Downloaded from orbit.dtu.

dk on: Jan 29, 2019

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

Duijm, Nijs Jan; Kozin, Igor; Markert, Frank

Publication date:
2014

Document Version
Publisher's PDF, also known as Version of record

Link back to DTU Orbit

Citation (APA):
Duijm, N. J., Kozine, I., & Markert, F. (2014). Offshore Platform Hydrocarbon Risk Assessment – OPHRA:
Feasibility. DTU Management Engineering.

General rights
Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright
owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights.

 Users may download and print one copy of any publication from the public portal for the purpose of private study or research.
 You may not further distribute the material or use it for any profit-making activity or commercial gain
 You may freely distribute the URL identifying the publication in the public portal

If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately
and investigate your claim.
Offshore Platform Hydrocarbon Risk
Assessment OPHRA: Feasibility
Feasibility study of an alternative method for
Quantitative Risk Assessment using Discrete Event
Simulation

Production and Service

Management – Risk Research

DTU Management Engineering

Nijs Jan Duijm

Igor Kozine
Frank Markert

November 2014
Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility
Feasibility study of an alternative method for Quantitative Risk Assessment using Discrete Event
Simulation

Report

November 2014

Authors:
Nijs Jan Duijm
Igor Kozine
Frank Markert

Reproduction of this publication in whole or in part must include the customary

Copyright:
bibliographic citation, including author attribution, report title, etc.
Cover photo: Colourbox
Department of Management Engineering, Produktionstorvet, Building 424, DK-
Published by:
2800 Kgs. Lyngby, Denmark
Request report
www.man.dtu.dk
from:
ISBN: 978-87-93130-11-1

Version: Date:
1 2014-11-01
Content

List of abbreviations .................................................................................................................. 6

1. Introduction ..................................................................................................................... 7
1.1 Monte Carlo type simulation for Risk Assessment............................................................ 8
1.2 Outcomes of a risk assessment ....................................................................................... 9
1.3 Verification of QRA.......................................................................................................... 9
1.4 Reporting requirements for QRA allowing for independent review.................................. 10
1.5 Documentation of the OPHRA framework ...................................................................... 11

2. The OPHRA method ..................................................................................................... 12

2.1 Transparent scenarios ................................................................................................... 12
2.2 Demonstrating traceability ............................................................................................. 13
2.3 Description of the event diagrams ................................................................................. 13

3. DES implementation...................................................................................................... 21

4. Implementation of the feasibility model .......................................................................... 23

4.1 Geometry ...................................................................................................................... 23
4.2 Simplifications for the feasibility study ............................................................................ 23
4.3 Results.......................................................................................................................... 24
4.4 Further work .................................................................................................................. 28

5. Conclusion .................................................................................................................... 29

Appendix A Model Specifications ............................................................................................ 31

List of general symbols............................................................................................................ 31

®
1 DES model layout in Arena .......................................................................................... 32

2 Basic specifications ....................................................................................................... 34

2.1 Input and output ............................................................................................................ 34

3 Model specifications – physical events .......................................................................... 36

3.1 Environmental conditions .............................................................................................. 36
3.2 Wind speed and ventilation within a module .................................................................. 38
3.3 Loss of containment – Release...................................................................................... 40
3.4 Dispersion ..................................................................................................................... 42
3.5 Ignition .......................................................................................................................... 45
3.6 Jet flame ....................................................................................................................... 46

4 Detection models .......................................................................................................... 48

4.1 Gas detection ................................................................................................................ 48

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

5 Models describing escape and evacuation .................................................................... 48
5.1 Manning distribution ...................................................................................................... 48
5.2 Model for securing the workplace .................................................................................. 48
5.3 Model of escape from the module.................................................................................. 48
5.4 Model to move to muster area ....................................................................................... 48

6 Models for describing consequences ............................................................................. 49

6.1 Heat radiation impact on persons .................................................................................. 49

Appendix B Development of a time-dependent dispersion model for offshore modules ............ 50

Overview ................................................................................................................................ 50

1. Dispersion in an offshore module .................................................................................. 52

1.1 The free momentum jet model ....................................................................................... 52
1.2 The JIP workbook model ............................................................................................... 54

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

Summary

This report describes the feasibility demonstration of a new method to perform risk assessments
for offshore platforms. This method simulates the following phenomena as concurrent sequenc-
®
es of events using the Arena Discrete Event Simulation (DES) software (version 14.50.00):
• Release, ignition and fire;
• Detection, shut down and alarm;
• Escape and evacuation;
• Exposure and impact on people and equipment
This method leads to a transparent framework for modelling, which helps to demonstrate the
correctness and appropriateness of models and assumptions.
The report lists the (type of) models and data needed for the risk assessment framework, and
provides specific suggestions for some of those models.
Some preliminary calculations with the DES model have been performed to illustrate type of re-
sults that can be obtained and to provide some insight in the accuracy and computational ef-
forts.
Finally, further work is identified in order to develop an operational risk assessment tool.

Acknowledgements

The OPHRA feasibility study has been sponsored by DONG E&P A/S.

