Journal of Hazardous Materials A137 (2006) 681–691

Barrier and operational risk analysis of hydrocarbon releases

(BORA-Release)
Part I. Method description
Terje Aven b , Snorre Sklet a,∗ , Jan Erik Vinnem b
a Department of Production and Quality Engineering, The Norwegian University of Science and Technology (NTNU), NO-7491 Trondheim, Norway
b University of Stavanger (UiS), NO-4036 Stavanger, Norway

Received 2 December 2005; received in revised form 14 March 2006; accepted 15 March 2006
Available online 3 May 2006

Abstract
Investigations of major accidents show that technical, human, operational, as well as organisational factors influence the accident sequences. In
spite of these facts, quantitative risk analyses of offshore oil and gas production platforms have focused on technical safety systems. This paper
presents a method (called BORA-Release) for qualitative and quantitative risk analysis of the platform specific hydrocarbon release frequency. By
using BORA-Release it is possible to analyse the effect of safety barriers introduced to prevent hydrocarbon releases, and how platform specific
conditions of technical, human, operational, and organisational risk influencing factors influence the barrier performance. BORA-Release comprises
the following main steps: (1) development of a basic risk model including release scenarios, (2) modelling the performance of safety barriers,
(3) assignment of industry average probabilities/frequencies and risk quantification based on these probabilities/frequencies, (4) development
of risk influence diagrams, (5) scoring of risk influencing factors, (6) weighting of risk influencing factors, (7) adjustment of industry average
probabilities/frequencies, and (8) recalculation of the risk in order to determine the platform specific risk related to hydrocarbon release. The various
steps in BORA-Release are presented and discussed. Part II of the paper presents results from a case study where BORA-Release is applied.
© 2006 Elsevier B.V. All rights reserved.

Keywords: Risk analysis; Hydrocarbon release; Loss of containment; Safety barrier; Organisational factors

1. Introduction Several models and methods for incorporating organisational

factors in QRAs or probabilistic risk assessments (PRA) have
In-depth investigations of major accidents, like the process been proposed. Among these are Manager [10], MACHINE
accidents at Longford [1] and Piper Alpha [2], the loss of the (Model of Accident Causation using Hierarchical Influence
space shuttles Challenger [3] and Colombia [4], the high-speed Network) [11], ISM (Integrated Safety Method) [12], WPAM
craft Sleiper accident [5], the railway accidents at Ladbroke (The Work Process Analysis Model) [13,14], I-RISK (Integrated
Grove [6] and Åsta [7], and several major accidents in Norway Risk) [15–17], the ␻-factor model [18], SAM (System Action
in the last 20 years [8] show that both technical, human, oper- Management) [19,20], ORIM (Organisational Risk Influence
ational, as well as organisational factors influence the accident Model) [21,22], and ARAMIS [23]. These models/methods have
sequences. In spite of these findings, the main focus in quanti- been developed and described in the literature in the last 15 years.
tative risk analyses (QRAs) is on technical safety systems. As However, none of them are so far used as an integrated part of
regards offshore QRAs, one of the conclusions drawn by Vin- offshore QRAs.
nem et al. [9] is that a more detailed analysis of all aspects of The Petroleum Safety Authority Norway (PSA) gives several
safety barriers is required. requirements to risk analysis and safety barriers in their regula-
tions [24] and one is that QRAs shall be carried out to identify
DOI of original article:10.1016/j.jhazmat.2006.03.027.
contributors to major accident risk and provide a balanced and
∗ Corresponding author. Tel.: +47 73 59 29 02; fax: +47 73 59 28 96. comprehensive picture of the risk. Nevertheless, existing QRAs
E-mail address: [email protected] (S. Sklet). of offshore platforms are limited to analysis of consequence

0304-3894/$ – see front matter © 2006 Elsevier B.V. All rights reserved.
doi:10.1016/j.jhazmat.2006.03.049
682 T. Aven et al. / Journal of Hazardous Materials A137 (2006) 681–691

reducing barriers with no, or limited analysis of barriers intro- (3) Reflects different causes of hydrocarbon releases.
duced to reduce the probability of hydrocarbon release. Thus, (4) Is suited for quantification of the frequency of initiating
there is need for a method that may be applied to analyse safety events and the performance of the barriers.
barriers introduced to prevent hydrocarbon releases. The method (5) Allows use of available input data as far as possible.
should be applicable for qualitative and quantitative analyses (6) Allows consideration of different activities, phases, and con-
of the effect on the barrier performance, and thus the risk, of ditions.
plant specific conditions of technical, human, operational, as (7) Enables identification of common causes and dependencies.
well as organisational risk influencing factors (RIFs). With this (8) Is practically applicable regarding use of resources.
background, the BORA-project (Barrier and Operational Risk (9) Provides a basis for “re-use” of the generic model in such
Analysis) was initiated [25]. a way that installation specific considerations may be per-
The main objective of this paper is to present and discuss formed in a simple and not too time-consuming manner.
a new method for qualitative and quantitative analyses of the
platform specific hydrocarbon release frequency, called BORA- A literature review was carried out in order to identify exist-
Release. BORA-Release combines use of barrier block dia- ing methods incorporating the effect of organisational factors
gram/event trees, fault trees, and risk influence diagrams in order in QRAs. Several models and methods for quantification of
to analyse the risk of hydrocarbon release from a set of hydro- the influence of organisational factors on the total risk are
carbon release scenarios. BORA-Release makes it possible to described in the literature [10–23]. These models and meth-
analyse the effect on the hydrocarbon release frequency of safety ods were reviewed and compared in view of the criteria (1)–(9)
barriers introduced to prevent release, and how platform specific above. The review was partly based on a framework for eval-
conditions of technical, human, operational, and organisational uation of models/methods for this type of risk analyses [27].
RIFs influence the barrier performance. The paper is limited to None of the models/methods were directly applicable for anal-
analysis of hydrocarbon release (or loss of containment). How- ysis of platform specific release frequencies including analysis
ever, the principles in BORA-Release are relevant for analysis of the effect of safety barriers introduced to prevent release and
of the consequence barriers as well. analysis of how platform specific conditions of RIFs influence
The paper is organised as follows. Section 2 describes the pro- the barrier performance. However, the comparison resulted in
cess for development of the method. Section 3 describes BORA- knowledge about the existing methods used as basis for devel-
Release. Section 4 discusses critical issues of the method. The opment of BORA-Release.
discussion is divided in two parts: a discussion of the different An assessment of the suitability of some existing modelling
steps in BORA-Release, and a discussion of the extent of fulfil- techniques was carried out in order to select an approach for
ment of a set of criteria. Some conclusions and ideas for further analyses of the release scenarios. The following techniques were
work are presented in Section 5. Part II [26] presents some results assessed: (a) the current practice in QRAs, (b) fault tree analysis,
from a case study where BORA-Release is applied. (c) barrier block diagram (corresponds to event tree analysis),
and (d) an overall influence diagram. The assessment was based
2. Research approach on a discussion of advantages and disadvantages of the different
methods and an attempt to “score” the different modelling tech-
The research process for development of BORA-Release con- niques according to fulfilment of the former described criteria.
sists of the following main steps: The assessment is shown in Table 1. A score of 1 indicates “not
suitable”, and a score of 5 indicates “very suitable”.
(1) Development of a set of criteria the method should fulfil. Based on this suitability assessment and the literature
(2) Literature review. review, it was concluded to apply barrier block diagrams to
(3) Selection of modelling approach. model the hydrocarbon release scenarios and fault tree analy-
(4) Development of a preliminary (draft) version of the method. ses and/or risk influence diagrams to model the performance
(5) Application of the method in case studies. of different barrier functions (“blocks” in the barrier block
(6) Revision of the method. diagram).
Next, a preliminary version of BORA-Release was devel-
Several criteria the BORA-Release should fulfil were devel- oped. This version was discussed in the BORA project group
oped. The criteria were developed as a result of discussions of the and led to some modifications. Further, the method was reviewed
purpose of the analysis method. To what extent BORA-Release by the BORA steering committee. A case study carried out in
fulfils these criteria are discussed in Section 4.2. The aim was order to test BORA-Release in practice is described in Part II of
to develop a method that: this paper [26]. The experience from the case study led to some
adjustments of the method and this paper presents the revised
version.
(1) Facilitates identification and illustration of safety barriers
planned to prevent hydrocarbon releases.
(2) Contributes to an understanding of which factors (technical, 3. Description of BORA-Release
human, operational, and organisational) that influence the
performance of the safety barriers and the risk. BORA-Release consists of the following main steps:
 T. Aven et al. / Journal of Hazardous Materials A137 (2006) 681–691 683

