 3.97E-03 6.49E-04 9.08E-04
Stab column liquid C-4101 2.41E-02 5.75E-03 6.05E-03 8.57E-04 1.11E-03
Stab column bottoms cooler
2.59E-02 4.45E-03 5.37E-03 9.02E-04 1.31E-03
E-4103 A/C
Stab offgas compressor
1.16E-02 2.16E-03 2.43E-03 3.32E-04 4.48E-04
aftercooler E-4102
1st stage booster
compressor aftercooler E- 1.18E-02 2.20E-03 2.48E-03 3.42E-04 4.63E-04
3101
Crude de-salter V-4103 1.31E-02 3.42E-03 4.14E-03 5.47E-04 6.12E-04
Stabilizer area 1.21E-01 2.57E-02 2.93E-02 4.32E-03 5.72E-03
T-4501 5.96E-03 1.26E-03 1.69E-03 2.89E-04 3.94E-04

T-4502 6.05E-03 1.26E-03 1.69E-03 2.97E-04 4.08E-04
Oil Export manifold and
2.64E-02 4.62E-03 5.52E-03 1.06E-03 1.57E-03
pumps P-4502A/B/C
Oil metering skid A-4501 1.10E-02 1.87E-03 2.36E-03 4.56E-04 7.18E-04
Line from oil metering skid to
1.69E-02 2.35E-03 3.34E-03 8.02E-04 1.27E-03
export launcher
Oil export launcher A-4502 5.54E-03 1.21E-03 1.86E-03 3.82E-04 6.74E-04
Oil export 7.18E-02 1.26E-02 1.65E-02 3.29E-03 5.04E-03
Sulphanol feed KO vessel

5.75E-03 1.84E-03 2.15E-03 1.70E-04 1.58E-04
V-5101
Sulphanol column C-5101 5.74E-03 1.32E-03 1.69E-03 2.65E-04 3.53E-04
Rich Amine bottoms Ex C-
5101
Sweet Gas ex Sulfinol
1.01E-02 3.05E-03 3.38E-03 3.33E-04 3.78E-04
column V-5102
Amine flash vessel V-5103
E-5102 rich - lean HE
C-5102 Sulphanol stripper +
E-5103
V-5104 Stripper reflux
accumulator
Sulfinol 2.16E-02 6.20E-03 7.21E-03 7.68E-04 8.88E-04
8.00E-04
Zalzala Injection gas export
7.58E-03 1.57E-03 2.32E-03 4.65E-04
launcher

Revision: Rev 3.0

Zalzala Injection gas line to
1.47E-03 1.91E-04 2.78E-04 7.22E-05 1.15E-04
pig launcher
Sour gas frying C-6101 1.77E-02 4.37E-03 5.18E-03 5.76E-04 7.49E-04
1st stage injection
1.62E-02 4.85E-03 5.04E-03 5.60E-04 7.12E-04
compressor
1st stage injection
8.92E-03 1.58E-03 1.96E-03 3.45E-04 4.93E-04
compressor Cooler E-6601/2
2n stage injection
1.46E-02 3.82E-03 3.85E-03 5.46E-04 7.92E-04
compressor
2n stage injection
9.81E-03 1.77E-03 2.02E-03 3.05E-04 4.30E-04
compressor Cooler E-6603
Seal gas system HP injection
1.61E-01 3.48E-02 2.62E-02 3.87E-03 1.82E-03
compressor
Injection compressor area 2.37E-01 5.30E-02 4.68E-02 6.74E-03 5.91E-03
Fuel gas preheaters E-8701 1.45E-02 3.16E-03 3.64E-03 5.85E-04 8.46E-04

