KOC.sa.041 - Rule Set for Quantitative Risk Assessment[1]

Revision - 0 Page 1 of 42

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Kuwait Oil Company Rule Sets for Quantitative Risk Assessment

Document Number: KOC.SA. 041 Document Coordinator:

Document Author:

Team Leader Safety

Approved by:

HSEMS Procedures Sub-committee

Authorized by:

HSSE Implementation Committee

Original Issue Date:

9 March, 2014

Control Tier:

Tier 2

Revision/Review Date:

9 March, 2014

Next Review Date:

8 March, 2019

Team Leader Standards

Revision - 0 Page 2 of 42

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Rev. No.

DATE

A

1 August, 2013

B

14 December, 2013

0

9 March, 2014

REMARKS

Initial draft circulated for review. Final draft with comments from H2S Core Working Group incorporated. Approved and Committee

authorized

by

HSSE

Implementation

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 3 of 42

Table of Contents 1.0 Introduction

5

1.1 Objectives

5

1.2 Scope

5

2.0 Applications

5

3.0 Reference Documents

6

4.0 Definitions

7

5.0 Abbreviations

7

6.0 Frequency Analysis 6.1 Parts Count 6.2 Leak Frequency 7.0 Manning Levels 8.0 Modifier Events Probabilities 8.1 Detection, Blow-down and Isolation 8.2 Ignition Probabilities 8.3 Offsite Effects for QRAs 9.0 Consequence Analysis 9.1 General Guidelines 9.2 Hole Size Bands 9.3 Composition and Time Averaging 9.4 Mass Flow Rates 9.5 Release Orientation 9.6 Atmospheric Conditions 9.7 Unignited Gas Dispersion 9.8 Fires 9.9 Effects of Smoke and Combustion Products

8 8 13 14 15 15 16 21 21 21 22 22 22 26 27 29 29 30

9.10 Explosions

30

9.11 Escalation (Knock-on Effect)

31

9.12 Effectiveness of Deluge Systems

31

10.0 Probability of Fatality

31

10.1 Jet Fires and Pool Fires

31

10.2 Flash Fires

32

10.3 Explosions

32

10.4 Toxic Gas

34

10.5 Escape and Evacuation Fatalities

37

11.0 Temporary Refuge (TR) Impairment 11.1 TR Impairment Analysis 11.2 H2S Ingress 11.3 Combustion Products Ingress 11.4 HVAC Shut-down Probability 11.5 Positive Pressurization Probability

37 37 38 38 38 38

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

12.0 Time at Risk 12.1 Individual Risk 12.2 Societal (Group) Risk 12.3 Summary of Time at Risk Rules 13.0 QRA Reporting 14.0 Sensitivity Studies

Revision - 0 Page 4 of 42

38 39 40 40 41 42

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 5 of 42

1.0 Introduction Quantitative Risk Assessment (QRA) is generally accepted as a powerful decision-making tool that can assist in the selection of acceptable solutions to safety issues. For this to be true, it is absolutely crucial that the QRA study adheres to a series of guiding principles, which are established in HSEMS Guidelines KOC.SA.040 for “Quantitative Risk Assessment”. One of the most important guiding principles is the consistent use and management of QRA assumptions and rule sets. Over forty QRA study reports prepared for different KOC facilities/activities in a period of three years have been reviewed. As a conclusion of this revision, it is clear that assumptions, rule sets, methodologies, criteria, input data, etc. currently employed in these various QRA studies across the projects and developments; present serious inconsistencies. This fact has resulted in studies that cannot be verified, reproduced, or compared, leading to QRA studies which cannot be considered as a reliable source for decision making on risk reduction. Given the potential interactions between the various hazards in different projects/facilities/activities within KOC, it is essential that a consistent approach be taken to ensure that an accurate and consistent picture of the overall integrated risk from major accidents is achieved at each location in all parts of KOC. Such an approach is essential to allow further integration and update of the risks at a subsequent time and to reduce the impact of errors due to incompatible assumptions and differences in calculation methodologies that can arise from independent QRA studies. All the rule sets presented in this document are based on the best practices used by the international Oil & Gas industry, and also on published sources that are widely known and accepted (see references). 1.1 Objectives The objective of this document is to set out clear rule sets for input data and assumptions to be made when conducting Quantitative Risk Assessment (QRA) studies for the various projects/facilities/activities associated with the development of KOC operations. The intention is to ensure that a consistent approach to QRA is applied throughout all projects in all phases.

1.2 Scope This document presents the rule sets and underlying data (together with justification and supporting references) to be used during Quantitative Risk Assessment (QRA) of KOC facilities and activities. It includes rule sets for QRAs of all facility types (wells, flow-lines, producing facilities, pipelines, drilling, etc.), all life-cycle phases from concept, FEED, detailed design, to operations and maintenance, as well as decommissioning, and all hazards related to hydrocarbon, toxic releases. The document supports the HSEMS Guidelines KOC.SA.040 for “Quantitative Risk Assessment” which, together with these rule sets, aims to facilitate the transparent tracking of the HSE assurance process. 2.0 Applications This document is applicable to the entire lifecycle of any KOC project, facility or activity

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 6 of 42

3.0 Reference Documents 1. KOC HSE Management System Guide 2. KOC.GE.001 HSE Management System Manual 3. KOC.GE.021 HAZOP Study Procedure 4. KOC-L-017 Recommended Practice for HAZOP Studies 5. KOC.SA.008 Procedure for establishing SIL for SIF 6. KOC.SA.018 Safety Risk Assessment Procedure 7. KOC.SA.040 Guidelines for Quantitative Risk Assessment 8. KOC.SA.037 Risk Management Framework in KOC 9. AICHE/CCPS, “Guidelines for Chemical Process Quantitative Risk Analysis”, Second Edition, Center for Chemical Process Safety, American Institute of Chemical Engineers, New York, 2000. 10. AICHE/CCPS, “Guidelines for Risk Based Process Safety”. Center for Chemical Process Safety, American Institute of Chemical Engineers, New York, 2007 11. NORSOK Standard Z-013, “Risk and Emergency Preparedness Analysis”, Norwegian Technology Center, Norway, 2001. 12. Lees, F. P. “Loss Prevention in the Process Industries”, Second Edition, Butterworth, London, 1989. 13. API Publication 4545, “Hazard Response Modeling Uncertainties”, Volume I, American Petroleum Institute, Washington, D. C., 1992. 14. API Publication 4546, “Hazard Response Modeling Uncertainties (A Quantitative Method)”, Volume II, American Petroleum Institute, Washington, D. C., 1992. 15. Ignition Probability Review, Model Development and Look-up Correlations, IP Research Report, Energy Institute, London, January 2006. 16. Classification of Hazardous Locations, AW Cox, FP Lees, ML Ang, IChemE, 1990. 17. 7th Report of the European Gas Pipeline Incident Data Group, 1970 – 2007, EGIG 08.TVB-0502, December 2008. 18. AEA Technology Report for UKOOA, 'An Analysis of the OIR12 Data and its use in QRA', AEAT/NOIL/27564001/002(R) Issue 1, 6 February 2001. 19. OGP, Risk Assessment Data Directory, Report No. 434 – 2 “Blowout Frequencies”, March 2010. 20. OGP, Safety Performance Indicators – 2005 Data, Report #379. 21. The Institute of Petroleum 2001, Guidelines for the Safe and Optimum Design of Hydrocarbon Pressure Relief and Blowdown Systems. 22. John Spouge 1999, A Guide to Quantitative Risk Assessment for Offshore Installations, Centre for Marine Petroleum Technology, ISBN I 870553 365, United Kingdom. 23. Netherlands Organisation for Applied Scientific Research TNO 1999, Guidelines for Quantitative Risk Assessment (Purple Book) 1st edition, CPR 18E, Netherlands. 24. OREDA-92 Offshore Reliability Data Handbook, 2nd Edition, 1992. 25. GASCON2 (1990), Gascon2, A Model to Estimate Ground Level H2S and SO2 Concentrations and Consequences from Uncontrolled Sour Gas Releases (Volume 5), E. Alp, M. J. E. Davies, R. G. Huget, L. H. Lam, and M. J. Zelensky. Energy Resources Conservation Board, Calgary, Alberta, Canada, October, 1990. 26. Handbook for Fire Calculations and Fire Risk Assessment in the Process Industry, Scandpower Risk Management AS and SINTEF Norwegian Fire Research Laboratory, April 2005. 27. Pipeline Performance in Alberta 1990–2005, Report 2007-A, EUB, Alberta, Canada, 2007. 28. Offshore hydrocarbon releases 2001-2008, Report RR-672, Health and Safety Executive, UK, 2008. 29. CONCAWE, Performance of European Cross-country oil pipelines, Statistical summary of reported spillages – 2004, Brussels, 2006 30. UKOPA, Pipeline Product Loss Incidents (1962-2008), GL Report Reference 9046, UK, 2009

