A Public Leak Frequency Dataset for Upstream and Downstream

Quantitative Risk Assessment

Andy Bolsover
Det Norske Veritas
Cromarty House, Regent Quay, Aberdeen, UK
andy.bolsover@dnv.com

Andreas Falck, Det Norske Veritas, Veritasveien 1, N-1322 Hovik, Norway
Robin Pitblado, Det Norske Veritas, 1400 Ravello Dr, Katy TX 77449


Keywords: leak, frequency, dataset, uncertainty, QRA

Abstract

A recent CSChE conference in Montreal identified frequency estimates as the area of greatest
uncertainty in current Quantitative Risk Assessment studies. There are a few sources of onshore
data Netherlands and Belgium have both issued two different datasets for use in Seveso
Directive risk assessments. Some companies and consultants have their own data but the
provenance of these is often uncertain and examples exist of frequencies that are too low, not
matching historical accident frequencies. It is detrimental to QRA methodology that such old or
inconsistent data is routinely used.

The UK HSE has maintained a leak event dataset for offshore facilities since the early 1990s.
This contains around 4000 leak events reported by facilities and supported by detailed
documentation completed by the company. This is considered the most extensive dataset of its
type and superior to current published datasets which often have much smaller and older data,
not reflecting current integrity management programs. DNV for several years has assessed this
data on behalf of a major operator and screened out leaks not appropriate for QRAs (e.g.
equipment isolated and under maintenance). While the data is noisy, typical for real data, a
smoothing function is applied to cover all leak sizes and leaks are differentiated for 17
equipment types.

DNV has decided to make this data publicly available, at no charge, so that all those carrying out
QRA studies can use this most up-to-date data, from a large data set. While the data is from
upstream, advice is also presented on how this may be applied to downstream and midstream
facilities (e.g. refineries and LNG facilities).


1. Introduction

Quantitative Risk Assessment (QRA) is widely used in process industries as a tool to aid risk
management. The QRA process is complex and involves large amounts of data, many of which
have considerable uncertainties. QRA studies can be improved if all practitioners have access to
up-to-date, accurate equipment failure rate data, but DNV has also noted that many QRA
practitioners are continuing to use frequency data that are superseded by different datasets.

As a technology leader in the field of QRA, DNV has considerable experience in the
interpretation and application of failure rate data and has now decided to make its main leak
frequency dataset available for wider use. By doing this, we intend that this will lead to improved
risk assessment and hence better decisions in major hazard industry.


2. Quantitative Risk Assessment

Quantitative Risk Assessment (QRA) helps decision-makers in high hazard industries to manage
the circumstances and events that have the greatest risks. Within the various sectors of process
industry these risks arise from several sources, but some of the most significant major accident
risks are associated with loss of containment of the process fluids.


2.1 Requirements and the challenges

The basic steps for performing a QRA for major hazard industries are agreed; they include:
identification of hazards, estimates of the likelihood that hazardous events are realised, estimates
of the physical consequences of these events including impacts on personnel, estimates of risk
and comparison against risk criteria. These steps are typically followed by identification and
assessment of risk-reducing measures as part of an ALARP process.

Quantitative Risk Assessment is not a precise science. Successful completion of a QRA study
requires input from many disparate sources of information and application of methods from
several professional disciplines. Examples of the types of information that are likely to be
required include: design (from chemical, structural, mechanical, electrical & instrumentation
disciplines), organisation (management, operation, maintenance, inspection), together with
psychology, physiology, physics, statistics and mathematical modeling.

A QRA study requires analysis / synthesis involving a large amount of data using methods drawn
from the above mentioned disciplines. There are inevitably considerable uncertainties in the
correct combination of data and methods from such a wide range of sources.

Estimate of event frequency has been identified as one of the major sources of uncertainty in
QRA [1]. It is therefore natural that efforts to improve QRA methods should consider what can
be done to improve the quality of frequency estimates.


2.2 Standardisation of tools and datasets

There are considerable benefits to be obtained by standardising some the tools and datasets that
are used in QRA. Documents that have helped to standardise these tools and datasets have
included publications from: CMPT [8], CCPS [9], OGP [10] and several other organisations.
Consequence models are described in such publications and some of these models have been
implemented in software tools that have become almost standard among QRA specialists.

Standardisation of datasets can help to ensure that accurate data is available for use in QRA. If
well-done, standardisation leads to improved consistency and accuracy in evaluations of risk,
leading to better decision-making and meaning that designs and management practices can be
improved to achieve safer workplaces.