LP fuel gas scrubbers V-
1.79E-02 5.42E-03 5.85E-03 6.01E-04 7.21E-04
8702
HP fuel gas distribution 8.48E-02 1.30E-02 1.79E-02 4.10E-03 5.86E-03
LP fuel gas distribution 6.10E-02 1.22E-02 1.56E-02 2.46E-03 3.11E-03
Utilities 1.78E-01 3.38E-02 4.29E-02 7.74E-03 1.05E-02
In the following table, Harweel 2A/B toxic release frequencies have been calculated by
subtracting the immediate and delayed ignited releases based on the ignition
probabilities.
Table A2.5: Harweel 2A/B toxic failure case frequencies
H2S release freq
Rabab Bulk Pig Receiver 1.23E-02 2.41E-03 3.27E-03 6.03E-04 9.99E-04
Dafaq Bulk Pig Receiver 1.02E-02 1.89E-03 2.77E-03 5.42E-04 9.03E-04
Sakhiya West Bulk Pig
1.60E-02 2.64E-03 3.86E-03 8.07E-04 1.33E-03
Receiver
Zalzala Bulk Pig
1.21E-02 2.18E-03 3.13E-03 6.36E-04 1.05E-03
Receiver
Production manifold 2.81E-02 4.49E-03 5.99E-03 1.14E-03 1.71E-03
Rabat separator vapour 1.59E-02 3.12E-03 3.72E-03 4.81E-04 6.99E-04
Rabat separator liquid 9.13E-03 1.89E-03 2.26E-03 2.91E-04 4.16E-04
Inlet facilities/manifold 1.04E-01 1.86E-02 2.50E-02 4.50E-03 7.10E-03
1st stage separator
1.10E-02 2.23E-03 2.68E-03 3.38E-04 4.85E-04
vapour
1st stage separator liquid 8.67E-03 1.74E-03 2.12E-03 2.89E-04 4.08E-04
2nd stage separator
8.77E-03 1.95E-03 2.32E-03 3.62E-04 3.52E-04
vapour
2nd stage separator
2.32E-03 4.65E-04 5.59E-04 7.49E-05 1.11E-04
liquid
3rd stage separator
8.08E-03 1.85E-03 2.18E-03 3.33E-04 3.17E-04
vapour
2nd stage pre-heater E-
1.74E-02 3.11E-03 3.80E-03 7.27E-04 1.11E-03
2201 A/B
3rd stage separator
6.76E-03 1.23E-03 1.54E-03 2.41E-04 3.63E-04
liquid
Two separator trains 1.26E-01 2.52E-02 3.04E-02 4.73E-03 6.29E-03
Vapour manifold 100 bar
1.51E-02 2.36E-03 3.03E-03 4.75E-04 7.36E-04
ex separator

Revision: Rev 3.0
60 bar gas manifold 4.84E-03 9.21E-04 1.08E-03 1.73E-04 1.96E-04

25 bar vapour manifold 8.32E-03 1.39E-03 1.71E-03 3.40E-04 3.86E-04
Low pressure vapour
3.40E-02 6.62E-03 8.41E-03 1.39E-03 1.70E-03
manifold
2nd stage booster
1.39E-02 3.13E-03 3.82E-03 5.00E-04 4.81E-04
compressor KO V-3104
2nd stage booster
9.50E-03 2.65E-03 2.37E-03 2.71E-04 3.94E-04
compressor K-3102
2nd stage booster
compressor aftercooler 1.30E-02 2.69E-03 2.83E-03 2.52E-04 3.08E-04
E-3102
3rd stage booster
9.34E-03 2.30E-03 2.78E-03 2.46E-04 2.93E-04
3rd stage booster
1.01E-02 2.73E-03 2.47E-03 2.90E-04 4.23E-04
compressor K-3103
3rd stage booster
E-3103
Flash train 2/3 st
3.58E-01 7.60E-02 9.04E-02 1.20E-02 1.51E-02
compressor
2.82E-04
1st stage booster
1.11E-02 2.94E-03 3.35E-03 4.36E-04
4.26E-04
1st stage booster
1.05E-02 2.85E-03 2.61E-03 4.02E-04
compressor K-3101
H2S release freq

Stabilizer offgas
8.41E-03 2.43E-03 2.28E-03 3.24E-04 4.63E-04
compressor K-4101
Vapour comp KO drum
1.27E-02 3.21E-03 3.89E-03 5.45E-04 4.69E-04
V-4102
1st compressor/booster
4.27E-02 1.14E-02 1.21E-02 1.71E-03 1.64E-03
glycol etc
Stab preflash drum V-
3.57E-03 9.56E-04 1.21E-03 1.61E-04 1.96E-04
4101 Vapour
Stab preflash drum V-
1.56E-02 3.42E-03 3.56E-03 4.65E-04 6.02E-04
4101 Liquid
Stab column vapour 1.48E-02 3.29E-03 3.93E-03 6.43E-04 8.46E-04
Stab column liquid C-
4101
Stab column bottoms
cooler E-4103 A/C
Stab offgas compressor
1.14E-02 2.14E-03 2.41E-03 3.10E-04 4.17E-04
aftercooler E-4102
1st stage booster
E-3101
Crude desalter V-4103
Stabilizer area 5.71E-02 1.20E-02 1.34E-02 1.90E-03 2.38E-03
Sulfinol feed KO vessel
5.70E-03 1.82E-03 2.00E-03 1.19E-04 1.11E-04
V-5101
Sulfinol column C-5101
Rich Amine bottoms Ex
9.10E-03 2.25E-03 2.91E-03 4.30E-04 5.33E-04
C-5101
Sweet Gas ex Sulfinol
column V-5102
Amine flash vessel V-
5.68E-03 1.28E-03 1.45E-03 1.95E-04 2.63E-04
5103