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 7 of 42

31. OGP, Risk Assessment Data Directory, Report No. 434-7 “Consequence Modelling”, March 2010 32. IGE, “Application of pipeline risk assessment to proposed developments in the vicinity of high pressure Natural Gas pipelines” IGEM/TD/2. Communication 1737. 33. BSI, “Code of Practice for Pipelines,- Part 2: Steel pipelines on land - Guide to the application of pipeline risk assessment to proposed developments in the vicinity of major accident hazard pipelines containing flammables,” PD 8010-3:2009 34. API RP 752, “Management of Hazards Associated With Location of Process Plant Buildings”, American Petroleum Institute, Washington, D. C., 1995. 35. Guide AIHA (2006), ERP Committee Procedures and Responsibilities, November 2006 36. AIHA, Curent AIHA ERPG Values, 2009 37. ERCB, Emergency Preparedness and Response Requirements for the Petroleum Industry, Directive 071, April 2008 38. UK HSE, Indicative Human Vulnerability to the Hazardous Agents Present Offshore for Application in Risk Assessment of Major Accidents, SPC/Tech/OSD/30, January 2006 39. API 55, Recommended Practice for Oil and Gas Producing and Gas Processing Plant Operations Involving Hydrogen Sulfide, 2nd Edition reaffirmed March 2007 40. API 49, Recommended Practice for Drilling and Well Servicing Operations Involving Hydrogen Sulfide, 3rd Edition, May 2001 41. API 68, Recommended Practice for Oil and Gas Well Servicing and Work-over Operations Involving Hydrogen Sulfide, 1st Edition, January 1998 4.0 Definitions Refer to HSEMS Guidelines KOC.SA.040 for “Quantitative Risk Assessment” for definitions. 5.0 Abbreviations AIHA - American Industrial Hygienist Association ALARP - As Low As Reasonably Practicable API - American Petroleum Institute BLEVE - Boiling Liquid Expanding Vapor Explosion CAM - Congested Area Method CBA - Cost Benefit Analysis CFD - Computational Fluid Dynamics CHCD - Closed Hole Circulation Drilling CLA - Cox, Lees & Ang DTL - Dangerous Toxic Load EGIG - European Gas Pipeline Incident Data Group EPZ - Emergency Planning Zone ERCB - Energy Resources Conservation Board ERP - Emergency Response Planning ERPG - Emergency Response Planning Guidelines ESD - Emergency Shutdown ESDV - Emergency Shutdown Valve ETA - Event Tree Analysis FB - Full Bore FTA - Fault Tree Analysis H2S - Hydrogen Sulphide HC - Hydrocarbon HCR - Hydrocarbon Release HEM - Homogeneous Equilibrium Method HPHT - High Pressure High Temperature HSE - Health, Safety and Environment HSEMS - Health, Safety and Environment Management System

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 8 of 42

IP - Institute of Petroleum IR - Individual Risk IRPA - Individual Risk Per Annum KOC - Kuwait Oil Company LBV - Line Block Valve LFL - Lower Flammable Limit LPG - Liquefied Petroleum gas LSIR - Location Specific Individual Risk NFPA - National Fire Protection Association NUI - Normally Unattended Installation OGP - Oil and Gas Producers PAZ - Protective Action Zone P&ID Process and Instrumentation Drawing PLL - Potential Loss of Life PPE - Personnel Protective Equipment PTW - Permit to Work QRA - Quantitative Risk Assessment RTC - Risk Tolerability Criteria SCBA - Self Contained Breathing Apparatus SIMOPs - Simultaneous Operations SLOD - Significant Likelihood of Death SLOT - Specified Level of Toxicity TR - Temporary Refuge UK HSE - United Kingdom Health and Safety Executive UKOOA - United Kingdom Offshore Operators Association 6.0 Frequency Analysis Determination of the frequency of the various scenarios used for the QRA requires performing a calculation procedure, which is described in this section. 6.1 Parts Count 6.1.1

General

The parts count method used by KOC is in line with the method used by the UK HSE to collect historical leak frequency information. The parts count shall be based on latest available revisions of P&IDs. It is good practice to highlight the parts counted on hardcopy P&IDs, with different colours defined for different types of equipment. For early stages of projects (where P&IDs are not available), the parts count should be based on existing P&IDs for a similar facility which is at least at detailed design stage (and ideally constructed). The following assumptions apply for Parts Count:  Equipment definitions used are taken to be the same as those given by the UK HSE, in their HCR database.  All spared items are live.  First valve off is closed on all service lines.

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 9 of 42

 Areas of the plant are broken down into isolatable inventories, in order to manage the emergency depressurisation of the plant and to limit the inventory that may feed a release. Section isolation boundaries are defined by: o

ESD valves;

o

Blow-down and relief valves; and

o

Control valves limiting the flow of hazardous gases to flare or blow-down headers.

 Although check valves, other control valves and rotating equipment can limit the inventory within an isolatable section, they are not used to define the isolatable section itself. 6.1.2 Release Sources A parts count is made for each isolatable inventory, but also the count is further divided into the potential release scenarios within each inventory (i.e. vapour phase release, liquid phase release, etc.). The location of each release source shall be documented. Typically, release sources are associated with the major equipment items within an isolatable inventory. 6.1.3 Valves Valves shall be classified within the count according to: 

Size (D < 3”, 3” ≤ D ≤ 11”, D > 11”, etc.)



Actuation (manual or actuated); and



Function (block, blow-down, ESD, choke, control, relief, bleed).

However, there is insufficient historical data to provide accurate leak frequency data by function. Subsequently, different leak frequencies are only provided for each size of manual and actuated valve and valve function is ignored. Where they act as the boundary points between adjacent hazardous isolatable inventories, ESD valves are counted as half valves (i.e. half in each section). While this is contrary to HSE guidance, the methodology ensures whole valves are always counted by counting the whole ESD valve in the few instances where they act as the boundary between a hazardous and non-hazardous inventories. A valve consists of the body, stem and packer but excludes flanges, controls and instrumentation. Typically then, where a valve can be found in a line, the count shall consist of: 

One valve (size, actuation and function recorded); and



Two flanges (size recorded).

The exception to this rule is where butt-welded, top-entry valves are indicated on the P&ID’s, in which case the count is: 

One valve (size, actuation and function recorded) only.

