The Modal QRA—Enabling Real-Time Risk Calculations

Abstract

Industry has for a long time aspired to a dynamic QRA (quantitative risk analysis), but due to the complexity of the traditional scenario-based risk analysis, it has not been practicably possible to perform fast enough analyses for real-time risk updates. As an analogy, if the speedometer had required several hours to calculate the speed of a car, it would never have become the valuable and mandatory risk management tool it is for all car drivers today. A completely new approach to QRAs has now rendered real-time risk updates a reality for industry, both for onshore plants and for offshore facilities. The new modal risk analysis represents a technical solution offering real-time QRA calculations, even for the largest and most complex facilities. A pilot version of the modal QRA has been developed and tested, and the modal risk updates are seen to be both real-time and sufficiently accurate for expedient risk-based decision-making. The new modal QRA can disruptively change the way we understand and manage the risk of our facilities.

1. Introduction

The overall ambition of a QRA is not to predict the future or to render accidental events impossible but rather to obtain sufficient insight into events that can occur and into the uncertainty of their consequences so that decisions made during design and operation can be made as safe as possible and within a risk framework that can be objectively regarded as a best practice for industry and companies.

From a regulatory perspective, risk often means the consequences of the activities with associated uncertainties [1]. As a result, an appropriate risk assessment must include the whole space of outcomes of what may happen. A good risk assessment remains valid regardless of what occurs at a facility, because it considers scenarios that are sufficiently similar. For this reason, a good risk analysis must address a very large number of accidental scenarios, from the smallest to the largest and from the very likely to the practically implausible.

While the ambition of spanning the whole space of outcome is what allows for risk-informed decision-making, it is also the same ambition that has prevented the traditional scenario-based QRA from being real-time. There are just too many scenarios that must be assessed, and this will always require computational time. The scenario-based risk speedometer will therefore always show risk with a significant delay. The solution is to convert from scenario-based QRAs to modal QRAs.

The modal QRA is a new concept and searches on sciencedirect.com and Google.com reveal that there are no previous publications on the topic. However, there are several somewhat related publications on real-time risk. The published research on real-time risk assessment is mainly based on two concepts, Bayesian Network models (e.g., ref. [2]) and machine learning models (e.g., ref. [3]). Both models are tools for trending patterns from empirical data and making predictions or decisions under uncertainty. These models differ from the modal QRA in the way that they need empirical data to be able to make predictions. The modal QRA can be applied to new concepts with limited empirical data (by running site-specific scenario simulations). The modal QRA will also guarantee that the risk prediction will be the same every time the boundary conditions are the same (which is not necessarily the case for machine learning agents).

Slightly more on the side of the modal QRA, but still considered relevant, the Norwegian Coastal Administration has developed a dynamic risk model (AISyRISK, ref. [4]) which reads AIS data for all ship traffic within a target area and gives daily updates of the risk exposure in terms of collision risk. This tool is considered a relevant example of dynamic models that provide deeper insight and allow the user to better understand and manage dynamic risk.

Another example of achieving deeper insight for risk-informed decision-making is reported from the nuclear industry by RiskWatcher (ref. [5]). This model is based on real-time updates of fault trees for online risk exposure, planning, and what-if simulations.

The research goal of this work is to test and validate the feasibility of applying a modal QRA to calculate and represent a 2D risk contour with the same accuracy as the traditional scenario-based QRA, but with a significantly shorter computational time.

2. Materials and Methods

2.1. Why Go Modal with Your Risk Model

The objective of a modal analysis is to reduce the size of a mathematical problem by representing it with a set of linearly independent (mutually independent) modes, each capturing significant information in a compact form. One well-known example is the Fourier transform, where any complex signal in the time or space domain can be converted into the frequency domain and expressed with only a limited number of frequencies, phases and amplitudes. For the interested reader, the portrait of Jean-Baptiste Joseph Fourier is mathematically expressed with some 300 modes with different amplitudes and phases [6].

