(40al) Inclusion of Non-Intrinsic Scenarios in Onshore QRAs (Quantitative Risk Assessment)

In Brazil, Quantitative Risk Analysis (QRA) are required by Environmental Agencies as part of the Operating Licensing permit. Some states in the country have a specific Terms of Reference for Quantitative Risk Analysis, including requirements for scenario definition, consequence modeling and a set of criteria for societal and individual risks. The QRAs (Quantitative Risk Assessment) are required to calculate damage arising from flammable effects or toxicity via inhalation, using fatalities to external population as metrics. For each onshore operational, whether a chemical facility or a long pipeline, the QRA must be performed and updated every five years or whenever the process suffers modifications.

Methodologies:

According to Brazilian requirements, the quantitative risk analysis starts with a qualitative study to identify scenarios. The scenarios are than selected for consequence modelling depending on specific criteria such as qualitative classification or presence of hazardous products. Once calculated the consequence of the unwanted event, if the defined effect criteria extrapolate facility boundaries and reaches sensitive population, then the risk must be calculated, and the frequency value is added to the analysis. Mitigation measures may be required to reduce consequence or frequency if societal or individual risk criteria are not met.

From this description, QRAs in Brazil may seem traditional to all international references, but there are nuances that generate unique insights. Traditionally, the qualitative risk assessment methodology used as input to QRA was the HAZID (Hazard Identification), a more simplified study that leads to hazards like the unwanted events normally included in QRA (e.g., small leak, large leak, catastrophic rupture). But with the popularization of HAZOP (Hazard and Operability) studies, some companies started to base the QRAs from the HAZOP instead of using a specific HAZID to generate scenarios. The HAZOP focus for operational disturbances lead to scenarios evidencing other non-traditional events for QRA such as overpressure (runway, overfill), internal explosion and BLEVEs (Boiling Liquid Expanding Vapor Explosion).

With the need to correlate the events for QRAs with the scenarios from qualitative analysis, the use of HAZOP enforced the division between traditional intrinsic cause events, e.g.,. small and large leaks, from non-intrinsic events caused by operational disturbances. This leads to simulation of specific events for overpressure, internal explosion due to flammable atmosphere formation and BLEVEs.

These non-intrinsic scenarios will have calculation differences for the consequences and the frequency compared to traditional QRA scenarios. For example, when simulating the consequence of an overpressure scenario, the pressure considered for the unwanted event is premised to be equal to the MAWP (Maximum Allowable Working Pressure) of a vessel, thus leading to much more severe damage compared to traditional rupture scenarios for intrinsic causes. As for the frequency, since most database references do not possess specific numbers for these overpressure events, other methods such as fault tree analysis are required to obtain specific values to such event.

The use of fault tree method allows for evaluation of specific and important safety function systems (e.g., high pressure interlocks) that differ greatly from company to company and allows the results to be very specific for one facility. Also, when evaluating mitigating measures, this methodology allows for simulation of improvement of key features in operational reality that otherwise may not have been assessed in QRA.

Although the specificness of these non-intrinsic scenarios, it is debatable if the frequencies for traditional events in the database references do not incorporate these operational disturbances events in the reported number. And so, if in a same QRA, traditional intrinsic events with frequency from database references are added to non-intrinsic events with frequency calculated based on fault tree analysis, it might be double counting operational disturbances in the analysis.

Overall, when observing the operation mode differences from facility to facility, it is noteworthy the importance of calculating numerically non-intrinsic events and the impact of individual safety functions that improve operational safety whenever available. Evidence of these differences are found when comparing loading terminals with a lot of manual operations from refineries with a lot of automation. Even though they might use similar equipment, frequencies related to operational events are expected to be much different given distinct realities.

Experience demonstrates that the numerical frequency for these non-intrinsic events, calculated using fault tree methods, tend to be much higher than frequencies from databases for facilities where proper safety functions are not installed. Also, the consequences for these non-intrinsic events tend to be much larger than intrinsic scenarios. Thus, these two factors lead to evidence of importance of non-intrinsic scenarios in final results of QRAs, that is, largely contributing to the overall risk of a plant.

Conclusion:

The main goal of this paper is to explore the differences of consequence and frequency modeling for non-intrinsic events, highlighting the importance of specific parameters and discussions around operational disturbances leading to unwanted events.

Additionally, the evidence of such scenarios was amplified with the need to correlate qualitative studies with the quantified events in the QRA, a requirement enforced by technical requirements from environmental agencies in Brazil.