Double block and bleed valves are counted as: 

One manual bleed valve; and



Two manual block valves.

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 10 of 42

6.1.4 Flanges Flanges shall be classified within the count according to their size (D < 3”, 3” ≤ D ≤ 11”, D > 11”). Flange size is taken from the line size upon which it sits, or the nozzle size to which it is mating. A count shall be made of the number of flange joints (where one flange joint consists of two flange faces). Flanges on equipment items are considered part of the equipment item and thus only the flange face on the piping mating to the item is counted (i.e. as half a flange joint). 6.1.5 Instruments All intrusive instruments (including corrosion coupons) shall be treated similarly and thus are counted within a single category, ‘Instruments’. However, depending on line specification, the instrument assembly may include different numbers of flanges and valves. The valve and flange count associated with each assembly is determined from the piping material specification. 6.1.6 Vessels Vessels shall be classified within the count according to: 

Orientation (vertical or horizontal); and



Function (adsorber, KO drum, reboiler, scrubber, separator, stabiliser or other).

A vessel comprises the vessel itself, its nozzles and man-ways but excludes all piping, valves and instrumentation associated with it. Where a vessel contains both, liquid and gases (i.e. in most cases), the methodology requires one half of the vessel to be counted on the gas side count, the other half on the liquid side count. 6.1.7 Compressors Compressors shall be classified within the count as either: 

Centrifugal; or



Reciprocating.

A compressor comprises all stages of compression driven on the same shaft. Thus a three stage compressor, which is driven on a common shaft, shall be counted only as a single compressor. This is in line with the way historical leak frequency data has been collected by the UK HSE. The count will include nozzles on the compressor but excludes all piping, valves and instrumentation associated with it. 6.1.8 Heat Exchangers Heat exchangers shall be classified within the count as either: 

Shell and tube heat exchanger (tube side);



Shell and tube heat exchanger (shell side); or



Plate heat exchanger.

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 11 of 42

A heat exchanger comprises the heat exchanger itself (in the case of shell and tube, the particular side under consideration) and its nozzles but excludes all piping, valves and instrumentation associated with it. Where both sides of a shell and tube exchanger contain hazardous inventories, one tube side and one shell side heat exchanger are counted. 6.1.9 Fin Fan Coolers A fin fan cooler is considered a single fin fan cooler unit. Where multiple units are grouped into banks of coolers, the multiple instances are counted. 6.1.10 Turbines Turbines shall be classified within the count as either: 

Dual fuel; or



Fuel gas.

The turbine fuel supply is taken from the P&ID and the turbine is classified accordingly. 6.1.11 Pumps Pumps shall be classified within the count according to: 

Type (reciprocating or centrifugal); and



Integrity (single or double seal).

Pump type can be determined from the P&ID illustration. Pump integrity is determined via discussions with process or is assumed to be double seal for high pressure systems. While pumps are classified according to type and integrity within the count, the historical data for double and single seal centrifugal pumps is very similar, so an average of the two is used and, for centrifugal pumps, the pump seal integrity is ignored. 6.1.12 Storage Tanks Each instance of a storage tank is counted as a single item. There is no subclassification of storage tanks. 6.1.13 Wellhead A wellhead is defined as the joint between the Xmas tree and the well itself. Xmas trees are made up of the entire unit (including valves, flanges, rams, etc.) down to the wellhead connection and up to the first flange, but excluding all piping, valves and fittings beyond the first flange. 6.1.14 Pipelines For cross-country pipelines parts count, KOC follows best practices well established around the world, which are reflected in several documents in the public domain, and in particular in references 32 & 33.

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 12 of 42

References 32 & 33 establish that pipelines present an extended source of hazard, and can pose a risk to developments at different locations along their route. Where a length of pipeline over which a location-specific accident scenario could affect the population is associated with a specific development, the full length over which a pipeline failure could affect the population or part of the population should be taken into account in the risk assessment.  Individual Risk Calculations For Individual Risk Calculations the above mentioned length is known as the interaction distance, and it is defined as the length of the pipeline through the community or development plus two times the impact radius for the most severe pipeline event. This interaction length is the length to be considered in the parts count for the pipeline. The interaction distance is calculated as shown in Figure 1 below.

Figure No. 1-Calculation of Interaction Distance

 Societal Risk Calculations (F-N Curve) A typical medium-sized plant/facility site might typically have a perimeter exposing risk to the public outside the site of 2 km, so following references 32 & 33 the equivalent length of pipeline exposing the same risk to the public is 1.6 km. In other words, the 1.6 km basis is chosen because it is judged to expose the public to the same level of risk as a typical medium-size plant or facility. This 1.6 km length is therefore the length to be considered in the parts count for the pipeline for societal risk calculation. When the length of the pipeline is less than 1.6 km, the parts count shall consider the whole length of the pipeline.

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 13 of 42

The societal risk shall be calculated for the worst-case 1.6 km of the pipeline route per populated area. The worst-case kilometer is assessed by an evaluation of the consequence area and the surrounding population density. 6.2 Leak Frequency 6.2.1 Process Equipment Release frequencies for individual items of process equipment shall be sourced from the UK HSE Offshore Hydrocarbon Release Database (see reference 28). This database is recommended by UKOOA and is arguably the most comprehensive and up to date database of hydrocarbon releases associated with offshore operations. The hydrocarbon release database collected by the HSE in the UK offshore industry contains data of a quality and quantity that far surpasses any previous leak data in the process industry, particularly compared to the existing onshore frequencies. For each leak underlying the frequency values, it is possible to establish the hole diameter, the system and equipment type, the hydrocarbon type and pressure, the estimated quantity released, and many other parameters It is a widely held belief in the onshore industry that the more harsh conditions offshore will result in higher leak frequencies. However, the causation factors in the offshore data do not provide support for this interpretation. Failure mechanisms associated with the offshore environment (such as salt water corrosion, produced sand erosion, dropped objects, etc.) constitute relatively small proportions of the total and cannot account for the observed order of magnitude difference in frequencies. On the other hand, given that many installations are under common safety management systems onshore and offshore, it would be expected that where hazards were greater in one environment than another, appropriate management controls would be adopted, with the effect of minimizing any differences between them. This explains why analysts were content to use onshore data for offshore QRAs before offshore data were available. Considering all the above, plus given the poor quality of available onshore frequency sources, the offshore data set, being more recent and of higher quality, is also considered valid for onshore facilities. For Normally Unattended Installations (NUIs), the leak frequencies for equipment will be higher during periods when people are present and working on the facilities, as many leaks arise due to human interactions with the system. However, no attempt to reflect this fact in the QRA is needed. 6.2.2 Pipelines References 17, 29 and 30 shall be used as the leak frequencies data bases for QRA studies for oil, gas, and product pipelines. Use of the above data for the sour oil and infield flow lines are considered to be less than conservative due to the high potential for corrosion of these lines in later field life when water content increases and the reliability of the corrosion inhibitor injection may reduce (based on previous experience). A revised data set is therefore recommended incorporating the internal corrosion rates from AEUB data (see reference 27).