Revision: Rev 3.0
E-5102 rich - lean HE 1.13E-02 2.42E-03 2.74E-03 4.98E-04 7.33E-04

C-5102 Sulpholane
2.00E-02 4.14E-03 5.05E-03 8.97E-04 1.29E-03
stripper + E-5103
V-5104 Stripper reflux
2.20E-02 6.65E-03 7.25E-03 7.74E-04 2.66E-04
accumulator
Sulphanol 7.37E-02 1.86E-02 2.14E-02 2.91E-03 3.19E-03
Zalzala Injection gas

7.51E-03 1.46E-03 2.16E-03 3.25E-04 5.60E-04
export launcher
Zalzala Injection gas line
1.45E-03 1.78E-04 2.59E-04 5.05E-05 8.08E-05
to pig launcher
Sour gas frying C-6101 1.75E-02 4.32E-03 4.83E-03 4.03E-04 5.25E-04
1st stage injection
1.61E-02 4.51E-03 4.69E-03 3.92E-04 4.98E-04
compressor
1st stage injection
compressor Cooler E- 8.83E-03 1.47E-03 1.82E-03 2.41E-04 3.45E-04
6601/2
2n stage injection
1.45E-02 3.56E-03 3.59E-03 3.82E-04 5.54E-04
compressor
2n stage injection
compressor Cooler E- 9.71E-03 1.65E-03 1.88E-03 2.13E-04 3.01E-04
6603
Seal gas system HP
injection compressor
Injection compressor
7.56E-02 1.72E-02 1.92E-02 2.01E-03 2.86E-03
area

Revision: Rev 3.0
A2.6 Blowout and Well Release Frequency

Table A2.6: SINTEF 2008 blowout and well release data

Revision: Rev 3.0
A2.7 Meteorological Data

Table 2.7: Weather data used for Harweel 2A/B representing South Oman
Harweel 24 hours
341-10 11-40 41- 71- 101- 131- 161- 191- 221- 251- 281- 311-
m/
70 100 130 160 190 220 250 280 310 340
Stab s
A-C 2 0.007 0.005 0.005 0.009 0.013 0.014 0.007 0.008 0.008 0.007 0.004 0.004
5 0.010 0.008 0.006 0.009 0.032 0.038 0.005 0.012 0.012 0.007 0.007 0.010
8 0.001 0.001 0.000 0.001 0.008 0.013 0.000 0.001 0.001 0.001 0.001 0.001
D 2 0.003 0.002 0.002 0.003 0.005 0.005 0.003 0.003 0.003 0.002 0.002 0.002
5 0.015 0.011 0.009 0.013 0.047 0.055 0.007 0.018 0.018 0.010 0.011 0.015
8 0.005 0.003 0.002 0.004 0.056 0.088 0.002 0.005 0.008 0.005 0.006 0.009
F 2 0.010 0.007 0.007 0.012 0.018 0.019 0.010 0.012 0.011 0.009 0.006 0.006
5 0.009 0.007 0.006 0.009 0.030 0.035 0.004 0.012 0.011 0.007 0.007 0.009
Table 2.8: Weather data used for Yibal Kuff representing North Oman
60- 90- 120- 150- 180- 210- 240- 270- 300- 330-
Stab m/s 0-30 30-60 90 120 150 180 210 240 270 300 330 0
B 3 0.001 0.0002 0.010 0.071 0.070 0.016 0.009 0.008 0.036 0.044 0.015 0.001
D 2 0.001 0.0000 0.004 0.020 0.017 0.003 0.003 0.006 0.015 0.011 0.001 0.001
D 6 0.001 0.0002 0.011 0.083 0.085 0.020 0.009 0.006 0.037 0.055 0.022 0.001
F 2 0.001 0.0002 0.011 0.078 0.077 0.018 0.010 0.009 0.039 0.049 0.017 0.001
A2.8 Cost Benefit Analysis