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 5

List of abbreviations

ASET Available safe evacuation time

BD Blow down
DES Discrete event simulation
EBD Emergency blow down
ESD Emergency shut down
FAR Fatal Accident Rate
F-N Cumulative Frequency versus Number of fatalities
IR Individual risk
LFL Lower flammability level
PLL Potential Loss of Life
QRA Quantified Risk Assessment
RSET Required safe evacuation time
UFL Upper flammability level

6 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

1. Introduction

In order to manage safety and to fulfill regulatory requirements, operators of hydrocarbon pro-
ducing offshore facilities have to prepare quantitative risk assessments (QRA). Those risk as-
sessments cover, among other hazards, the risk of (major) leaks of hydrocarbons from wells,
risers and process equipment. Basically, a risk assessment has the objective to identify every-
thing that may go wrong and, in order to make these findings operational, to predict the event’s
probability and the event’s consequences and final impacts. Therefore, one has to establish the
event sequences and their probability of occurrence that lead to an undesired impact to people,
property and environment. When hydrocarbons are accidentally released, each event sequence
consequences, such as the impact of fire and explosion, depend not solely on the release rate
and total amount, but also on prevention and mitigation measures, such as the response of
safety systems and personnel. By nature, this is a dynamic process with concurrent events
which may be mutually dependent.

The QRA’s goal is to demonstrate that installations do not expose personnel to intolerable lev-
els of risk, to identify the most important contributions to risk, and to ensure that risk is reduced
effectively and efficiently. The outcomes of a QRA are risk indicators that can be compared with
risk criteria (for details see chapter 1.2). The existing and widely accepted risk assessment
techniques use static methods to deal with these processes, as e.g. (static) fault and event
trees that describe the possible outcomes. Time dependent parameters, that influence the out-
comes of the event trees, are used as averages over a period of time, as e.g. an average leak
rate per year, average ignition probability or average number of workers in place over a year.
There are many other input parameters, as weather conditions, actual amount of hydrocarbon
and pressure in the processing equipment that needs simplification in order to take the assess-
ment to a practical level. Still, such event trees may easily become very complex and are by that
difficult to use in practice. The simplifications do not allow capturing the dynamic nature of the
processes in a convenient manner, normally leading to conservative (i.e. overestimating risk)
assumptions to be on the safe side.

The objectives of the present OPHRA feasibility study are twofold:

1. To demonstrate the transfer and application of state-of-the-art operational management
techniques (Discrete event simulation, DES) to industrial risk assessment. The goal is to
provide an alternative to the static event trees, and develop a dynamic assessment tech-
nique, which simulates the concurrent processes following a release of hydrocarbons on an
offshore hydrocarbon-production platform (see also chapter 1.1 below).
2. To demonstrate a framework for such assessment technique that allows the risk assess-
ment to be verifiable and easier to use in practice, i.e. a framework that provides the nec-
essary transparency and documentation of all assumptions and arguments used in the
course of the assessment (see also chapter 1.3 below).

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 7

1.1 Monte Carlo type simulation for Risk Assessment
Computer simulation models1 of complex environments to support risk management have been
around for many years. Today, the broad availability of powerful computers and the associated
development of easy-to-use modelling tools promote the use of even complex modelling and
simulation as a standard tool for the reliability and risk practitioner.

Discrete Event Simulation (DES) models appear a competitive alternative to the conventional
reliability and risk analysis models such as fault and event trees, cause-consequence and barri-
er diagrams as well as Bayesian networks (Kozine, Markert, Alapetite 2009; Markert and Kozine
2012). While these conventional models have proven to be very effective tools for reliability and
risks analyses, they cannot capture a number of relevant features accurately. The main differ-
ence between the DES approach and the conventional one is that the former provides a con-
venient way for developing dynamic models while the latter is a way to construct static models.
An attempt to endow the static models with a dynamic dimension (e.g. dynamic fault trees)
makes the models too complex and rather impracticable. On the contrary, by employing DES
models, the focus is shifted from abstract disciplines like Boolean algebra, probability theory, bi-
nary decision diagrams, cut sets, etc., to mimicking real processes. As the models imitate the
technological processes well understood by the field experts, these experts in turn become ac-
tive collaborators in the model development, which raises confidence about the outcome and
contributes positively to the model validation.

The analysis framework is based on simulation of the dynamic interactions between concurrent
phenomena following loss of containment, specifically:
• The physical processes (outflow, dispersion, ignition, heat radiation, explosion)
• Detection, alarming and emergency shutdown
• Escape and evacuation
• Impact on persons, escalation and impairment of safety functions

The simulation model runs repeatedly loss of containment scenarios to evaluate the associated
stochastic events in time with random delays, durations, instances of occurrences and others.
The output data sets are collected over all the simulated scenarios and are further processed to
predict risk indicators as the Individual Fatality Risk (IR), the Potential Loss of Life (PLL), the Fa-
tal Accident Rate (FAR, at platform and workplace level), and the group risk (distribution of
number of simultaneous fatalities).