Applying a similar principle, the numerous accidental scenarios of a QRA can be aggregated in linearly independent modal building blocks, reducing the degree of freedom in the mathematical problem by several orders of magnitude. Consequently, the modal QRA will be several orders of magnitude faster to compute than the traditional scenario-based QRA. In this context, linearly independent means that each building block can be scaled independently, based on its own activity, without affecting the risk contribution of other building blocks.

By careful definition of modal building blocks, the QRA can be both real-time and sufficiently accurate to provide support for expedient risk-informed decision-making.

With the real-time modal QRA, risk-informed decision-making will potentially improve to the next level of consistency, documentability, and accuracy. The modal QRA will at any time provide the overall risk exposure, and with it, a list of which factors are the main drivers of risk anomalies. With real-time updates of the QRA, the activity planners can document safe plans without expensive last-minute changes and delays. Barrier management can gain quantitative insight into how the status of barriers affects risk exposure, in combination with activity levels and wind conditions. With a real-time traffic light update of the risk level at all company assets, management can oversee safe operation and feel confident that they have facilitated their organization with the appropriate tools to understand and manage risk.

Like speedometers are mandatory on all cars, regulators may eventually choose to mandate the modal QRA for real-time monitoring of the risk exposure of assets.

2.2. The Onshore Modal QRA

A pilot modal QRA has been developed for onshore petroleum process plants. Based on their share size and complexity, onshore petroleum plants are considered the most complex industry plants to establish QRAs for, and if the modal QRA can be demonstrated to be real-time for these plants, it can be expected to be applicable for all other facilities, both onshore and offshore.

The onshore modal QRA pilot has been developed on the basis of the Kårstø gas process plant in Norway, and in collaboration with the technical service provider Equinor. While the development has been based on the Kårstø gas processing plant, the resulting modal QRA pilot software is generic and can be applied to any onshore plant handling flammable, explosive, and toxic substances.

With a traditional scenario-based QRA of a plant like Kårstø, the number of scenarios that should be simulated will quickly approach 1 billion (as an example, 1000 leak points, 100 leak rates, 100 leak directions, and 100 wind conditions represent 1 billion scenarios). By aggregating scenarios to linearly independent modes, the space of outcomes from 1 billion scenarios can be expressed by a few hundred or an order of one thousand modal building blocks. The field of risk representing the spatial distribution of LSIR risk (location-specific individual risk—see ref. [7] for guidance), or any other relevant risk currency for the plant, can then be represented by combining the 1 thousand building blocks rather than the 1 billion scenarios. This alone has reduced the mathematical problem by an order of magnitude of 1 million times and consequently paved the way for real-time risk updates.

The number of linearly independent building blocks must be carefully selected so that any variation in the dynamic input parameters (including wind conditions, activity levels, and status of barriers) can be sufficiently represented by 1 thousand scaled building blocks rather than 1 billion scaled scenarios. This is the core of balancing the modal QRA; there must be few enough modal building blocks to allow for real-time risk updates but also a sufficient number to capture the spatial variation in risk generated by the dynamic input parameters.

2.3. Aggregating Scenarios to LSIR Building Blocks

An area where all leaks inside it can normally be assumed to have a uniform leak frequency distribution between all leak points can be defined as a building block object, i.e., an object that will generate modal building blocks. Examples can be a process area, or parts of a process area, a storage tank, a load transfer station, or a pipe rack.

All leak scenarios from a building block object are aggregated into several scalable building blocks associated with the object, with each building block representing a defined ignition source. A flow diagram of how scenarios are aggregated into building blocks is outlined in Figure 1. As an example, the modal building block for internal ignition of leaks is aggregated from a large number of scenarios, all with different scenarios of leak frequencies and internal ignition probabilities; see Figure 2. The plotting domain is in this figure defined as the area where the modal field variable is aggregated (any fatality outside this region is not captured).