Table 1
Comparison of various modelling techniques
No. Criteria Current QRA Fault tree Barrier block diagram Overall influence diagram

1 Facilitate identification and illustration of safety 1 3 5 2

barriers
2 Contribute to an understanding of which factors that 1 3 4 3
influence the performance of the barrier functions
3 Reflect different causes of hydrocarbon release 1 4 4 4
4 Be suitable for quantification of the frequency of 5 3 3 2
initiating events and the performance of safety
barriers
5 Allow use of relevant data 5 3 3 2
6 Allow consideration of different activities, phases, 2 3 4 2
and conditions
7 Enable identification of common causes and 1 4 5 5
dependencies
8 Be practically applicable regarding use of resources 5 2 3 2
9 Provides “re-use” of the generic model 1 3 5 4
Total score of modelling approach 22 28 36 26

(1) Development of a basic risk model including hydrocarbon duced to prevent hydrocarbon release. A representative set of 20
release scenarios and safety barriers. hydrocarbon release scenarios has been developed and described
(2) Modelling the performance of safety barriers. [28]. Examples are: (a) release due to mal-operation of valve(s)
(3) Assignment of industry average probabilities/frequencies during manual operations, (b) release due to incorrect fitting
and risk quantification based on these probabilities/ of flanges or bolts during maintenance, and (c) release due to
frequencies. internal corrosion.
(4) Development of risk influence diagrams. The basic risk model is illustrated by barrier block diagrams
(5) Scoring of risk influencing factors (RIFs). (see Fig. 1). A barrier block diagram consists of an initiating
(6) Weighting of risk influencing factors. event, arrows that show the event sequence, barrier functions
(7) Adjustment of industry average probabilities/frequencies. realized by barrier systems, and possible outcomes. A horizontal
(8) Recalculation of the risk in order to determine the platform arrow indicates that a barrier system fulfils its function, whereas
specific risk. an arrow downwards indicates failure to fulfil the function. In
our case, the undesired event is hydrocarbon release (loss of con-
3.1. Development of a basic risk model tainment). Hydrocarbon release in this context is defined as gas
or oil leaks (including condensate) from the process flow, well
The first step is to develop a basic risk model that covers flow or flexible risers with a release rate greater than 0.1 kg/s.
a representative set of hydrocarbon release scenarios. The pur- Smaller leaks are called minor release or diffuse discharges. A
pose is to identify, illustrate, and describe the scenarios that may barrier block diagram corresponds to an event tree and can be
lead to hydrocarbon release on a platform. The basic risk model used as a basis for quantitative analysis.
forms the basis for the qualitative and quantitative analyses of An initiating event for a release scenario is the first significant
the risk of hydrocarbon release and the safety barriers intro- deviation from a normal situation that under given circumstances

Fig. 1. Barrier block diagram; scenario “Release due to incorrect fitting of flanges or bolts during maintenance”.
684 T. Aven et al. / Journal of Hazardous Materials A137 (2006) 681–691

Fig. 2. Risk influence diagram; basic event “Checker fails to reveal a valve in wrong position”.

