Analysis of underlying causes of investigated loss of containment incidents in Dutch Seveso plants using the Storybuilder method

In the Netherlands there are around 400 “Seveso” sites that fall under the Dutch Major Hazards Decree (BRZO) 1999. Between 2006 and 2010 the Dutch Labour Inspectorate's Directorate for Major Hazard Control completed investigations of 118 loss of containment incidents involving hazardous substances from this group. On the basis of investigation reports the incidents were entered in a tailor-made tool called Storybuilder developed for the Dutch Ministry of Social Affairs and Employment for identifying the dominant patterns of technical safety barrier failures, barrier task failures and underlying management causes associated with the resulting loss of control events. The model is a bow-tie structure with six lines of defence, three on either side of the central loss of containment event. In the first line of defence, failures in the safety barriers leading to loss of control events were primarily equipment condition failures, pre start-up and safeguarding failures and process deviations such as pressure and flow failures. These deviations, which should have been recovered while still within the safe envelope of operation, were missed primarily because of inadequate indication signals that the deviations have occurred. Through failures of subsequent lines of defence they are developing into serious incidents. Overall, task failures are principally failures to provide adequate technical safety barriers and failures to operate provided barriers appropriately. Underlying management delivery failures were mainly found in equipment specifications and provisions, procedures and competence. The competence delivery system is especially important for identifying equipment condition, equipment isolation for maintenance, pre-start-up status and process deviations. Human errors associated with operating barriers were identified in fifty per cent of cases, were mostly mistakes and feature primarily in failure to prevent deviations and subsequently recover them. Loss of control associated with loss of containment was primarily due to the containment being bypassed (72% of incidents) and less to material strength failures (28%). Transfer pipework, connections in process plant and relief valves are the most frequent release points and the dominant release material is extremely flammable. It is concluded that the analysis of a large number of incidents in Storybuilder can support the quantification of underlying causes and provide evidence of where the weak points exist in major hazard control in the prevention of major accidents.     

A safety barrier-based accident model for offshore drilling blowouts

Blowout is one of the most serious accidents in the offshore oil and gas industry. Accident records show that most of the offshore blowouts have occurred in the drilling phase. Efficient measures to prevent, mitigate, and control offshore drilling blowouts are important for the entire offshore oil and gas industry. This article proposes a new barrier-based accident model for drilling blowouts. The model is based on the three-level well control theory, and primary and secondary well control barriers and an extra well monitoring barrier are established between the reservoir and the blowout event. The three barriers are illustrated in a graphical model that is similar to the well-known Swiss cheese model. Five additional barriers are established to mitigate and control the blowout accident, and event tree analysis is used to analyze the possible consequence chains. Based on statistical data and literature reviews, failures of each barrier are presented. These failures can be used as guidance for offshore drilling operators to become aware of the vulnerabilities of the safety barrier system, and to assess the risk related to these barriers. The Macondo accident is used as a case study to show how the new model can be used to understand the development of the events leading to the accident. The model can also be used as an aid to prevent future blowouts or to stop the escalation of events.     

A conceptual offshore oil and gas process accident model

The purpose of this paper is to present and discuss an accident prevention model for offshore oil and gas processing environments. The accidents that are considered in this work relate specifically to hydrocarbon release scenarios and any escalating events that follow. Using reported industry data, the elements to prevent an accident scenario are identified and placed within a conceptual model to depict the accident progression. The proposed accident model elements are represented as safety barriers designed to prevent the accident scenario from developing. The accident model is intended to be a tool for highlighting vulnerabilities of oil and gas processing operations and to provide guidance on how to minimize their hazards. These vulnerabilities are discussed by applying the 1988 Piper Alpha and the 2005 BP Texas City disaster scenarios to the model.     