QRA enables a better understanding of the relative risks associated with options being
considered. Where risk is measured in terms of potential loss of life, perhaps in
combination with individual risk, then a measure of the relative safety of each option is
derived. Each option will also have an economic value attached to it. When the safest
option is much more expensive than the less safe option it is necessary to gauge the
relative worth of each. While no amount of money can compensate for the loss of life it
would be unrealistic to assume that an investment aimed at the potential reduction of
loss of life must be made regardless of the size of that investment.
Implicit in such evaluations is the fact that one is gauging the relative costs to avert a
potential fatality as the logic applied is:
Cost of measures = Potential saving of life x Cost per potential life saved.
The cost per potential life saved is referred to as Implied Cost to Avert a Fatality, ICAF.
Discussion on this subject can be emotive and care must be taken to provide a
detailed explanation as to why it is necessary to venture into this seemingly sensitive
area of option evaluation. Experience within the group is that derivation of ICAF
achieves not only a ranking of improvement options but also provides a spur to the
creative development of yet safer and more economic options.
Some oil companies use the cost for avoidance of a fatality as a basic criterion.
However, they only apply it if the risk to personnel is below a specific threshold value,
e.g. probability of an incident with 1-5 fatalities should be less than 1 in 10,000.
PDO does not express the value of life in monetary terms. QRAs usually lead to clear
recommendations without this valuation. Also, for risk reduction measures which are
relatively inexpensive, costs to avert fatality calculations can be misleading. A very
cheap measure which may have HSE benefits but not significantly reduce fatality risk
may have a very high ICAF and hence be rejected whilst common sense would dictate
that it should be done (e.g. high visibility jackets).

Revision: Rev 3.0
Nevertheless, to assess the effectiveness of expensive safety measures, it is

recommended to calculate and compare the amount spent to avert a fatality. This
calculation should take account of the fact that measures to reduce risk to people are
also likely to reduce the potential loss of assets and production. Sensitivity
calculations should also be carried out in which the less tangible or indirect costs are
also included if thought to be significant. The net cost of the safety measures is
therefore reduced:
Net cost of measures = Cost of measures minus (-)
Reductions in PV loss of assets and production
and:
Net cost of measures = Potential fatalities averted x ICAF
In cases where the cost to avert a fatality seems prohibitive it should be verified
whether all hazards and all incident types have been considered. Dependent on the
cost of labour and the fatal accident rate for the specific type of activity a potential loss
of 1 fatality per US $50 to 100 million expenditure in the EP industry is estimated (1995
values). In other words: it is difficult to justify expenditure of more than this amount per
fatality averted as this would only result in a shift of the risk to another location.
For expensive safety measures it is therefore suggested to calculate the cost to avert a
fatality. However, if high values are found this should not necessarily lead to
acceptance of the status quo. It should be used as a stimulus to develop more
innovative and cost effective safety measures.
For comparison of the effectiveness of alternative safety improvements the cost to
avert a fatality is a very suitable yardstick. However, some people may not readily
accept this way of presentation of effectiveness. Especially for presentations to a
larger audience or outside the company it is recommended to avoid its use without a
detailed explanation.
The use of the cost to avert a fatality as a rigid and absolute yardstick should be
avoided. There is no amount of money that can compensate the loss of life.

Revision: Rev 3.0
Appendix 3, Related Business Control Documents and References
[1] PDO HEALTH, SAFETY AND ENVIRONMENT SPECIFICATION

Quantitative Risk Assessment (QRA) SP 1258, REVISION - 2.0, 25/06/2002.
[2] HSE Manual, Quantitative Risk Assessment, EP 95-0352, 20/10/95.
[3] Shell Global Solutions. FRED 5.0 Physical Effects Modeling Software,
Version 5.0.0.1, 2007.
[4] CMPT, A Guide to Quantitative Risk Assessment for Offshore Installation, 1999.
[5] Alberta Energy and Utilities Board EUBH2S A Model for Calculating Emergency
Response and Planning Zones for Sour Gas Facilities, Volume 2: Emergency
Response Planning Endpoints December 2006.
[6] Martin de Groot, 2006, H2S Toxicity Note.
[7] Technical specification blast resilient and blast resistant control buildings/field
auxiliary rooms DEP 34.17.10.30-gen. September 2002.
[8] Shell Global Solutions. Shell Shepherd 2.0, Risk Integration Software.
[9] Shell Global Solution, Technical Guide for the Shell Shepherd Desktop Version 2.0.
2007.
[10] IP research report, Ignition Probability Review, Model Development and Look-up
Correlations, January 2006.ISBN 978 0 85293 454 8
[11] Professor David J Ball & Dr Peter J Floyd, Social Risk, Final Report paper.
[12] HSE UK, PADHI – HSE’S LAND USE PLANNING METHODOLOGY.
[13 API RP 55, 1995 ‘’Recommended Practice for Oil and Gas Producing and Gas
Processing Plant Operations Involving Hydrogen Sulfide’’ - Second Edition.
[14] VECTR Middle East Limited, Petroleum Development Oman (PDO) Qarn Alam
Facility Stage I and II Building Risk Assessment Report, Assumption Sheet, February
2008.
[15] Health and Safety Executive UK, “Proposals for revised policies to address
societal risk around onshore non-nuclear major hazard installations”
[16] Harweel Phase 2A/B Development ‘’Managing the Harweel Quantitative Risk
Assessment (QRA)’’, HWL-PDO-OP701-0001-001, 2007.
[17] Blowout and Well Release Frequencies-BlowFAM Edition, February 2009.
[18] PDO note to file OSZ/2003/039/HSE, Harweel Phase 2 – Non-Hydrocarbon Risk
(Health & Safety)