As already noted, a critical area of uncertainty in QRA is the estimate of leak frequencies for
equipment containing hazardous fluids. This uncertainty is due in part to the absence of a widely
accepted set of equipment leak frequencies for use in QRA. DNV has therefore decided to put its
dataset (and supporting methodology) for equipment leak frequencies into the public domain.


3. Available sources of leak frequencies

This section describes some of the most widely used sources of data for equipment leak
frequencies: the Hydrocarbon Release Database (HCRD) [11] from UKs Health and Safety
Executive (HSE) and the Dutch and Belgian data sources.

Other sources of data do exist, but these are usually deprecated either because they contain old
data, contain smaller numbers of events, or have unclear provenance.

There are considerable difficulties in establishing reliable datasets; data collection requires
careful planning and many years of commitment.


3.1 HCRD

An important recommendation from Lord Cullens inquiry into the Piper Alpha disaster was that
the UK Health and Safety Executive should require all offshore operators in the UK Sector of the
North Sea to record and submit details of every leak event in a standard format suitable to derive
leak statistics.

Offshore releases of hydrocarbons have been reported to HSE as dangerous occurrences under
the UK regulations known as RIDDOR (Reporting of Injuries, Diseases and Dangerous
Occurrences Regulations). Details of these releases are recorded together with additional
voluntary information in HSEs HCRD. The database contains data from reports of offshore
hydrocarbon releases meeting the RIDDOR criteria since 1 October 1992.

Duty holders (i.e. owners / operators of offshore installations) have provided incident reports
from release incidents to HSE for inclusion in HCRD; at the time of writing the HCRD contains
details of 4283 release events that have occurred up to the end of March 2012. (Other incidents
are recorded for the period post-March 2012, but these records may be incomplete due delays in
final reporting). For each event there are more than 70 data fields describing the event. These
data fields include information on:
Characteristics of installation where leak occurred: age, fixed or mobile, manned or not
etc.
Facilities on installation: production, wellhead etc.
Release fluid characteristics: gas / 2-phase / oil / non-process etc.
Dimensions of release: quantity released, duration, hole diameter (mm) through which
the release occurred etc.
System / Equipment where release occurred: equipment type, rating, dimensions etc. (the
database recognises 78 different types and sizes of process equipment)
Area ventilation characteristics: forced / natural, air change rate, wind speed etc.
Means of release detection: gas, flame etc.
Cause of release: design / mechanical failure / operational etc.
Ignition details: delay time, explosion / jet fire etc.
Response: shutdown, blowdown, muster etc.


HSE in fact holds two databases, both of which are necessary for production of meaningful
statistics on the frequency of release events. The first is HCRD which records details of the leak
events; the second is an equipment population database which contains information on the
amount of equipment on installations on UK Continental Shelf. In order to derive a generic leak
frequency for a specific equipment type it is necessary that the equipment in the second database
is the same equipment from which leaks are reported in the first database. The two databases
must match if accurate leak frequencies (per equipment year) are to be derived.

The HCRD database and its associated population database are not perfect and have their own
problems associated with the issues described in section 4. But after many years of experience
working with many sources of data, DNV has concluded that despite the deficiencies in these
databases, they are the best available source of data for deriving generic equipment leak
frequencies for many different types of equipment. Effort is still required to fix some of the
problems recognised in the HSE data, and some of these may eventually be fixed by the recent
initiatives from the Energy Institute and Oil and Gas UK [2].

3.2 Netherlands and Belgium data

The Dutch data [3] and Belgian data [4] define default failure frequencies for the various parts of
a containment system in terms of major equipment items such as pressurised storage tanks,
atmospheric storage tanks, pipeline etc. The Dutch data provides some sub-categorisation of
these major equipment items but in any case the equipment is defined only at a high level. Using
this data it is not possible to account for influencing factors such as numbers of flanges, all-
welded construction, number of small-bore instrument connections etc. because the failures of
such connections are included in the default failure frequency of items of major equipment items.
This means, for example, that the benefits of an all-welded construction cannot be assessed using
Dutch default data, nor is it possible to account for the increased failure rate if the system
includes a large number of instrument connections.

The coarse approach to equipment counts adopted by the Dutch and Belgian methodologies
might have been partially countered by ensuring that the failure frequencies are suitably
conservative. However, a comparison the equipment failure rates for different equipment types
indicates that the Dutch and Belgian default failure frequencies tend to significantly
underestimate the frequency of failure when compared with the DNV interpretation of the
HCRD.

Much of the Belgian failure frequency data relevant to offshore applications is based on old
sources of information that are considered to be superseded by data derived from HCRD.

It is DNVs considered opinion that analyses based on the Dutch and Belgian data are likely to
lead to worse decision-making than can be obtained using HSE data.


