Quantitative risk assessment across major hazard industries
A BRIEF HISTORY OF QRA
The terms QRA (Quantitative Risk Assessment), PSA (Probabilistic Safety Assessment) and PRA (Probabilistic Risk Analysis) are used synonymously in different industries to describe various techniques for evaluating risk. Whilst quantification of risk for specific issues has been around for a long time, the grandfather of modern probabilistic assessment of the overall risk for an entire major hazard facility is generally accepted to be WASH-1400, commissioned by the US Nuclear Regulatory Commission in 1975. This quantified the safety risks associated with the operation of all electricity generating nuclear power plants in the US. The nuclear industry led the way, motivated by a desire to demonstrate that the actual risk was less than other industrial facilities and counter the public’s perception that nuclear stations are very risky because the worst case consequences are potentially so catastrophic.
It is not surprising that the petrochemical industry followed suit shortly after, since the toxic effects of large chemical releases can disperse many miles and affect large numbers of people in local towns and cities. Explosion effects can also be devastating. For example, an explosion in 1974 at the Flixborough chemical plant in the UK killed 28 people.
One of the first major QRAs for petrochemical installations was the highly industrial area of Canvey Island near London, in 1978.
The UK’s offshore oil and gas industry came relatively late to formal QRA of overall risks, prompted by the Piper Alpha disaster in 1988 in which 167 workers lost their lives. The rail industry in the UK also started formal QRAs in the early 1990’s, against a background of train accidents, including the Clapham Junction crash in 1988 when three rush-hour trains collided, killing 34 people.
WHY CONDUCT QRA?
All industries were motivated to use QRA for much the same reasons – to provide insights into the nature of the facility that is being managed, to design defence in depth, to understand any constraints on operating the facility and any issues that require further investigation.
It is fair to say that in each industry, at various points in time, QRA has been misused, typically in efforts to ‘prove’ that calculated risk levels meet numerical risk acceptance criteria (see Box 1). This perhaps stems from the heavily engineering-biased culture within major hazard industries, where there is desire to have a precise answer represented by a number.
Whenever this has happened the industry has tended to redeem itself, getting back to a sensible use of QRA to help reduce risk by making better risk-informed decisions. In particular, the probabilistic approach of QRA can be extremely useful in demonstrating that a broad range of scenarios have been considered. This contrasts with more traditional deterministic approaches which are always left open to yet another “what if?” question and yet another study. A robust, well developed QRA can readily handle such questions and put the findings in the context of the total risk profile.
ARE THERE ANY DIFFERENCES IN QRA BETWEEN INDUSTRIES?
A formal QRA attempts to answer the questions:
- What can go wrong?
- How often does it happen?
- How bad are the consequences?
- Is the risk acceptable?
In addressing these questions, there are a number of subtle differences in the way the nuclear, petrochemical, oil and gas, and rail industries go about their QRAs. These differences tend to be shaped by the risk criteria, technology involved, the nature of the hazard itself, and whether or not the system being modelled is static.
Risk criteria. The QRA must be able to generate risk results in the right form to allow comparison with the risk criteria set by the regulator or the operator. For example, where members of the public are exposed to toxic chemicals, the QRA may need to be able to generate ‘FN-curves’, which are plots of the frequency F of events which may cause N or more fatalities. In contrast, the nuclear industry tends to require that the frequency of a given radiological release and associated doses are less than defined levels. On an offshore platform however, where only workers are exposed, the emphasis is more on the individual risk to personnel.
Technology involved. In the nuclear reactor industry, for example, a great deal of effort is expended in analysing the causes and frequency of initiating events because a lot of complex engineering has to fail before a reactor core can be damaged and radio-nuclides released from the containment. The petrochemical and oil and gas industries, on the other hand, tend to start their QRAs with historical frequencies of gas or oil leaks because leaks are quite common and data are readily available. There is also less redundancy and diversity in safety systems to model than for nuclear power plants
Nature of the hazard. Another difference relates to analysing the impact of the hazardous event. A fire or explosion in a chemical plant or a train derailment or collision both have the potential to cause fatalities immediately, within seconds of the event. Nuclear releases however may cause latent health effects, the extent of which may not be known until many years later. For example, the Chernobyl nuclear accident in 1986 caused 31 immediate deaths, but by 1991 some 7,000 clean-up workers were believed to have died and some estimates of the eventual death toll are as high as 75,000 [Ref. 1]. Clearly, QRAs are sensitive to the models used to estimate the likelihood of fatality from the magnitude of the hazard.
Dynamic or static conditions. Unlike nuclear stations or chemical plants, which are located at a single site, trains can travel hundreds of miles through different local environments, picking up and putting down differing numbers of passengers. Rail industry QRAs are specifically designed to handle these transitory aspects.
There are other differences between industries as well, such as the way that fatalities are modelled during evacuation, or the extent to which frequencies and consequences are integrated into an overall risk picture, but what is evident is that the differences are not as great as one might first think – the level of detail and the focus of the analysis are shifted to enable QRA to help answer the specific questions unique to the industry.
SO WHAT IS THE SAME?
One thing that all major hazard industries do agree on, however, is the best uses of QRA (see Box 2).
Even so, QRA is not without its limitations (see Box 3). Because QRA involves lots of numbers it appears to be objective when in fact there are many judgements throughout the analysis. Some judgements are explicit but many more are hidden within data and methods. It is the role of QRA practitioners to interpret results in the context of the uncertainties inherent within the analysis.
In general, attitudes have changed from early scepticism, not helped by over-selling by QRA enthusiasts, to one of positive support for QRA approaches that provide clarity of focus to controlling hazards.
WHERE IS QRA TODAY?
Today, the nuclear industry is arguably taking an increasingly integrated approach to QRA, in that there is a more transparent combination of the frequency and consequences of events. It will be interesting to see how this plays out in light of the swelling interest in building new nuclear power stations.
Offshore UK, which is a mature operating environment, has seen the regulator pulling back somewhat from QRA and placing a much greater emphasis on the operational management of asset integrity. Nevertheless, internationally, there is an increasing demand for QRA and the value it can add, especially on major design projects.
The rail industry in the UK is using QRA more and more, applying it to increasingly complex situations to obtain a greater understanding for important risk-based decisions.
CONCLUSION
Modern QRA has been around for over 30 years, led by the nuclear and onshore petrochemical industries, shortly followed by the offshore and rail industries. The differences in the focus and level of detail of QRA in each industry arise from the need to understand the critical risk issues unique to the industry. But all industries agree that while QRA is not a panacea, it does help to make better risk-informed decisions, thus saving lives, protecting the environment, reducing economic loss and preserving the reputation of the associated organisation.
References
Loss Prevention in the Process Industries, Lees, 1996
This article first appeared in RISKworld Issue 13.
