GCPS 2011 __________________________________________________________________________

QRA method for Land-Use Planning around Onshore Natural Gas

Production Sites



Eelke S. Kooi
RIVM
Anthony van Leeuwenhoeklaan 9
3721 MA Bilthoven
The Netherlands
[email protected]

Margreet B. Spoelstra
RIVM
Anthony van Leeuwenhoeklaan 9
3721 MA Bilthoven
The Netherlands
[email protected]


Prepared for Presentation at
American Institute of Chemical Engineers
2011 Spring Meeting
7th Global Congress on Process Safety
Chicago, Illinois
March 13-16, 2011


UNPUBLISHED



AIChE shall not be responsible for statements or opinions contained
in papers or printed in its publications
GCPS 2011 __________________________________________________________________________

QRA method for Land-Use Planning around Onshore Natural Gas
Production Sites



Eelke S. Kooi
RIVM
Anthony van Leeuwenhoeklaan 9
3721 MA Bilthoven
The Netherlands
[email protected]

Margreet B. Spoelstra
RIVM

Keywords: QRA; Natural gas production; Land-use planning; Blowout

Abstract
In the Netherlands, owners of sites where large amounts of hazardous substances are handled
or stored must carry out a quantitative risk analysis (QRA) for land-use planning purposes. The
outcomes of the QRA are used to assess the acceptability of the risk imposed by the site to its
surroundings. The surroundings may contain other industries, buildings for the general public
and other types of populated areas. The indicators that are used to assess the acceptability of a
hazardous activity are individual risk and societal risk.

In the current paper, the QRA methodology for onshore natural gas production sites is
presented. This includes the risk related to drilling, completion, production, injection and
intervention of wells. Gas processing plants are discussed but were not specifically investigated.
The quantitative risk analysis includes the identification of release scenarios, the associated
probabilities and the calculation of the consequences of the identified scenarios.

1. Introduction

By Dutch legislation, owners of sites where large amounts of hazardous substances are
handled or stored are required to perform a quantitative risk analysis (QRA) for permitting and
land-use planning purposes ([1]). For a new hazardous activity and for renewed permit
applications, a permit will only be issued if the risk that is imposed on objects around the site is
acceptable. Similarly, changes in the land-use around the site will only be allowed if the
associated risk is tolerable. Both decisions depend on the outcomes of a QRA.

Two indicators are used for the assessment of the acceptability of risk: individual risk (IR)
and societal risk (SR). Individual risk is defined as the probability per year that a fictitious
unprotected person who resides continuously at a specific location will die as a result of an
accident at the involved hazardous industry. Buildings for the general public are not acceptable
at locations where the individual risk exceeds one in a million (10
-6
) per year. Societal risk is
GCPS 2011 __________________________________________________________________________

defined as the probability per year that N or more persons outside the industry die in an accident
and is calculated for various values of N. In the Netherlands; no strict acceptance criteria are
defined for societal risk. Instead, the responsible public authorities must determine if the
calculated level of the societal risk is tolerable.

The use of the QRA outcomes for public decision-making for current and future land-use
requires a methodology that is transparent and robust ([2]). All stakeholders must be able to
verify the method and therefore only publicly accessible data can be used for the development of
the QRA methodology. The outcomes of the QRA should not depend on subjective choices of
risk analysts or differences in software tools. Therefore, the method to carry out a QRA is
prescribed by legislation, including the prescribed use of the Dutch QRA handbook ([3]) and the
software tool SAFETI-NL

([4]).

The external safety legislation currently applies to chemical industries, rail marshalling yards,
pesticide storages and several other hazardous activities. Onshore oil and gas production sites
and gas processing plants also impose risks on their surroundings and are planned to be included
in the external safety legislation in 2011. As a result, the existing handbook must be extended
with a methodology for onshore oil and gas production and processing sites. For reasons of
consistency, this new QRA method should follow the existing methodology for general chemical
industries ([3]) as much as possible.

This paper presents the new methodology for gas production and processing sites. Most effort
was paid to the risks related to releases from wells, and therefore the focus of this paper will be
on production sites. The hazardous activities involved and the release scenarios and frequencies
to be used in the quantitative risk analysis are described in Section 2. Section 3 will explain how
the consequences of the identified release scenarios are calculated in the Dutch context. An
illustration of the overall risk outcomes for a typical gas production site is presented in section 4.
It is noted that offshore activities are excluded from this study because protection of surrounding
populated areas is not relevant for offshore activities.

The project was carried out by NOGEPA (Netherlands Oil and Gas Exploitation and
Production Association) and RIVM (Dutch National Institute for Public Health and the
Environment) and was supervised by the ministries of I&M (Infrastructure and Environment)
and ELI (Economic Affairs, Agriculture and Innovation). International peers and experts from
the industry were consulted for specific parts of the project.

2. Activities, scenarios and frequencies

The activities discussed in this paper involve onshore production and injection of natural gas
and natural gas processing activities (cleaning and separation of produced streams). This
distinction is made because the production and processing do not always take place at the same
site. Table 1 provides an overview of all relevant activities. Many of the activities listed in Table
1 are not unique for the gas industry and, for these activities, release scenarios and failure
frequencies are already available in the Dutch QRA handbook for the chemical industry ([3]).

