- Email: [email protected]
The major accident risk (MAR) process - developing the profile of major accident risk for a large multi national oil company
process safety and environment protection 8 7 ( 2 0 0 9 ) 59–63
Contents lists available at ScienceDirect
Process Safety and Environment Protection journal homepage: www.elsevier.com/locate/psep
The major accident risk (MAR) process - developing the profile of major accident risk for a large multi national oil company M. Considine ∗ , S.M. Hall BP International, Safety and Operations, Chertsey Road, Sunbury on Thames, Middlesex TW16 7LN, UK
a b s t r a c t The paper describes a programme to develop the profile of major accident risk across a large multi national oil company. It describes the concepts, tools and processes for constructing the risk profile and some of the key learnings from the exercise. © 2008 The Institution of Chemical Engineers. Published by Elsevier B.V. All rights reserved. Keywords: Major accident; Risk profile
1.
Introduction
The current BP Group was formed through a series of mergers of companies with differing strategies for managing major accident risk. In order to achieve a more consistent approach, it was decided to review the various methodologies of the heritage companies and develop a philosophy which would best serve the newly formed Group. The various approaches adopted within the heritage companies included: • Consequence based methodology, with protection designed on the basis of a “maximum credible accident”. • Quantification of individual risk (to workers and the public) and comparison against an upper “intolerability limit”. • Application of cost benefit methodology in order to demonstrate as low as reasonably practicable (ALARP). A workshop was held to discuss the strengths and weaknesses of each approach and it was recognised that each had its own limitations. In particular, none of the approaches made adequate provision for the very low frequency but potentially very large consequence events. It was therefore agreed that a new approach would be adopted—the “Major Accident Risk” (MAR) process. The major accident risk process was developed as a high level quantified risk assessment with a consistent approach for all BP operations with the potential to give rise to a
∗
major accident, i.e. one that causes multiple fatalities and/or severe damage to the environment. The MAR process is now mandated by the BP integrity management standard and its application is detailed in an engineering technical practice. The MAR process was not intended to be the sole hazard evaluation and risk management tool. Individual sites would still employ a range of tools appropriate to their operations, that might include techniques such as compliance with regulatory and industry codes, hazard identification (HAZID), layers of protection analysis (LOPA), hazard and operability studies (HAZOP) and quantified risk assessment (QRA).
2.
Objectives of the MAR process
BP’s goal is to drive continuous risk reduction throughout the entire range of major accident risk with the ultimate goal of no accidents, no harm to people and no damage to the environment. Inherent in the MAR approach is the principle of continuous risk reduction. The concept of continuous risk reduction recognizes that the resources available to reduce risk are not infinite, but that we should actively seek measures to reduce risk and prioritise these measures in relation to their risk reduction effectiveness. Sites are accountable for their Risk Reduction Plans. The BP Group has however defined a level of societal risk above which the risks and associated mitigation & risk reduction plans must be reported to the Group.
Corresponding author. Tel.: +44 1932763610. E-mail addresses: [email protected] (M. Considine), [email protected] (S.M. Hall). Received 18 February 2008; Accepted 30 April 2008 0957-5820/$ – see front matter © 2008 The Institution of Chemical Engineers. Published by Elsevier B.V. All rights reserved. doi:10.1016/j.psep.2008.04.008
60
process safety and environment protection 8 7 ( 2 0 0 9 ) 59–63
Fig. 1 – The MAR approach. The MAR approach is illustrated schematically in (Fig. 1): All assets and operations within the BP Group which have the potential for a major accident are required to quantify the societal and environmental risk from such accidents. These risks are then compared against a “Group Reporting Line” (GRL). Each asset has been allocated its own GRL. The position of this line was determined from a consideration of: • • • •
company sustainability; regulatory precedents for establishing risk criteria; industry experience of major accidents; and scale of the operation.