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 14 of 42

6.2.3 Pipeline Valves Hole sizes and leak frequencies for the ESD and block valves on the pipelines shall be obtained from the HSE Hydrocarbon Release Database, as per Section 6.2.1. If sufficient data exists to benchmark the performance of KOC valves based on valve design and construction quality (i.e. so that they are deemed less likely to fail than the average population in the database) then this should be taken into account in the leak frequencies. 6.2.4 Releases during Pigging Pig launchers and receivers are treated in a similar way and are referred to as pig traps. The UK HSE Hydrocarbon Release Database gives leak frequencies for pig traps, and this shall be used for QRA studies in KOC. The approach used shall be to count the component parts making up the pig launcher/receiver (e.g. valves, flanges, seals, etc.) and apply a leak frequency per part, taking into account the fraction of time the pig launcher/receiver is in use. In addition, the probability of an operator inadvertently opening the launcher/receiver door whilst it is under pressure should also be assessed. The risks associated with pigging are considered to be related directly to the activity and it is expected that they may be reduced by introducing temporary measures during the operation (restricting access, etc.). 6.2.5 Drilling Releases and Well Intervention The relevant frequencies for blowouts and well releases shall be determined using the SINTEF data as published in OGP Risk Data Directory (Ref. 19). Note: For the fractured zones, experience from High Pressure High Temperature (HPHT) wells is considered most relevant. Drilling in HPHT conditions has a higher likelihood of blowout compared to drilling in normal pressure regimes. This is because the first barrier, the mud column, is known to be highly unreliable due to narrow pressure margins. During CHCD, the mud weight is less critical, because drilling can occur while fluid is pumped into the well. Therefore, CHCD is considered a risk reduction. 6.2.6 Dropped Objects Risk There shall be no routine lifts over hydrocarbon equipment. Maintenance lifts shall also only take place over isolated equipment during the annual shutdowns. Therefore dropped objects are not anticipated to increase the process risk. This should be confirmed by a dropped object analysis and incorporated in the QRA if the risk is significant.

7.0 Manning Levels In order to facilitate QRA calculations, individuals shall be assigned to a worker group representative of their work pattern and location. Typical worker groups are given below:

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 15 of 42

Typical Worker Groups  Mechanical maintenance  Electrical maintenance  Instrument maintenance  Production operations (area specific e.g. oil processing, gas sweetening, LPG, sulphur recovery, storage, utilities)  Civil / structural  Support  Supervision Table No. 1: Typical Worker Groups

It may be decided that certain worker groups (e.g. support, vendor maintenance) need not be assessed, on the grounds that they will have a lower risk than the most exposed worker group. Each worker group is assigned a representative rotation/shift pattern and the time spent at each area of the facility/plant versus time spent in the control room/offices/accommodation is also estimated. These estimates are used to calculate the individual risk to each person within each worker group. For the purposes of group risk (PLL, F-N), the total number of individuals within each worker group must also be estimated. The information required to estimate these manning distributions should be based on discussions with Operations and Maintenance. For a facility which is normally unmanned (NUI), worker groups are only exposed to the facility risks for the fraction of the year that they are present on the facility. However, the company must assure itself that the total risk for each worker group is acceptable; for crews this means taking into account the risk from each location visited over the entire year. It may be necessary to distinguish between periods of time when the facility is operating and periods when the facility is shut down and de-pressurised. The analysis should then take account of the fact that, during shutdown, workers are not exposed to the full range of hydrocarbon release scenarios. Where facilities are categorised by toxic operating zones, the manning levels/times spent by each worker group in each zone should also be taken into account. 8.0 Modifier Events Probabilities 8.1 Detection, Blow-down and Isolation The duration of a release depends on the time taken to identify that it has occurred and the steps necessary to stop it. The following sections describe rule sets for determining the probability of detecting and isolating a release, and estimating its duration. 8.1.1 Process Equipment The suggested approach is to determine the probability of detection based on the fire and gas detection system performance standards and, in addition, to define an event tree node for probability of early detection, i.e. detection within 15 seconds. The probability of early detection is estimated on an area by area basis using the toxic and/or flammable footprint and the gas detector layouts for a number of release points and release orientations. Where early detection does not occur (either due to failure of the gas detector, or because the gas cloud does not reach the detector), it is reasonable to

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 16 of 42

assume that detection will occur by some other means (e.g. manual detection, process upset alarms) within 10 minutes of the start of the release. Where QRAs consider only the immediate toxic and flammable effects, the probability of isolation is taken as 100%, the probability of blow-down is taken as 0% and the release duration is of secondary importance. A 1 minute delay for isolation is assumed. A sensitivity analysis should be performed for the isolation probability to assess the impact of failing to isolate, whether from isolation valve failure or damage to isolation valves arising from explosion or fire. If EER fatalities and escalation are included in the assessment, the probability of isolation and blow-down rule set will require further consideration. 8.1.2 Pipelines Detection of a release from a pipeline depends on the location of the release point (i.e. proximity to populated areas/plant), whether the pipeline is fitted with a monitoring system/pressure sensors and the size of the release. Pipeline monitoring systems should have a defined operational effectiveness, specifying the minimum detectable leak rate/volume and the response time for various sizes of leak. Where such systems are fitted, the system specification can be used to estimate the release duration depending on the size of the leak. It is reasonable to assume that full bore releases will be detected within a few seconds. Smaller releases will take longer to detect and there is the potential for small releases to go undetected (i.e. where there is no installed monitoring system or where the size of the release is below the threshold of the monitoring system), until they either increase in size or are identified by other means. Once a release is detected, the duration of the discharge depends on the probability of isolation, the time taken for the isolation valves to close and the size of the isolated inventory (between LBVs/ESDVs). It is assumed that LBVs and ESDVs are 100% reliable on the basis that they will be maintained and tested in an appropriate manner such that the probability of failure to operate on demand is very low. It is also assumed that all full bore releases will automatically lead to closure of the LBVs/ESDVs and that valve closure takes 30 seconds. For smaller leak sizes, it may be that the release rate remains relatively unaffected by blow-down (i.e. a steady state release persists for a considerable time period) in which case the effect of blow-down need not be considered (see section 9.3.3). 8.2 Ignition Probabilities 8.2.1 Event Tree Analysis (ETA) The ETA used for KOC QRA studies shall have the structure shown in figure No. 2 below when assessing the probability of ignition. The structure is built around the premise that immediate ignition results in jet fires and delayed ignition can result in either flash fires or, where sufficient congestion exists, explosions.

Revision - 0 Page 17 of 42

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Immediate Ignition

Delayed Ignition

Explosion given DI

Scenario

Jet Fire

YES Leak

YES

VCE

YES

NO

NO

Flash Fire

NO

Toxic/Dispersion

Figure No. 2-Ignition Probability Event Tree Structure

8.2.2 Ignition Probabilities For all KOC QRAs the ignition probability shall be based on the Institute of Petroleum (IP) data (see reference 15). The IP model provides simple, mass release rate based ignition probability look-up correlations for a selected range of representative release scenarios, with guidance on selecting the appropriate correlation to use in a given situation (e.g. onshore, pipelines, inside mechanically ventilated enclosures, etc.). As an example, see figures No. 3 and 4 below. 1 Small Plant Gas LPG

Small Plant Liquid

Small Plant Liquid Bund

Probability of Ignition

0.1 Large Plant Gas LPG

Large Plant Liquid

Large Plant Liquid Bund

0.01 Large Plant Confined Gas LPG

Cox,Lees,Ang - Gas

Cox,Lees,Ang - Liquid

0.001 0.01

0.1

1

10

100

1000

10000

Mass Release Rate, kg/s

Figure No. 3-IP Look-Up Correlation – Onshore

100000

Revision - 0 Page 18 of 42

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

1 Pipe Liquid Industrial

Pipe Liquid Rural

Pipe Gas LPG Industrial

Pipe Gas LPG Rural

0.1 Probability of Ignition

Tank Liquid 300x300m Bund

Tank Liquid 100x100m Bund

Tank Gas LPG Storage Plant

Tank Gas LPG Storage Industrial

0.01 Tank Gas LPG Storage Rural

Cox,Lees,Ang - Gas

Cox,Lees,Ang - Liquid

Tank Liquid - diesel, fuel oil

0.001 0.01

0.1

1

10

100

1000

10000

100000

Mass Release Rate, kg/s

Figure No. 4-IP Look-Up Correlation – Tanks and Pipelines

In addition to the above graphs, the IP correlations can also be expressed as equations. The IP look up correlation should be selected based on the nature of the plant area. For example: Correlation 8

9

12

14

Description

Application

Large Plant Gas LPG (Gas or LPG release from large onshore plant) Large Plant Liquid (Liquid release from large onshore plant)

Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling point from large onshore outdoor plants (plant area above 1200m2, site area above 35,000m2).