GCPS 2011 __________________________________________________________________________

New scenarios and/or frequencies were derived for three types of equipment. To start, no
scenarios and frequencies had previously been defined for well-related activities and the new
scenarios/frequencies are therefore discussed in detail in section 2.1. For two other activities, on-
site transportation through piping or pipelines and gas compression, scenarios and frequencies
were available from [3], but it was expected that the numbers cited in [3] were not applicable to
the high pressure equipment used in the gas industry. As a result, a substantial effort was made to
determine the failure frequencies for piping, interunit pipelines, and for compressors; the results
of these two studies are discussed in section 2.2 and section 2.3, respectively. The frequencies
obtained for piping can also be used for finger type slugcatchers.


Table 1 Natural gas production and processing: equipments used and release scenarios
Activity Associated equipment Reference

Well activities
Drilling and completion Wells Section 2.1
Production and injection Wells Section 2.1
Maintenance Wells Section 2.1

Gas processing
Separation of liquid and gas Vessel type slug catchers
Finger type slug catchers
Knock-out drums
[3], C.3.4 and C.3.5
See piping (section 2.2)
[3], C.3.4 and C.3.5
Drying and cleaning Adsorbers, scrubbers [3], C.3.4 and C.3.5
Heating and cooling Heat exchangers [3], C.3.12
Pumping and compression Pumps, compressors Section 2.3
Storage Pressure vessels
Atmospheric storage vessels
[3], C.3.4 and C.3.5
[3], C.3.6
Transport units Tank trucks, tank wagons and
ships
[3], C.3.14
Fuel gas system Small dimension pipes, vessels Not deemed relevant
Venting system Vent stacks Not deemed relevant
Drainage system Pipes, containment systems Not deemed relevant

Other
Piping Standard pipework
Piping (interunit pipelines)
[3], C.3.8
Section 2.2


2.1 Release scenarios and frequencies for well activities

For the current analysis, we considered wells that are used for the production of natural gas
from underground reservoirs and for the injection of gas. The maintenance of the well (well
interventions or services in jargon) is intrinsically related to production, and the risks related to
these activities were therefore also analyzed. Drilling was not considered in this study because
the legislative context for this one-time event is separately addressed.

GCPS 2011 __________________________________________________________________________

Figure 1 shows an example of a typical Western European onshore gas production well. The
well itself is shown in light-grey and the production tree in dark-grey. The well contains a
surface controlled subsurface safety valve (SCSSV) at a depth of 50 to 150 meters, and this can
be regarded as the lower end of the well head. The safety equipment fitted on top of the well and
the connections to joining flow lines is referred to as the production tree. As prescribed by the
North Sea Standard, the production tree contains a lower master gate valve and a surface safety
valve (or upper master gate valve) in addition to the wing valves and swab valve (see Figure 1).
During drilling operations, a blowout preventer is installed on top of the well in order to isolate
the well when necessary.


Figure 1 Schematization of a production well



Lower Master Gate Valve
Upper Master Gate Valve
Annulus
Valves
Kill Wing Valve
Swab Valve
Production
Wing Valve
Surface Controlled
Subsurface Safety Valve
(about 50-150 m deep)
Casing
Tubing
GCPS 2011 __________________________________________________________________________

A literature survey was carried out to determine the accident scenarios and frequencies for
well releases, and the SCANDPOWER report ([5]) turned out to be the most useful. The data in
this report are derived from the confidential SINTEF Offshore Blowout Database (see [6]),
which contains both accident data (more than 500 releases) and exposure data for the Gulf of
Mexico, the Outer Continental Shelf and the North Sea.

The SCANDPOWER report distinguishes between oil and gas wells and between various
types of operations (see
Table 2). The scenarios and frequencies in the SCANDPOWER report show good agreement
with data in other literature sources, such as [8], [9] and [10], which is logical because all these
references use the SINTEF database as their main source of information. In 2010, the
International Association of Oil & Gas Producers (OGP) also recommended using the
SCANDPOWER data for installations that follow the North Sea Standard
(1)
, including onshore
installations ([7]).

Although the SCANDPOWER report contains useful data, a few modifications were
necessary to obtain specific release scenarios. In line with the SINTEF database, the report
distinguishes between blowouts and well releases, and both are further subdivided in full
releases and restricted releases. We will show that only the distinction between full releases
and restricted releases is useful for our risk analysis.

In the SCANDPOWER report, blowouts are defined as incidents where formations fluid
flows out of the well or between formation layers after all the predefined technical well barriers
or the activation of the same has failed. A well release is defined as an incident where
hydrocarbons flow from the well at some point where flow was not intended and the flow was
stopped by use of the barrier system that was available on the well at the time of the incident.
This distinction therefore marks a difference in the release duration but not a difference in the
initial stage of the incident. In terms of risk, the difference between a blowout and a well
release is that the latter has a lower probability of delayed ignition, but it was not possible to
further quantify this difference
(2)
. As a result, we decided not to use the distinction between
blowout scenarios and well releases.

With respect to full releases and restricted releases, the SINTEF database does not
provide a clear definition. From personal communications with SINTEF, we learned that an
unrestricted tubing blowout is an example of a full release and that a leak from a casing is a
restricted release. Restricted releases thus have a smaller release rate than full releases. Because
detailed information on equivalent hole size was not available for the accidents in the SINTEF
database (or any other available data source), we decided to associate the full release with a full
bore release from the well and to associate the restricted release with a smaller leak scenario
(equivalent orifice diameter equal to 10% of the tubing diameter). This choice is in line with [3]
and was agreed upon by experts from the industry.