The GRL does not seek to set a level of “acceptable” or “tolerable” risk, since the MAR approach requires that efforts should be sought to reduce all risks as part of a process of continuous improvement (but with prioritisation of improvements based on the magnitude of the risk). Rather, activities above the GRL can be considered as representing a disproportionately high level of risk to the sustainability of the company and hence need to be brought to the attention of, and monitored at, Group level. For any activity found to be above the Group Reporting Line, the Integrity Management (IM) standard requires that the risks and accompanying mitigating action plan be reported promptly to the Group Engineering Director and recorded in the Annual Engineering Plan. The Group Engineering Director then reports all activities found to be above the Group Reporting Line as exceptions to the Integrity Management Standard. Otherwise, the results of the assessment are reported to the Business Segment consistent with procedures establish by the Segment. This is part of a continuous management process whereby decisions on risk mitigation are taken at a level in the BP organisation appropriate to the degree of risk. The MAR approach requires that a process of continuous risk reduction be applied to all identified risks. Within the Segments, the overall objective is to show that major accident risk is on a steady decline. This does not mean that major accident risk cannot increase within any business or at any site, rather that this increase should be more than balanced, over time, by risk reductions achieved elsewhere (for example due to discontinuance of some operations or through efforts to mitigate risk). Because of regional cultural differences (e.g. over the applicability of cost benefit approaches) there is no Group mandated approach. Segments, with input from the Regions, decide how this can best be achieved and what metrics should be adopted. Various options exist such as
• An F–N-based approach. The MAR process generates F–N and F–Environment curves for sites/operations. These can be accumulated to generate curves at Asset, Business Unit, Segment and Group level. Appropriate Group Reporting Lines (based on scale of operation) can also be accumulated in the same way. This approach is best suited to reviewing the magnitude of the overall risks at Segment and Group level. One way of demonstrating risk reduction is to regularly monitor the F–N and F–E curves at Segment and Group level to ensure that they are on a steady decline. • Weighted expectation values (WEV). The MAR process incorporates a risk aversion index of 1.5 (events involving higher N values are treated disproportionately in terms of severity, i.e. scaling as N1.5 ). The MAR studies generate risk weighted Expected Values (WEV) for risk contributors in the form of fN1.5 and fE values. These values can be used to establish priorities for risk reduction measures. The fN1.5/fE are numeric values, where a higher value represents a greater major accident risk. Therefore if all risk contributors for a facility, Segment or the Group are listed in terms of fN1.5/fE, the highest priorities can be identified for risk reduction purposes.
3.
The MAR process
The key steps in the process are:
1. A facility review is conducted by a team comprising site personnel, central BP experts in Major Accident Assessment and, in some cases, independent external consultants. The team leader would normally be an internal BP expert. 2. Existing background data is collected. 3. Population locations—workforce & community populations (numbers day & night hours) are identified. 4. The facility is sectioned into blocks for analysis based on potential major accident scenarios. 5. A hazard review is completed to identify the worst case and more typical scenario events for each block. 6. The potential consequences of fire, explosion and toxic release calculated for identified scenarios using appropriate consequence models. 7. Effect zones for the various identified scenarios are overlaid on maps/drawings with population and building/structures vulnerability details to identify potential fatalities and environmental impact. 8. Any environmental impact is defined in terms of four categories of societal reaction: Global, Regional, National and Local. Therefore it is the societal reaction that is used to define environmental damage rather than, for example, the quantity of product spilt. Consideration is given to quantity and duration of a spill to evaluate how far pollution could spread and whether this would result in a more wide-spread public reaction (e.g., global, regional (Europe, Asia, etc.), national/state, or local level). 9. The scenario event frequencies are defined based on real industry accident data (the assumption is that BP is no better or worse than the industry) 10. The risk of fatalities and environmental damage is calculated for each identified scenario (risk = event frequency combined with event consequence). 11. Risk results for each scenario are summed to get an overall potential frequency versus number of potential fatalities
process safety and environment protection 8 7 ( 2 0 0 9 ) 59–63
61
Fig. 2 – Event tree for typical process unit. or environmental damage, plotted as an F–N curve or F–E curve. 12. Any scenarios above the Group Reporting Line are identified. 13. Other scenarios are ranked for inclusion as part of the process for continuous risk reduction.
