Application of quantitative risk assessment on offshore oil & gas industry

Production of Oil & Gas in offshore involves some of the most ambitious engineering projects of the modern world, is a prime source of revenue for many countries. It is also involved risks of major accidents which have been demonstrated by disaster on the UK production platform Piper Alpha. Major accidents represent the ultimate, most disastrous way in which an offshore engineering project can go wrong. Accidents cause death, suffering, environmental pollution and disruption of business. To ensure all risks identified and controlled, risk management approaches need applying. This paper discusses the application of quantitative risk assessment approaches and its importance throughout the entire offshore installation.


INTRODUCTION
Quantitative Risk Assessment (QRA) approaches have been first given wide application in offshore Oil & Gas installation as recently as the early 1980s [1].In 1988, the Piper Alpha disasters has led to widespread adoption of QRA in decision support within the North Sea Oil & Gas industry.The Offshore Installation (safety case) regulations 1992 provided the first statutory definition of QRA within the UK legal framework: "Quantitative Risk Assessment means the identification of hazards and evaluation of the extent of risk a raising therefrom, incorporating calculations based upon the frequency and magnitude of hazardous events".In fact, offshore oil & gas production generates risks at all stages.To optimize the negative outcome, they must be evaluated.

RISK ANALYSIS AND RISK MANAGEMENT STRATEGIES
Since 1980s, QRA has been developed as a tool to assist in an organization's safety management system which can be effectively applied for Planning, Front End Engineering Design (FEED), Detailed Design, Construction, Commissioning, Decommissioning and Disposal or modifications in the process system [3].
Nowadays, it is compulsory regulation in oil & gas industry for many countries [2].A risk analysis comprises with five elements (Fig. 1), including: Hazard identification, Postulation of the accidents, Consequence analysis, Frequency analysis and the Risk summation.If the risks are controlled, satisfied with the acceptance criteria, or event fallen into the As Low As Reasonable Practicable (ALARP) region, the safety of process system were built.If the question is no, then options to mitigate the magnitude of the consequence or decrease the frequencies of the events are considered.

HAZARD IDENTIFICATION AND POSTULATE ACCIDENTS
Hazard identification involves a qualitative review of accidents that might occur with the object of gaining an appreciation of possible hazards and suggesting appropriate prevention.Identification of all major hazards exposed during platform operation is the most important because of its significant effects to QRA results.
Two (02) kinds of Major Accidental Event (MAE) related to operation of offshore installation are categorized as Hydrocarbon hazards and Nonhydrocarbon hazards.Hence, key issues relate to basic knowledge of the system, entails from the experienced staff and use of the formal structured methods.

CONSEQUENCE ANALYSIS
For a QRA, consequence analysis shall include but not limited sub-studies which may be presented as part of QRA or through separate studies.These sub-studies are relevant: Table 1 gives the formulas determining the consequence of an ignited hydrocarbon release event.For modern safety assessment, simple consequence models are now replaced by improved models incorporating with better mechanism and validated against real data, such as PHAST, SAFETI, PLATO…

FREQUENCY ANALYSIS
Frequency analysis involves estimating the likelihood of each of the failure cases that were defined in the hazard identification.There are two basic forms in which the likelihood of an event may be concerned [6]:  Frequency -The expected of occurrences of the event per unit time, usually a year.
 Probability -The probability of the event occurring in a given time period or the conditional probability of it occurring given that a previous event has occurred There are several approaches to estimate the failure frequency.The simplest one is to employ historical statistical data, derived from many sources (chemical process, offshore installations, thermal industries …).Estimating the failure frequency, available engineering drawings are reviewed to develop the "parts count" which evaluates the combined failure frequency of all equipment process system divided into isolatable segments.The isolatable segment is normally bound by specific isolation points, such as valves that can be remotely operated from the control room.The likelihood of a leak from the main process equipment has been calculated using computer programs or generic database [10].
A higher level approach to estimate the failure frequency is using of Event Tree Analysis (ETA) which is a graphical logic model to identify and quantify the possible outcomes of an initiating event.ETA is based on binary logic, in which an event has or has not happened.The outcome event consequences, usually expressed in terms of fatalities, are then combined with the frequency of occurrence to produce an F-N curve to help assess the acceptability of the response to hazards (Andrews and Dunnett, 2000).Risk analysis for answer to the following questions (Kaplan and Garrick, 1981) [4]:  What can go wrong that could lead to an outcome of hazard exposure? How likely is this to happen? If it happens, what consequences are expected?By using the ETA, three questions above would be answered one by one, because ETA will define a list of outcome (scenario), determine the frequency and consequence of each scenario (Mohammad, 1999).Therefore, risk can be defined, quantitatively, as the following set of triplets: R = (Si, Pi, Ci), (where: i = l, 2…n) Where S is a scenario of events that lead to hazard exposure, P is the probability of scenario i, and C is the consequence of scenario i, where the ETA gave the best Trang 64 results for answer the three questions precedents.