may cause a hydrocarbon release (loss of containment). A “nor- tions since plant specific data should be applied when possible.
mal situation” is a state where the process functions as normal Plant specific data may be found in, e.g. incident databases, log
according to design specifications without significant process data, and maintenance databases. In practice, extensive use of
upsets or direct interventions into the processing plant. Exam- industry average data is necessary to be able to carry out the
ples on initiating events are: (a) valve in wrong position after quantitative analysis. Several databases are available presenting
manual operations, (b) incorrect fitting of flanges or bolts dur- industry average data like OREDA [31] for equipment reliabil-
ing maintenance, and (c) internal corrosion beyond critical limit. ity data, and THERP [32] and CORE-DATA [33,34] for human
A barrier function is defined as a function planned to prevent, reliability data (see [35] for an overview of data sources). In
control, or mitigate undesired events or accidents [29]. A bar- some cases, neither plant specific data nor generic data may be
rier system is a system designed and implemented to perform found, and it may be necessary to use expert judgment to assign
one or more barrier functions. A barrier system may consist of probabilities.
different types of system elements, for example, technical ele-
ments (hardware, software), operational activities executed by 3.4. Development of risk influence diagrams
humans, or a combination thereof.
Step (4) is to develop risk influence diagrams. The purpose
3.2. Modelling the performance of safety barriers is to incorporate the effect of the plant specific conditions of
human, operational, organisational, and technical RIFs on the
The next step is to model the performance of safety barriers occurrences (frequencies) of the initiating events and the barrier
in order to analyse the plant specific barrier performance taking performance. Examples on risk influence diagrams for the basic
platform specific conditions of human, operational, organisa- events “Checker fails to reveal valve in wrong positions” and
tional, and technical factors into consideration. The following “Failure to detect leak in the leak test” are shown in Figs. 2 and 3.
attributes regarding performance of safety barriers should be If necessary, we have to develop one risk influence diagram for
allowed for in the analysis [29]: (a) functionality or effective- each basic event.
ness, (b) reliability/availability, (c) response time, (d) robustness, Due to the complexity and variation in the types of events
and (e) the triggering event or condition. considered, a combined approach is preferred in order to identify
Fault tree analysis is used for analysis of barrier performance RIFs: (1) a top–down approach where a generic list of RIFs is
in BORA-Release. The “generic” top event in the fault trees in used as a basis, and (2) a bottom–up approach where the events
BORA-Release is “Failure of a barrier system to perform the to be assessed are chosen as a starting point. This implies that
specified barrier function”. This generic top event needs to be specific RIFs are identified for each initiating event and each
adapted to each specific barrier in the different scenarios (e.g. basic event from the generic list of RIFs. The generic list may
“Failure to reveal valve in wrong position after maintenance by be supplemented by new RIFs when necessary.
3rd party control” and “Failure to detect diffuse discharge of The framework for identification of RIFs consists of the fol-
hydrocarbons by area based leak search”). The results from the lowing main groups of RIFs:
qualitative fault tree analyses are a list of basic events and an
overview of (minimal) cut sets [30]. • Characteristics of the personnel performing the tasks.
• Characteristics of the task being performed.
3.3. Assignment of industry average • Characteristics of the technical system.
probabilities/frequencies and risk quantification based on
these probabilities

The purpose of step (3) is to assign probabilities/frequencies

to the initiating events and the basic events in the fault trees
and carry out a quantitative analysis of the risk of hydrocarbon
release by use of these probabilities/frequencies (quantitative
analysis of the event trees and the fault trees). The results of Fig. 3. Risk influence diagram; basic event “Failure to detect leak in the leak
this calculation may to some degree reflect plant specific condi- test”.
 T. Aven et al. / Journal of Hazardous Materials A137 (2006) 681–691 685

Table 2
Descriptions of risk influencing factors
RIF group RIF RIF description

Personal Competence Cover aspects related to the competence, experience, system knowledge and training of personnel
characteristics Working load/stress Cover aspects related to the general working load on persons (the sum of all tasks and activities)
Fatigue Cover aspects related to fatigue of the person, e.g. due to night shift and extensive use of overtime
Work environment Cover aspects related to the physical working environment like noise, light, vibration, use of chemical
substances, etc.
Task characteristics Methodology Cover aspects related to the methodology used to carry out a specific task
Task supervision Cover aspects related to supervision of specific tasks by a supervisor (e.g. by operations manager or
mechanical supervisor)
Task complexity Cover aspects related to the complexity of a specific task
Time pressure Cover aspects related to the time pressure in the planning, execution and finishing of a specific task
Tools Cover aspects related to the availability and operability of necessary tools in order to perform a task
Spares Cover aspects related to the availability of the spares needed to perform the task
Characteristics of the Equipment design Cover aspects related to the design of equipment and systems such as flange type (ANSI or compact),
technical system valve type, etc.
Material properties Cover aspects related to properties of the selected material with respect to corrosion, erosion, fatigue,
gasket material properties, etc.
Process complexity Cover aspects related to the general complexity of the process plant as a whole
HMI (human machine interface) Cover aspects related to the human–machine interface such as ergonomic factors, labelling of
equipment, position feedback from valves, alarms, etc.
Maintainability/accessibility Cover aspects related to the maintainability of equipment and systems like accessibility to valves and
flanges, space to use necessary tools, etc.
System feedback Cover aspects related to how errors and failures are instantaneously detected, due to alarm, failure to
start, etc.
Technical condition Cover aspects related to the condition of the technical system
Administrative Procedures Cover aspects related to the quality and availability of permanent procedures and job/task descriptions
control Work permit Cover aspects related to the system for work permits, like application, review, approval, follow-up,
and control
Disposable work descriptions Cover aspects related to the quality and availability of disposable work descriptions like safe job
analysis (SJA) and isolation plans
Organisational Programs Cover aspects related to the extent and quality of programs for preventive maintenance (PM),
factors/operational condition monitoring (CM), inspection, 3rd party control of work, use of self control/checklists, etc.
philosophy One important aspect is whether PM, CM, etc. is specified
Work practice Cover aspects related to common practice during accomplishment of work activities. Factors like
whether procedures and checklists are used and followed, whether shortcuts are accepted, focus on
time before quality, etc.
Supervision Cover aspects related to the supervision on the platform like follow-up of activities, follow-up of
plans, deadlines, etc.
Communication Cover aspects related to communication between different actors like area platform manager,
supervisors, area technicians, maintenance contractors, CCR technicians, etc.
Acceptance criteria Cover aspects related to the definitions of specific acceptance criteria related to for instance condition
monitoring, inspection, etc.
Simultaneous activities Cover aspects related to amount of simultaneous activities, either planned (like maintenances and
modifications) and unplanned (like shutdown)
Management of changes Cover aspects related to changes and modifications

• Administrative control (procedures and disposable work (b) organisational factors in models for analysis of the influence
descriptions). of organisational factors on risk like I-RISK [15] and WPAM
• Organisational factors/operational philosophy. [13,38], and (c) performing shaping factors (PSFs) in meth-
ods for human reliability analysis (HRA), like THERP [32],
CREAM [39], SLIM-MAUD [40], and HRA databases (CORE-
The detailed taxonomy of generic RIFs is shown in Table 2. DATA [41]).
A brief explanation of each RIF is included in the last column.
The proposed RIF framework and the taxonomy of generic RIFs
are based on a review, comparison, and synthesis of several 3.5. Scoring of risk influencing factors
schemes of classification of human, technical, and organisa-
tional (MTO) factors and experience from the case study. The We need to assess the status of the RIFs on the platform.
schemes includes classification of: (a) causes in methods for The aim is to assign a score to each identified RIF in the risk
accident investigations (MTO-analysis [36] and TRIPOD [37]), influence diagrams. Each RIF is given a score from A to F, where
686 T. Aven et al. / Journal of Hazardous Materials A137 (2006) 681–691