4. Selection and assessment of scenarios for onshore operations The scenarios chosen for each selected area include those due to a “catastrophic” release. For example, for process units a “catastrophic” release would typically be taken as the release over a 60 s period of the maximum isolatable inventory on the unit. For storage tanks and vessels the “catastrophic” release would usually be the release of the entire contents of the storage unit. This could be rupture of the tank shell or a release through an orifice equivalent to the largest pipe diameter attached to a vessel. A “major” release is also addressed and is based on the release of material through an equivalent 50mm diameter hole in a vessel or pipe. A typical list of scenarios might be: • • • • • • • • • • • •
Toxic cloud from rupture in F2 conditions. Toxic cloud from rupture in D5 conditions. Toxic cloud from leak in F2 conditions. Toxic cloud from leak in D5 conditions. Flash fire from rupture in D5 conditions. Flash fire from leak in D5 conditions. Localised fire from rupture. Localised fire from leak. Fireball/BLEVE. Vapour cloud explosion from drifting cloud. Explosion at source. Environmental effect.
Effect zones are determined using the BP CIRRUS consequence modelling package. BP Cirrus is a computer program
that incorporates industry recognized methodologies for the calculation of the effects of fire, explosion and toxic release. The program has been subject to an independent technical review which examined the basic physics, compared the program results with published internationally recognized experiments and checked that protocols had been accurately input to Cirrus. Event frequencies for the MAR process have been evaluated from a worldwide consideration of major events within the BP Group and within the industry. For example, from this information the following event tree was constructed for a typical process unit (Fig. 2):
5. Selection and assessment of scenarios for offshore operations As for onshore facilities, releases associated with major (50 mm dia) and catastrophic releases (up to full bore) are considered. The hazards associated with offshore oil and gas exploration and production arise due to the toxic effects of H2 S rich streams, thermal radiation and smoke from fires, and blast overpressure from explosions. Possible types of fires are confined module fires, free jet fires and sea pool fires. In the assessment account is taken of whether decks are grated or plated when determining the location of events. Scenarios reflect the potential for escalation to other inventories, to other modules, refuges, escape routes and structural supports. The following process events are typically considered: • Short duration (no escalation) gas and liquid fires. • Medium duration (escalation to other inventories) gas and liquid fires. • Long duration (damage to refuges/structural collapse) gas and liquid fires. • VCE sufficient to cause fatalities within module and breach of non-blast resisting module wall. • VCE sufficient to cause escalation. • VCE sufficient to cause structural deflection and massive escalation.
62
process safety and environment protection 8 7 ( 2 0 0 9 ) 59–63
• VCE sufficient to cause structural collapse. • Unignited toxic releases (due to H2 S rich streams). • Escalated fires. The primary differences in effects modelling for offshore (as opposed to onshore) facilities are the confinement of the physical effects by walls and ceilings, the importance of escape, shelter and evacuation and the need to take into account the three-dimensional geometry of an offshore installation. In most cases, use of the free field dispersion models contained in Cirrus is inappropriate and more specialised models must be used. Release frequencies have been derived from UK North Sea data which has a rigorous incident recording regime. Process release frequencies were developed from the OIR 12 UKCS database based on reported events per process system (e.g. oil metering, oil separation, gas dehydration, gas compression, etc.). Riser and pipeline release events were taken from the PARLOC 2001 database and blowouts during drilling and well operations from the Scandpower database. Since the offshore data was derived primarily from North Sea data, an adjustment factor was applied to reflect the local historical experience of leaks. This factor was derived as the ratio of total number of leaks per year experienced by a facility to that for a similar N Sea operation. Where the ratio was greater than 1, the N Sea frequency data was scaled up accordingly.
In addition a number of non-process events are also considered in the process including ship collisions, earthquakes, wind/wave loading, loss of stability/capsize, structural collapse, dropped objects, accommodation fires and transportation accidents (e.g. helicopter crashes).
6.