Tank Liquid 300x300m Bund (Liquid release from onshore tank farm where spill is limited by a large bund) Tank Gas LPG Storage Plant (Gas or LPG release from onshore tank farm within the plant)

Releases of flammable liquids that do not have any significant flash fraction (10% or less) if released from large onshore outdoor plants (plant area above 1200m2, site area above 35,000m2) and which are not bunded or otherwise contained. Releases of flammable liquids that do not have any significant flash fraction (10% or less) if released from large onshore outdoor storage area ‘tank farm’ (e.g. spill in a large multi-tank bund over 25,000m2 area).

Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling point from onshore outdoor storage tanks located in a ‘tank farm’ entirely surrounded by plant(s).

Table 2: IP Look-up Correlations

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 19 of 42

8.2.3 Explosion Probabilities Figure No. 2 above illustrates the ETA structure for dealing with ignition probabilities. The structure requires ignition probabilities to be input in three stages: 

P(immediate ignition)



P(delayed ignition given that immediate ignition has not occurred)



P(delayed ignition and explosion)

Explosions occur where flammable clouds infiltrate a congested area and encounter an ignition source; where there are no congested areas, explosions shall not be modelled. The IP review of ignition and explosion probabilities (see reference 15) concludes that there are too little data to draw any firm conclusions but that “risk assessment approaches based on 30:70 to 50:50 split delayed ignition or jet / pool fire : flash fire / explosion are reasonable”. Furthermore, it also identifies that, on average, approximately 20% of ignited gas releases result in explosions. The proposed explosion probability rule set is therefore (based on reference 15): 

50% of all ignitions are immediate resulting in jet/pool fires (F);



20% of all ignitions result in explosion (PEX);



The remainder (30%) of ignitions result in flash fires (1-F-PEX).

Based on the above, the ratio between P(immediate ignition) and P(delayed ignition) is estimated as 50:50. This estimate is supported by the joint industry Ignition Probability Review (see reference 15), which shows that approximately 50% of ignitions occur within a minute or so of the leak commencing. To account for the event tree structure, this 50:50 split gives the following input probabilities:  P(immediate ignition) = P(ignition) x F  P(delayed ignition or no ignition) = [P(ignition) x (1 – F)] / [(1-P(immediate ignition)] where P(ignition) is the mass flow rate-dependent probability of ignition calculated as described in Section 8.2 above, and F = P(immediate ignition given ignition) = 0.5. Hence:  P(immediate ignition) = P(ignition) x 0.5  P(delayed ignition or no ignition) = [P(ignition) x 0.5] / [(1-(P(ignition) x 0.5)] Having apportioned the overall ignition probability in this way, a value for P(delayed ignition and explosion) is required. Chapter 16 of CLA (see reference 16) gives the following values for P(explosion given ignition) (see figure No. 5 below).

Revision - 0 Page 20 of 42

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Probability of Explosion Given Ignition Gas

Probability of Ignition (overall)

1.000

0.100

0.010

0.001 0.01

0.10

1.00

10.00

100.00

1000.00

Flow Rate (kg/s)

Figure No. 5- Cox, Lees and Ang Explosion Probability

The value for P(delayed ignition and explosion) is calculated from the above graph using:  P(delayed ignition and explosion) = P(explosion given ignition) / (1 – F) i.e. P(explosion given ignition) / 0.5 8.2.4 Exposure to Toxic Releases Before Delayed Ignition Occurs For releases which are not immediately ignited, the toxic effects of the unignited gas will impact on personnel within the toxic cloud footprint. Where delayed ignition occurs, the flash fire or explosion effects will also impact on personnel within the hazard zone, some of whom may have been affected by the toxic event. If the probabilities of fatality from both types of event are treated as totally independent of each other, the QRA could potentially over-count fatalities, i.e. the same individual could be counted as a toxic fatality and also as a flash fire and/or explosion fatality. Alternatively, if a simple rule set is applied such as ignoring the toxic effects of all ignited events (immediate and delayed), the total number of fatalities may be under-counted. The QRA shall deal with this situation by calculating fatalities arising from both toxic effects and delayed ignition events for the delayed ignition branches of the event tree and combining them. 8.2.5 Delayed Ignition/Explosion Probabilities for Pipelines P(delayed ignition) for cross-country pipelines is based on the background ignition probability expressed in terms of a probability per unit area affected by the release. The figures to be used for this case are those presented in reference 15. Where the far reaching effects of toxic releases is mitigated by ignition of the release, a sensitivity analysis with zero background ignition probability should be considered (but the possibility of immediate ignition remains).

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 21 of 42

For releases from cross-country pipelines, clouds that ignite are not expected to detonate due to the lack of congestion in the affected areas hence P(explosion) is zero i.e. delayed ignition always results in a flash fire. 8.3 Offsite Effects for QRAs When calculating offsite effects from onshore facilities, the toxic effects are assumed to dominate and hence ignition probabilities are set to zero (i.e. there are no thermal radiation fatalities offsite).

9.0 Consequence Analysis 9.1 General Guidelines All modeling of physical phenomena is imperfect. Any use of software must be within the limitations set out for the software. Nonetheless, modeling implies a series of uncertainties. Consequently, the analyst must carry out sensitivity analysis on the results. Depending on the application, a simple model may be fit for purpose, or detailed modeling (e.g. using CFD) may be required. Deciding which model is best involves clearly defining (among other aspects), what is the scope and depth of the study, as well as the amount of release scenarios to be modeled In any case, it is absolutely critical that the analyst always understands fully how the models work to ensure that the results represent physical reality. This is particularly important since the models tend to be “black-box-like” tools. 9.2 Hole Size Bands 9.2.1 Process Equipment Component release frequencies are required for the following equivalent hole sizes of 7mm, 22mm, 70mm and 150mm. The 7mm class is intended to provide a basis to assess the risks from small releases, which could present a toxic hazard. This also allows more appropriate analysis of small releases, helping to distinguish between the hazards from low and high pressure systems. These nominal hole sizes have been selected such that the nominal size represents the geometric mean of the different ranges used by the HSE Hydrocarbon Release (HCR) data (see reference No. 28). Generally speaking, a 7mm release can be assumed to represent to a small bore connection leak, a 22mm release corresponds to the rupture of an instrument connection, a 70mm release represents rupture of a 4” diameter pipe, etc. All QRAs for offsite and onsite effects shall consider full bore (FB) releases. However, special care shall be taken when modelling the consequences of full bore releases; in particular, any hazard range estimates from continuous or transient releases must be supported by the inventory of material available to be released. Full bore rupture of large storage tanks or large inventory process vessels is modelled as a quasi-instantaneous model of the full inventory release (for vapour dispersion or a fire ball for example).