Table 3 3.6. Weighting of risk influencing factors

Generic scheme for scoring of RIFs
Score Explanation Weighting of the RIFs is an assessment of the effect (or impor-
A Status corresponds to the best standard in industry
tance) the RIFs has on the frequency of occurrence of the basic
B Status corresponds to a level better than industry average events. The weights of the RIFs correspond to the relative dif-
C Status corresponds to the industry average ference in the frequency of occurrence of an event if the status
D Status corresponds to a level slightly worse than industry average of the RIF is changed from A (best standard) to F (worst prac-
E Status corresponds to a level considerably worse than industry average tice). The weighting of the RIFs is done by expert judgment.
F Status corresponds to the worst practice in industry
In practice, the assessment of the weights is based on a general
discussion of the importance with platform personnel and the
analysts where the following principles are applied:
score A corresponds to the best standard in the industry, score
C corresponds to industry average, and score F corresponds to (1) Determine the most important RIF based on general discus-
worst practice in the industry (see Table 3). The six-point scale sions.
is adapted from the TTS (Technical Condition Safety) project (2) Give this RIF a relative weight equal to 10.
[42]. (3) Compare the importance of the other RIFs with the most
Several methods for assessing organisational factors are important one, and give them relative weights on the scale
described in the literature (e.g. see [38]). Three approaches for 10–8–6–4–2.
assignment of scores of the RIFs are described in this paper: (1) (4) Evaluate if the results are reasonable.
direct assessment of the status of the RIFs, (2) assessment of
status by use of results from the TTS projects, and (3) assess-
The weights are normalized as the sum of the weights for the
ment of status by use of results from the RNNS (Risk Level on
RIFs influencing a basic event should be equal to 1.
the Norwegian Continental Shelf) project [43].
Direct assessment of the status of the RIFs in the risk influence
diagrams may be carried out in a RIF audit. Usually, a RIF audit 3.7. Adjustment of industry average
is carried out by structured interviews of key personnel on the probabilities/frequencies
plant and observations of work performance. Useful aids are
behavioural checklists and behaviourally anchored rating scales Further, the industry average probabilities/frequencies used
(BARS) [38]. In addition, surveys may be used as part of the in the quantitative analysis are adjusted. The purpose is to assign
RIF audit as supplement to the other techniques. platform specific values to the input probabilities/frequencies
The TTS project proposes a review method to map and mon- allowing for platform specific conditions of the RIFs. The indus-
itor the technical safety level on offshore platforms and land- try average probabilities/frequencies are revised based on the
based facilities based on the status of safety critical elements, risk influence diagrams through an assessment of the weights
safety barriers, and their intended function in major accidents and the status of the RIFs. The following principles for adjust-
prevention [42]. The TTS project is based on a review technique ment are proposed:
using defined performance requirements described in perfor- Let Prev (A) be the “installation specific” probability (or fre-
mance standards for 19 areas. The condition of safety barriers is quency) of occurrence of event A. The probability Prev (A) is
measured against these performance requirements. A number of determined by the following procedure:
examination activities are defined and used to check each per- n


formance requirement, including document reviews, interviews, Prev (A) = Pave (A) wi Qi (1)
visual inspections, and field tests. A six-point scoring scheme is i=1
used in the TTS project that may be directly transformed to the
scores in Table 3. where Pave (A) denotes the industry average probability of occur-
Finally, the assessment of the status of the RIFs may be based rence of event A, wi denotes the weight (importance) of RIF no.
on results from the RNNS project [43] and accident investiga- i for event A, Qi is a measure of the status of RIF no. i, and n is
tions. The RNNS project includes a broad questionnaire sur- the number of RIFs. Here:
vey, which addresses general health, environmental, and safety n


(HES) aspects, risk perception, and safety culture. The surveys wi = 1 (2)
are conducted once every second year. Data may be provided i=1
as average values for the entire industry, as well as on platform
specific basis. By selecting relevant questions from the survey, The challenge is now to determine appropriate values for Qi
these data may provide input to scoring of the RIFs for differ- and wi . To determine the Qi ’s we need to associate a number to
ent platforms. However, the data should be further analysed to each of the status scores A–F. The proposed way to determine
get scores of the RIFs according to the scheme in Table 3 [44]. the Qi ’s is:
Results from accident investigations may be used as a supple-
ment to the results from the RNNS project in order to assess the • Determine Plow (A) as the lower limit for Prev (A) by expert
scores of the RIFs. judgment.
 T. Aven et al. / Journal of Hazardous Materials A137 (2006) 681–691 687

• Determine Phigh (A) as the upper limit for Prev (A) by expert 3.8. Recalculation of the risk
judgment.
• Then put for i = 1, 2, . . . n: The final step of BORA-Release is to determine the platform
⎧ specific risk of hydrocarbon release by applying the platform
⎨ Plow /Pave if s = A
⎪ specific input probabilities/frequencies (Prev (A)) for all events
Qi (s) = 1 if s = C (3) in the risk model. Use of these revised probabilities results in an
⎪
⎩ updated risk picture including analysis of the effect of the perfor-
Phigh /Pave if s = F
mance of the safety barriers introduced to prevent hydrocarbon
where s denotes the score or status of RIF no i. release. The revised risk picture takes the platform specific con-
ditions of technical, human, operational, and organisational RIFs
into consideration.
Hence, if the score s is A, and Plow (A) is 10% of Pave (A),
then Qi is equal to 0.1. If the score s is F, and Phigh (A) is 10 4. Discussion
times higher than Pave (A), then Qi is equal to 10. If the score s
is C, then Qi is equal to 1. Furthermore, if all RIFs have scores The discussion is divided in two main parts. The different
equal to C, then Prev (A) = Pave (A), if all RIFs have scores equal steps in BORA-Release are discussed in part one, while part
to A, then Prev (A) = Plow (A), and if all RIFs have scores equal two contains a discussion to what extent the criteria presented
to F, then Prev (A) = Phigh (A). in Section 2 are fulfilled.
To assign values to Qi for s = B, we assume a linear relation-
ship between Qi (A) and Qi (C), and use sA = 1, sB = 2, sC = 3, 4.1. Discussion of the steps in BORA-Release
sD = 4, sE = 5, and sF = 6. Then:

Plow (sB − sA )(1 − (Plow /Pave )) The basic risk model developed as part of BORA-Release
Qi (B) = + (4) may be seen as an extended QRA-model compared to the current
Pave sC − s A
status of offshore QRAs for three reasons:
To assign values to Qi for s = D and E, we assume a linear
relationship between Qi (C) and Qi (F). Then: (1) It facilitates a detailed modelling of loss of containment
including initiating events reflecting different causal fac-
(sD − sC )((Phigh /Pave ) − 1) tors of hydrocarbon release and safety barriers introduced
Qi (D) = 1 + (5)
sF − s C to prevent release.
(2) The risk model incorporates different operational barriers
Qi (E) is calculated as Qi (D) by use of sE instead of sD in such as use of self control of work/checklists, 3rd party
formula (5). Fig. 4 shows different values of Qi depending on control of work, and inspection to detect corrosion.
different values of Plow and Phigh : (3) Event trees and fault trees are linked together in one common
risk model.
Case 1. Plow = Pave /10, and Phigh = 10Pave .
Case 2. Plow = Pave /5, and Phigh = 5Pave . Development of a risk model with a set of hydrocarbon
Case 3. Plow = Pave /3, and Phigh = 3Pave . release scenarios and RIFs answers the criticism formulated
Case 4. Plow = Pave /2, and Phigh = 2Pave . by e.g. Kafka [45] that the existing QRAs are not suitable for
analysing the effect of the most effective safety measures to
avoid initiating events.
BORA-Release is based on a broad view on safety barriers,
which means that the performance of different types of safety
barriers like the process shutdown system, 3rd party control of
work, and the inspection program need to be analysed. The fault
tree analyses applied for analysis of the performance of safety
barriers are linked to the event trees in one common risk model.
The fault tree analysis will not necessarily cover all attributes
relevant for analysis of the barrier performance, and there may
be need to carry out other analysis, e.g. human reliability anal-
ysis (HRA), analysis of fire and explosion loads, impairment
analysis, and qualitative assessments of barrier functionality.
Combination of barrier block diagrams/event trees and fault
trees is an attractive modelling technique as barrier block dia-
grams makes it possible to give a clear and consistent represen-
tation and illustration of the different barrier systems that fulfil
the defined barrier functions introduced to prevent hydrocarbon
Fig. 4. Values of Qi depending on different values of Plow and Phigh . release. The approach enables a separate analysis of each barrier
688 T. Aven et al. / Journal of Hazardous Materials A137 (2006) 681–691

at the desired level of detail. The barrier block diagrams may be The second approach, assessment of status by use of results
generic for several platforms, while the detailed analysis of the from the TTS projects, uses existing data from a project car-
different safety barriers may be platform specific. ried out for several platforms on the Norwegian Continental
Assignment of industry average probabilities/frequencies Shelf (NCS) so the use of resources will be limited. The scor-
implies use of generic databases in addition to extraction of ing scheme used in the TTS project also consists of a six-point
platform specific information regarding operational conditions, scale, but the scores are related to some performance criteria and
experience from surveillance of operational activities, and test- not to the industry average level. However, the TTS scores may
ing of technical safety systems. Recovery of data from internal be transformed to the BORA scores. There are some disadvan-
databases or surveillance systems may require extensive manual tages of this approach. The TTS projects are not carried out for
work and often some interpretations of the recorded data may all platforms on the NCS. The main focus in the project is the
be necessary. Due to the novelty of the modelling of the con- status of technical aspects of the consequence reducing barriers
tainment barrier, relevant data are lacking for some barriers. The so limited knowledge may be collected about the organisational
availability of relevant human reliability data is low, thus there is factors. The TTS assessment may be carried out several years
need for collection of data to support the analyses. Alternatively, before the actual analysis as the time aspect may cause that the
some expert judgment sessions may be carried out in order to data to be out-of-date. Finally, the relevance of the data may
generate relevant data. be questionable since the original assessments have been per-
The top–down approach for development of risk influence formed for another purpose. Thus, the results should be carefully
diagrams ensures that the RIFs are identified and defined in assessed prior to use.
the same manner in different analysis, while the bottom–up The third approach, use of results from the RNNS survey
approach ensures that unique RIFs for specific plants are iden- and accident investigations has been applied during the case
tified and assessed. While traditional performance influence study. The main advantage is the availability of platform specific
factors as reviewed by Kim and Jung [46] focuses on factors results form the survey on all platforms on the NCS. However,
influencing human failure events, the RIF framework presented there are several disadvantages with this approach. The main
in Section 3.4 also includes factors influencing hardware (sys- disadvantage is the low validity since the scores are assigned
tem/component) failure events (e.g. material properties and pro- based on questions from a questionnaire not developed for this
gram for preventive maintenance). purpose where the questions are rather general and not specific
Experience from the case study indicates that the main RIF for the specific RIFs. As an example, the RIF “time pressure”
groups in the framework are adequate for identification of RIFs. will be given the same score for all activities on the platform
But the list of generic RIFs in Table 2 may be supplemented by regardless of who, when, or where the activity is carried out. The
more RIFs to cover all the basic events included in the analyses survey is carried out every second year, and hence the results
of barrier performance. This implies that the list of generic RIFs from the last survey may not be up to date when the data are
may be a “living” document that may be revised due to more applied. The last aspect is that the answers in the survey may be
experience by use of the list. influenced by other factors, e.g. general dissatisfaction with the
A six-point score scheme is used for assignment of scores to working conditions not relevant for the analysed RIF.
the RIFs and the scores are related to different levels in the indus- The credibility of the status assessment is one important
try. The rationale behind is that industry average data reflects aspect to consider when selecting approach for scoring of RIFs.
the industry average standard as regards status of the RIFs. The As a rule of thumb, we may say that more specific, detailed,
argument for the misalignment of the scores (A and B better and resource demanding the assessment of the RIF status are,
than average, and D, E, and F worse than average) is that the the more credible are the results. However, the use of resources
existing safety level within the industry is so high that the poten- should be balanced against the argument from the representa-
tial for declining in the status is greater than the improvement tives from the oil companies that it is important to use existing
potential. data in order to minimize the use of resources.
Three approaches for giving scores to the RIFs are described. A rather simple technique for weighting of RIFs by use of
The approaches may be used separately, or combined in order to expert judgment is proposed. The weighting process is easy to
assign scores. The first approach, direct assessment of the sta- carry out in practice. The results from the weighting process
tus of the RIFs by a RIF-audit is the most resource demanding are unambiguous, and the traceability is good. An important
approach. However, this approach may ensure a high validity1 aspect of the identification, scoring, and weighting of RIFs is the
of the assignment of scores since the assessment of the specific involvement of operational personnel working on the platform.
RIFs is based on the risk influence diagrams developed for each Nobody is as competent as the operational personnel to carry out
basic event. There is demand for development of aids for execu- these steps. However, a risk analyst knowing the methodology
tion of RIF audits, e.g. BARS with description of the reference should guide the operational personnel through the weighting
levels for scoring. Such aids will contribute to better consistence process.
of the assignment of scores. The revised probabilities of occurrences of the basic events
are calculated as a sum of products of the scores and the nor-
malized weights of the relevant RIFs for each basic event multi-
1 Validity refers to whether or not it measures what it is supposed to measure plied with the industry average probabilities. The upper (Phigh )
[47]. and lower (Plow ) values act as anchor values and contribute to
 T. Aven et al. / Journal of Hazardous Materials A137 (2006) 681–691 689