Experience of applying the MAR process
The programme for conducting MAR assessments has lasted for more than 4 years and MAR studies are now available on most of the Groups operations. Typically a study of a major site (e.g. a refinery) can be completed within about 2 weeks (with about 10 man weeks of effort). This compares to a required effort of at least 10 times greater to conduct a detailed QRA of the same facility. The early onshore studies were carried out using a spreadsheet approach. More recently, the process has been captured within the BPMARC package and all earlier onshore studies have now been transferred into this package. A sample run of the onshore package is shown below (Fig. 3): The present offshore model is spreadsheet based but similar efforts are underway to convert the studies into a more purpose based tool. The strengths of the MAR process are: • It is a high level approach requiring much less effort than a detailed QRA.
Fig. 3 – The BPMARC onshore risk calculator.
process safety and environment protection 8 7 ( 2 0 0 9 ) 59–63
63
• as is generally the case for QRAs, the MAR approach generally assumes a fixed relationship between plant and populations, i.e. does not presently cover situations which are highly transient in nature (although the BPMARC package now opens up this possibility). Because the MAR approach assesses risk based on average event frequencies and site specific consequences, most of the recommendations arising from the MAR studies relate to consequence reduction (e.g. relocating populations, strengthening buildings, reducing inventories, etc.). Nonetheless we also anticipate that application of the IM Standard will lead to a steady decline in the incidence of releases. The overall impact in terms of risk reduction will be as in (Fig. 4): Fig. 4 – Risk reduction process.
7. • As such it can be applied in a consistent fashion across all operations. • It provides an overview of the whole company such that the highest risks receive Group level attention. • It establishes a basis for applying the principle of continuous risk reduction across all operations. However the MAR process has some limitations: • frequencies are derived at unit/system level and reflect “average” design and operation, hence: • the frequencies cannot reflect those cases where unit design is much better or worse than average nor can it account for operation of plant outside reasonably anticipated parameters;
Summary
The major accident risk is a key component of Integrity Management and is mandated by the IM Standard. Societal and Environmental Risks are quantified and compared against the Group Reporting Line. Risks above the line are reported to Group with an accompanying action plan and all risks are subject to a process of continuous risk reduction. BP has been carrying out a programme of assessments for more than 4 years and now has a consistent picture of the major accident risk across the whole company. These assessments will be a key driver in moving towards the goal of “No accidents, No harm to people, No damage to the environment”.
Contents lists available at ScienceDirect
Process Safety and Environment Protection journal homepage: www.elsevier.com/locate/psep
The major accident risk (MAR) process - developing the profile of major accident risk for a large multi national oil company M. Considine ∗ , S.M. Hall BP International, Safety and Operations, Chertsey Road, Sunbury on Thames, Middlesex TW16 7LN, UK
a b s t r a c t The paper describes a programme to develop the profile of major accident risk across a large multi national oil company. It describes the concepts, tools and processes for constructing the risk profile and some of the key learnings from the exercise. © 2008 The Institution of Chemical Engineers. Published by Elsevier B.V. All rights reserved. Keywords: Major accident; Risk profile
1.
Introduction
The current BP Group was formed through a series of mergers of companies with differing strategies for managing major accident risk. In order to achieve a more consistent approach, it was decided to review the various methodologies of the heritage companies and develop a philosophy which would best serve the newly formed Group. The various approaches adopted within the heritage companies included: • Consequence based methodology, with protection designed on the basis of a “maximum credible accident”. • Quantification of individual risk (to workers and the public) and comparison against an upper “intolerability limit”. • Application of cost benefit methodology in order to demonstrate as low as reasonably practicable (ALARP). A workshop was held to discuss the strengths and weaknesses of each approach and it was recognised that each had its own limitations. In particular, none of the approaches made adequate provision for the very low frequency but potentially very large consequence events. It was therefore agreed that a new approach would be adopted—the “Major Accident Risk” (MAR) process. The major accident risk process was developed as a high level quantified risk assessment with a consistent approach for all BP operations with the potential to give rise to a
∗
major accident, i.e. one that causes multiple fatalities and/or severe damage to the environment. The MAR process is now mandated by the BP integrity management standard and its application is detailed in an engineering technical practice. The MAR process was not intended to be the sole hazard evaluation and risk management tool. Individual sites would still employ a range of tools appropriate to their operations, that might include techniques such as compliance with regulatory and industry codes, hazard identification (HAZID), layers of protection analysis (LOPA), hazard and operability studies (HAZOP) and quantified risk assessment (QRA).