1
Reference [6] is recommended for installations in other parts of the world.
2
Both the time of ignition and the response time of the barriers (for a well release) are not reported in the SINTEF
database. Moreover, the majority of the installations are offshore, and it is questionable if offshore probabilities of
ignition can be used for onshore installations.
GCPS 2011 __________________________________________________________________________

The difference in the categorization of data between the SINTEF database and
SCANDPOWER report and our methodology is summarized below:















Apart from the different categorization of data, three additional modifications relating to the
derivation of frequencies were made:

1. The decreasing trend in time that was proposed by SCANDPOWER, was not used by
RIVM. SCANDPOWER claims that the frequencies for blowouts and well releases have
been decreasing since 1980 and advises the use of reduced frequencies for current
activities. We performed a statistical analysis and concluded that a statistically significant
reduction of frequencies could not be observed in the data. As a result, we decided to use
the entire data set and not to use a correction for an arguable trend in time.

2. A different method was used to derive mean frequencies. In the SCANDPOWER report,
the mean is calculated by dividing the number incidents by the number of experience
years. If the number of incidents is low, the uncertainty in the deduced frequency is high,
and as a result, these frequencies will be very sensitive to the possible occurrence of new
accidents. In order to be more conservative, we used the upper 95% limit of the one-sided
confidence interval of the mean frequency
(3)
. Depending on the number of accidents in a
scenario and the amount of equipment years of experience, the expectation values derived
by RIVM are up to 400% higher than the expectation values from SCANDPOWER.

3. An additional assumption had to be made for the release direction. The release direction
is not reported in the SINTEF database but is very relevant for the risk calculation. Using
expert opinion, we decided that all full releases (blowouts) should be vertical while a part
of the leaks could be horizontal. It was estimated that the number of horizontal releases
was 10% of the sum of full releases and limited releases.

The resulting failure frequencies are shown in
Table 2.


3
For the calculation of the confidence interval we assumed that the number of incidents is Poisson distributed.
full bore release (tubing- or casing diameter)


leak (equivalent hole size 10% of tubing diameter)
blowout, full release
well release, full release

blowout, restricted release
well release, restricted release
SINTEF / SCANDPOWER: RIVM methodology:
GCPS 2011 __________________________________________________________________________

Table 2 Release scenarios and proposed failure frequencies for natural gas wells
Type of activity Blow-out frequency Leak frequency Leak frequency
Vertical release Vertical release Horizontal release
Drilling
3.91 10
-4

per well
1.43 10
-4

per well
5.93 10
-5

per well
Completion
8.05 10
-4

per well
6.01 10
-4

per well
1.56 10
-4

per well
Production and injection
7.17 10
-5

per year
1.06 10
-4

per year
1.98 10
-5

per year
Wireline
2.25 10
-5

per activity
4.18 10
-5

per activity
7.14 10
-6

per activity
Coiled-tubing
5.54 10
-4

per activity
4.43 10
-4

per activity
1.11 10
-4

per activity
Workover
1.09 10
-3

per activity
9.47 10
-4

per activity
2.27 10
-4

per activity
Snubbing
6.63 10
-4

per activity
5.30 10
-4

per activity
1.33 10
-4

per activity


It was further assumed that a blowout during drilling, completion, workover or snubbing may
either be a blowout from the tubing or a blowout from the casing, with relative probabilities of
80% and 20%, respectively. For production, injection, wireline and coiled-tubing, all blowouts
were considered to be tubing blowouts.

2.2 Release scenarios and frequencies for piping and interunit pipelines

Another investigation was carried out to determine the release scenarios and frequencies for
the piping and interunit pipelines that are present at natural gas production and processing sites
(4)
. Although the Dutch QRA handbook ([3]) already contains data for general pipework and for
underground pipelines, it was unknown if these generic data could be applied to the high-
pressure piping and pipelines used in the gas industry. The aim of the study was to derive new
release scenarios and failure frequencies for flange connections and to update the failure
frequencies for high-pressure piping and interunit pipelines. The investigation comprised a study
of Dutch historical data, a literature and database survey, and a comparison of methods used in
various Western European countries. This paper only gives an overview of the work. A detailed
description is provided in [11].

As a start, the Dutch natural gas industry provided historical data for their onshore
installations. These data included the number of accidents and the total amount of equipment
experience years. The results are shown in


4
In [11], a distinction is made between pipework, piping and pipelines. The term pipework is used for process
pipes, which usually have a short length and diameter, are connected to process equipment and may be exposed to
significant changes in pressure or temperature. The term pipelines is used for pipes that transport products to a
remote part of the site (interunit pipelines) or to another site (transmission pipelines). The term piping is used for
pipes that are neither process pipes nor pipelines. Peaces of piping usually have a length substantially larger than
10 m and are not subject to significant changes in pressure or temperature.
GCPS 2011 __________________________________________________________________________

Table 3 (flanges) and Table 4 (piping). About 100 leaks were found for flanges. For all but one
of these leaks, the equivalent hole diameter was below 10 mm and these leaks were deemed
irrelevant for off-site risk. It was stressed that not a single rupture of a high-pressure gas pipeline
occurred during this period. Using the historical data, expectation values were deduced for the
leak and rupture frequencies. This was again done by taking the upper 95% limit of the one-sided
confidence interval (see section 2.1).