By this aggregation approach, a very large number of scenarios can be aggregated to one single modal building block for internal ignition. The number of scenarios per building block will vary between different building block objects based on, e.g., number of leak points and number of leak rates defined for the object, but an order of 10 million scenarios can be expected for a typical-sized process area. The aggregated building block can be scaled in the modal QRA to reflect changes in leak frequencies or internal ignition. Scaling of the modal building block is vastly faster than re-simulating 10 million scenarios with different scenario leak frequency and internal ignition probability.

Note that it is possible to aggregate modal building blocks for different leak categories, say, one for small leaks and one for large leaks. The computational time for dynamic updates (scaling) of two modal building blocks will still be vastly faster than re-simulating 10 million scenarios. This is the core of the speed-up offered by the modal QRA.

Before a modal QRA can be set up, the building blocks need to be tailor-made for the individual asset. Note that the building block generator has no speed-up compared to a traditional QRA (since scenarios must also be looped for the building block generator), but when the modal building blocks are generated from the scenario looping, the total risk can be updated in real time by scaling and aggregating the building blocks. The real-time scaling and aggregation of building blocks is referred to as the DRM (dynamic risk model) in this paper.

2.4. Directional LSIR Building Blocks

High-intensity ignition sources like roads, open flames, and air intakes can sometimes contribute significantly to the plant risk. But ignition on these external ignition sources (they are named external sources since they are often located outside the building block object, but they can also be located inside the process area) are only exposed when flammable gas has certain unfavorable directions. These scenarios are therefore aggregated into directional external ignition building blocks.

When aggregating directional building blocks for external ignition sources, one must subtract the frequency of the scenarios that have already been ignited by internal ignition. This ensures that each scenario is ignited only once and the internal and external modal building blocks can remain linearly independent in the modal QRA. Consequently, if the internal ignition changes in the DRM, then the associated external ignition building blocks may need to be corrected accordingly.

If more than one external ignition source is exposed by one scenario, then the LSIR contribution to each of the external modal building blocks must be distributed according to their ignition intensity. In the DRM, ignition intensities for external sources can be adjusted (based on exposure information available from the scenario looping) to account for the increase in contribution from remaining sources if one is removed.

Directional external ignition can also arise from adjacent process areas when hot work is being carried out in those areas.

An illustration of types of building blocks that can be generated from leaks in one process area (building block object) is given in Figure 3. Note that the directional building blocks will always be located inside the internal building block object. This is because all leak scenarios will have an internal ignition probability (all possible consequences of fires and explosions from external ignition can also be a result of internal ignition).

Note that in Figure 3, different colors indicate different LSIR values (like looking at different colors indicating different elevations in a map). The overlap indicates that these building blocks are linearly independent and can be scaled independently. The different size of each building block indicate that the spatial extent (and LSIR values) can be different in the different building blocks.

As shown in Figure 3, building blocks will typically be aggregated from the millions of scenarios originating from leaks in building block object number (i). If there are two building block objects, A and B, then building blocks will be generated for leaks associated with area A and area B separately. Figure 4 illustrates how two external ignition sources will generate four external directional building blocks, two for leaks in building block object A and two for leaks in building block object B. In addition, one internal ignition building block is generated for each of the building block objects.

2.5. Explosion Risk Building Blocks

Explosion risk in terms of pressure-frequency curves is calculated for all defined buildings in the plant. The explosion intensities are based on the multi-energy method [8].

Explosion building blocks are defined with the same assembly as the LSIR building blocks (for internal ignition, external ignition, and adjacent area hotwork ignition), but with a simpler structure. While LSIR building blocks are field variables, the explosion building blocks are defined on a vector with 11 datapoints (from 0.0 to 1.0 barg).

Figure 5 illustrates how scenarios are looped into an explosion building block, Figure 6 illustrates how modal building blocks are generated for each ignition source (similar to LSIR building blocks), and Figure 7 illustrates how the final pressure–frequency curve is aggregated from leaks across all individual building block objects. The explosion building blocks are scaled with the same factors as the LSIR building blocks in the dynamic risk model (DRM).