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 22 of 42

9.2.2 Pipelines Three hole sizes are modelled for pipeline releases: 7mm, 22mm and full bore rupture. In this case, consideration shall be given the maximum calculated non-propagating hole size. 9.3 Composition and Time Averaging 9.3.1 Composition Both software used by KOC, PHAST and FRED use a simplified mixing tool and therefore limit the number of components that can be modelled to fourteen/sixteen depending on the version of the software. In any case, the composition input shall be kept as proportional as possible to the composition on the heat and material balance. In particular, the mole% of hydrogen sulphide shall be kept constant and the molecular weight of the inventory checked to ensure it is as close as reasonable practicable. Initial temperature, pressure and mass of the inventory at the time of the release shall be taken from the heat and material balance data sheets. 9.3.2 Time Averaging Averaging times take account of the effects of changes in wind direction over the course of the release. A standard toxic dispersion averaging time of 600 seconds shall be used. Where discharge durations are short, the validity of this assumption can be questioned, results should be reviewed and the averaging time adjusted if necessary. 9.4 Mass Flow Rates Source modelling is referred to the discharge calculations (flow rate) resulting from the hypothetical release scenarios specified. The fundamental equation for source modelling is the mechanical energy balance developed into release scenarios. Source modelling shall include predicting discharge calculations for the following: 

Liquid (non-flashing), gas (sonic and subsonic) and two-phase discharges through an orifice.



Liquid, gas and two phase releases through a piping system.



Flashing and evaporation after the release. This includes vapour releases, and twophases formation, liquid entrainment, aerosol formation, and rainout. Liquid will form pools, which will evaporate.

Note 1: Releases can be assumed to undergo isentropic or isenthalpic paths. Note 2: Pool evaporation should include all heat and mass transfer mechanisms. If liquid is not diked, assume a constant depth of 1 cm. Note3: There are no completely acceptable methods for predicting aerosol formation. For conservative analysis, assume that all aerosols evaporate. Where there is concern over the validity of the results from PHAST or FRED mass flow rate models, then a more detailed method may be used. This method would need to be agreed with the Process Engineering team. However, it is important to note that it is PHAST or

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 23 of 42

FRED as total packages that are validated and therefore any over-prediction of mass flow rates may be offset by an under-prediction of a different parameter elsewhere in the model. 9.4.1 Releases from Process Equipment Steady state mass flow rates are generally assumed, with the discharge duration set to correspond to the size of the isolatable inventory. 9.4.2 Releases from Pipelines Pipeline releases are transient in nature due to closure of LBVs/ESDVs and inventory depletion following release. Generally speaking for pipelines, 22mm and 70mm hole sizes show relatively little change in release rate due to the large inventory, so steady state releases shall be modelled for these type of hole sizes. In addition, the blow-down characteristics also show relatively little change in release rate so the effect of blow-down is not considered. Full bore ruptures are, however, transient releases. The transient releases from pipelines shall be modelled with the rate of decrease in release rate dependent on the isolated inventory between the LBVs/ESDVs and the hole size. Full bore ruptures shall be modelled as double ended (i.e. material is released from both open ends of the ruptured pipe) effectively doubling the mass flow rate from a single hole. a. Gas Pipelines Full bore ruptures of the gas lines lead to a rapid depressurising of the line where the mass flow rate of the release rapidly falls and the release plume never becomes fully established. The effects of the release are therefore somewhat lower than a steady state assessment based on the starting pressure. The flammable effects of cloud and jet fires shall therefore be based on the average flow rate over the first 30 seconds. This reflects the fact that the release rate drops rapidly as the line depressurises and also that any harmful effects will occur over a relatively short timescale. The LBVs and ESDVs will not operate within this 30 second period and their impact shall not be included. For toxic effects, in addition to the reduction in the extent of the toxic cloud (compared to a steady state release) the exposure period is also a key element and is particularly relevant if there are LBVs/ESDVs that will operate following a major release. The average release rate shall therefore be calculated by considering the total inventory of the release (i.e. the total quantity of gas which will be released, allowing for the effect of the block valves closing after 30 seconds (operating period)), and considering what flow rate is required to achieve this release over a 90 second period. The selection of the 90 second period is based on judgement and roughly corresponds to the time at which 90% of the releasable inventory has been discharged. The aim is to estimate an ‘effective release rate’ on which to base the maximum concentration levels in the transient toxic plume. This approach means that the maximum levels will be slightly underestimated in the area close to the release, where the maximum levels will be the instantaneous release rate at time t=0. However, due to the high levels experienced in this region the probability of fatality will be close to 1.0 anyway, limiting this error. In the far field, the approach is conservative as the area will be exposed to the whole dose in

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 24 of 42

the form of a higher concentration for a shorter period of time. The effect will increase the fatality probability for a given location and is thus conservative. The effective release rate is used to determine the toxic concentration contours for the release. Where there are no LBVs/ESDVs installed in the pipeline, there is a much longer period during which a significant release continues to take place as the pipeline depressurises. In this case, the release shall be analysed over an 1800 second period and the effective release rate calculated based on the rate required to release the total inventory over this time. This approach reduces the overall exposure time by ignoring the ramp up and ramp down effects of the release, however it increases the concentration such that the overall dose (Ct) is the same. The effect increases the fatality probability for a given location and is thus conservative. b. Liquid/Multiphase Pipelines It is assumed that following full bore rupture the pressure in the line falls to the vapour pressure of the fluid and is then maintained at this level as the fluid flashes inside the pipeline. (In reality the pressure would be expected to drop slowly from this level but for the purpose of QRA studies this is a conservative approach). It is assumed that the liquid in the line will continue to be discharged with a composition and density equal to the pre-rupture liquid in the line. This rate and composition is used to determine the flash fire, jet fire and pool fire scenarios. It is accepted that this approximation is conservative; however it is not considered to be unrealistic for the short term < 30 second effects related to jet fires and cloud fires. The exposure period of the toxic gas is determined by dividing the inventory of the line by the release rate. In the event that LBVs/ESDVs operate, the reduction in available inventory is used to determine the release duration. This approach reduces the overall exposure time by ignoring the ramp up and ramp down effects of the release, however it increases the concentration such that the overall dose (Ct) is the same. Since the toxic probit used to determine the toxic dose effects is of the form [Cnt], the effect increases the fatality probability for a given location and is thus conservative. c. Buried Gas Pipelines For full bore releases, it shall be assumed that a crater is formed, allowing for a free jet. For lower pressure or small releases, the crater formation may not happen, therefore, diffusion through the soil must be assumed. Several release orientations shall be assumed (see Figure No. 6 below), and a full range of weather conditions shall be applied to make the analysis complete. Furthermore, a key consideration is the impact of the burial on the momentum of the release (which is a key driver for the dispersion behavior). Some recent experimental work (unpublished) in this regard indicates that a reduction of up to 90% of the initial momentum is possible. Consequently, the reduction of momentum is an issue to evaluate, but must be treated probabilistically. Because not all release scenarios will have less momentum than a free jet, the modelling process shall either make conservative assumptions (near-horizontal releases have full momentum and vertical releases have very little),

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 25 of 42

or model a range of initial momentum conditions, each with an appropriate conditional probability. Using only orientation at 45o angle from horizontal is not adequate.