Flange leaks - The frequency that was derived for a leak from a flange connection was
expected to give a good estimate and it was therefore proposed to use this value in QRAs.
Rupture of a flange connection - Rupture of a flange connection, on the other hand, was
contended to be very unlikely. Flange connections are stronger than the attached
pipework, and therefore, during production, pipelines will sooner fail than flange
connections. An important prerequisite is that, before start-up of a plant, flange
connections are tested with inert gas before pressurization with natural gas.
Piping leak and rupture - For piping and pipelines, it was expected that the frequencies
that were derived from the historical data for leak and for rupture were too conservative
as a result of the method that was used and the limited amount of equipment experience
years in the data set. Therefore, it was investigated if failure data were available for other
types of pipework and pipelines and if an analogy could be used to translate these data to
frequencies for on-site piping and pipelines.


Table 3 Analysis of Dutch historical data for flanges
Release scenario Experience Accidents Frequency Used for QRA
Leak from flange
connection
1.8 million flange
connection years
1 2.610
-6

per connection per year
Yes
Rupture of flange
connection
1.8 million flange
connection years
0 1.710
-6

per connection per year
No


Table 4 Analysis of Dutch historical data for piping and interunit pipelines
Release scenario Experience Accidents Frequency Used for QRA
Leak from pipeline 2.8 million meter
years
0 1.110
-6

per meter per year
No
Rupture of pipeline 2.8 million meter
years
0 1.110
-6

per meter per year
No


Because insufficient historical data were available for the derivation of failure frequencies, a
literature and database survey was carried out to determine if other data sources could be used.
The literature survey showed that there was no publicly available source of failure statistics for
onshore high-pressure gas installations in general and for on-site piping and pipelines in
particular. Instead, it was recommended to further investigate the possible use of the UK
hydrocarbon releases (HCR) database system for offshore installations ([12], [13]), and the
European EGIG database for transmission pipelines (see [17]).
GCPS 2011 __________________________________________________________________________



HCR Database - The HCR database contains data from UK offshore installations since
1995 and is widely used for the derivation of release scenarios and failure frequencies
(e.g. [14], [15] and [16]). Our analysis, however, showed serious limitations on the use of
these data ([18]). Firstly, the dataset (0.6 million equipment years for flange connections
and 1.9 million meter years for pipelines) is smaller than the dataset obtained from the
Dutch gas industry. More importantly, no distinction is made in the HCR database
between small leaks, large leaks, and ruptures. Additional assumptions are required to
derive specific release scenarios, and the validity of these assumptions was deemed
questionable
(5)
. As a result, we decided not to use the HCR data for further analysis.
EGIG Database - The EGIG database contains data for European cross-country
transmission pipelines, and the data set for natural gas pipelines, is very large (3 billion
meter years experience). According to experts of the gas industry, the construction,
maintenance and use of cross-country transmission lines is comparable to on-site piping
and interunit pipelines ([19]); therefore, the possibility to use the EGIG data was further
investigated. The EGIG database for transmission pipelines distinguishes between
various causes, and some of these causes were deemed equally relevant for on-site piping
and interunit pipelines while other causes of accidents were expected to be irrelevant (see
Table 5). On the other hand, on-site lifting activities (LA) and vehicle movements (VM)
were identified as causes that could be relevant for on-site pipelines but would not lead to
accidents with cross-country transmission pipelines. These two accident causes should
therefore be considered in addition to the other relevant causes
(6)
.

A summary of the relevant accident causes for transmission pipelines and for on-site piping
and interunit pipelines is shown in Table 5. The resulting failure frequencies (95% percentile)
that were proposed for gas production and gas processing sites, are shown in Table 6.

Table 5 Relevance of various causes for transmission pipelines and interunit pipelines
Cause Included in the EGIG data
for transmission pipelines
Relevant for aboveground
interunit pipelines
External interference Yes No
Ground movement Yes No
Hot tap Yes No
Construction defect Yes Yes
Material failure Yes Yes
External corrosion Yes Yes
Other or unknown Yes Yes
On site lifting activities (LA) No Yes
On site vehicle movements (VM) No Yes

5
In [14], a frequency for rupture of a pipeline is derived from an extrapolation from small leak sizes. This approach
was also used in [16]. Extrapolation for small leaks to full bore ruptures is, however, disputable, especially because
different failure mechanisms apply to small leaks and full bore ruptures.
6
The contribution of lifting activities and vehicle movements should be added to the base frequency. A tool from
Advantica ([20]) can be used to quantify the contribution of these activities.
GCPS 2011 __________________________________________________________________________

Table 6 Proposed release scenarios and frequencies for piping and pipelines
Release scenario Experience Number of
accidents
Frequency Used for
QRA
Leak from the pipeline
(equivalent orifice size equal to 10%
of total pipe diameter)
3 billion meter
years
63 8.0 10
-8
per meter
per year without
LA and VM
(6)

Yes
Full bore rupture of the pipeline 3 billion meter
years
17 2.5 10
-9
per meter
per year without
LA and VM
(6)

Yes


2.3 Release scenarios and frequencies for high pressure compressors

A third investigation was carried out to determine the release scenarios and frequencies for
high-pressure compressors and pumps. The aim was to determine if the current data in the Dutch
QRA handbook ([3]), which were derived for general chemical industries, were applicable to
high-pressure compressors at gas production and processing sites. The project included a survey
of rule sets used for risk analysis in various countries, an analysis of Dutch historical data, a
database and literature survey, fault tree analysis (FTA), and failure mode and effect analysis
(FMEA). The focus of the study was on centrifugal and reciprocating compressors because these
two types are most widely used.