3. Results

3.1. Aggregating the Risk from Modal Building Blocks

When modal building blocks are established, the plant risk can be rapidly calculated by scaling and aggregating the building blocks. Scaling of building blocks can be done in several ways. The first and most obvious is frequency scaling. Any activity or barrier status that can be expected to affect the likelihood of an accidental release can be transferred into a frequency scaling factor for the building block of the affected area. A building block is scaled uniformly by applying the same factor to all spatial values (e.g., LSIR). Secondly, activities and barrier statuses that can be expected to affect the ignition probability can be transferred into an ignition probability scaling factor. As an example, the likelihood for cars on roads will affect the scaling factor for the external ignition building block. One third way to scale building blocks is to scale the consequence fields of the building blocks, which for practical purposes represent a stretching of the spatial building blocks. However, in some cases, it may be more practical to convert a spatial-domain representation into a frequency-domain correction factor. One example is the effect of process overpressure. Increasing the overpressure will increase the leak rate from a given hole size, and assuming the hole size distribution is independent of overpressure (which is a normal assumption in QRAs), an increased pressure will lead to increased leak rates for all hole sizes. However, when leaks are grouped in fixed leak categories, the increased leak rate can be expressed in an altered leak frequency for each leak rate category (and a corresponding increase in total leak frequency, which corresponds to the frequency of leaks that shift from below the cut-off limit and into the lowest leak category).

Figure 8 shows the aggregated LSIR risk and the resulting PLL (potential loss of life) for an example plant with three process areas, four roads, one discrete ignition source (air intake) and two buildings. This simple plant is represented by 20 modal building blocks, which are based on looping approximately 6 million scenarios from leaks in the three process areas.

Figure 9 shows the same example plant, only with scaling of the leak frequencies in the south process area by a factor of 3. The modal QRA updates the plant risk and the resulting personnel risk (PLL) in the defined manned areas accordingly. The update of both risk contours and PLL was done in real time (within 0.1 s).

The modal QRA can plot the risk from all building blocks (representing the total plant risk) or from selected building blocks and selected wind conditions, allowing for deeper insight into risk drivers and risk variability. Figure 10 shows the risk contribution from the north road alone given strong wind from the north. Figure 11 shows the risk contribution from the same road when the wind is from the south. As one can expect, the risk increases when the wind is from the south since more scenarios will expose the road to the north when the wind is from the south (the likelihood of cars on the road is the same in both cases).

The explosion risk is aggregated from the explosion building blocks in a similar way as the LSIR aggregation. Figure 12 shows the aggregated pressure–frequency curves for the example plant. The pressure–frequency curve can be applied both to identify a dimensioning accidental load (DiAL) and to calculate the LSIR personnel risk inside a building by assessing the exceedance of the design accidental load (DeAL).

3.2. The Building Block Generator, EmQRA

Plant-specific modal building blocks need to be generated before the real-time risk can be calculated in the DRM. The aggregation of modal building blocks must normally be based on scenario looping and will hence require similar computational time as a traditional QRA. However, the time-consuming production of building blocks is only done once (typically during the design of the plant), the daily operational risk updates are based on real-time scaling of the modal building blocks in the DRM.

The scenario looping to building blocks can be based on many approaches, all with different accuracy of the resulting building blocks. The DRM scaling and aggregation of building blocks will be performed in real time independently of the accuracy of the building blocks, but the quality of the building blocks will depend on the quality of the scenario looping. This is further discussed in Section 4.1.

A pilot empirical building block generator (EmQRA) has been developed as part of the modal QRA. The EmQRA is based on the principle of providing a maximum level of accuracy and quality with a minimum of complexity for the user. Similarly to the RISP project [9], the EmQRA aims at not spending time simulating something that should be readily available from experience, but unlike the RISP project, the EmQRA quantifies the total risk from all accidental events.

