Vous êtes sur la page 1sur 10

What is Quantitative Risk Assessment (QRA) QRA is a mathematical approach to engineers to predict the risks of accidents and give

guidance on appropriate means of minimizing them. Nevertheless, while it uses scientific methods and verifiable data, QRA is a rather immature and highly judgmental techni ue, and its results have a large degree of uncertainty. !espite this, many branches of engineering have found that QRA can give useful guidance. "owever, QRA should not be the only input to decision#making about safety, as other techni ues based on e$perience and judgment may be appropriate as well. Risk assessment does not have to be uantitative, and ade uate guidance on minor hazards can often be obtained using a ualitative approach. The Key Components of QRA %igure on ne$t page illustrates the classical structure of a risk assessment. &t is a very fle$ible structure, and has been used to guide the application of risk assessment to many different hazardous activities. 'ith minor changes to the wording, the structure can be used for ualitative risk assessment as well as for QRA. (he first stage is system definition, defining the installation or the activity whose risks are to be analyzed. (he scope of work for the QRA should define the boundaries for the study, identifying which activities are included and which are e$cluded, and which phases of the installation)s life are to be addressed. (hen hazard identification consists of a ualitative review of possible accidents that may occur, based on previous accident e$perience or judgment where necessary. (here are several formal techni ues for this, which are useful in their own right to give a ualitative appreciation of the range and magnitude of hazards and indicate appropriate mitigation measures. (his ualitative evaluation is described in this guide as )hazard assessment). &n a QRA, hazard identification uses similar techni ues, but has a more precise purpose # selecting a list of possible failure cases that are suitable for uantitative modeling. *nce the hazards have been identified, frequency analysis estimates how likely it is for the accidents to occur. (he fre uencies are usually obtained from analysis of previous accident e$perience, or by some form of theoretical modeling. &n parallel with the fre uency analysis, consequence modelin evaluates the resulting effects if the accidents occur, and their impact on personnel, e uipment and structures, the environment or business. +stimation of the conse uences of each possible event often re uires some form of computer modeling, but may be based on accident e$perience or judgments if appropriate. 'hen the fre uencies and conse uences of each modeled event have been estimated, they can be combined to form measures of overall risk. ,arious forms of risk presentation may be used. Risk to life is often e$pressed in two complementary forms.. !ndividual risk # the risk e$perienced by an individual person. /. 0roup 1or societal2 risk # the risk e$perienced by the whole group of people e$posed to the hazard. 3p to this point, the process has been purely technical, and is known as risk analysis" (he ne$t stage is to introduce criteria# which are yardsticks to indicate whether the risks are acceptable, or to make some other judgment about their significance. (his step begins to introduce non#technical issues of risk acceptability and decision#making, and the process is then known as risk assessment"

&n order to make the risks acceptable, risk reduction measures may be necessary. (he benefits from these measures can be evaluated by repeating the QRA with them in place, thus introducing an iterative loop into the process. (he economic costs of the measures can be compared with their risk benefits using cost#benefit analysis. (he results of QRA are some form of input to the design or ongoing safety management of the installation, depending on the objectives of the study. "andout te$t is modified after 4A guide for Quantitative Risk Assessment for *ffshore &nstallations, 567( publication8, Aberdeen, 39, :ohn ;pouge, 1.<<<2.


Hazard identification DOW, SPI

"!antitative #azard assessment$ MCAA Accident scenario development MCAS

Pro%a%ilistic #azard assessment$ASM a!lt tree development

a!lt tree for t#e envisa0ed scenario

Conse&!ences anal'sis MA(C)*D

a!lt tree anal'sis P)O A+

Appl' add on safet' meas!res

)is, estimation

Identif' !nits t#at contri%!te s!%stantiall' to t#e pro%a%ilit' of top event

W#et#er ris, is accepta%le/es


Is pro%a%ilit' red!ction possi%le.o



Develop disaster mana0ement plan

Quantitative risk assessment and its use safety (measure design) managements

QRA as $art of Risk %ana ement QRA is primarily an analytical process, estimating risk levels, and evaluating whether various measures are effective at reducing them. (his is a part of risk mana ement# which consists of the on#going actions to minimize risks as part of the safety management system of the activity. (here has been a tendency for QRA to be treated as an isolated analytical e$ercise, with only a loose link to other risk management activities. &n order to correct this, QRA can be seen as an integrated part of the risk management process, consisting of the following iterative steps 1see figure on ne$t page2 &dentifying hazards that are present. ;etting acceptance standards for the risks. +valuating the likelihoods and conse uences and risks of possible events. !evising or confirming arrangements to prevent or mitigate the events, and respond to them if they do occur, and checking that the residual risks are acceptable. +stablishing performance standards to verify that the arrangements are working satisfactorily. 5ontinuously monitoring, reviewing and auditing the arrangements.