2.
Objectives of the MAR process
BP’s goal is to drive continuous risk reduction throughout the entire range of major accident risk with the ultimate goal of no accidents, no harm to people and no damage to the environment. Inherent in the MAR approach is the principle of continuous risk reduction. The concept of continuous risk reduction recognizes that the resources available to reduce risk are not infinite, but that we should actively seek measures to reduce risk and prioritise these measures in relation to their risk reduction effectiveness. Sites are accountable for their Risk Reduction Plans. The BP Group has however defined a level of societal risk above which the risks and associated mitigation & risk reduction plans must be reported to the Group.
Corresponding author. Tel.: +44 1932763610. E-mail addresses: [email protected] (M. Considine), [email protected] (S.M. Hall). Received 18 February 2008; Accepted 30 April 2008 0957-5820/$ – see front matter © 2008 The Institution of Chemical Engineers. Published by Elsevier B.V. All rights reserved. doi:10.1016/j.psep.2008.04.008
60
process safety and environment protection 8 7 ( 2 0 0 9 ) 59–63
Fig. 1 – The MAR approach. The MAR approach is illustrated schematically in (Fig. 1): All assets and operations within the BP Group which have the potential for a major accident are required to quantify the societal and environmental risk from such accidents. These risks are then compared against a “Group Reporting Line” (GRL). Each asset has been allocated its own GRL. The position of this line was determined from a consideration of: • • • •
company sustainability; regulatory precedents for establishing risk criteria; industry experience of major accidents; and scale of the operation.
The GRL does not seek to set a level of “acceptable” or “tolerable” risk, since the MAR approach requires that efforts should be sought to reduce all risks as part of a process of continuous improvement (but with prioritisation of improvements based on the magnitude of the risk). Rather, activities above the GRL can be considered as representing a disproportionately high level of risk to the sustainability of the company and hence need to be brought to the attention of, and monitored at, Group level. For any activity found to be above the Group Reporting Line, the Integrity Management (IM) standard requires that the risks and accompanying mitigating action plan be reported promptly to the Group Engineering Director and recorded in the Annual Engineering Plan. The Group Engineering Director then reports all activities found to be above the Group Reporting Line as exceptions to the Integrity Management Standard. Otherwise, the results of the assessment are reported to the Business Segment consistent with procedures establish by the Segment. This is part of a continuous management process whereby decisions on risk mitigation are taken at a level in the BP organisation appropriate to the degree of risk. The MAR approach requires that a process of continuous risk reduction be applied to all identified risks. Within the Segments, the overall objective is to show that major accident risk is on a steady decline. This does not mean that major accident risk cannot increase within any business or at any site, rather that this increase should be more than balanced, over time, by risk reductions achieved elsewhere (for example due to discontinuance of some operations or through efforts to mitigate risk). Because of regional cultural differences (e.g. over the applicability of cost benefit approaches) there is no Group mandated approach. Segments, with input from the Regions, decide how this can best be achieved and what metrics should be adopted. Various options exist such as
• An F–N-based approach. The MAR process generates F–N and F–Environment curves for sites/operations. These can be accumulated to generate curves at Asset, Business Unit, Segment and Group level. Appropriate Group Reporting Lines (based on scale of operation) can also be accumulated in the same way. This approach is best suited to reviewing the magnitude of the overall risks at Segment and Group level. One way of demonstrating risk reduction is to regularly monitor the F–N and F–E curves at Segment and Group level to ensure that they are on a steady decline. • Weighted expectation values (WEV). The MAR process incorporates a risk aversion index of 1.5 (events involving higher N values are treated disproportionately in terms of severity, i.e. scaling as N1.5 ). The MAR studies generate risk weighted Expected Values (WEV) for risk contributors in the form of fN1.5 and fE values. These values can be used to establish priorities for risk reduction measures. The fN1.5/fE are numeric values, where a higher value represents a greater major accident risk. Therefore if all risk contributors for a facility, Segment or the Group are listed in terms of fN1.5/fE, the highest priorities can be identified for risk reduction purposes.