This way of tackling the problem allows capturing a great deal of specific characteristics of dif-
ferent platforms, dynamic change of people responses and other characteristics. Scenarios with
severe consequences can be ‘played back’ to learn from them and can be animated, which ex-
cept for the learning effect provides a new way of validation. This also makes the simulation
models a good communication tool between system analysts and domain experts.

1
Computer simulation refers to methods for studying models of real-world systems by numerical evaluation using soft-
ware designed to imitate the system’s operations or characteristics. The simulation model can be allowed to become
quite complex and if needed to represent the system faithfully.

8 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

The approach as a whole and the computer model are the tools improving risk assessment by
providing an overall framework to describe and simulate the interactions between concurrent
chains of events under the hazardous scenarios and produce probabilistic risk measures.

1.2 Outcomes of a risk assessment

The purpose of a quantitative risk assessment (QRA) is to provide a realistic estimate of the
likelihood of adverse events (accidents) and the extent of the adverse consequences of these
events, i.e. the set of all possible triples {adverse event, likelihood of the event, consequence of
the event}. This triple equals the combination of adverse event and its risk. The complete set of
adverse events can be considered to represent the total risk in some heterogeneous form of the
operation. For complex operations with different types of adverse events, the events may be put
into classes of similar events that can be treated in a homogeneous way, e.g. for an offshore
platform, examples of such classes can be: ship collisions; releases of hydrocarbons; and loss
of structural integrity due to severe weather.
The combined output of assessments for these different classes can be by a mapping of the
consequences and likelihoods to a single parameter that describes risk, the risk indicator. This
requires some simplification (parameterization) of the consequences, e.g. by simplifying the
consequence to the number of fatalities or the financial damage. This allows a way of present-
ing the multi-facetted aspect of “consequence” together with the likelihood on a two-dimensional
graph, displaying the (cumulative) probability distribution of the parameterized consequence,
such as the F-N curve.
Alternative ways of reporting the output of a QRA are by means of estimating that some person
may be affected by an adverse event (e.g. using the concept of Individual Risk - IR) or the risk
at some specific position (location-based risk or local Fatal Accident Rate).
A QRA applies a set of linked models describing possible events and their outcomes. The out-
come of the QRA is therefore completely determined by these models and how they are linked.
A model is a set of assumptions (hypotheses) concerning relations or dependencies between
objects (notions) that represent observations of reality.

1.3 Verification of QRA

By nature of the assessment - an estimate of likelihood of future, very often rare, events - it is
impossible to validate a QRA empirically (unless we deal with frequent events that allow statisti-
cal analysis).
The quality of the QRA depends therefore on the quality of the single elements of the models
and how they are put together. We assume that it may be possible to qualify (verify) single parts
of the model, and if that is possible, we assume that we may arrive at an informed opinion
whether the results of the QRA are trustworthy.
In order to verify the quality of a QRA we need thus:
• Review the individual models (are the model assumptions realistic, do they represent the
best knowledge and understanding of nature, also in the context of the application?)
• Verify independent input data to the set of models (are the input data in agreement with
observations?)
• Verify that the final results are deduced correctly from the input data using the model as-
sumptions (can the results be reproduced using an alternative expression (implementation)
of the model?)

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 9

The models used in a QRA can be distinguished into the following types or combinations there-
of:
1. Models of logical reasoning, describing events and conditions with statements of the form
“if–then-else”: fault tree models are typical examples of models of logical reasoning, provid-
ing the necessary and sufficient conditions for the top event to happen, but also many
models describing physical phenomena include some (implicit) logical reasoning (if a hole
in a tank under the liquid level, then a liquid outflow will occur). Logic reasoning involves
assumptions about causality, and is a fundamental element of risk assessment, because it
determines what consequences are credible outcomes of adverse events.
2. Probabilistic models. These models describe the output as a probability or probability distri-
bution given some input. A typical example is the Bayesian Belief Network. Note that these
models are based on some logic model reasoning, but where 1-to-1 causality is extended
to consider alternative outcomes of an initial event, outcomes that are possible but not nec-
essary. If the basic events in a fault tree are assigned probabilities, the top event can be
assigned a probability, and the fault tree becomes also a probabilistic model. A special form
of a probabilistic model is the Probit model, describing the consequence of exposure of a
population (typically humans or animals) to some impact. Here the probability distribution of
damage is based on empirical observations. Note that the (joint) probability distributions
assigned to the input parameters of the model either can be considered to be an inherent
part of the model (as in the case of Probit models) or as specific input for a specific case
(for e.g. a Bayesian Belief Network).
3. Deterministic models. These models, typically describing the physics of nature, predict the
consequence of certain events using the laws of physics and chemistry, normally with con-
siderable simplifications. Examples are the prediction of the rate of release from a hole,
given the physical parameters of the hole (size, shape), substance and thermodynamic
state (temperature, pressure), and the prediction of the size and radiation from jet flames.
For each release a single (deterministic) value is predicted using appropriate physical mod-
els and a given set of input parameters for each scenario. Deterministic models may be-
come probabilistic when probability distributions are assigned to the impact parameters.
Such probability distributions may depend on inherent variability of the initial and boundary
conditions (aleatory variability) as well as uncertainty in the model (epistemic uncertainty).
Aleatory variability can be assessed by repeating the calculations with different sets of re-
lated input parameters (Monte Carlo type of calculation). This will produce e.g. the probabil-
ity distribution of flame length caused by variations in the input and boundary conditions.