RISK SUMMATION
The risks are presented in form of Local Specific Individual Risk (LSIR); Potential Loss of Life (PLL) and Individual Risk Per Annum (IRPA), including

DOMINO EFFECTS ASSESSMENT
Due to specific working environment, limited and congested space are the most concern on the offshore installations.Large inventories of hydrocarbon, intense temperature and pressure conditions in process area is often situated in close proximity to other equipment which may increase probability of domino effects when incident occurs.Table 2 determines the time to failure in fires based on The Netherlands Organization of Applied Scientific Research (TNO) and The Centre for Marine and Petroleum Technology (CMPT) [6].
It is seen that, allowable time for equipment endured in jet fire is 5 minutes and 15 in pool fire.Therefore, to avoid the domino effects from escalation event, it is necessary to protect the equipment/structures by Passive Fire Protections (PFPs) i.e. equipment/structure coatings to withstand hydrocarbon fires.Experiments on gas jet fires impinging on steel tabular members by Shell/British Gas evaluated as follows 0:

RISK ACCEPTANCE CRITERIA
Once the risks have been estimated, they are "benchmarked" against acceptance criteria to see if they place personnel at an unacceptable level of risk.The criteria typically identify three bands.The lower level (<10 -5 per year) covers the background risk people could typically be exposed to during everyday life.Should the overall risk fall below this level then no additional mitigation measures are considered necessary as the risks are no greater than those faced and accepted by people conducting everyday life.In the upper band (>10 -3 per year), the risks are considered too high for an individual to bear and need to be reduced in order for the project to go ahead.In the remaining band (10 -5 to 10 -3 per year), the risks are considered as elevated with respect to the everyday risks faced by an individual but this increase in risk is considered acceptable when placed in the context of benefit to the person and the community as a whole from the project.Should the risks fall into this band then it needs to be demonstrated that all the risks are understood, control measures are in place and that sufficient mitigation measures are in place consummate with the level of risk posed [11].

General assumption
This section is an example of determination of risks related to leakage of 26" gas riser system which is essentially conductor pipes connecting the platform on the surface and the pipeline at the subsea (Fig. 2) [7].Dimension of the deck is 15 x 25 m.Every two weeks, the platform requires a 4-person team to visit and maintain.Duration of each visit is around 12 hour.The system can be isolated by a subsea shutdown valve (SSIV) and shutdown valve (SDV) on the topside.
Release rate for release scenarios (small, medium and large hole size) are 0.3, 7.61 and 30 kg/s in respect.Operating pressure and temperature are 25 bar and 50 0 C. Assumed length of riser section is 70 m.

Consequence Analysis
Possible consequence of release event on riser are given in Table 3:

Frequency Analysis
The update of loss of containment data for offshore pipeline (PARLOC 2001) determines the failure frequency at 1.2 x 10 -4 per riser/year contributed by small hole size (<20 mm) 60%, medium size (20-80 mm) 15% and large (>80 mm) 25%.For a release event on riser, location of release shall lead to potential outcomes of the Event Tree Analysis (Fig.   Table 4 determines the frequency of possible event outcomes generated by a release event on riser.To determine the risk, event codes No. R1, R2 and R4 are considered as the potential fatal risks on the platform i.e. the LSIR of the platform due to riser release is 4 x 10 -7 per year.The calculated IRPA value of maintenance is 7.12 x 10 -9 per year and the PLL is 5.7 x 10 -8 per year.Comparing to risk acceptance criteria, process risk related to riser release falls into the broadly acceptable region.

Domino effect assessment
Potential escalation of process equipment/structure due to jet fire depends on duration of release and size or jet flame.Table 2 determines the time to failure of process vessel and piping from jet fire is 5 minutes.Figure 4 presents the release profile of riser release event.It is seen that, after 5 minutes the release rate reached the zero and insignificantly to escalate.Only the small release size may cause escalation.The jet flame size at 5 minutes is 10.3 m in length and 1.03 m in width (in respect with release rate of 0.24 kg/s).This size of jet may impact to process equipment located on the area of 10.4 m 2 nearby the release location.To avoid the possible escalation, it is suggested to relocate the process equipment with at least distance of 10.5 m downwind of the riser.

CONCLUSION
QRA is carried out to assess the different parameter of risk exposed to facility personnel.Individual and societal risks are identified, quantified and compared to acceptance criteria to ensure all risk exposed are identified and control within As Low As Reasonably Practicable (ALARP) level.It is shown that the main increase in risk is from immediate effects which are mitigated by leak and fire detection, isolation, blowdown or control of ignition sources.Besides, the PFP should be provided to avoid the potential domino effects from ignited events.However, there is a conflict between the cost impact and safety aspect.E&P managers as well as government supervisor authorities are constantly faced with decisions to be made regarding of safety.In order to ensure comparability and to set priorities application of QRA is a useful tool to justify choices made with regard to personnel safety, environmental protection, asset damage and business reputation, it is recommended to apply the systematic cause analysis method and develop the risk management models which contains an integral approach toward the health, safety and environmental aspect 0,00 [10]: LSIR = Outcome Frequency x Probability of death for an individual present all time in area IRPA = Total of LSIR * Presence factor PLL = IRPA x N / Offshore time per year Where: N = number of fatalities caused by the outcome coating, 34 mm thick can keep the temperature to 100 0 C for approximately 45 minutes. An intumescent epoxy coating, 14 mm thick can keep the temperature rise to approximately 6 0 C per minutes, reaching 370 0 C after 1 hour.
3).Probability of ignition or failure of safety equipment are based on the OREDA (Offshore Reliability Data Handbook) which is published by SINTEFF [8].

Figure. 2 . 3 .
Figure. 2. Flow diagram of a riser system Figure.3. Event tree for gas riser release

Table 1 .
Simplify consequence model

Table 2 .
Selected failure times in fires

Table 3 .
Possible consequence by simple model