Revision: Rev 3.0


SP-1258 - HSE Specification - Quantitative Risk Assessment (QRA)

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

SP-1258 - HSE Specification - Quantitative Risk Assessment (QRA)

Uploaded by

Copyright:

Available Formats

Revision: Rev 3.

RESTRICTED Document ID: SP-1258

Petroleum Development Oman L.L.C.

Technical Safety Engineering

Please familiarise yourself with the

This page was intentionally left blank

Page 2 Quantitative Risk Assessment Specification Printed 09/06/11

Page 3 Quantitative Risk Assessment Specification Printed 09/06/11

Page 4 Quantitative Risk Assessment Specification Printed 09/06/11

Version No. Date Author Scope / Remarks

Page 5 Quantitative Risk Assessment Specification Printed 09/06/11

iii Related Business Process

Related Corporate Management Frame Work (CMF) Documents

Page 6 Quantitative Risk Assessment Specification Printed 09/06/11

Page 7 Quantitative Risk Assessment Specification Printed 09/06/11

5.2.1 Sampling Time ...................................................................................................18

Page 8 Quantitative Risk Assessment Specification Printed 09/06/11

9.1.7 Emergency Planning Zone (EPZ) .......................................................................32

Page 9 Quantitative Risk Assessment Specification Printed 09/06/11

1.4 Target Audience

1.5 Roles and Responsibilities

Page 10 Quantitative Risk Assessment Specification Printed 09/06/11

1.6 Review & Improvement

1.7 Related Business Control Documents

Page 11 Quantitative Risk Assessment Specification Printed 09/06/11

2 Quantitative Risk Assessment

2.1 Study Purpose and Objectives

2.2 Misuse of QRA

Page 12 Quantitative Risk Assessment Specification Printed 09/06/11

2.3 Timing of Study

2.4 Links to Other Activities

Page 13 Quantitative Risk Assessment Specification Printed 09/06/11

3 Failure Case Selection

3.1.1 Hazard Identification

3.1.2 How to Model Hazards

Figure 1: represent the possible accident scenarios

Page 14 Quantitative Risk Assessment Specification Printed 09/06/11

3.2 Specific Requirements

3.2.1 Hole Size Distribution

3.2.2 Meteorological Conditions

Page 15 Quantitative Risk Assessment Specification Printed 09/06/11

4.1 Input Required

4.2 Specific Requirements

4.2.1 Leak Frequency and Parts Count

4.2.2 Hole Size Distribution

4.2.3 Material selection

Page 16 Quantitative Risk Assessment Specification Printed 09/06/11

Page 17 Quantitative Risk Assessment Specification Printed 09/06/11

5.1 Input Required

5.2 Specific Requirements

5.2.1 Sampling Time

Page 18 Quantitative Risk Assessment Specification Printed 09/06/11

5.2.2 Surface Roughness

Table 1: Represents guideline on using the surface

5.2.3 Liquid / Vapour Phase - Export / Import

5.2.4 Flammables / Thermal Radiation

For Shell Shepherd modeling, the default values should be used:

Page 19 Quantitative Risk Assessment Specification Printed 09/06/11

As general initial screening criteria for flammable gas dispersion:

5.2.5 Toxic Effects

5.2.6 Building Blast Resilience

Page 20 Quantitative Risk Assessment Specification Printed 09/06/11

For Occupied Building Risk Assessments (OBRAs), building construction can be