4. Uncertainty in the HCRD

There are many sources of uncertainty in the assessment of event frequency for QRA. The
HCRD is recognised as the preferred source of data for deriving generic equipment leak
frequencies, but QRA practitioners should be aware that there are some significant uncertainties
even here.

For event frequencies that are estimated on the basis of historical events several things must
happen in several stages before information from the event can be applied in a QRA, and
uncertainties are introduced at each stage.

The following bullet points summarise some of the sources of uncertainty that have been
identified in the HCRD.
Detection of historical failure events e.g. under-reporting of small leaks, late detection
(operators only know about a leak when it is first detected either a fire / gas detectors,
direct observation or an explosion) thus the description of the event is always incomplete
Analysis of the historical failure events e.g. estimation of the quantity of gas released,
idealisation of holes as perfectly round when trying to relate the release rate to operating
pressure, estimate of leak event duration and delay before ignition
Reporting process for historical events e.g. interpretation of reporting guidance,
communication of event to person making the event report, tendency to report hole-sizes
as round numbers (e.g. 1 inch, 1 mm), and straightforward errors in form completion.
(Reporting guidance is under review by an Oil and Gas UK work group which intends to
issue revised guidance shortly).
Interpretation of HCR database by QRA analysts e.g. scarcity of events for specific
equipment types leads to equipment types being grouped together, and the scarcity of
large release events leads to extrapolation of data, approximation of hole-size distribution
by curve fitting
Equipment population data e.g. inaccuracies in the estimate of offshore equipment
population among which the leak events occur. This is probably one of the more
significant sources of uncertainty. Interrogation of the database shows that the population
data has been unchanged since 2003 despite significant changes in the number of
installations. (The database is also inaccurate in counts of population on mobile units
because of rig movements).
Application in QRA e.g. Inaccurate parts counts and variation in counting conventions
between companies performing QRA, simplifications such as assuming that that all
liquid/gas vessels are half full, discretisation of hole-sizes into hole-size bands, and
truncation of hole size ranges which leads to omission of risks from hole-sizes less that
the smallest size considered by QRA

This paper is primarily concerned with unignited events, but there are also considerable
uncertainties in the estimation of frequencies for ignited events, usually obtained through the use
of ignition models. The best ignition models are based on the interpretation of available data
which includes data from the HCRD. Only about 5% of the events in the HCRD are recorded as
ignited meaning that the ignition models are inevitably also based on a small number of events.

Finally, many QRAs assume that the installation under assessment is adequately represented by
an average North Sea installation. This uncertainty arises from the straightforward application
of average release frequency data to all installations without recognising that all installations are
different. (DNV has used Management Factors to account for some of this plant-specific and
operator-specific variation [5, 6]).

It is possible that some of the more-significant sources of uncertainty listed here will be
addressed following the recent establishment of a technical committee by the UK Energy
Institute [2].

The above discussion demonstrates that there are many sources of uncertainty even in the best
available datasets, but despite these considerations, DNV judges that HCRD is preferred as a
basis for deriving generic release frequencies.


5. The public leak frequency dataset

5.1 Experience with HCRD

DNV recognised the strength of the HCRD many years ago and has been using this dataset in
QRA for its clients. This database has been analysed to produce generic leak frequencies
applicable for use with offshore installations that are operated to UK North Sea standards. The
methodology for analysis of HCRD and estimating generic release frequencies for process
equipment was been developed by DNV in conjunction with Statoil and was presented in the
2009 HAZARDS XXI conference [7].

Although HCRD is a compilation of hydrocarbon releases from the offshore oil and gas industry,
DNV normally use these data for QRA at both offshore and onshore facilities. Despite the
significant differences between operations onshore and offshore, we believe that the HSE
offshore data usually provides the best available estimate of leak frequencies for both onshore
and offshore process equipment.

It is recognised that there are some differences between onshore and offshore operations which
may drive differences in leak frequency. The HSE data set gives higher leak frequencies than
most of the onshore sources of data. Possible reasons might be extra external corrosion from
salt-water spray, internal erosion from entrained sand, or impacts resulting from the more
compact equipment layouts. However, offshore installations have safety management systems
that would be expected to counter such evident hazards. Furthermore, the HSE dataset on leak
causes also shows that corrosion/erosion is a minor contributor, with operational/procedural
faults and mechanical defects being the primary causes.

There are also differences in data quality: the HSE data comes from a 20 year program of
systematic data gathering across a very large population of equipment whereas many of the
available onshore leak frequencies come from small sample sizes or earlier collections whose
size and origin are now unknown.