Application of dynamic risk analysis in offshore drilling processes

Process safety is the common global language used to communicate the strategies of hazard identification, risk assessment and safety management. Process safety is identified as an integral part of process development and focuses on preventing and mitigating major process accidents such as fires, explosions, and toxic releases in process industries. Accident probability estimation is the most vital step to all quantitative risk assessment methods. Drilling process for oil is a hazardous operation and hence safety is one of the major concerns and is often measured in terms of risk. Dynamic risk assessment method is meant to reassess risk in terms of updating initial failure probabilities of events and safety barriers, as new information are made available during a specific operation. In this study, a Bayesian network model is developed to represent a well kick scenario. The concept of dynamic environment is incorporated by feeding the real-time failure probability values (observed at different time intervals) of safety barriers to the Bayesian network in order to obtain the corresponding time-dependent variations in kick consequences. This study reveals the importance of real-time monitoring of safety barrier performances and quantitatively shows the effect of deterioration of barrier performance on kick consequence probabilities. The Macondo blowout incident is used to demonstrate how early warnings in barrier probability variations could have been observed and adequately managed to prevent escalation to severe consequences.     

Dynamic-risk-informed safety barrier management: An application to cost-effective barrier optimization based on data from multiple sources

An integrated approach for performance assessment and management of safety barriers in a systemic manner is needed concerning the prevention and mitigation of major accidents in chemical process industries. Particularly, the effects of safety barriers on system risk reduction should be assessed in a dynamic manner to support the decision-making on safety barrier establishments and improvements. A simulation approach, named Simulink-based Safety Barrier Modeling (SSBM), is proposed in this paper to conduct dynamic risk assessment of chemical facilities with the consideration of the degradation of safety barriers. The main functional features of the SSBM include i) the basic model structures of SSBM can be determined based on bow-tie diagrams, ii) multiple data (periodic proof test data, continuous condition-monitoring data, and accident precursor data) may be combined to update barrier failure probabilities and initiating event probabilities, iii) SSBM is able to handle uncertainty propagation in probabilistic risk assessment by using Monte Carlo simulations, and iv) cost-effectiveness analysis (CEA) and optimization algorithms are integrated to support the decision-making on safety barrier establishments and improvements. An illustrative case study is demonstrated to show the procedures of applying the SSBM on dynamic risk-informed safety barrier management and validate the feasibility of implementing the SSBM for cost-effective safety barrier optimization.     

Generic event trees and probabilities for the release of different types of hazardous materials

To simplify quantitative risk analysis, the initiating events leading to loss of containment are normally described using generic hypotheses. For example, the following hypothesis is applied to the loss of containment from a storage tank: instantaneous release of the complete inventory, continuous release of the complete inventory in 10 min, and continuous release from a hole with a diameter of 10 mm. Once the initiating events have been specified, the corresponding event trees must be drawn to establish the sequences from each initiating event to the diverse final outcomes or accident scenarios, which will depend on the properties of the released material or on other specific factors. In this paper we propose, in a systematic way, a set of short generic event trees for the main loss of containment scenarios involving different types of hazardous materials. Even though most of them have been taken from the literature (BEVI Reference Manual), we have modified some of them, added the corresponding intermediate probabilities (immediate ignition, delayed ignition, flame front acceleration, etc.) obtained from a literature review and expert judgment, and associated the use of each event tree to the hazardous properties of the material (flammability, volatility and toxicity) and to its category according to EC labeling directives.     

Dynamic accident modeling for high-sulfur natural gas gathering station

Dynamic accident modeling for a gas gathering station is implemented to prevent high-sulfur natural gas leakage and develop equipment inspection strategy. The progress of abnormal event occurring in the gas gathering station is modeled by the combination of fault tree and event sequence diagram, based on accident causal chain theory, i.e. the progress is depicted as sequential failure of safety barriers, then, the occurrence probability of the consequence of abnormal event is predicted. Consequences of abnormal events are divided into accidents and accident precursors which include incidents, near misses and so on. The Bayesian theory updates failure probability of safety barrier when a new observation (i.e. accident precursors or accidents data) arrives. Bayesian network then correspondingly updates failure probabilities of basic events of the safety barriers with the ability of abductive reasoning. Consequence occurrence probability is also updated. The results show that occurrence probability trend of different consequences and failure probability trend of safety barriers and basic events of the safety barriers can be obtained using this method. In addition, the critical basic events which play an important role in accidents occurrence are also identified. All of these provide useful information for the maintenance and inspection of the gas gathering station.     