Figure No. 6: Quadrants for Release Directions (Taken from reference No. 31)

For lower pressure, and/or small horizontal or downward leaks, the force exerted by the flow is unlikely to create a crater hence the flow will only slowly percolate to the surface. The following approach taken from reference No. 31, is suggested for all release directions:  Calculate discharge rate as normal.  Remodel release with a very low pipeline pressure (1 barg for operating pressure >10 barg, 0.1 barg for operating pressure < 10 barg), to simulate diffusion through the soil, with the hole size modified to obtain the same discharge rate as above. d. Releases During Drilling / Well Intervention Blowout flow rates depend on the well Absolute Open Flow (AOF) and productivity index. As an example, Table No. 3 shows AOFs and corresponding flow rates for some of the Jurassic Reservoirs in NK. Reservoir

AOF (MMSCFD)

Raudhatain NWRA Sabriyah Umm Niga Dhabi

300 200 300 150 150

WH Temperatur e (oC) 87 93 87 87 85

WH Pressure (barg) 419 385 429 435 395

Max. Total Flow Rate (kg/s) 51 68 106 100 46

Release Orientation Horizontal Horizontal Horizontal Horizontal Horizontal

Table 3: Example of Simulated Blowout Flow Rates and Release Orientation for NK

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 26 of 42

9.5 Release Orientation 9.5.1

Releases from Process Equipment / Plant

a. Equipment Outdoors (not enclosed) Releases from equipment located outdoors in relatively open plant are assumed to be horizontal unimpinged and oriented in the downwind direction as this gives longer dispersion distances than other release directions upwards from the horizontal. Horizontal unimpinged releases are considered reasonable in this case due to the relative uncongested nature of the plant. Horizontal impinged releases are modelled only for specific highly congested areas and inside enclosures (provided enclosure walls are not pressure retaining. For pressure retaining walls see section 9.5.1.b, below). Please note that consequence calculations software normally calculates that the maximum hazard areas for impinged releases are greater than for the unimpinged releases. This is as expected because there is less air entrainment due to lower momentum of the impinged releases. The release elevation is set at 1m above ground level; this is realistic as most releases are not at ground level and it provides better modelling of droplet behaviour for continuous releases. This elevation is also representative of the average height of the population in a range of postures. Individuals are assumed to be 1m away from the equipment being worked on. A sensitivity analysis should be carried out for vertical, downward and angled releases. b. Equipment Inside Enclosures Indoor release scenarios are generally discharged via the enclosure HVAC stack. These are modelled as vertical releases (i.e. assume no cowls fitted to stacks), with a source term based on the stack height and dimensions and assuming the forced ventilation is shut down. The gas temperature at the stack tip is assumed to be the same temperature as the gas from the leak orifice. Some larger releases exceed the HVAC capacity and are therefore modelled as horizontal releases via the enclosure HVAC duct exit location (rather than via the stack). The approach expressed above is a fair approximation to reality. However, it is highly recommended to apply CFD modelling for equipment inside enclosures for a better and more accurate model of this particular situation. 9.5.2 Releases from Pipelines Table No. 4 below shows the release orientation for the various orifice sizes. It applies for both gas and liquid releases, i.e. pressurised releases. The releases are unimpinged.

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

in

Horizontal

Revision - 0 Page 27 of 42

Hole Size

Orientation Plane

Orientation in Vertical Plane

22mm

Single hole, equal probability of jet being directed in any direction.

Pipeline releases will be subsurface with no jet breakthrough. Full release will diffuse to surface and disperse. Above surface releases will produce a momentum driven jet.

70mm

Single hole, equal probability of jet being directed in any direction.

Release will excavate a clear path to the surface. 100% of releases will be vertical.

Full Bore Rupture

Double sided release, equal probability of jets being directed in any direction.

Release will completely excavate a crater and is assumed to be 100% horizontal.

Table 4: Pipeline Release Orientations

9.5.3 Releases during Drilling/Well Intervention As per Table No. 3 above, releases shall be considered that are orientated horizontally. The release elevation is the height above sea level. 9.6 Atmospheric Conditions 9.6.1 Weather Conditions For 'wind-driven' gas dispersion scenarios, the hazard range depends on the wind speed and atmospheric stability conditions. Therefore, the consequences shall be evaluated for a range of representative weather types (wind speed/stability combinations). The probability of each weather type shall be factored into the risk. Information on wind speed and direction shall be obtained from an official source (e.g. Kuwait Airport), normally presented as a wind rose. An example of a wind rose for Kuwait is given in Figure No 7 below. As can be seen from Figure No. 7, the information given in this wind rose includes a sixteen sector wind-rose with the data broken down into seven categories of wind-speed.

Figure No. 7: Wind Rose for Kuwait (2008)

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 28 of 42

The wind rose in Figure No. 7 shows the relative predominance of wind, as an annual average, from 16 compass point directions. It can be seen that there is a clear prevailing wind from the North-North-West, while wind from the South East is the other key direction. Note that the wind rose is given for true co-ordinates. Atmospheric stability categories defined by the Pasquill-Gifford scheme shall be used for consequence modeling. This considers seven categories ranging from Stability A (very unstable) to Stability G (very stable). Analysis of the available data shows that average wind-speeds during the hours of darkness are markedly lower than during daylight hours. Low wind-speed conditions at night-time are often characterized by more stable atmospheric conditions (E/F), with F dominating where there is minimal cloud cover. These conditions represent the worstcase for wind-driven dispersion modelling (i.e. give the longest hazard ranges due to reduced mixing with air). During periods of strong sun (typical daytime weather in Kuwait for most of the year) the atmospheric conditions tend to be unstable (stability A, B or C depending on windspeed). During the periods before sunset and after dawn the stability tends to be neutral (D). Stability D also dominates at night with high (> 3 m/s) wind-speeds and during the daytime where cloud cover exists. Based on the above observations, the following stability/wind-speed categories shall be used for QRA studies in KOC:  D stability, 5 m/s (referred to as D5) and F stability, 1.5 m/s (referred to as F1.5) weather categories shall be applied for QRA studies for KOC, as broadly representative of ‘typical’ and ‘worst-case’ dispersion conditions.  From interpretation of the wind rose given in Figure No. 7, F1.5 conditions are assumed to occur for 30% of the time, with D5 conditions applying for the remainder.  An average ambient (and surface) temperature of 30oC shall be applied, together with an average relative humidity of 70%.  Solar radiation for Kuwait is estimated at 0.946 Kw/m2. Limited influence on the consequence results.  Atmospheric pressure for Kuwait is estimated at 1.005 bar. Average from the minimum and maximum air barometric pressure. Limited influence on the consequence results. 9.6.2 Surface Roughness A surface roughness parameter of 0.11 is adopted for all wind speeds and stability classes. This reflects the equivalent of open countryside, and is a median average between the plant, which is an industrial site, and flat land/open farmland which is prevalent off-site in Kuwait.

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 29 of 42

9.6.3 Releases Inside Enclosures The above information on atmospheric conditions does not apply to enclosures. 9.7 Unignited Gas Dispersion 9.7.1 Releases Outside Enclosures For releases from process plant/equipment outside enclosures, gas dispersion physical effects are calculated using PHAST and/or FRED (latest versions). 9.7.2 Releases Inside Enclosures Releases inside enclosures for toxic and/or flammable gases shall be analysed using CFD modelling. Note that asphyxiation hazards shall be assessed for non-toxic process streams released inside enclosures. Depending on the release size and ventilation rate, releases which deplete oxygen rapidly to unacceptable levels shall be included in the unignited gas fatality probabilities. 9.7.3 Releases from Pipelines For large bore releases from pipelines, significant distances (several km) can be reached by toxic levels of unignited gas. For releases from pipelines, gas dispersion physical effects are calculated using PHAST and/or FRED (latest versions). 9.7.4 Releases during Drilling/Well Intervention Dispersion of unignited gas from blowout scenarios is calculated using PHAST and/or FRED (latest versions). 9.8 Fires 9.8.1 Flash Fires Flash fires involve the release and dispersion of flammable gas (or flashing condensate) to form a flammable gas cloud, followed by subsequent (i.e. delayed) ignition. For releases outside enclosures, flash fire physical effects shall be calculated to LFL, using PHAST and/or FRED (latest versions). Sensitivity analysis shall be done to 0.5LFL. For releases inside enclosures, immediate ignition is assumed to always result in jet fires and delayed ignition is assumed to always result in explosions. 9.8.2 Jet Fires A pressurised gas release normally results in a dispersing gas jet which, upon immediate ignition, creates a jet fire. Pressurised liquid releases that ignite immediately also lead to a jet fire. Jet fire physical effects for releases outside enclosures are calculated using PHAST and/or FRED (latest versions). The impinged (obstructed) jet fire model shall be used. While jet fire risks using the impinged model may be optimistic for locations further from the release source, for near field locations the model is conservative as it considers that people behind the release are as exposed as those in front of it.