The HSE data set is also usually preferred for application to LNG plant where large experience
data sets do not exist and the risk drivers are unlikely to be within the direct experience of
individual plants and terminals. Establishing the frequency of such events is difficult, precisely
because of their rarity.


5.2 Analysis

Interpretation of the information contained in HCRD is not straightforward and requires a deep
understanding of the limitations of the data as discussed in section 4. The analysis process starts
by grouping the data before fitting curves to the data to represent the distributions of release
cases.

Different types and sizes of equipment are grouped where there is insufficient experience to
show significant differences between different equipment types and sizes. This grouping results
in the 78 different equipment types and sizes being reduced to 17 types of process equipment in
the analysis. (Wellhead equipment, drilling equipment, pipelines and risers are all excluded from
the analysis, since other more extensive data sources are available for these types of equipment).

Analytical leak frequency functions are then fitted to the data, in order to obtain a smooth
variation of leak frequency with equipment and hole-size. This curve fitting recognises that
HCRD events may describe several distinct release scenarios. In particular:
ESD isolated leaks, which are defined as cases where the outflow quantity is comparable
with that predicted for a leak at the operational pressure.
Late isolated leaks, presumed to be cases where there is no effective ESD of the leaking
system, resulting in a greater outflow quantity. Late isolated leaks are defined as cases
where the outflow is greater than predicted for a leak at the operational pressure
controlled by the slowest credible ESD and no blowdown.

In the terminology of the analysis ESD isolated leaks and Late isolated leaks are collectively
termed Full leaks. These are the types of leak that are normally included in QRA; they have the
potential of developing into serious events endangering personnel and critical safety functions.

In addition, the DNV analysis of the HCRD also identifies two further categories of leaks that
could potentially be excluded from a QRA: Limited and Zero pressure leaks. Limited leaks
are similar to Full leaks, but for various reasons have durations and release quantities that are
significantly smaller than might be expected by a conventional QRA calculation. If limited leaks
are included in a QRA specialist may elect to account for the reduced release durations and
volumes in the consequence calculations. Zero pressure leaks involve cases where the pressure in
leaking equipment is virtually zero (0.01 barg or less); these events represent situations such as
vapour releases from open drains, or where the leaking equipment has been depressurised for
maintenance. There are arguments for omitting so-called zero pressure leaks from a QRA. In any
case, QRA analysts should be aware of the reasons for separate identification of limited leaks
and zero pressure leaks; QRA analysts can then make an informed decision about how account
for these types of leaks. In many cases, DNV uses leak frequencies for full pressure leaks,
including limited leaks but omitting the zero pressure leaks.

The HCRD data is statistically noisy; the curve fit approximates this real data by a function of
the form shown below.

F(d) = C(1 + aD
n
) d
m
+ F
rup


where

F(d) = frequency of holes exceeding size d
C, a, n = constants for each equipment type
d = hole diameter
D = equipment diameter
m = curve slope parameter
F
rup
= additional rupture frequency

The curve fit function describes the frequency of releases for holes in the size range 1 mm up to
the characteristic dimension D, where the curve fit function is truncated.

(Some equipment types do not exhibit any variation of frequency with respect to equipment size,
and hence use a simpler form of fitting curve).

Figure 1 shows an example curve fit to some typical data from HCRD. The figure also identifies
examples of how DNVs knowledge of the limitations of the data has affected the choice of
curve fitted to the data.

Figure 1: Curve fit to HCRD data (example)

The process for fitting a curve to the data has already been described in detail [6] and will not be
repeated here, but it is noted that the process utilises an understanding of the data that has been
gained from years of experience and aims to account for uncertainties in the data due to likely
under-reporting and truncation in the reporting criteria


5.3 Implementation

DNV makes a review of the HCRD typically every two years and makes a reanalysis of the data
in order to update the release frequency curves. These updates are then made available within
DNV for use within QRA studies. Earlier releases of the analysis continue to be available so that
QRAs can be re-run and where consistency with earlier QRAs is a requirement. The analysis is
also implemented in commercially available DNV LEAK software.

It should be noted that although the database analysis is based on defining distributions of hole-
sizes, QRA specialists commonly prefer to use a distribution of release rate. The conversion
between release rate and hole-size distribution is straightforward. Experience has shown that the
use of release rate distributions requires a small amount of additional up-front effort in a QRA
which is compensated by the simplifications achieved in later stages of QRA.

This dataset is generally applied in QRAs across all sectors of process industry. In particular, the
data is applied to offshore and onshore process industry and LNG facilities, despite the offshore
origin of the data. The extension of application to onshore and LNG facilities is due to the
generally poor quality of release frequency data for the onshore and LNG. There has been no
systematic collection of failure statistics for onshore / LNG to match the scale the HCRD data
collection effort.