基于安全屏障模型的海上钻完井作业风险分析

海上钻完井作业面临海洋环境恶劣、浅层地质灾害等复杂工况,极易发生油气泄漏、井喷等事故。为有效预防海上钻完井作业事故,提出基于瑞士奶酪模型的安全屏障模型。采用事故树和故障模式及影响分析相结合的方法,分析作业过程风险。该模型根据挪威标准D-010,建立完井作业关井阶段的物理安全屏障和安全屏障控制原理图,在此基础上构建油气泄漏事故树和失效模式与影响分析表,找出关井阶段可能的油气泄漏途径。通过对重要度计算和风险优先度值排序确定作业过程中最薄弱的安全屏障和关键故障模式。结果表明,作业过程中最薄弱的安全屏障是采油树、油管和地面控制井下安全阀(SCSSV),采油树腐蚀、密封失效、油管接头密封失效和SCSSV开关故障是影响作业过程的关键故障模式。     

Qualitative risk assessment of a Dual Fuel (LNG-Diesel) system for heavy-duty trucks

A Dual Fuel (LNG-Diesel) system can be applied to heavy-duty diesel trucks for achieving environmental benefits in comparison to existing diesel vehicles. Because of lack of reports about risk assessment of this technology, we performed a qualitative assessment based on a framework of some literature techniques for risk identification, analysis and evaluation. After constructing a Reliability Block Diagram (RBD) to establish the context, we conducted bow-tie analysis, Fault Tree Analysis (FTA), Failure Mode and Effects Analysis (FMEA), likelihood and consequence analysis, and used a risk matrix. We applied these methods and techniques qualitatively to identify causes (e.g. collisions), critical events (e.g. releases of natural gas), related consequences (e.g. fires and explosions), and different possible pathways from a specific cause to its consequence, and to assess some negative accident scenarios related to use and parking of the vehicle. The bow-tie analysis also allowed to make explicit barriers and controls that prevent critical events and/or mitigate consequences. Therefore, we identified a set of safety measures, including design, technical, management, and emergency actions, which shall be implemented in each step of the system's life cycle.Our risk assessment showed that the risk level of the Dual Fuel (LNG-Diesel) system is similar to the risk level of a traditional diesel system. Future research will overcome current lack of data and, therefore, permit a quantitative rating of the risk of the Dual Fuel (LNG-Diesel) system.     

Operational risk assessment: A case of the Bhopal disaster

Accidental releases of hazardous chemicals from process facilities can cause catastrophic consequences. The Bhopal disaster resulting from a combination of inherently unsafe designs and poorly managed operations is a well-known case. Effective risk modeling approaches that provide early warnings are helpful to prevent and control such rare but catastrophic events. Probability estimation of these events is a constant challenge due to the scarcity of directly relevant data. Therefore, precursor-based methods that adopt the Bayesian theorem to update prior judgments on event probabilities using empirical data have been proposed. The updated probabilities are then integrated with consequences of varying severity to produce the risk profile.This paper proposes an operational risk assessment framework, in which a precursor-based Bayesian network approach is used for probability estimation, and loss functions are applied for consequence assessment. The estimated risk profile can be updated continuously given real-time operational data. As process facilities operate, this method integrates a failure-updating mechanism with potential consequences to generate a real-time operational risk profile. The real time risk profile is valuable in activating accident prevention and control strategies. The approach is applied to the Bhopal accident to demonstrate its applicability and effectiveness.     