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 30 of 42

To avoid underestimating the risks to personnel close to the source of the jet fire it is recommended that any flame lift off is added to the radiation distances. For releases inside enclosures, all immediate ignitions are considered to be jet fires and their physical effects are modelled as for releases outside enclosures. 9.8.3 Pool Fires Pool fires involve loss of containment of a flammable liquid (e.g. condensate) followed by its ignition. The magnitude of the fire depends on the size of the burning pool, which is usually determined by the extent of the bunded area provided for spill containment and available drainage paths. For releases outside enclosures, the physical effects of pool fires are calculated using PHAST and/or FRED (latest versions). For releases inside enclosures, all immediate ignitions are considered to be jet fires. 9.9 Effects of Smoke and Combustion Products Due to the open nature of the terrain and the buoyancy of fire plumes, these effects are not considered to be a significant hazard compared to the other toxic and flammable effects. Releases containing H2S that ignite are not considered for toxic effects as they are thermally buoyant and not expected to have an impact. Sulphur dioxide (SO2), which is a by-product of a jet fire fuelled by the sour process fluids (H2S), is thermally buoyant and therefore not anticipated to have an impact on risk to personnel. 9.10 Explosions Experience has shown that several types of explosion are possible in the O&G industry, among others: 

Vapour Cloud Explosions



Condensed phase explosions



Dust explosions



Runaway reactions

In addition, BLEVEs and vessel bursts generate overpressures that may be significant. However, for QRA studies in KOC, explosions shall be taken to mean exclusively vapour cloud explosions (VCEs). The physical effects of explosions shall be calculated using PHAST and/or FRED (latest versions), which have becoming more sophisticated and considered fit for purpose for these calculations. However, where design or layout decisions may critically depend on explosion risks, use of CFD for specific scenarios would give additional robustness to, and confidence in, the results. Therefore, it is highly recommended the use of CFD explosion modelling for these types of cases.

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 31 of 42

9.11 Escalation (Knock-on Effect) Escalation is possible from either prolonged jet fire impingement (e.g. for more than 5 minutes) or from explosion overpressure causing knock-on damage. Jet fire durations are estimated from the isolatable inventory. Typically equipment/piping can be assumed to fail if exposed to overpressures of ≥1 bar and the frequency of such exposure can be estimated from overpressure exceedence curves for the location under consideration. Where escalation occurs, the knock-on effects are modelled as full bore jet fires or, where escalation causes vessel failure, a catastrophic fireball. However, it is important to note that in practice, the contribution of escalation events to the risk to personnel is relatively small compared to the immediate fatality effects (and also because, in the case of jet fire impingement/escalation, survivors would be expected to have escaped from the area before escalation occurs). Consequently, QRA studies performed for KOC shall not consider the knock-on effect. 9.12 Effectiveness of Deluge Systems Deluge systems shall be considered to have negligible impact on the immediate effects of fires and hence no impact on risk. 10.0

Probability of Fatality

10.1

Jet Fires and Pool Fires

A range of thermal radiation Probits are available and for this assessment, the Tsao & Perry (1979) modified “Eisenberg” Probit, has been adopted (see reference 22) for calculating the probability of fatality to personnel exposed to jet fires occurring outside enclosures: Pr= a + b ln (Q4/3 x t) Where : Pr = probit value a = constant (-12.8, see reference 2222) b = constant (2.56, see reference 22) Q = thermal radiation level (Kw/m2) t = exposure time (seconds) This form of the modified “Eisenberg” thermal Probit equation has been modified to specifically apply to hydrocarbon fires (see reference 22). Once the Probit value has been calculated, it can be translated into a probability of fatality by use of lookup tables (e.g. reference 22) or scaling from a normal distribution. In order to derive a Probit value and hence probability of fatality, an exposure time is required. For this assessment an exposure time of 20 seconds is assumed to be representative of the time an individual may be exposed to immediate effects of jet fires (see reference 23). Consequently, from the above information Table No. 5 below shows the rule is set adopted for thermal radiation:

Revision - 0 Page 32 of 42

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Thermal Radiation (Kw/m2)

Probability of Fatality (%)

37.5

100

12.5

50

6.0

1

Table 5: Thermal Radiation Probabilities of Fatality

When calculating offsite effects (i.e. effects to the public), the toxic effects are assumed to dominate and hence ignition probabilities are set to zero (i.e. there are no thermal radiation fatalities offsite). 10.2 Flash Fires For flash fires occurring outdoors, it is assumed that personnel located inside the footprint to the LFL have a 100% probability of fatality. Additionally, it is assumed that personnel located outside the footprint to the LFL, but inside the footprint to 0.5LFL have a 10% probability of fatality. For flash fires occurring inside enclosures, the consequences shall be treated as those of jet fires. 10.3

Explosions

10.3.1 Impact on People Outdoors The relationship between explosion overpressure levels and probability of fatality is expressed in terms of a Probit relationship, defined as follows: Pr = 1.47 + 1.37 loge (P) Where, Pr is the Probit value, and P is the static overpressure in bar. The probability of fatality is estimated from the Probit value Pr based on a cumulative normal distribution with a mean of 5 and a standard deviation of 1. It is important to note that this relationship is relevant to injury to people inside normal brick-built buildings, taking into account the potential for building collapse. The probability of fatality for people in outdoor locations, away from structures and explosiongenerated missiles is lower for a given static overpressure. The explosion risks calculated for outdoor locations are therefore likely to be overestimates. Table No. 6 below shows the rule set adopted for overpressure outdoors: Overpressure (mbar)

Probability of Fatality (%)

>500

100

300

50

140

1

Table 6: Probabilities of Fatality for Overpressure Outdoors

KOC.SA.041 Rule Sets for Quantitative Risk Assessment

Revision - 0 Page 33 of 42

10.3.2 Impact on People Indoors The indoor fatality rates applied for the (five) different explosion overpressures are based on guidance contained within API RP 752 (see reference No. 34), which defines different fatality rate curves for the following building categories:  B1 - Wood-frame trailer or shack 

B2 - Steel-frame, metal-siding or pre-engineered building



B3 – Unreinforced masonry bearing wall building. This type of building is similar to domestic/small commercial buildings



B4 - Steel or concrete framed with reinforced masonry infill or cladding



B5 - Reinforced concrete or reinforced masonry shear wall building

The same curves apply for B1, B2 and B4 building types, which are taken as representative for the ‘standard’ buildings. Shelters are categorized as buildings (API B1 building classification) for the purposes of assessing the impact from exposure to explosion overpressure to any occupants. A ‘protected’ building type is also defined, which corresponds to the “B5” building type in this case. The “B3” building vulnerabilities are also shown for completeness. Tables No. 7 to 9 below show the impact criteria for explosion effects on people indoors, depending on the type of building.

Peak Overpressure (bar) P