(here are many points of linkage between QRA and risk management, particularly in the area of decision# making about risk acceptability and reduction measures. ;ignificant research is going on this topic, one may find many research application in open literature. What is QRA &sed 'or( (he objectives of a QRA may include +stimating risk levels and assessing their significance. (his helps decide whether or not the risks need to be reduced. &dentifying the main contributors to the risk. (his helps understanding of the nature of the hazards and suggests possible targets for risk reduction measures. !efining design accident scenarios. (hese can be used as a design basis for fire protection and emergency evacuation e uipment, or for emergency planning and training. 5omparing design options. (his gives input on risk issues for the selection of a concept +valuating risk reduction measures. QRA can be linked to a cost#benefit analysis, to cost# effective ways of reducing the risk. !emonstrating acceptability to regulators and the workforce. QRA can show whether risks have been made )as low as reasonably practicable). &dentifying safety#critical procedures and e uipment. (hese are critical for minimize risks, and need close attention during operation. &dentifying accident precursors, which may be monitored during operation to provide trends in incidents=

(aken together, these possible uses of QRA provide a rational structure for monitoring guidance for decision#making about safety issues.

System Modification to incorporate suggested risk control measures

Hazard Identification

Accident Modelin0

re&!enc' estimations

)is, "!antification

QRA and other risk assessment methodologies as part of risk )is, management process Doc!mentation 3 ollo4 !p plan


Risk management

Description and definition of s'stem

Quantitative Risk assessment

Probabilistic Safety Analysis

Safety Analysis

)cope of a QRA (he types of risk that a QRA may evaluate include >oss of life. (his is usually the only measure of harm to people, since sickness a define and predict. !mpairment of safety functions" (his is the likelihood of key safety functions lifeboats, temporary refuge etc, being made ineffective by an accident. (his risk me- as a simple alternative to the risk of loss of life. $roperty damage. (his consists of the cost of clean#up and property replacement, i: re#drilling wells if necessary. ?usiness interruption" (his includes the cost of delays in production or drilling. *nvironmental pollution" (his may be measured as uantities of oil spilled onto the shore, or as likelihoods of defined categories of environmental impact.

(he choice of appropriate types of risk will depend on the objectives of the QRA and criteria that are to be used. 6any offshore QRAs consider only loss of life or impairment of safety functions, but a comprehensive evaluation of acceptability and cost#benefit should address all the above types of risk. $hases of $latform +ife &n principle, a QRA should address risks over the entire life of the platform, from th drilling to the final abandonment of the field or scrapping of the rig. &n practice, most phases where the risks are high and the potential for risk reduction is greatest. 6ost QRAs of production platforms have only addressed the main drilling and hydrocarbons. *ther phases have mainly been addressed ualitatively QRA to cover all phases of the platform life and may include *nshore construction &nshore outfitting and mating (owing operations *ffshore installation *ffshore hook#up and commissioning !evelopment drilling ;imultaneous drilling and production 7roduction 'orkovers 6ajor modifications 1e.g. addition of gas compression2 Abandonment at the end of the platform)s life

,oundaries of the QRA

(he boundaries of the QRA should be defined clearly, identifying which activities, hazards and personnel are included. An offshore installation has relatively clear boundaries, but several issues re uire definition. (hese include Accidents involving attendant vessels such as supply vessels, stand#by vessels, etc. &t might be e$pected that all activities and personnel involved in routine operations of the platform would be included in the QRA, but in practice attendant vessels are often neglected e$cept where they damage the platform in a collision. &f they were included, this would re uire risk estimates for them while on#station and in#transit to shore, and introduce a new issue of defining the boundary in their port. Accidents involving passing merchant ships. 6ost platform QRAs include the risk of passing ships damaging the platform but not the risk of fatalities or damage this may cause on the ship. ;ince this is the main area where the platform may be the cause of third party fatalities, the 39 6arine ;afety Agency has argued that it should be included in the QRA of the platform. Accidents involving helicopter transport to and from the platform. 6ost platform QRAs include accidents in helicopter travel. ;ome have e$cluded risks to the helicopter crew, on the grounds that their safety is the responsibility of the helicopter company and the civil aviation authorities not the offshore operator. 'here crew boats are used, these are normally included in the QRA. Accidents involving road transport to and from the heliport. (hese are not normally covered, e$cept where different concept designs involve different amounts of road transport from a well# defined base. Accidents originating in pipelines between the platform and the shore and@or other platfoill.;. (his boundary is important if pollution or business interruption risks are to be evaluated.