1.4 Reporting requirements for QRA allowing for independent review

When performing a QRA, the activity consists of:
1. Developing specific models for the study at hand, i.e. models (typically models of logic rea-
soning e.g. models defining the full set of accident scenarios), that are unique for this study;
2. Selecting general models, typically models that describe physical phenomena (outflow,
cloud growth, explosion);
3. Selecting the specific input data for the study at hand, which also includes that it is ensured
that the models that have to be run subsequently provide adequate output for the models to
be run next.
4. Performing (“running”) the models with the selected input data, while ensuring that models
(input/output) are linked correctly.

10 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

One issue that should be considered is the following: The QRA is a construction based on the
combination of different models. Each model produces a probability and we have ascertained
the validity of each model’s outcome. But by combining these outcomes, we extrapolate statisti-
cal observations that are significant on the level of the single model, to very rare situations (ex-
tremely low probabilities) that together will not be observable, let alone verifiable. Combinations
of those models assume that the events, described by each of the models, are independent of
each other. This is a questionable assumption, which should be scrutinized by the analyst.
In order to allow an independent review of this process to be possible, the analyst has to report
these steps in such a way, that the reviewer in principle would be able to reproduce the results
of the analysis. However, this is, in view of the enormous amount of data in modern risk as-
sessments, not a trivial exercise.
The report on the QRA needs to include the following:
1. A description of the study-specific models, especially the logic reasoning that define the ac-
cident scenarios and the credible “consequence-space”. These include typical event trees
and scenario diagrams (barrier diagrams).
2. A list of the selected general models, with references to detailed descriptions and valida-
tions of those general models. The analyst does not need to describe the general models if
that information can be found elsewhere, but the analyst should address why the selected
models are suitable, and how uncertainties in these models affect the results of the QRA.
3. The input data put into the models. In principle all decisions made by the analyst when run-
ning the models should be documented. In case of complex models, such as 3-dimensional
Computational Fluid Dynamics (CFD) models, it may be impractical to provide all input data
– in that case one might alternatively provide model results for “simple” cases (e.g. undis-
turbed boundary layer flow), or cases where validation has been performed, in order to justi-
fy the chosen input data.
4. The linking of the models, i.e. how output from one model propagates as input to another
model in the study.

1.5 Documentation of the OPHRA framework

The appendices include detailed model descriptions for some of the models that have been de-
veloped or adapted to the OPHRA approach. This holds especially for gas dispersion (a model
based on the JIP workbook model referenced in (Anonymous 2006), but modified to enable time
dependent cloud sizes) and ignition (using direct simulation of continuous and intermittent igni-
tion sources rather than a probabilistic approach, but using the statistical information from
(Anonymous 2006))

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 11

2. The OPHRA method

The OPHRA feasibility study aims at developing methods that allow a step towards verifiable
risk assessments and improving the practical use of QRA results. The hypothesis is that a clear
and transparent structure of the inputs and outputs for the simulations and animation of the cal-
culation steps support this. The present study is the first step in this development and develops
the needed framework to enable testing the hypothesis.

2.1 Transparent scenarios

One of the objectives of the OPHRA project is to provide a framework which supports verifiable
risk assessments. This is pursued by structuring OPHRA using a framework at an overall level
that describes subsequent and simultaneous processes during a loss-of-containment (LoC)
event. This framework would be the basis for the logic reasoning that defines the accident sce-
narios. The possibilities of Discrete Event Simulation are exploited by defining the framework as
a few separate “event diagrams”. Each event diagram describes the sequence of events that
are directly linked by causality as a function of time, while the events in separate event dia-
grams may occur in parallel, so the diagrams form a set of dynamic event trees, allowing for in-
teraction. Such a set of parallel event diagrams, while each diagram is rather simple on its own,
allows for a much larger variety of scenarios, than what can be obtained by building one static
event tree that should capture all possible combinations (in time) of events.
Each event diagram consists of a number of events that are linked by causal or probabilistic re-
lations. More complex events (such as “jet dispersion”) require a separate (deterministic) model
to describe the outcome of those events. The structure of the event diagrams with embedded
events means that models can be developed individually for those events without too much
concern about interactions between the events in the diagram 2. The framework of diagrams de-
scribes the relations between these models, and what requirements these models should fulfil in
terms of input and output. These models can be selected and “plugged in” individually, accord-
ing to the required level of detail or simplification.
Of course, the diagrams in themselves represent a logic model and as such already contain
assumptions about the developments and interactions between the phenomena and actions,
and the challenge is to keep these diagrams as general as possible.
Verification of risk assessment using the OPHRA method would therefore require:
• An assessment whether the generic event diagrams used in OPHRA present a defend-
able description of all possible adverse events related to hydrocarbon releases on off-
shore (production) platforms;
• A validation that the logic, represented by the generic event diagrams, is implemented
correctly;
• Validation of the models that are “plugged in” in the event blocks and in the probabilistic
relations in the event diagrams, this validation can be provided outside and separate of
OPHRA ;
• Verification that correct data has been used as input to the different models.

