How would you answer the following question:
Is refinery A safer than refinery B?
I know a few of you would recommend quantifying risks in each refinery. This will enable us to estimate how many fatalities (on-site and off-site) can occur in the two refineries. We can thus use the predicted risk levels refinery operation to compare risks. For the sake of discussion, let us assume you performed a quantitative risk analysis and came up with following individual risk levels:
- Individual risk (IR) for Refinery A – 1 fatality every 1000 years
- Individual risk (IR) for Refinery B – 0.5 fatalities every 1000 years
Does this mean Refinery B is safer than Refinery A?
Should the workers in Refinery A be paid more for accepting additional risks?
Is risk in Refinery A unacceptable?
In order to answer the above questions, we need to look closely at the basis for estimating these risks.
Quantitative Risk Assessment (QRA)
Before getting into details here’s a quick background on Quantitative Risk Assessment (QRA). It is also referred to as Probabilistic Risk Assessment (PRA)
QRA is an accepted methodology used to quantify risks in chemical plants. Typically, in a refinery QRA you model initiating events (e.g. loss of containment) that can lead to incidents. You then estimate fatalities from fire, explosion or toxic gas exposure. The initiating event can be equipment failure or events based on scenarios from the hazard identification study such as HAZOP/HAZID/PHA.
Let us take a closer look at estimation of initiating events (the probabilistic piece of the analysis) – equipment failure and incident scenarios.
Predicting Equipment Failure
Typically, for a refinery QRA generic equipment failure data forms the basis for probabilistic estimation of loss of containment. This is historic failure data and thus represents an aggregate of equipment of various sizes and various failure modes.
For example, in an earlier post I discussed failure rate for an Above Ground Storage Tank (AST) is once every 67 years. Does it mean you will not see a failure for 67 years? Is this failure rate same for every AST? How will this failure rate be modified based on contents in the tank? What about quality of workmanship? How will maintenance and inspection affect this failure rate?
With generic failure data you cannot predict the likelihood of failure in your refinery unless you closely start analyzing the possible failure modes in details. A detailed analysis of failure modes is worthwhile for inherently high-risk operations such as chemical weapons destruction or nuclear industry. However, given the constraint on resources and data availability, one cannot do a detailed analysis of failure modes for equipment in a refinery.
This implies that failure rate being used in a QRA represents certain aggregate failure rate and is NOT representative of failures you will see in your plant. Consequently, the QRA does not an accurate representation of your plant’s risk profile.
Predicting Incidents
For a major catastrophe to occur four to five things have to go wrong. Therefore, major accidents are rare events and follow unique trajectories. So even if you had identified plausible catastrophic scenarios in HAZOP and want to quantify these high-consequence scenarios using QRA…these will contribute minimally to risks in the QRA due to the fact that they have a very low likelihood.
Current State of QRA
QRAs are mandated by law in parts of Europe and I know QRAs are being performed for upcoming projects in middle-east. But as I have pointed out in the earlier paragraphs most QRAs being performed today for chemical plants and refineries are not representative of the risk profile of the plant. A QRA framework is excellent IF you are trying to compare relative risks. For example, if you are comparing risks between two configurations, two designs, two options. So besides compliance it is difficult for me to gauge benefits of performing a refinery QRA using generic failure data.
One can develop sound risk mitigation strategies even without the QRA step.
9 Responses
I agree with you, BUT there is a basic major flaw that can easily be corrected: just do not use “generic failure data”. In our book (see our web site) there is a specific section about this subject.
Furthermore, always remember that what happened in the past is not what will happen in the future.
Finally, it is simply not possible to properly compare risks unless proper tolerability criteria are defined. Visit our Slideshare presentations to see examples. Our book contains a full section on how to develop explicit tolerability criteria.
Absolutely correct. Having performed numerous QRA’s myself and commissioned them from various consultants (because my clients or the regulator required them), I think that they are mostly useless. Let’s face it – the uncertainties in a QRA, from variation in the freqeuency of failure (using “generic” failure rates) to the wide variations in prediction of fatality due to thermal radiation, explosion overpressure or toxix exposure, to the variation in predicting the likelihood of exposure, mean that the final answer could vary by 3 or more orders of magnitude. There is some value in using QRA for comparison of options as you suggest, but little value in using it as a measure of safety or acceptability.
QRA is one of the safety tool that can help understand the risk picture between two potential development concepts. Agree that, having done the QRA should not make management or design engineers complacement about safety in desing.
Performing a QRA should be part of a larger Risk Management process. It is the Risk Management process that will reduce your risk.
A good QRA should provide insight into the Risk Control options and provide a basis for deciding which controls to implement.
When performed on its own outside of such a process, QRA’s are basically paperwork.
Hi Gareth…thanks for your comments. Can you please elaborate on how to go about deciding risk control options based on QRA and how that fits into larger risk management plan? Thanks
Agree QRA should be part of a larger Risk Management process.
Previously I have used the results to identify high risk areas and successfully implement risk reduction measures (inventory minimisation; additional esd; flange optimisation; flange orientation; layout optimisation, etc); Similarly if the risk contours are skewed in a certain direction lot of inferences can be made and risk can be reduced. It is one of the tools to improve safety.
The use of generic data, which might not be specific to the site for which a QRA is being performed, is a critical flaw in the process. More demand for evidence-based methodologies in numerous sciences and health or safety disciplines (e.g., medicine, toxicology, children’s services) indicates a lack of satisfaction in reliance on former methodologies that incorporated too many assumptions or for which the outcomes were non standardized, qualitative descriptors.
I’d like to invite you to discuss my latest post on BP crisis foreseeability….
http://foboni.wordpress.com/2010/06/08/bp-crisis-rational-analysis-what-bp-did-not-perform/
Kindest regards to All,
Franco
Further to my post.
The risk management process involves five, ongoing processes:
– Identify Hazards / Threats
– Assess Risks
– Develop Risk Controls
– Implement Risk Controls
– Monitor Results
The QRA is typically performed on a subset of hazards/threats identified. The QRA should result in three categories of risk:
– Tolerable
– Intolerable
– ALARP (As Low As Reasonably Practicable)
Tolerable risks do not require any further action. Intolerable risk requires action to reduce the risk to the ALARP region. ALARP risks require reasonable risk controls, however, the definition of reasonable has always been difficult.
The risk control options have one or more of the following objectives:
– Avoid the Hazard altogether
– Reduce the frequency of the hazard
– Reduce the consequence of the hazard
Once the risk controls are implemented, then the effectiveness needs to be monitored and the controls should be revisited.