This paper only gives an overview of the outcomes. A detailed description of the work is
provided in [21] and [22]. The most important findings are:

1. Different databases use different definitions for a pump and a compressor. For example,
in the OREDA database ([23], [24]), a compressor comprises the entire compression
unit between the upstream and downstream block valves. This includes flanges, valves,
instrumentation and typically some 20 m of pipework. In the HCR database ([12]), a
compressor relates to the compressor body alone.

2. The difference in definitions mentioned above is particularly relevant for centrifugal
compressors. For this type of compressor, the study showed that a leak from connected
piping and equipment is more likely than a leak from the actual compressor body itself.

3. Small releases from compressor bodies may occur and should be taken into
consideration. Frequencies can be derived from the HCR database and are typically
higher for reciprocating pumps and compressors.

4. Catastrophic rupture of a (high-pressure) reciprocating pump or compressor body is
possible, but catastrophic rupture of high-pressure centrifugal pump or compressor body
is very unlikely due to the inherent strength of the compressor casing.

5. The majority of the reported accidents with compressors involves small compressor units
at offshore platforms. It is uncertain if the corresponding frequencies can also be used for
large compressors.
GCPS 2011 __________________________________________________________________________

6. For a compressor unit (compressor body with subsidiary equipment), leak or rupture of
inlet or outlet pipes is an important cause for accidents. This is most relevant for
centrifugal compressors because the compressor body of a centrifugal compressor cannot
fail catastrophically. Failure frequencies will therefore depend on the number of
subsidiary parts. A default number of pipes, valves and flanged joints was defined in the
research report ([22]); subsequently, failure rates could be derived using frequencies for
flanges and pipework taken from [14].

The resulting scenarios for various types of pumps and compressors are listed in
Table 7. It is emphasized that these numbers include the presence of subsidiary equipment.
Reference [22] can be used for further reading.

Table 7 Proposed frequencies for various release scenarios for different types of pumps
and compressors
Equipment type 10 mm leak 50 mm leak 150 mm leak Catastrophic
rupture / full
bore rupture
Canned pump or compressor
vessel type
similar to process vessels
Canned pump or compressor
magnetic drive type
similar to ordinary pump / compressor (not canned)
Centrifugal pump including
subsidiary equipment
5.8 10
-3
/ yr 3.4 10
-4
/ yr 2.4 10
-5
/ yr 1.2 10
-5
/ yr
Reciprocating pump including
subsidiary equipment
5.3 10
-3
/ yr 9.0 10
-4
/ yr 2.7 10
-4
/ yr 2.8 10
-4
/ yr
Centrifugal compressor including
subsidiary equipment
1.6 10
-2
/ yr 8.9 10
-4
/ yr 2.3 10
-4
/ yr 1.4 10
-4
/ yr
Reciprocating compressor -
including subsidiary equipment
7.0 10
-2
/ yr 4.3 10
-3
/ yr 7.7 10
-4
/ yr 6.5 10
-4
/ yr


3. Consequence analysis

The second step in the risk analysis involves the assessment of the consequences related to the
release scenarios that were defined in the previous section. All consequences are calculated with
SAFETI-NL ([4]), which is a software tool from Det Norske Veritas (DNV). As a result of the
desire to harmonize risk analyses in the Netherlands, the use of this software tool is already
prescribed by law for general chemical industries, and will be prescribed for oil and gas plants in
2011.
The assessment of release rates is discussed in section 3.1 and the fire and explosion
phenomena that are taken into account are listed in section 3.2. The translation of fire and
explosion phenomena to lethality is briefly outlined in section 3.3.


GCPS 2011 __________________________________________________________________________


3.1 Release characteristics

The existing Dutch QRA handbook describes in general how release scenarios should be
modeled in SAFETI-NL (see [3], Module B, Chapter 3 for more detail). The most commonly
used scenarios are catastrophic rupture of a vessel, leak from a vessel, and rupture or leak from a
pipeline. Some additional requirements are:

1. If the flow from adjacent equipment is significant
(7)
and not blocked by a valve, this
additional flow should be added to the flow from the failing equipment itself.

2. For all isolation systems such as Emergency Shut-Down (ESD) systems, both the
possibility of successful shut-down and the possibility of failing shut-down should be
included in the QRA. The probability of success and failure should be assessed and
justified by the industry (permit holder).

3. If the release rate is highly time-dependent, a time-averaged release rate over the first 20
seconds should be used for releases of flammable substances.

4. A scenario will be modeled as an instantaneous event if the release duration is 5
seconds
(8)
or less. In all other cases, it will be modeled as a continuous event.

5. The release direction is horizontal for aboveground installations and vertical for
underground equipment. For leaks from wells, a distinction is made between horizontal
releases and vertical releases (see section 2.1).

For blowouts, the release characteristics are calculated using the following assumptions.

Drilling, completion and workover During drilling, completion and workover, the well
is filled with fluid prior to the blowout. The blowout rate to be used in the risk analysis
for these operations is thus maximally equal to the inflow from the reservoir, that is, the
casing blowout potential (CBOP) or the tubing blowout potential (TBOP), depending on
the release scenario (see section 2.1). These blowout potentials must be assessed and
justified by the owner of the well.
Wireline and coiled-tubing - During wireline and coiled-tubing, the well is contained but
pressurized. The blowout rate can be calculated assuming an isolated pipeline that
initially has a pressure equal to the closed-in tubing-head pressure (CITHP).
Production and injection - During production and injection, the well is defined by stable
flow conditions. The blowout rate can be derived from the flowing tubing-head pressure
(FTHP), with additional inflow from the reservoir for production. For the blowout
scenario during production or injection, the possibility of gas flow from connected piping
and equipment should also be taken into account.