2
Although there is one limitation: the “dynamic” nature of the modelling, where events can happen at any point in time,
requires that the physical models also are dynamic, i.e. produce output as a function of time, to be able to generate the
correct initial conditions for the next event.

12 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

2.2 Demonstrating traceability
The discrete event simulation “simulates” release scenarios. This allows a demonstration of the
correctness of the implementation and the trustworthiness of the logic diagrams. Single scenar-
ios can be analyzed step by step, demonstrating the sequence of events in time. This will pro-
vide some evidence that the framework provides realistic and traceable outcomes. That is, we
can find back to certain scenarios and study the values of all parameters, accidental events and
their combination that have resulted in the observed consequences.
Validation of the implementation of the framework can be performed by investigating the re-
sponse of the software with special input sets and models, for which the output can be predicted
analytically.

2.3 Description of the event diagrams

For OPHRA we have selected the partition of the phenomena in four concurrent sequences of
events or phenomena, viz.:
1. the causal sequence of release, gas dispersion, ignition, combustion and heat transfer;
2. The sequence of detection and initiation of countermeasures in terms of alarm, emer-
gency shutdown, and blow-down;
3. The sequence of escape and evacuation, i.e. processes related to the presence and
movement of personnel; and
4. The assessment of final effects, i.e. the exposure of people and equipment to physical
effects (pressure, heat)

Each concurrent sequence is generated by a separate model though heavily dependent on and
interacting with each other. All four models “talk” to each other and trigger different responses.
Events taking place in one sequence can change the conditions in the other sequences (dy-
namic interaction). This is depicted in the figure below. The DES model lay-out is described in
more detail in Appendix A.

Physical phenomena

Detection & response

Escape & evacuation

Impact &
consequence

Time

Figure 1. Dynamic and interdependent models of the OPHRA method

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 13

These processes are described by means of 4 “event diagrams” The basic assumption of our
modelling is that these event diagrams provide a realistic description of hydrocarbon releases
on offshore platforms in general. Possible weaknesses of this description is that these se-
quences are incomplete, or do not allow to account for certain combinations of events.
Apart from the description of the sequences, the analysis needs to account for initial and
boundary conditions. These conditions typically relate to:
• Physical lay-out of the platform (location of walls, decks, equipment, process sections,
etc. in relation to the release);
• Process conditions in the process sections that determine the thermodynamic state of
substances when released;
• Ambient conditions that affect the consequences (typically wind speed and direction);
• Distribution and presence of personnel.

The description of these initial and boundary condition is a simplification of reality, and as such
an assumption. It is possible to include very detailed input descriptions, but in general the sub-
sequent models will not be able to account for all interactions (e.g. detailed description of
equipment layout is simplified to distributed porosity to allow ventilation estimates). There is
therefore a need for a balanced appraisal of the description of initial and boundary conditions in
combination with the complexity of the models that are applied later in the risk analysis.
For each of the basic four 4 sequences listed above, an event diagram has been derived. These
event diagrams consist of probabilistic elements and deterministic elements. Probabilistic ele-
ments are controlled by probabilistic conditions, such as hole size, probability of ignition, wind
direction, distribution of personnel, etc. Deterministic elements describe the relation between
physical conditions, such as release rate depending on internal pressure, cloud size, heat radia-
tion, etc. Of course there is an interaction between the deterministic and probabilistic events,
e.g. the probability of ignition depends on the area covered by the cloud given release rate and
wind speed.
The blocks in the diagrams mainly relate to deterministic models, while the links between the
blocks (e.g. the “event tree branches”) relate to logic and probabilistic models.