5.4 Publication of dataset

DNV has decided to make its analysis of the HCRD and the failure frequency dataset publicly
available. In doing this we hope that it will contribute to reducing the uncertainty involved in
developing, running and reporting QRA studies. Ready availability of a consistent high-quality
dataset will help to eliminate the use of poor quality datasets that are used by some QRA
analysts. We expect that this will lead to estimates of major accident risk that are more realistic
and avoid the gross underestimates of risk that must occur when some poor quality datasets are
used.

The dataset has been published in a booklet that describes the method for analysis of HCRD and
deriving frequency distributions. The booklet also tabulates the equipment failure rates for 17
equipment types for several different equipment sizes and hole-sizes. As an example, Figure 2
shows generic leak frequency data for a 6 inch actuated valve (the booklet also provides data for
actuated valve sizes up to 20 inch). In this example, the estimated total frequency of leaks from
hole sizes in the range 1 mm to 3 mm is about 5.7 x 10
-4
per year.


Figure 2: Release Frequency Data Example (6 inch actuated valve)


Process Equipment Leak Frequencies
Rev.: 1
Date: 26/9/2012
Equipment Type: Actuated Valves
Source: HCRD 10/92 03/10

Definition:
Includes all types of actuated valves (block, blowdown, choke, control, ESDV and relief), but not actuated pipeline
valves (pipeline ESDV and SSIV). Valve types include gate, ball, plug, globe and needle. The scope includes the valve
body, stem and packer, but excludes flanges, controls and instrumentation.
Frequency Data:
Equipment Size Category Total Full Pressure Zero Pressure
6 in
1 - 3 mm 5.711E-04 5.540E-04 1.517E-05
3 - 10 mm 1.805E-04 1.718E-04 1.050E-05
10 - 50 mm 5.500E-05 5.119E-05 8.060E-06
50 - 150 mm 8.033E-06 7.292E-06 3.172E-06
> 150 mm 1.347E-05 1.307E-05 6.748E-06
Total 8.281E-04 7.974E-04 4.365E-05

The booklet is available for download from the DNV website or as a hard-copy. The booklet is
also available on request from the authors of this paper.

6. Conclusions

DNV is placing a dataset (and the supporting analysis methodology) for equipment leak
frequencies for use in QRA into the public domain. This dataset draws on DNVs long
experience working with failure rate data across many industries. This is being done in
recognition of our role as technology leaders and our commitment to develop, implement,
maintain and continually improve best practices in SHE risk management.

The dataset is based on an analysis of the HCRD from UKs HSE. All sources of available
failure rate data contain factors that lead to uncertainty, but our experience leads us to believe
that that HCRD is the most reliable source of data. The dataset is available in a short publication
that may be downloaded from DNVs website.

We intend that the dataset will be updated from time to time so that industry can continue to
benefit from the best available leak frequency data for use in QRA. We hope that this will assist
future QRAs, and improve management of risk in high hazard industries


7. References


[1] R. Pitblado et al (2011), Frequency Data and Modification Factors used in QRA Studies,
Journal of Loss Prevention in the Process Industries
[2] Energy Institute (2012), Technical Workshop Proceedings: Leak frequency & EI
UKOOA Ignition probability model review (Committee document)
[3] RIVM (2009), Reference manual BEVI risk assessments, Centre for External Safety,
Netherlands National Institute of Public Health and the Environment, v3.2
[4] Flemish Government (2009), Handbook Failure Frequencies for drawing up a Safety
Report, May 2009
[5] R. Pitblado et al (2010), Modification of Risk using Barrier Methodology, 6
th
Global
Congress on Process Safety
[6] R. Pitblado et al (2009), Frequency Data and Modification Factors used in QRA Studies,
8
th
World Congress of Chemical Engineering
[7] A Falck et al (2009), Leak Frequency Modelling for Offshore QRA Based on the
Hydrocarbon Release Database, Hazards XXI Process Safety & Environmental
Protection Symposium IChemE
[8] CMPT (1999), A Guide to Quantitative Risk Assessment for Offshore Installation
[9] CCPS (2000), Guidelines for Chemical Process Quantitative Risk Analysis, Centre for
Chemical Process Safety, 2
nd
edition, AIChE-CCPS
[10] OGP (2010), Risk Assessment Data Directory, Report no. 434 (incl. 434-1 to 434-20)
[11] HSE (2013), Hydrocarbon Release System, retrieved from:
http://www.hse.gov.uk/offshore/hydrocarbon.htm