The EmQRA is based on best industry models for the scenario rate of occurrence (typically PLOFAM for process leak frequencies [10]), MISOF for process ignition probabilities [11], and empirical models for consequences. A library of approximately 200,000 different empirical consequences is established based on approximately 4000 CFD simulations. Empirical consequences are established for gas exposure and fire loads from both diffusive leaks (liquid pools) and jet leaks (high-momentum gas and spray). Since very time-efficient empirical scenario consequences are applied, EmQRA can loop a very high number of different accidental scenarios and hence efficiently span the space of outcomes for the risk uncertainty.

Compared with a CFD-based building block generator, the EmQRA is able to loop vastly more scenarios (more leak points, more leak rates, more leak directions, more wind directions and more wind speeds) but will have less accuracy for each looped scenario. In a risk accuracy context, this represents a pro and a con for the EmQRA in comparison with a CFD-based building block generator. Note that the real-time benefit of the modal QRA is the same whether an empirical or a CFD-based building block generator is applied.

The EmQRA can model accidental events from process areas (both outdoor and indoor), storage tanks, load transfer stations, pipe racks, and pipeline end valves. In addition, it can model unique ignition sources like roads, air intakes and compressor stations. It also includes site-specific conditions like the wind data and general objects like buildings and a fence (for area-planning QRAs, it is often required that flammable gas outside the fence are assumed to always ignite [7]).

In addition to being a modal building block generator, the EmQRA represents a new tool for very fast modeling of a QRA to a sufficient accuracy for appropriate decision-making, both in the design phase and in the operational phase. The accuracy of the EmQRA is discussed in Section 4.1.

Figure 13 shows the EmQRA interface for the example process plant applied for the above result demonstration. From the left menu, it can be seen that three process areas, one discrete ignition source, four roads, two buildings and one fence are included in the model. In the right menu, the properties of the west process area are listed (since the west process area is selected in the left menu).

4. Discussion

4.1. The Accuracy of Modal QRAs

Assessing the accuracy of a QRA model is different from assessing the accuracy of a deterministic consequence model like a CFD tool. While CFD tools are validated against experimental tests with well-defined outcomes, a QRA tool must assess all possible scenarios with their uncertainty and variability [1], and no ground truth values can be documented to exist.

For accuracy and validity assessments of QRA tools, it is therefore better to assess against the guideline given by the Norwegian Directorate for Civil Protection (DSB) [7]. According to DSB—see Figure 14—the accuracy of a QRA is ensured by being in control of three important aspects: the scenario frequency (including the ignition probability), the physical modeling of scenarios, and the sample space modeling (which is a sufficient space for the outcome modeled).

In the EmQRA sub-models, the scenario frequencies are based on best industry models when available. This means that the EmQRA models can be expected to have as good frequency models (including ignition probability) as any QRA performed according to best Norwegian Continental Shelf practice.

However, the physical modeling of the EmQRA is based on generic experience. Even though based on CFD scenarios, these empirical consequence models will not be as accurate as the best available physical models, CFD, but they will be significantly faster. The accuracy of the empirical consequences is, however, considered to be sufficient to be applied in the scenario consequence assessment (fatalities, fire loads and explosion loads).

While the physical modeling of the pilot EmQRA is not the most accurate available, it is so fast that it allows for simulating vastly more scenarios than a traditional QRA using CFD. The third accuracy aspect of the EmQRA, sample space modeling, is therefore significantly above any QRA model in the industry today. As an example, the highest number of CFD fire scenarios currently simulated as part of a traditional Vysus QRA is around 4000 scenarios. In the pilot EmQRA, one can, as an example, expect an order of 500 million fire scenarios to be simulated for the Kårstø plant. This is 125,000 times more fire scenarios than what is normally performed by CFD in a traditional QRA.