Safety barriers: Research advances and new thoughts on theory,engineering and management

Safety barriers include physical and non-physical means in different industries for preventing the occurrences of hazardous events and mitigating the consequences in case they have occurred. After clarifying the relevant terminologies, this article reviews the literature in the domain of safety barriers in the recent decade, and categorizes these studies into barrier theory, barrier engineering and barrier management. Classifications of barriers, performance measures, modeling approaches and data-driven analysis for safety barriers are reviewed as parts of barrier theories. In the engineering section, the research advances are presented in accordance with design for reliability and safety, test and maintenance strategies, responses to dependent failures, and diagnosis and prognosis of degradations. Then, project and process management, human and organizational factors, and standardization and compliance management of safety barriers are summarized. Based on the review of literature, research perspectives on safety barriers for resilience, digital safety, security of barriers, utilizing data, and dealing with intelligence, are highlighted and potential challenges are mentioned. This study is therefore expected to be beneficial to the researchers of system and safety engineering, with systematically streamlining and innovatively categorizing the recent findings and insights.     

Real-time risk assessment of explosion on offshore platform using Bayesian network and CFD

Combustion or explosion accident resulting from accidental hydrocarbon release poses a severe threat to the offshore platform's operational safety. Much attention has been paid to the risk of an accident occurring over a long period, while the real-time risk that escalates from a primary accident to a serious one was ignored. In this study, a real-time risk assessment model is presented for risk analysis of release accidents, which may escalate into a combustion or explosion. The proposed model takes advantage of Fault Tree-Event Tree (FT-ET) to describe the accident scenario, and Bayesian network (BN) to obtain the initial probability of each consequence and describe the dependencies among safety barriers. Besides, Computational Fluid Dynamics (CFD) is applied to handle the relationship between gas dispersion and time-dependent risk. Ignition probability model that considering potential ignition sources, gas cloud, and time series are also integrated into this framework to explain the likelihood of accident evolution. A case of release accidents on a production platform is used to test the availability and effectiveness of the proposed methodology, which can be adopted for facilities layout optimization and ignition sources control.     

Methodology for selecting hole sizes for consequence studies

Predicting release rates is the first step, and a crucial step, in consequence analysis. When the release is from an isolated volume of vessel and/or piping, the release rate decreases with time. There is often debate about what equivalent hole sizes should be used for a consequence study, and usually a range of hole sizes (3–4 values) is examined.This paper shows the effect of hole size on the ultimate impact of hydrocarbon releases for several scenarios and the methodology to select them. The impact depends on the intensity and exposure time. The intensity for a fire is the thermal radiation level, and that for an unignited release is the gas concentration. As the release rate decreases with time, so does the intensity. Probit functions describe the probability of a given impact based on the time-varying intensity. For a number of example scenarios, the predictions show that the worst-case hole size is an intermediate hole size, i.e., the impact goes through a maximum with increasing hole size. For smaller holes, the event is small enough that its impact is low even though the duration is long. For larger holes, the initial event is large but decreases so rapidly that the impact is low. For the intermediate hole, the event is large enough, and the duration long enough, to cause the greatest impact.This consequence study was made evaluating hole sizes with diameters between 5 and 400 mm in a fixed volume upstream process vessel. Worst case scenario consequence predictions for fire damages, effects on people and toxic releases were determined to be somewhat different for different hole sizes. However, hole sizes in the 30 mm–90 mm range seems to have the highest impact in dry gas service.     

Predicting major accidents in the process industry based on the barrier status at scenario level: A practical approach

OCI Nitrogen wants to gain knowledge of (leading) indicators regarding the process safety performance of their ammonia production process. This paper answers the question whether indicators can be derived from the barrier system status to provide information about the development and likelihood of the major accident processes in the ammonia production process.The accident processes are visualized as scenarios in bowties. This research focuses on the status of the preventive barriers on the left-hand side of the bowtie. Both the quality – expressed in reliability/availability and effectiveness – and the activation of the barrier system give an indication of the development of the accident scenarios and the likelihood of the central event. This likelihood is calculated as a loss of risk reduction compared to the original design. The calculation results in an indicator called “preventive barrier indicator”, which should initiate further action. Based on an example, it is demonstrated which actions should be taken and what their urgency is.     