credibility of the results. A wide range implies the possibility carry out some installation specific considerations about the sta-
for major changes in the risk level, while a small range implies tus on each platform, and to carry out simple comparisons with
minor changes in the risk level. The final results are obviously other platforms (e.g. practice regarding operational barriers as
dependent of these values. The upper and lower limits may be third party control of work or status of the RIFs) (9).
established by expert judgment, preferably supported by expe- A problem may arise in respect to the availability of relevant
rience data. Another approach to be considered as a basis for input data (5). To be able to use relevant input data it may be
determining Phigh and Plow , is to use the upper and lower bounds necessary to collect new types of data. Especially within the field
(e.g. generated from failure rates) presented in generic databases of human reliability data it seems to lack relevant data from the
like OREDA and THERP. offshore field. Some data on a limited set of activities has been
As illustrated in Fig. 4, a linear relationship is assumed collected on the British sector [33,34], but it has been necessary
between Qi (A) and Qi (C), and Qi (C) and Qi (F) respectively. to use data from the nuclear industry in the case study.
Other relationships may be assumed here. Fig. 4 illustrates With respect to criteria (6), the focus so far has been on fail-
another important aspect of the method, that the risk improve- ures introduced during normal production, maintenance, shut-
ment potential is less than the risk worsening potential. This down, and start-up within the operational phase of the life-cycle
aspect may be explained by the existing low risk level due to of a platform, and safety barriers introduced to prevent releases
high focus on risk reduction measures for several years. due to such failures. Latent failures from the design phase and
The final step of BORA-Release, recalculation of the risk in safety barriers aimed to prevent such failures have not been anal-
order to calculate the platform specific risk by use of revised plat- ysed yet.
form specific probabilities/frequencies, is easy to execute when Criterion (7) states that the method should enable identifica-
the other steps have been carried out. The revised hydrocarbon tion of common causes and dependencies. Events in BORA-
release frequency takes platform specific conditions as regards Release are considered independent conditional of the RIFs.
technical, human, operational, as well as organisational RIFs Independence could be questioned, however, it is likely to be
into consideration. In addition, the effect of the performance sufficiently accurate from a practical point of view. There may be
of safety barriers introduced to prevent hydrocarbon releases is interaction effects among the RIFs influencing one basic event.
included in the results. Interaction effects mean that a RIF will have a different effect
The recalculated risk picture gives valuable input to decision- on the basic event, depending on the status of another RIF (pos-
makers. The improved knowledge about existing and non- itive correlation), e.g. if the competence of personnel is poor,
existing safety barriers and better understanding of the influence it will be even more serious if the quality of procedures also is
of RIFs (i.e. the qualitative analysis) are important results in poor. A simple approach is suggested for analysis of interac-
itself, independent of the quantitative results. As in other risk tion effects among RIFs in BORA-Release. If two or more RIFs
analyses, the quantitative results from use of BORA-Release are assumed to interact and the status are worse than average
rely on a set of assumptions. Slight adjustments of the scaling (D, E, or F), the score of one of them is reduced one category
systems or the input to the analysis (e.g. data and expert judg- (e.g. from D to E), and similarly if the scores of two interact-
ments) influence the final numerical results. Decision-makers ing RIFs are better than average. However, more sophisticated
using the results from risk analyses using BORA-Release should methods should be assessed as part of future research, e.g. use
be aware of these assumptions and not only base their decisions of Bayesian belief networks to more accurately model the inter-
on the numerical results of the analysis. It is necessary to see the actions between the RIFs (see e.g. [21]). Development of a risk
results of the analysis in a broader context, where the limitations model including safety barriers that may prevent, control, or
and constraints of the analysis are taken into account. mitigate accident scenarios with in-depth modelling of barrier
performance allows explicit modelling of functional common
4.2. Fulfilment of criteria cause failures (e.g. failures due to functional dependencies on
a support system). However, there is need for further research
Criteria (1)–(4), and (9) presented in Section 2 are fulfilled. to assess the effect of residual common cause failures that may
Use of barrier block diagrams evidently facilitates identification lead to simultaneous failures of more than one safety barrier
and illustration of safety barriers (1). A risk model that consists (e.g. calibration errors introduced during maintenance that may
of a combination of barrier block diagrams/event trees, fault cause simultaneous failures of gas detectors and fire detectors).
trees, and risk influence diagrams allows inclusion of technical, Criterion (8) deals with practical applicability with respect
human, operational, as well as organisational elements and the to use of resources. Unfortunately, to carry out a comprehensive
graphical illustrations make them well suited for use in presen- analysis of the complex reality in a process plant is resource
tations and discussions that will increase the understanding of demanding. If the analysis shall give adequate support during
RIFs (2). BORA-Release allows for analysis of technical fail- the decision-making process the level of detail of the analysis
ures and human errors as initiating events, as well as analysis need to reflect the reality on the platform. However, it may be
of technical, human, and operational barriers (3) (see [28] for possible to carry out less comprehensive analysis of specific
more information). Event trees, fault trees, and risk influence problem areas on the platform with less use of resources.
diagram are applicable for quantification of the frequency of One basis for BORA-Release is the assumption that the aver-
initiating events and the performance of the safety barriers (4). age standard of RIFs corresponds to industry average (generic)
If a generic risk model is developed, it will be manageable to input data and better standard on the RIFs than average lead
690 T. Aven et al. / Journal of Hazardous Materials A137 (2006) 681–691