3.
The MAR process
The key steps in the process are:
1. A facility review is conducted by a team comprising site personnel, central BP experts in Major Accident Assessment and, in some cases, independent external consultants. The team leader would normally be an internal BP expert. 2. Existing background data is collected. 3. Population locations—workforce & community populations (numbers day & night hours) are identified. 4. The facility is sectioned into blocks for analysis based on potential major accident scenarios. 5. A hazard review is completed to identify the worst case and more typical scenario events for each block. 6. The potential consequences of fire, explosion and toxic release calculated for identified scenarios using appropriate consequence models. 7. Effect zones for the various identified scenarios are overlaid on maps/drawings with population and building/structures vulnerability details to identify potential fatalities and environmental impact. 8. Any environmental impact is defined in terms of four categories of societal reaction: Global, Regional, National and Local. Therefore it is the societal reaction that is used to define environmental damage rather than, for example, the quantity of product spilt. Consideration is given to quantity and duration of a spill to evaluate how far pollution could spread and whether this would result in a more wide-spread public reaction (e.g., global, regional (Europe, Asia, etc.), national/state, or local level). 9. The scenario event frequencies are defined based on real industry accident data (the assumption is that BP is no better or worse than the industry) 10. The risk of fatalities and environmental damage is calculated for each identified scenario (risk = event frequency combined with event consequence). 11. Risk results for each scenario are summed to get an overall potential frequency versus number of potential fatalities
process safety and environment protection 8 7 ( 2 0 0 9 ) 59–63
61
Fig. 2 – Event tree for typical process unit. or environmental damage, plotted as an F–N curve or F–E curve. 12. Any scenarios above the Group Reporting Line are identified. 13. Other scenarios are ranked for inclusion as part of the process for continuous risk reduction.
4. Selection and assessment of scenarios for onshore operations The scenarios chosen for each selected area include those due to a “catastrophic” release. For example, for process units a “catastrophic” release would typically be taken as the release over a 60 s period of the maximum isolatable inventory on the unit. For storage tanks and vessels the “catastrophic” release would usually be the release of the entire contents of the storage unit. This could be rupture of the tank shell or a release through an orifice equivalent to the largest pipe diameter attached to a vessel. A “major” release is also addressed and is based on the release of material through an equivalent 50mm diameter hole in a vessel or pipe. A typical list of scenarios might be: • • • • • • • • • • • •
Toxic cloud from rupture in F2 conditions. Toxic cloud from rupture in D5 conditions. Toxic cloud from leak in F2 conditions. Toxic cloud from leak in D5 conditions. Flash fire from rupture in D5 conditions. Flash fire from leak in D5 conditions. Localised fire from rupture. Localised fire from leak. Fireball/BLEVE. Vapour cloud explosion from drifting cloud. Explosion at source. Environmental effect.
Effect zones are determined using the BP CIRRUS consequence modelling package. BP Cirrus is a computer program
that incorporates industry recognized methodologies for the calculation of the effects of fire, explosion and toxic release. The program has been subject to an independent technical review which examined the basic physics, compared the program results with published internationally recognized experiments and checked that protocols had been accurately input to Cirrus. Event frequencies for the MAR process have been evaluated from a worldwide consideration of major events within the BP Group and within the industry. For example, from this information the following event tree was constructed for a typical process unit (Fig. 2):
5. Selection and assessment of scenarios for offshore operations As for onshore facilities, releases associated with major (50 mm dia) and catastrophic releases (up to full bore) are considered. The hazards associated with offshore oil and gas exploration and production arise due to the toxic effects of H2 S rich streams, thermal radiation and smoke from fires, and blast overpressure from explosions. Possible types of fires are confined module fires, free jet fires and sea pool fires. In the assessment account is taken of whether decks are grated or plated when determining the location of events. Scenarios reflect the potential for escalation to other inventories, to other modules, refuges, escape routes and structural supports. The following process events are typically considered: • Short duration (no escalation) gas and liquid fires. • Medium duration (escalation to other inventories) gas and liquid fires. • Long duration (damage to refuges/structural collapse) gas and liquid fires. • VCE sufficient to cause fatalities within module and breach of non-blast resisting module wall. • VCE sufficient to cause escalation. • VCE sufficient to cause structural deflection and massive escalation.