Confidence-based quantitative risk analysis for offshore accidental hydrocarbon release events

Quantitative risk analysis (QRA) has been widely used to conduct the assessment of offshore accidental risks. However, the accuracy and validity of QRA is significantly affected by uncertainties when subjective judgments are involved. Therefore, it is unrealistic to determine the probability of a hazardous event by using one single explicit value when safety experts have a relatively low confidence level in their judgments. This paper proposes a new methodology for incorporating uncertainties into conventional QRA using the concept of confidence level. Offshore hydrocarbon release hazards are focused on and a barrier and operational risk analysis (BORA-Release) method is selected as the basic model to illustrate the proposed methodology. A left–right (L–R) bell-shaped fuzzy number is employed and its membership curve is able to control its shape to represent different confidence levels. As to the complex geometry of the bell-shaped fuzzy number, an α-cut operation is introduced to conduct the arithmetic operations of the fuzzy number, and a defuzzification method with total integral value is chosen to match the α-cut operations and acquire complete information for the fuzzy numbers. In the meantime, an optimism index is used to describe the attitude of the decision-maker. One case study is provided in this paper to demonstrate the implementation of this method.     

I-Risk: development of an integrated technical and management risk methodology for chemical installations

This paper presents an integrated quantitative risk assessment method for hazardous installations, taking into account management as well as technical design and producing risk level measures. The key components of the I-Risk methodology are the technical model, the management model and their interface. The technical model consists of developing a master logic diagram (MLD) delineating the major immediate causes of loss of containment (LOC) and associated quantitative models for assessing their frequency. The management model consists of the tasks, which must be carried out systematically in the primary business functions (such as operations, emergency operations, maintenance and modifications). A management audit quantifies the quality of these management tasks. The management–technical interface modifies certain parameters of the technical model on the basis of the quality of the safety management system of the specific installation. The methodology is exemplified through its application to the risk assessment of an ammonia storage facility. A detailed technical model simulating the response of the system to various initiating events is developed along with a detailed management model simulating the influence of the plant-specific management and organisational practices. The overall effect is quantified through the frequency of release of ammonia as a result of a loss of containment in a storage tank and in a pipeline.     

事故致因理论对自主系统开发与安全运行的启示

在现代工业中,自主智能系统处在创新与探索阶段。由于先验知识的缺乏,其自身所带来的风险问题,越发得到学术界与工业界的关注。本文对于如何应用国际主流的事故致因理论以提高自主系统开发与运营的安全性进行了探讨。指出,现有的事故致因理论可用来从不同角度识别已知风险源,提高对未知风险源的警惕性,并通过描述事故场景,来辅助设计技术安全屏障与运行策略提高自主系统的安全性。为更好的理解自主系统如何会做出错误或不恰当决策,需对现有事故致因理论未涉及到的脑科学与认知心理学进一步的探讨与研究。     

Evaluation of the Risk OMT model for maintenance work on major offshore process equipment

Operational safety is receiving more and more attention in the Norwegian offshore industry. Almost two thirds of all leaks on offshore installations in the period 2001–2005, according to the Risk Level Project by the Petroleum Safety Authority in Norway, resulted from manual operations and interventions, as well as shut-down and start-up. The intention with the Risk OMT (risk modelling – integration of organisational, human and technical factors) program has been to develop more representative models for calculation of leak frequencies as a function of the volume of manual operations and interventions. In the Risk OMT project a generic risk model has been developed and is adapted to use for specific failure scenarios. The model considers the operational barriers in event trees and fault trees, as well as risk influencing factors that determine the basic event probabilities in the fault trees. The full model, which applies Bayesian belief networks, is presented more thoroughly in a separate paper. This paper presents the evaluation of the model. The model has been evaluated through some case studies, and one important aspect is the evaluation of the importance of each risk influencing factor. In addition some risk-reducing measures have been proposed, and the paper presents how the effect of these measures has been evaluated by using the model. Finally, possible applications and recommendations for further work are discussed.