to a lower probability or frequency of occurrence of the basic be carried out in order to improve the descriptions of RIFs and
events. This assumption seems to be realistic where generic data assess whether the total number of RIFs (see Table 2) may be
from the offshore industry exists. However, there are needs for reduced, e.g. by combining two RIFs into one new RIF.
further discussions whether the adjustment of human error prob-
abilities should be based on scores of the RIFs related to the Acknowledgements
average standard in the North Sea or whether traditional assess-
ment of performance shaping factors applied in human reliability The development of BORA-Release has been carried out as
analysis should be applied (adjustment of nominal human error part of the BORA-project financed by the Norwegian Research
probabilities by assessment of task specific performance shaping Council, The Norwegian Oil Industry Association, and Health
factors). and Safety Executive in UK. The authors acknowledge person-
nel from the steering committee that have commented on the
5. Conclusions and further work preliminary version of BORA-Release.

This paper presents BORA-Release, a method for qualitative References

and quantitative analyses of the platform specific hydrocarbon
release frequency. The method makes it possible to analyse the [1] A. Hopkins, Lessons From Longford: The Esso Gas Plant Explosion, CCH
effect on the release frequency of safety barriers introduced to Australia Ltd., Sydney, 2000.
prevent hydrocarbon release, and platform specific conditions [2] W.D. Cullen, The Public Inquiry into the Piper Alpha Disaster, Hmso,
of technical, human, operational, and organisational RIFs. The London, 1990.
[3] D. Vaughan, The Challenger Launch Decision: Risky Technology, Culture,
method may be used to analyse the plant specific frequency of and Deviance at NASA, University of Chicago Press, Chicago, 1996.
loss of containment in other types of process plants. However, [4] CAIB, The Colombia Accident Investigation Board Report, vol. 1, 2003,
the main area of application is not the calculation of the release http://www.caib.us/.
frequency itself, but use of the method to assess the effect of risk [5] NOU-2000:31, Hurtigbåten MS Sleipners forlis 26 november 1999, Justis-
reducing measures and risk increasing changes during opera- og politidepartementet, Oslo, Norge, 2000.
[6] W.D. Cullen, The Ladbroke Grove Rail Inquiry: Report, Part I, HSE Books,
tions. Sensitivity analysis may be carried out in order to analyse United Kingdom, 2001.
the effect of changes in technical, human, operational, as well [7] NOU-2000:30, Åstaulykken, 4 januar 2000. Justis-og politidepartementet,
as organisational RIFs. Focus on relative changes in the release Oslo, Norge, 2000.
frequency instead of absolute numbers may increase the credi- [8] S. Sklet, Storulykker i Norge de siste 20 årene, in: S. Lydersen (Ed.), Fra
bility to the results. In addition, the effect of introduction of new flis i fingeren til ragnarok, Tapir Akademisk Forlag, Trondheim, 2004.
[9] J.E. Vinnem, T. Aven, H. Hundseid, K.A. Vassmyr, F. Vollen, K. Øien, Risk
safety barriers may be analysed. assessments for offshore installations in the operational phase, in: ESREL
Application of BORA-Release to analyse the frequency of 2003, Maastricht, The Netherlands, 2003.
loss of containment gives a more detailed risk picture than tra- [10] R.M. Pitblado, J.C. Williams, D.H. Slater, Quantitative assessment of pro-
ditional QRAs where no analysis is made of causal factors of cess safety programs, Plant/Oper. Prog. 9 (3) (1990).
loss of containment. The qualitative analysis of the release sce- [11] D.E. Embrey, Incorporating management and organisational factors into
probabilistic safety assessment, Reliab. Eng. Syst. Safe. 38 (1–2) (1992)
narios generates knowledge about factors influencing the risk 199–208.
of hydrocarbon release within the process plant even though no [12] M. Modarres, A. Mosleh, J.A. Wreathall, Framework for assessing influ-
quantitative analysis is carried out. This knowledge may support ence of organisation on plant safety, Reliab. Eng. Syst. Safe. 38 (1992)
decisions of importance for the future performance of the safety 157–171.
barriers. [13] K. Davoudian, J.-S. Wu, G.E. Apostolakis, Incorporating organisational
factors into risk assessment through the analysis of work processes, Reliab.
Only a limited sample of the release scenarios described in Eng. Syst. Safe. 45 (1994) 85–105.
[28] have been analysed quantitatively so far. However, further [14] K. Davoudian, J.-S. Wu, G.E. Apostolakis, The work process analysis
work will be carried out in the BORA-project to analyse more model (WPAM-II), Reliab. Eng. Syst. Safe. 45 (1994) 107–125.
release scenarios. Further work will also be carried out in order [15] L.J. Bellamy, I.A. Papazoglou, A.R. Hale, O.N. Aneziris, B.J.M. Ale, M.I.
to link the model of the hydrocarbon release scenarios to the Morris, J.I.H. Oh, I-RISK: Development of an Integrated Technical and
Management Risk Control and Monitoring Methodology for Managing
traditional QRA model that includes analysis of the consequence and Quantifying On-Site and Off-Site Risks. Main Report. Contract no:
reducing barriers. ENVA-CT96-0243, 1999.
There is still need for further research focusing on some of [16] I.A. Papazoglou, O.N. Aneziris, J.G. Post, B.J.M. Ale, Technical modelling
the steps in BORA-Release. The main challenge is the scoring in integrated risk assessment of chemical installations, J. Loss Prevent.
of the RIFs and further work will be carried out in order to Proc. Ind. 15 (6) (2002) 545–554.
[17] I.A. Papazoglou, L.J. Bellamy, A.R. Hale, O.N. Aneziris, J.G. Post, J.I.H.
assess whether the results from the TTS project may be used, Oh, I-Risk: development of an integrated technical and management risk
or if it is necessary to perform specific RIF-audits. In the latter methodology for chemical installations, J. Loss Prevent. Proc. Ind. 16
case, it may be necessary to develop behaviourally anchored (2003) 575–591.
rating scales (BARS) or similar aids that may be used as basis [18] A. Mosleh, E.B. Goldfeiz, An Approach for Assessing the Impact of Organ-
for the RIF-audits. Another challenge is lack of relevant data, isational Factors on Risk, Technical Research Report, CTRS, A. James
Clark School of Engineering, University of Maryland at College Park, 1996.
especially for human error probabilities on offshore platforms [19] D.M. Murphy, E.M. Paté-Cornell, The SAM framework: modelling the
and there may be need for collecting new types of data that are effects of management factors on human behaviour in risk analysis, Risk
not available in existing databases. Further work should also Anal. 16 (4) (1996).
 T. Aven et al. / Journal of Hazardous Materials A137 (2006) 681–691 691