7
Additional flow is conceived to be significant if the quantity is 10% or more in comparison with the released mass
from the failing equipment or if the flow rate is 10% or higher than the flow rate from the failing equipment.
8
The value of 5 seconds is currently under debate, see discussion.
GCPS 2011 __________________________________________________________________________

In order to simplify the risk calculation, the consequences of natural gas releases are modeled
with methane, the consequences of unstabilized condensate or crude with butane and the
consequences of stabilized condensate and crude with hexane.

3.2 Fire and explosion events considered in the Dutch risk analyses

In order to be coherent with other hazardous activities, the event trees to be used for releases
of flammable materials were copied from the Dutch QRA handbook (see [3], Module B, 3.4.6).
An overview of the considered consequences is provided in
Table 8. A distinction is made between events for immediate ignition (e.g. fireball and jet fire)
and events for delayed ignition (vapor cloud fire and explosion). To a large extent, the event
trees of
Table 8 follow the historic development of the software, and some improvements are both
possible and desirable. However, it is not expected that the location of the risk contours will
change significantly if more realistic event trees would be used.

Table 8 Consequence events to be used according to the QRA handbook
Release phase Release type Time of ignition Consequence events in SAFETI-NL
Gaseous Instantaneous Immediate ignition Fireball, immediate fire and immediate
explosion
Delayed ignition Vapor cloud fire (flash fire) and vapor
cloud explosion
Continuous Immediate ignition Jet fire
Delayed ignition Vapor cloud fire (flash fire) and vapor
cloud explosion
Liquid Instantaneous Immediate ignition Fireball, immediate fire and immediate
explosion, with pool fire
Delayed ignition Vapor cloud fire (flash fire) and vapor
cloud explosion, with pool fire
Continuous Immediate ignition Jet fire with pool fire
Delayed ignition Vapor cloud fire (flash fire) and vapor
cloud explosion, with pool fire


The total probability of ignition is the sum of the probability of immediate ignition and the
probability of delayed ignition. The first is standardized and is shown in Table 9. Except for
releases of highly flashing liquids, the probability of immediate ignition is low. For the
probability of delayed ignition, the following rule set is used

1. If the area covered by the lower flammability (LFL) contour is partly outside the plant
site boundary, then the cloud is assumed to ignite with maximum probability (such that
probability of immediate ignition + probability of delayed ignition = 1).

2. If the area covered by the LFL is located entirely inside the plant site boundary, then the
probability of delayed ignition is derived from the presence of ignition sources and their
specific ignition probabilities (as a function of exposure duration).
GCPS 2011 __________________________________________________________________________

(The first rule is sometimes referred to as the free field assumption and is intentionally
conservative.)

Table 9 Immediate ignition probabilities
Substance involved Release quantity
(instantaneous release)
Release rate
(continuous release)
Probability of
immediate ignition
Natural gas 0 1000 kg 0 10 kg/s 0.02
1000 10,000 kg 10 100 kg/s 0.04
> 10,000 kg > 100 kg/s 0.09
Unstabilized condensate and
crude
0 1000 kg 0 10 kg/s 0.20
1000 10,000 kg 10 100 kg/s 0.30
> 10,000 kg > 100 kg/s 0.70
Stabilized condensate and
crude
all release quantities all release rates 0.065


3.3 Vulnerability criteria (individual risk)

As a last step, the impact of the considered fire and explosion phenomena should be translated
to a probability of lethality. The rule sets had already been defined for general chemical
industries (see [3], Module B, 3.4.9) and are therefore only briefly discussed.

1. For vapor cloud fires (flash fires), the probability of lethality is equal to one at all
locations inside the LFL contour and equal to zero outside this contour.

2. For prolonged fires, the probability of lethality is derived from the exposure to heat
radiation. The probability of lethality is equal to one if the heat radiation exceeds 35
kW/m
2
independent of exposure duration. For lower heat radiation levels, the probability
of lethality is calculated with the probit function from the Purple Book ([25]). The
maximum exposure duration is assumed to be 20 s. For this exposure duration, a level of
9.8 kW/m
2
corresponds to 1% lethality and 19.5 kW/m
2
corresponds to 50% lethality.

3. For explosions, the lethality is assumed to be one at locations where the overpressure
exceeds 300 mbar and equal to zero at all other locations.


4. Application of the methodology

4.1 Illustration for a typical Dutch onshore gas production site

In order to illustrate the methodology, a fictitious production site was defined with
dimensions that are typical for Dutch onshore installations. This site produces natural gas from a
250 bar reservoir at a depth of 3 km using four identical wells. The wells are connected to a
header and a transmission pipeline that transports the produced gas to a nearby gas processing
site (not further considered). Each well is fitted with a flow sensor and a choke valve which are
connected to the Distributed Control System (DCS), thereby guaranteeing a stable flow rate. The
GCPS 2011 __________________________________________________________________________

choke valve also acts as a non-return valve, preventing back flow from the header in case of a
blowout of the well. An ESD valve is installed between the header and the transmission pipeline
and will close in case of a blowout from one of the wells or a major release from the piping or
the header. The choke valves and the ESD valve all have a probability of failure on demand of
0.01. Further equipment details are provided in
Table 10.