(he installation)s safety zone may form its legal boundary, and this may be used to define the boundary of a QRA. QRA in the +ife of an !nstallation (o obtain the full benefit from the study, QRA should be an on#going process throughout the life of an installation, as an integral part of its risk management. &deally, one QRA should be prepared and evolve through the installation)s life. (ypical stages when a QRA or an update are re uired are %easibility studies and concept selection stage. "ere, a simple QRA is appropriate due to the absence of design detail. (he QRA should compare the risk implications of the various possible concepts, and verify that the chosen one has the potential to be acceptably safe. 5oncept design. (his is one of the most fruitful stages for a QRA, since information is available to allow a reasonably detailed study, while the design is still fle$ible enough to be influenced substantially by the QRA conclusions. QRAs at this stage have often been known as 5oncept ;afety +valuations, but full fatality risk analyses are also possible. (he QRA should evaluate major risk reduction measures such as layout changes, lifeboat numbers, etc. !etailed design. !uring detailed design a (otal Risk Assessment may be appropriate, although some companies restrict it to fatalities. (he QRA may use several supporting studies. &t should be in sufficient detail to evaluate specific risk reduction measures such as life boat locations, fire protection, etc. and should be able to provide guidance for developing operating and emergency procedures.

*peration. (he full QRA of the final design should be revised to take account of the )as built) state of the platform typically every A#B years or after significant changes to the installation or to QRA methodology. (he QRA should reflect operational e$perience of leaks, shipping movements, manning levels and emergency e$ercises. &t should be used in decision#making as part of the on#going safety management system on the installation.

*-istin .uidance on /ffshore QRA (he lack of a comprehensive guide to offshore QRA is one of the motivations for producing the present guide. Nevertheless, some limited guidance does e$ist (he Norwegian 7etroleum !irectorate has published brief guidelines on how to apply risk analysis to meet its regulations. (he 39 "ealth C ;afety +$ecutive has published brief guidance on risk assessment in the conte$t of *ffshore ;afety 5ases. (he 5anada#Newfoundland *ffshore 7etroleum ?oard has produced brief guidance on &nstallation ;afety Analysis to help operators meet its regulations. (he American 7etroleum &nstitute has produced a recommended practice for design and hazard analysis offshore production platforms. (he 39 *ffshore operators Associations has produced a procedure for the conduct of formal safety assessment of offshore installations, with very brief coverage of hazard assessment.

7itblado C (urney 1.<<B2 give a good introduction to QRA for the process industries, including a section on offshore QRA. 6ore detailed guides to QRA 1notably 557; .<D<a, and parts of >ees .<<E2 are useful in the area of basic techni ues and conse uence modeling, but do not cover many key areas specific to offshore installations. Aven 1.<</2 provides detailed discussion of offshore QRA, focusing in particular on reliability analysis. 5rook 1.<<F2 provides a ualitative review of recent technical and regulatory developments in the field of safety against fire and blast offshore research group at 6emorial 9han and coworkers are working fire and e$plosion modeling of offshore platform, inherently safer design, and human factor. 0roup lead by ?rian ,eitch has worked e$tensively on Rescue and evacuation from offshore platform. Which Calculation *nvironment to &se %anual calculations are based on written documentation, typically supported by hand#held calculators. +arl QRAs were performed in this way, but the approach is suitable only for very simple QRAs or for checks of more sophisticated work. &ts strengths are fle$ibility and economy of effort in simple work. &ts weaknesses are difficulty in handling large numbers of events and updating after changing inputs, and the variable uality documentation from different analysts. Computer spreadsheets have been used e$tensively in recent QRA studies. At the most basic level, they can be used to combine some of the function of hand#held calculators and word#processors, performing simple calculations, adding the results of each failure case, and presenting the risk in tabular and graphical format. (hey are also widely used as a computing environment for simple conse uence models. ;ome spreadsheets are controlled by macro commands, allowing them to function like complete computer programs for offshore QRA. (he strengths of spreadsheets are their low cost, fle$ibility of calculation and presentation, minimal training re uirements, and easy portability from one study to the ne$t. (heir weaknesses are that they are prone to errors by the analyst and very difficult to checkG the macro programming language is particularly difficult to understand and checkG they re uire relatively simple modelingG and they tend to be very personal to