[20] E.M. Paté-Cornell, D.M. Murphy, Human and management factors in prob- [33] G. Basra, H. Gibson, B. Kirwan, Collection of Offshore Human Error
abilistic risk analysis: the SAM approach and observations from recent Probability Data, Phase 2, vol. 1: Offshore Drilling Data, Health & Safety
applications, Reliab. Eng. Syst. Safe. 53 (1996) 115–126. Executive, 1998.
[21] K. Øien, A framework for the establishment of organisational risk indica- [34] G. Basra, H. Gibson, B. Kirwan, Collection of Offshore Human Error
tors, Reliab. Eng. Syst. Safe. 74 (2) (2001) 147–167. Probability Data, Phase 2, vol. 2: Permit to Work data, Health & Safety
[22] K. Øien, S. Sklet, Organisational Risk Indicators Pilot Study Statfjord A (in Executive, 1998.
Norwegian), SINTEF-Report STF38 A00421, SINTEF, Trondheim, Nor- [35] ROSS-website, Data Sources for Risk and Reliability Studies,
way, 2000. http://www.ntnu.no/ross/info/data.php.
[23] H. Andersen, J. Casal, A. Dandrieux, B. Debray, V. De Dianous, N.J. [36] J.-P. Bento, Menneske - Teknologi - Organisasjon Veiledning for gjen-
Duijm, C. Delvosalle, C. Fievez, L. Goossens, R.T. Gowland, A.J. Hale, D. nomføring av MTO-analyser. Kurskompendium for Oljedirektoratet, Over-
Hourtolou, B. Mazzarotta, A. Pipart, E. Planas, F. Prats, O. Salvi, J. Tix- satt av Statoil, Oljedirektoratet, Stavanger, Norway, 2001.
ier, ARAMIS—User Guide, EC Contract number EVG1-CT-2001-00036, [37] J. Groeneweg, Controlling the Controllable: The Management of Safety,
2004. DSWO Press, Leiden, The Netherlands, 1998.
[24] PSA, Regulations relating to management in the petroleum activities (The [38] R. Jacobs, S. Haber, Organisational processes and nuclear power plant
Management Regulations), 3 September 2001, Petroleum Safety Authority safety, Reliab. Eng. Syst. Safe. 45 (1994) 75–83.
Norway, Stavanger, 2001. [39] E. Hollnagel, Cognitive Reliability and Error Analysis Method: CREAM,
[25] J.E. Vinnem, T. Aven, S. Hauge, J. Seljelid, G. Veire, Integrated Barrier Elsevier, Oxford, 1998.
Analysis in Operational Risk Assessment in Offshore Petroleum Opera- [40] D.E. Embrey, P. Humphreys, E.A. Rosa, B. Kirwan, K. Rea, SLIM-MAUD:
tions, PSAM7-ESREL’04, Berlin, 2004. An Approach to Assessing Human Error Probabilities Using Structured
[26] S. Sklet, J.E. Vinnem, T. Aven, Barrier and operational risk analysis of Expert Judgment, Department of Energy, USA, 1984.
hydrocarbon releases (BORA-Release). Part II. Results from a case study, [41] H. Gibson, G. Basra, B. Kirwan, Development of the CORE-DATA
J. Hazard. Mater. 137 (2006) 692–708. database, Paper dated 23.04.1998, University of Birmingham, Birming-
[27] K. Øien, S. Sklet, A Structure for the Evaluation and Development of ham, United Kingdom, 1998.
Organisational Factor Frameworks, PSAM 5, Osaka, Japan, 2000. [42] O. Thomassen, M. Sørum, Mapping and monitoring the technical safety
[28] S. Sklet, Hydrocarbon releases on oil and gas production platforms: release level, SPE 73923, 2002.
scenarios and safety barriers, J. Loss Prevent. Proc. Ind. 19 (2006) 481–493. [43] PSA, Trends in Risk Levels—Summary Report Phase 5 (2004), The
[29] S. Sklet, Safety barriers: definition, classification, and performance, J. Loss Petroleum Safety Authority, Stavanger, 2005.
Prevent. Proc. Ind. 19 (2006) 494–506. [44] T. Aven, S. Hauge, S. Sklet, J.E. Vinnem, Operational risk analysis. Total
[30] M. Rausand, A. Høyland, System Reliability Theory: Models, Sta- analysis of physical and non-physical barriers. H2.1 methodology for anal-
tistical Methods, and Applications, Wiley-Interscience, Hoboken, NJ, ysis of HOF factors, Draft 1, Rev 1, 2005.
2004. [45] P. Kafka, The process of safety management and decision making, ESREL
[31] OREDA, Offshore Reliability Data Handbook (OREDA 2002), 4th ed., 2005, Tri City, Poland, 2005.
SINTEF, Trondheim, Norway, 2002. [46] J.W. Kim, W.D. Jung, A taxonomy of performance influencing factors for
[32] A.D. Swain, H.E. Guttmann, Handbook of Human Reliability Analysis with human reliability analysis of emergency tasks, J. Loss Prevent. Proc. Ind.
Emphasis on Nuclear Power Plant Applications: Final Report NUREG CR- 16 (6) (2003) 479–495.
1278, SAND80-200, Sandia National Laboratories Statistics Computing [47] Statistics, Britannica Student Encyclopedia, Encyclopædia Britannica
and Human Factors Division, Albuquerque, 1983. Online. 10 November 2005, http://search.eb.com/ebi/article-208648, 2005.