Because the fictitious site only consists of production wells and piping, the release
scenarios are limited to blowouts and leaks from wells and ruptures and leaks of piping. The
most important outcomes per scenario are shown in Table 11. The most likely accidents are leaks
from the wells. These accidents only have a local effect with a maximum effect distance (1%
lethality) of 30 m. The release rates of the blowout scenarios vary between 35 and 70 kg/s. The
associated effect distances are between 45 and 65 m. The largest release rates and largest effect
distances are related to a rupture of the piping, the header or the transmission line. The
frequencies pertaining to these scenarios are, however, very small. The probability of ignition is
below 10% for all scenarios except horizontal releases that cross the site boundary (20 m away
from the wells and the piping). For the scenarios where the LFL is (partly) located outside the
site boundary, the probability of ignition is equal to 1 (see section 3.2).

Table 10 Technical details about the fictitious gas production site
Wells
Tubing diameter 5
Casing diameter 7
Depth of the reservoir 3000 m
Reservoir temperature 70 C
Reservoir pressure 250 bar
Closed-in tubing-head pressure 200 bar
Flowing tubing-head pressure 100 bar
Production rate 4 million Nm
3
per day (35 kg/s) per well
Natural gas molar weight 18 g/mol
Frequency of wireline activities once per year per well
Frequency of coiled-tubing activities 3 times per hundred years per well
Frequency of workover activities once per eight years per well
Frequency of snubbing activities never

Piping
Internal diameter of the piping 5
Pressure 100 bar
Length of the piping 4 10 m

Header and transmission line
Internal diameter 10
Pressure 100 bar
Length of the pipework 55 m

Other data
Meteorology Dutch average weather data used
GCPS 2011 __________________________________________________________________________

Table 11 Most important outcomes per scenario
Release scenario Total
release
frequency
Release
rate
Ignition
prob.
Distance to
1% lethality
(worst case
9
)
Well scenarios
Production blowout (tubing) (choke valve closes) 2.810
-4
/yr 50 kg/s 0.04 50 m
Production blowout (tubing) (choke valve fails) 2.910
-6
/yr 185 kg/s 0.09 100 m
Production vertical leak 4.410
-4
/yr 2 kg/s 0.02 10 m
Production horizontal leak 8.010
-5
/yr 2 kg/s 0.02 20 m
Wireline blowout (tubing) 9.210
-5
/yr 70 kg/s 0.04 65 m
Wireline vertical leak 1.710
-4
/yr 4 kg/s 0.02 15 m
Wireline horizontal leak 2.810
-5
/yr 4 kg/s 1.00 30 m
Coiled-tubing blowout (tubing) 6.810
-5
/yr 70 kg/s 0.04 65 m
Coiled-tubing vertical leak 5.210
-5
/yr 4 kg/s 0.02 15 m
Coiled-tubing horizontal leak 1.310
-5
/yr 4 kg/s 1.00 30 m
Workover blowout (casing) 1.110
-4
/yr 70 kg/s 0.04 60 m
Workover blowout (tubing) 4.410
-4
/yr 35 kg/s 0.04 45 m
Workover vertical leak 4.810
-4
/yr 1 kg/s 0.02 5 m
Workover horizontal leak 1.110
-4
/yr 1 kg/s 0.02 10 m

Piping scenarios
Full bore rupture of piping (ESD effective) 3.210
-7
/yr 145 kg/s 1.00 155 m
Full bore rupture of piping (ESD fails) 3.210
-9
/yr 200 kg/s 1.00 180 m
Leak from piping 1.110
-5
/yr 2 kg/s 1.00 20 m
Full bore rupture of transmission line (ESD effect.) 4.410
-7
/yr 145 kg/s 1.00 155 m
Full bore rupture of transmission line (ESD fails) 4.410
-9
/yr 370 kg/s 1.00 240 m
Leak from transmission line 1.410
-6
/yr 7 kg/s 1.00 40 m


The individual risk contours are shown in Figure 2. In the Dutch context, the IR 10
-6
/yr
contour is most important because various types of buildings are unacceptable or highly
undesirable inside this contour (see [2] for more information). This contour is located at 25 m
distance from the site boundary (45 m from the wells and piping). The location of this contour
depends entirely on the risks associated with the blowout scenarios. From 70 m onwards, the risk
is determined by a potential rupture of the piping, the header or the transmission pipeline. In this
area, new constructions can be developed with moderation. The IR 10
-9
/yr contour is located at
150 m distance from the centre of the production site.

The location of the IR 10
-6
/yr contour is most sensitive to the behavior of the choke valves.
If the choke valves were not to act as non-return valves, the release rate for a blowout during
production would increase from 50 kg/s to 185 kg/s. The IR 10
-6
/yr contour would subsequently
expand about 35 m in all directions.

9
In SAFETI-NL, consequences are calculated for six different weather types (stability class and wind speed). The
reported values are the largest values.
GCPS 2011 __________________________________________________________________________

Figure 2 Individual risk outcome for the fictitious gas production site



4.2 Application of the methodology to other activities

The example in the previous section consisted of a fairly simple installation with dimensions
that are typical for Dutch onshore gas production. The location of the IR 10
-6
/yr contour was
determined entirely by the effect distances associated with the various blowout scenarios. This
observation also proved to be valid for gas production sites of other dimensions. As a result, it is
possible to derive safety distances for gas production sites that only depend on the tubing
diameter and the closed-in tubing-head pressure.