14 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

2.3.1 Diagram and models for the physical processes

Figure 2 Event diagram for physical processes

Figure 2 shows the logic model for the processes directly (physically) related to the loss of con-
tainment event. In the feasibility study we only address releases of gas (excluding liquid re-
lease, two phase releases, pools, and pool fires). The gas from the release can ignite immedi-
ately, leading to a jet fire, or not, in which case the unignited gas disperses and a flammable
cloud or jet builds up. Late ignition may ignite this cloud, leading to a flash fire or explosion; after
the flash fire or explosion, the remaining gas leaking from the hole will form a jet flame. Alterna-
tively the gas is never ignited.
This diagram needs the following models and input data for completion (references to the corre-
sponding model specification sections in Appendix A are included when such specification has
been developed, the underlined models are included in the feasibility study:
• Release frequencies: A probabilistic model describing the likelihood of a loss of containment
of specific size, location and direction. (Appendix A section 3.3.1).
• Immediate ignition: A probabilistic model predicting the probability of immediate ignition as a
function of type and size of failure (Appendix A section 3.5.1).
• Outflow model: A (deterministic) model that predicts outflow as a function of hole size (and
other characteristics), substance, and thermodynamic state of the substance inside the con-
tainment. (Appendix A section 3.3.2).
• Jet-fire model: A (deterministic) model that describes the extent and position of the jet
flame, and other parameters such as radiative and convective heat radiation to (nearby) ob-
jects, as a function of outflow, local wind (or ventilation) speed and direction, and nearby
geometry. (Appendix A section 3.6).
• Dispersion model: A (deterministic) model that describes the development, position and ex-
tent of the unignited jet or cloud (e.g. the extent of the flammable contour) as a function of
outflow, local wind (or ventilation) speed and direction, and geometry. (Appendix A section
3.4 describes a simple cloud model).
• Delayed ignition: A model predicting when or whether the cloud ignites. This contains a
probabilistic model of the presence and character (continuous or intermittent) of ignition
sources, linked to the output of the dispersion model telling when the cloud will reach such
ignition source. (Appendix A section 3.5.2).
• Flash Fire/Explosion model: A (deterministic) model to describe the extent of the flash fire
(area or volume affected by high temperature) or explosion (overpressures on nearby ob-

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 15

jects and structures) as a function of the position and extent of the unignited cloud immedi-
ately prior to ignition, local wind (or ventilation) speed and direction, and nearby geometry.
(The feasibility study includes the simple assumption that any delayed ignition leads to 100
% fatality of the personnel that is still in the module for any release).
• Ventilation model: The models above require input by mean of information on boundary
conditions (typically wind speed and direction) and geometry, and some (deterministic)
model linking ventilation and wind speed and direction inside the structure to the geometry.
(Appendix A section 3.2).

2.3.2 Framework and models for detection and response

Figure 3 Event diagram for detection and response

Figure 3 shows the framework how detection will react to the basic adverse physical events
from the “physical” framework (shown in Figure 2). This framework consists of two parts: first
the detection of the event; and second the response by means of alarming personnel, shutdown
and blow-down of the hydrocarbon containing sections, and eventually firefighting.
The installation may have installed different detection systems. In this framework the most es-
sential detection systems are included: direct detection of the release (here introduced as an Ul-
trasonic Detector), detection of flammable gas by gas detectors, detection of fire by some flame
or heat detectors, and detection by personnel, typically effectuated by use of a push button. For
each of those systems, the QRA need to include some model, predicting the possibility or prob-
ability whether and when the respective detector will detect the phenomenon. So the following
models are needed:
• Ultrasonic detector model: A probabilistic model of the probability of detecting outflow, as a
function of the reliability of the detector system, the distance of the detector from the release
position, outflow rate, and possibly the type of release (hole or rupture). If several detectors

16 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

are installed, the model should be applied on all detectors, considering the position of each
of detector. Common mode failures should be considered.
• Gas detector model: A probabilistic model of the probability of detecting gas over a certain
concentration, when one or more gas detectors is hit by a gas cloud. This model takes input
from the dispersion model, which should generate the location and extent of the gas cloud
at 10% LFL (or any other detection limit) as a function of time. Further input is the location
of the gas detector, and the reliability of the single detector. as well as the joint reliability.
(Appendix A section 4.1, in the feasibility model there is only one detector).
• Flame- and heat detector model: A probabilistic model similar to the gas detector model.
This model takes input from the jet flame and pool fire model, which should generate extent
and location of the fire (for convective heat transfer) and radiation to the environment as a
function of time.
• Human detection model: A probabilistic model describing the response of personnel present
in the area to release, dispersion and fire. The model takes as input the presence of per-
sonnel, and should consider the “detectability” of the event (size of release, distance to
event), time and possibility to reach the push button, and likelihood of surviving this time,
given the nature of the events.
• Detection response model: A model describing the specific alarm strategy at the platform in
response to a set of detections. The model contains a probabilistic part describing the
(overall) reliability of the system to provide triggers to alarm, ESD and blow down systems.
• Alarm model: A (probabilistic) model describing in what areas personnel are alarmed by
acoustic and visual warnings. The feasibility study assumes that any detection leads to
alarming the personnel
• ESD/BD model: A (probabilistic) model describing what isolation and blow down valves will
operate successfully and how fast they will isolate and empty process sections. This model
takes as input the description of process sections. The model is linked to the outflow model
that should respond to the changed inventory and conditions.
• Active Fire protection model: A (probabilistic) model describing where Active fire protection
is activated. The model will be linked to fire and dispersion consequence models, changing
the likelihood of ignition and heat impact to objects and persons.

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 17

2.3.3 Framework and models for escape and evacuation

Figure 4 Event diagram for escape and evacuation.