In sum, the vast number of scenarios simulated by the EmQRA compensates largely for the simplified physical modeling of scenarios, rendering the overall risk to be of high quality and sufficiently accurate to be applied for risk-informed decision-making, both during the design phase and during the operational phase. The space of outcomes (and hence the risk-associated uncertainty as defined by HAVTIL [1]) is therefore considered to be well resolved by the EmQRA.

Based on the assessment of the three DSB-aspects, it is concluded that the pilot EmQRA has sufficient accuracy to be the basis for risk-informed decision-making.

Note that the modal DRM will be as accurate as the applied building blocks (produced by the building block generator), and consequently the pilot DRM with the pilot EmQRA is concluded to be sufficiently accurate for risk-informed decision-making. Any accuracy beyond what will change the decision-making does not provide a real marginal value of a QRA.

4.2. The Offshore Modal QRA

The modal approach to quantitative risk analysis (QRA) is applicable to both onshore processing plants and offshore petroleum facilities. The pilot development conducted in collaboration with Equinor encompasses parallel onshore and offshore implementations of the methodology. Development efforts were initiated with the onshore version, and consequently, the present paper reports the results and findings from this initial onshore pilot.

In parallel, the offshore pilot study has also been initiated, and its results will be disseminated in a separate publication upon completion. Nevertheless, the fundamental principles, analytical framework, and methodological formulations presented in this paper are equally valid for offshore petroleum installations and are expected to be directly transferable to that context.

5. Conclusions and Recommendations

By applying established mathematical principles in a new engineering context, the new modal QRA has been demonstrated as a viable concept.

By use of linearly independent building blocks, the mathematical problem of a QRA can be reduced by several orders of magnitude. By combining a limited number of scaled building blocks, any spatial distribution of risk can be expressed with sufficient accuracy for expedient decision-making. A traditional QRA of several million scenarios can be mathematically expressed with only tens of modal building blocks.

In a concept test case, it is seen that the speed-up from the scenario-based QRA to the modal QRA was by a factor of more than 10,000 (from more than 3 h for scenario looping to less than 1 s for scaling and aggregation of modal building blocks).

The modal QRA represents a methodology that for the first time can provide real-time calculations of a field-variable risk model even for very complex assets. This represents a significant improvement in the operator’s ability to understand and manage risk based on dynamic boundary conditions such as activities, barrier status, technical conditions, and weather.

As part of the modal QRA, an empirical building block generator, the EmQRA, has been developed. In addition to being a modal building block generator, the EmQRA also represents a traditional QRA based on scenario looping. The EmQRA allows the user to set up a digital QRA in a fraction of the time of that of traditional QRAs (days rather than months).

The accuracy of the modal QRA can be controlled through the selection of number of modal building blocks. The accuracy of the EmQRA building block generator is demonstrated to be within good industry practice.

For further development of the modal QRA approach, it is recommended to investigate the trade-off between accuracy and computational speed in greater detail. A real-time solution does not necessarily need to achieve maximum accuracy, provided that it supports sound decision-making. At the same time, the calculations must be sufficiently fast to qualify as real-time.

One area for further investigation is the effect of dividing building blocks into sub-building blocks based on leak size and how this influences both risk estimates and calculation time. For example, separate building blocks for small and large leaks would allow independent scaling of scenarios that are primarily activity-dependent (small leaks) and those that are more design-dependent (large leaks). This could provide a more refined risk assessment, although it would also increase computational time, potentially by a factor of two.

Potential dependencies within the applied scaling models should also be investigated further. Some barrier systems may have partially overlapping functions, and these interactions must be carefully addressed to avoid double scaling effects. For example, confirmed gas detection may trigger isolation of segments in the affected area. However, if the segment isolation barrier function is already impaired, the impact of a degraded gas detection barrier function will differ accordingly.

Another recommended area for further development of the modal QRA approach is the offshore application outlined in Section 4.2. This application includes additional accident types that are not implemented in the onshore version, such as ship collision risk and helicopter accident risk. Experience and findings from the offshore implementation will be presented in a separate publication upon completion.