the analyst and so difficult to update without errors. As a result, they re uire very careful uality assurance. Computer pro rams are mainly used in QRA as single#issue stand#alone models for conse uence calculation, fault#tree analysis, and theoretical fre uency models for specific events. &n this form, they can be combined with manual calculations, spreadsheets or more comprehensive software to produce overall risk results. Comprehensive offshore QRA soft0are has been developed to combine event fre uencies with conse uence models, and produce documentation. Although these have been developed in spreadsheet form, the main e$amples are in more advanced operating environments. (he *ffshore "azard and Risk Analysis 1*"RA2 (oolkit is a graphical tool for structuring an offshore risk analysis. &t provides a set of conse uence and fre uency models 1i.e. single#issue computer programs2, event trees and fre uency data, and allows the user to combine them using an intuitive graphical interface and a restricted spreadsheet capability. (he toolkit automatically transfers data between the models, and keeps a record of the input values that were used, thus allowing ready updating of the results. &ts strengths are the inclusion of many computer models in a common environment, the ability to link them fle$ibly, to audit the calculations and readily update them. &ts weaknesses are the high initial cost of learning to use the technology efficiently, the difficulty of modeling the impact of conse uence zones on a A#dimensional platform population, and the relatively early stage of development of this approach. 7>A(* is a software system for offshore risk analysis which performs the entire risk calculation from definition of the platform)s e uipment and initiating events to production of the risk results. &t is based on )object#orientated) programming, involving a A#! model of the platform geometry and emergency control systems. &ndividual events can be generated automatically and the various possible escalation paths can be simulated according to pre#defined rules, replacing traditional event# tree modeling under the analyst)s control. Risk results can then be computed automatically. )tren ths and +imitations of QRA )tren ths (he main strength of QRA is that it is one of the few techni ues able to provide guidance to designers and operators on how best to minimize the risks of accidents. QRA combines previous e$perience with structured judgments to help anticipate accidents before they occur. QRA is most effective when applied to major accidents. (hese are difficult to address subjectively, because they lie outside the e$perience of most designers, operators and regulators. (he chances of such accidents occurring are low, but their conse uences can be catastrophic, involving the potential for massive loss of life, damage to the environment, financial loss, and on occasions leading to the failure of the company or major changes to the entire industry. (hus there is a moral and practical incentive to use the best#available methods to minimize these risks. QRA is readily applied to activities where there is plenty of operating e$perience to provide a statistical base for the analysis 1e.g. semi#submersible drilling rigs2. "owever, safety in these areas can be managed reasonably well on the basis of accident e$perience. (he added value of a QRA is usually greatest in relatively novel applications 1e.g. early concrete platforms, floating production systems, tension leg platforms etc2 with little operating e$perience, especially where standard technology is applied in novel environments. "ere, identify and assess accidents that have never happened in these applications, on the basic elsewhere. An e$ample of this is provided by QRAs in the Norwegian ;ector which e$plicitly identified the need for measures to minimize the risks of gas riser fires several years before the Piper Alpha accident.

?ecause offshore QRA has developed largely from techni ues used by the onshore process industries, it is most highly developed in the area of hydrocarbon release forming fires and e$plosions and hence is most effective at predicting risk of process or pipeline operations. &ts prediction in other areas 1e.g. structural failures, capsize of floating units2 are relatively simplistic at present. Nevertheless, improvements are being made in all areas, so this imbalance is slowly being corrected. +imitations QRA is a relatively new techni ue. &n general, there is a lack of agreed approaches and poor circulation of data, resulting in wide variations in study uality. &n some areas, accident data has not been collected or analyzed, and no theoretical models are available, so risk estimates are inevitably very crude. &n other areas, availability of data and analytical techni ues is developing rapidly, and the risk estimates tend to fluctuate as a result. ?ecause it is uantitative, QRA appears to be objective, but in reality it is very judgmental. (hese judgments may be e$plicit in areas where data is unavailable, but there are also many implicit judgments in the analysis and application of data that is available, and these are often unrecognized. *verlooking the significance of these judgments may lead to false precision in the risk estimates. *ver#emphasis on the judgmental nature of a QRA, on the other hand, may lead to its potential benefits being overlooked. QRA only provides one input to decision#making about safety issues, and most of its advocates recognize that it cannot make the decision itself. (here are some aspects, such as public dread of particular sources of risk, which QRAs do not take into account at present. !ecision#making about hazardous activities is legitimately influenced by many other economic, social and political factors besides risk, and these must be considered independently in the decision#making process.