Figure 4 shows the events that are initiated by alarming personnel. They deal with the alterna-
tives of moving away from and avoiding exposure to the hazardous phenomena. The framework
involves the following models:
• Safeguarding workplace: When alarmed, the personnel (1 to 5 persons at a time) have to
leave their workplaces. This may require some time, which is related to working position
(e.g. on a scaffold), tools being used, or objects being handled (e.g. performing lifts). The
model predicts the time needed to secure the workplace (triangular distribution); the per-
sonnel is assumed to stay located on their positions they had when the LoC started. Both
predict as part of the RSET (Appendix A section 5.2).
• Escape from module: After securing the workplace, personnel will move towards the escape
exits of the module towards the escape routes to the muster area. Position as a function of
time is modelled probabilistically assuming movement patterns and walking speeds (Ap-
pendix A section 5.3).
• Moving to point of evacuation (muster, secondary muster, escape to sea, trapped): Depend-
ing on what routes are impaired by the release or fire, personnel will decide on moving to-
wards one of the evacuation options. Position on the escape routes is modelled probabilisti-
cally assuming walking speeds (Appendix A section 5.4).
• Change of ignition sources: Some ignition sources depend on the presence and activities of
personnel. The DES framework allows changing the position and presence of ignition
sources depending on the movement of the personnel.

18 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

2.3.4 Framework and models for impact on people and assets

Figure 5 Event diagram for final consequences on personnel and equipment

Figure 5 shows the structure for evaluating consequences. Jet flames and flash fires/explosions
can cause direct fatalities to personnel, impair process equipment (with possible escalation
when isolation and blow down are not successful), impair the structural members, causing loss
of integrity of the platform, impair module separations, leading to escalation to neighboring
modules, and impair escape routes. Unignited clouds may impair escape routes.
The impact models are either probabilistic (Probit model for heat radiation impact on persons) or
deterministic (heat load on structures). The following models are needed:
• Fatality of personnel due to heat impact: This model combines the heat radiation from the
fire models, presenting incident radiation at a position, and the position (changing with time)
of personnel, to calculate the heat radiation dose received by a person, and estimating fatal-
ity. The DES model will use a sampling technique to decide on fatality for a given scenario.
(Appendix A, section 6.1) (The feasibility study has implemented a very simple model: if the
module is hit by a flash fire or jet fire, all personnel still present in the module are assumed
fatalities)
• Fatality of personnel due to overpressure: The feasibility study has not considered fatality
due to overpressure.
• Impairment of process equipment: failure of process equipment is calculated based on total
heat load, physical response, presence of passive or active (working) fire protection. Output
is failure (and failure mechanism: Rupture, hole, BLEVE) at certain time.

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 19

• Impairment of structural members: Similar as impairment of process equipment. The re-
sponse of the whole structure should be related to the criticality of the member within the
structure (in a simplified way, full structural analysis will not be included), the simplest ap-
proach would be that impairment of any critical member leads to collapse of the platform.
• Impairment of module separation: Similar as impairment of structural members. Failure of
walls, etc., will lead to adjacent modules being exposed to fire and heat radiation.
• Impairment of escape routes: This model will describe the decision by personnel whether or
not an escape route is available for escape or not. The model will simulate the information
available to the personnel while escaping, which is visual observation and instructions by
the PA/Alarm system. Visual information is the presence of smoke and flames, and alarm
lights. The issue is that invisible gas clouds may endanger certain escape routes without the
impairment being observable for the personnel.

20 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

3. DES implementation
The implementation of the algorithm follows the logic shown in Figure 1 and its general structure
is presented in Figure 6. The algorithm is implemented in the Arena DES software that is based
on the programming language SIMAN and can be controlled through Visual Basic for Applica-
tions (VBA).
Most of the input data are stored in an Excel sheet and read by the model during the initializa-
tion phase. Some other input data are hardcoded in the VBA script. In principle, all input data
including modelling constants and other parameters can be inputted from Excel.
The modelling output in the current version of the model is limited to the number of people died
and escaped, which is outputted to the same Excel sheet where the input data are stored.

Figure 6. The general structure of the algorithm

The model exists in two different versions. One models a single accident scenario with the visu-
alization of the dispersion and jet flame (if an immediate ignition source is present) and people
escape from the process area. The other is the batch mode version that is run repeatedly in one
simulation session with varying sampling values.

The output is the accumulated number of fatalities and escaped people following each simulat-
ed accident. Based on these data the average number of people dying per accident is assessed
as the ration
𝑁 𝑟𝑟𝑟𝑟
𝐸(𝑁 𝑑𝑑𝑑𝑑 )
= �� 𝑁𝑖𝑑𝑑𝑑𝑑 ��𝑁 𝑟𝑟𝑟𝑟
𝑖=1
. Here 𝑁 𝑟𝑟𝑟𝑟 is the number of simulated accidents (model runs) and 𝑁𝑖𝑑𝑑𝑑𝑑 is the number of peo-
ple dying in each accident. 𝐸(𝑁 𝑑𝑑𝑑𝑑 ) can be interpreted as the average number of people dying
per accident if the number of simulated releases 𝑁 𝑟𝑟𝑟𝑟 is large.