The offsite risks of gas processing plants can be calculated using the methodology
described in section 2 and 3. However, because these sites are far more diverse than gas
production sites, it was not deemed feasible to define a typical case. Several risk analyses that
were recently carried out have shown that the risks associated with these activities are
significantly larger than the risks of production. This can be explained by the fact that more
equipment is present at these sites and that the majority of this equipment is located above-
ground. This results in a larger number of release scenarios, a higher cumulative release
frequency, a larger number of horizontal releases, and higher associated probabilities of ignition.
An IR 10
-6
/yr contour that is located at several hundreds of meters distance from the boundary of
the gas processing site is not exceptional.

GCPS 2011 __________________________________________________________________________

5. Conclusion

A methodology was developed to calculate off-site risk for onshore oil and gas production
and processing sites. New release scenarios and failure frequencies were defined for various
activities relating to the production of oil and gas from wells. The scenarios commonly used in
the literature (blowouts and well release) were modified because the distinction between the two
was not related to a difference in the initial release rate. Frequencies were updated for high-
pressure piping and interunit pipelines and for pumps and compressors. In both cases, it was
shown that the existing data in the public literature were not valid for the high-pressure
equipments that were considered in this paper.

In the Netherlands, buildings for the general public may not be present inside the IR 10
-6
/yr
contour of a hazardous activity. For natural gas production sites, the location of this contour
depends entirely on the consequence distances that are associated with blowout scenarios. For
well with a 5 inch tubing and a closed-in tubing-head pressure of 200 bar, the IR 10
-6
/yr contour
is located at 45 m distance from the wells.

The risk imposed by gas processing plants is generally larger than the risk imposed by
natural gas production sites. This is a result of the fact that more equipment is present at these
sites and most equipment is located aboveground. Because natural gas processing sites are not
standardized, it is not possible to assess the risks without carrying out a full quantitative risk
analysis.


6. Acknowledgements

The authors wish to thank the Dutch Ministry of Infrastructure and Environment for financing
this work. Many colleagues and peers were involved in parts of the project, and their help was
very much appreciated. A word of special gratitude is reserved for Schelte Rozendal from the
Nederlandse Aardolie Maatschappij, who has been willing to explain technical issues and to
provide data and examples on many occasions.


7. References

[1] Dutch external safety degree (Besluit externe veiligheid inrichtingen), Dutch Ministry of
Housing Spatial Planning and the Environment (VROM), First issue 2004, current issue
2009 (in Dutch)
[2] Uijt de Haag, Gooijer and Frijns, Quantitative risk calculation for land use decisions: the
validity and the need for unification, Proceedings of the International Conference on
Probabilistic Safety Assessment and Management (PSAM) 2008, 2008
[3] Reference Manual Bevi Risk Assessments version 3.2, RIVM, 2009
[4] SAFETI-NL, version 6.54, Det Norske Veritas (DNV), release 2009
[5] Blowout & Well Release data, Report no. 80.005.003.2008-R3, SCANDPOWER, 2008
GCPS 2011 __________________________________________________________________________

[6] Blowout and Well Release Characteristics and Frequencies, Report no. STF50 F06112,
SINTEF, 2006
[7] Blowout Frequencies, Report no. 434-02, International Association for Oil and Gas
Producers (OGP), 2010
[8] Holand, P., Offshore Blowouts Data for Risk Assessment, OMAE Volume II, Safety
and Reliability ASME, 427-434, 1995
[9] Holand, P., Offshore Blowouts Causes and Control, ISBN 0-88415-514-5, 1997
[10] Joffre, G-H. and LePrince, A., Database for major accidents on underground gas storage
facilities, Marcogaz Report DES.ST-GHJ/TLA-2000.00023, 2002
[11] Van Vliet, A.A.C., Gooijer L. and Laheij, G.M.H., On-site natural gas piping
Scenarios and failure frequencies, Report no. RIVM 620550001/2010, RIVM, 2011
[12] Hydrocarbon releases system (a.k.a. Hydrocarbon Releases Database System),
www.hse.gov.uk/hcr3
[13] Offshore Hydrocarbon Releases 2001-2008, Report no. RR672, UK Health and Safety
Executive, 2008
[14] Spouge J., New Generic Leak Frequencies for Process Equipment, Process Safety
Progress, Vol. 24, No. 4, 2005
[15] Falck A., Bain B., Rdstre LK., Leak Frequency modeling for offshore QRA based on
the Hydrocarbon Release Database (HCRD), Proceedings of the Hazards XXI
symposium, 2009
[16] Process release frequencies, Report No. 434-1, International Association of Oil & Gas
Producers (OGP), 2010
[17] Gas pipeline incidents 1970-2007, Report no. 8.TV-B.0502, EGIG, 2008
[18] Crossthwaite, P., The HCR database Its Potential for Use at Above Ground Gas
Facilities, Report no. EP028197, DNV, 2010
[19] Acton M.R., Estimating failure frequencies for above-ground pipelines, Report no.
10287.2011, GL Noble Denton, 2011
[20] Cooper, M.G., Failure frequency of above ground pipework due to impact damage,
Advantica, 2003
[21] Uijt de Haag, P.A.M., Failure data analysis of pumps and compressors (in progress),
RIVM, 2011
[22] Failure Data Analysis Pumps & Compressors Research Report, Report no. 680-3231-
R001, Arcadis Vectra, 2010
[23] Offshore Reliability Data (OREDA), wwww.oreda.com
[24] Offshore reliability data handbook 4th edition, SINTEF, 2002
[25] Guidelines for quantitative risk assessment (Purple Book), Part one: Establishments,
RIVM, 1999