62
process safety and environment protection 8 7 ( 2 0 0 9 ) 59–63
• VCE sufficient to cause structural collapse. • Unignited toxic releases (due to H2 S rich streams). • Escalated fires. The primary differences in effects modelling for offshore (as opposed to onshore) facilities are the confinement of the physical effects by walls and ceilings, the importance of escape, shelter and evacuation and the need to take into account the three-dimensional geometry of an offshore installation. In most cases, use of the free field dispersion models contained in Cirrus is inappropriate and more specialised models must be used. Release frequencies have been derived from UK North Sea data which has a rigorous incident recording regime. Process release frequencies were developed from the OIR 12 UKCS database based on reported events per process system (e.g. oil metering, oil separation, gas dehydration, gas compression, etc.). Riser and pipeline release events were taken from the PARLOC 2001 database and blowouts during drilling and well operations from the Scandpower database. Since the offshore data was derived primarily from North Sea data, an adjustment factor was applied to reflect the local historical experience of leaks. This factor was derived as the ratio of total number of leaks per year experienced by a facility to that for a similar N Sea operation. Where the ratio was greater than 1, the N Sea frequency data was scaled up accordingly.
In addition a number of non-process events are also considered in the process including ship collisions, earthquakes, wind/wave loading, loss of stability/capsize, structural collapse, dropped objects, accommodation fires and transportation accidents (e.g. helicopter crashes).
6.
Experience of applying the MAR process
The programme for conducting MAR assessments has lasted for more than 4 years and MAR studies are now available on most of the Groups operations. Typically a study of a major site (e.g. a refinery) can be completed within about 2 weeks (with about 10 man weeks of effort). This compares to a required effort of at least 10 times greater to conduct a detailed QRA of the same facility. The early onshore studies were carried out using a spreadsheet approach. More recently, the process has been captured within the BPMARC package and all earlier onshore studies have now been transferred into this package. A sample run of the onshore package is shown below (Fig. 3): The present offshore model is spreadsheet based but similar efforts are underway to convert the studies into a more purpose based tool. The strengths of the MAR process are: • It is a high level approach requiring much less effort than a detailed QRA.
Fig. 3 – The BPMARC onshore risk calculator.
process safety and environment protection 8 7 ( 2 0 0 9 ) 59–63
63
• as is generally the case for QRAs, the MAR approach generally assumes a fixed relationship between plant and populations, i.e. does not presently cover situations which are highly transient in nature (although the BPMARC package now opens up this possibility). Because the MAR approach assesses risk based on average event frequencies and site specific consequences, most of the recommendations arising from the MAR studies relate to consequence reduction (e.g. relocating populations, strengthening buildings, reducing inventories, etc.). Nonetheless we also anticipate that application of the IM Standard will lead to a steady decline in the incidence of releases. The overall impact in terms of risk reduction will be as in (Fig. 4): Fig. 4 – Risk reduction process.
7. • As such it can be applied in a consistent fashion across all operations. • It provides an overview of the whole company such that the highest risks receive Group level attention. • It establishes a basis for applying the principle of continuous risk reduction across all operations. However the MAR process has some limitations: • frequencies are derived at unit/system level and reflect “average” design and operation, hence: • the frequencies cannot reflect those cases where unit design is much better or worse than average nor can it account for operation of plant outside reasonably anticipated parameters;
Summary
The major accident risk is a key component of Integrity Management and is mandated by the IM Standard. Societal and Environmental Risks are quantified and compared against the Group Reporting Line. Risks above the line are reported to Group with an accompanying action plan and all risks are subject to a process of continuous risk reduction. BP has been carrying out a programme of assessments for more than 4 years and now has a consistent picture of the major accident risk across the whole company. These assessments will be a key driver in moving towards the goal of “No accidents, No harm to people, No damage to the environment”.