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 21

𝐸(𝑁 𝑑𝑑𝑑𝑑 ) multiplied by the frequency of a gas release taking place on the off-shore platform
gives us the risk measure Individual Risk per Annum, which is the output of the batch mode
version of the model.
It is also possible to assess the Group Risk measure (FN-curve). It is done by running the model
𝑁 𝑟𝑟𝑟𝑟 times and storing the set of numbers 𝑛𝑁𝑑𝑑𝑑𝑑 , N = 1, …, 𝑛Σ , where 𝑛Σ is the maximal number
of people present at the platform and 𝑛𝑁𝑑𝑑𝑑𝑑 is the number of simulation runs (out of 𝑁 𝑟𝑟𝑟𝑟 ) the
outcome of which was 𝑁 fatalities. These data allow the assessment of the values of the FN-
curve as the formula shows:
𝑛Σ
𝑛𝑁𝑑𝑑𝑑𝑑
𝐹𝐹 = �1 − � � 𝑓 𝑟𝑟𝑟𝑟𝑟𝑟𝑟
𝑁 𝑟𝑟𝑟𝑟
𝑁=1
release
In the above formula 𝑓 is the frequency of a gas release.
To run the model one needs to have Arena installed with a version not lower than 13.90

22 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

4. Implementation of the feasibility model
4.1 Geometry

Figure 7 3D views of the demonstration platform

Figure 8 Dimensions of the demonstration platform

The feasibility study makes use of a simple presentation of a platform with 5 deck levels, an ac-
commodation section (at the South end, from level 1 up to 4), a process section (in the center,
level 2 and 3, the deck at level 3 is open except for a gang way along the outside of the plat-
form) and a well head section on the north part. Escape routes run North-South along the full
length of the platform on both the West- and East side of the platform on all deck levels except
the (unobstructed) roof deck. Staircases between the deck levels are on all four corners of the
platform.
rd
The lifeboat is on the 3 deck level north of the accommodation section; for the feasibility study
it is assumed that personnel is safe (i.e. they will survive) when they have reached the location
of the lifeboats.

4.2 Simplifications for the feasibility study

The feasibility study focused on gas release only. Showing the overall principles will also
demonstrate the feasibility introducing other models dealing with liquid phase releases. There-

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 23

fore, it is planned to introduce models dealing with liquid and two-phase releases in a next
phase.
The consequence calculations are mainly widely used simplified engineering models taken from
the Yellow book, unless different approaches have been described in the appendices and refer-
enced in the sections 2.3.1 to 2.3.4.

The evacuation model is based on an ASET-RSET evaluation. RSET is calculated from time to
secure working place, the actual position in module to exit and time to reach muster area from
the exit. The ASET is calculated from the time difference of the detection time of the gaseous
release and the time of the delayed ignition. Once the ignition occurs the number of fatalities is
equal to the no. of persons in the module. In case of jet fires the detection time is a little longer
than the immediate ignition time and the ASET time is about zero. Nevertheless, people may
evacuate away from the jet flame and it is assumed that flames less than 5 m give no fatalities.
This is of course a first implementation for the feasibility study, but an explosion, heat radiation
and direct impingement model will be established in the next phase.

4.3 Results
This section present some results from calculations performed with the feasibility implementa-
tion of the DES-based risk assessment framework. The example considers a process section
consisting of a cooler, a separator and a condensate pump, as shown in Figure 9. The corre-
sponding distribution of hole size distribution is based on OGP failure data and shown in Figure
10. The cumulative frequency for a release from this process section is about 0.02 per year. In
order to generate some more serious events, a uniform distribution of hole sizes has been used,
leading to the same cumulative release frequency, but with an average hole size of about 12
mm instead of between 2 and 3 mm.

Figure 9 Cooler-separator-pump process section for example calculations

Table 1 shows the statistical results for simulations of 10 000 release scenarios. Given the
above mentioned cumulative release frequency, the simulations cover about 500 000 years.,
Table 1 shows that there are 0.413 fatalities on average per release event, which means that
the PLL (for these more serious simulations) in the process module is about or 0.8 per 100
years.

24 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

Figure 10 Failure rate distribution from OGP failure data for the process section shown in Figure 9. For the fea-
sibility d a uniform failure rate distribution has been used, leading to the same cumulative release frequency,
input for the results presented in Table 1 and Table 2.

Table 1 Example of statistical output for 10 000 release events.

Average Half width3 Minimum Maximum

No of release events 10000
Simulation run time (minutes) 12.87
No of immediate ignitions (<0.01 s) 508
Ignition_Start_Time 2.03E-04 1.77E-05 0 0.01
Delayed_Ignition_Time s 172.41 2.5481 0 6004
ASET s 429.79 6.321 -0.09 600 4
Fatalities 0.41303 0.06291 0 5
wind_direction in rad 1.5782 0.01909 0 3.1414
wind_speed m/s 10.563 0.09821 5 19.997
Hole_Direction in rad 1.5708 (Insuf) 0 1.5708
Jet flame length m 13.652 3.0561 0 226.02
Flammabel volume @ LFL_max m3 246.19 8.9892 0 1180.8
Release_Detect_Time in s 0.50275 0.01757 0 34.7
Jet flame SEPmax kW/m2 0.79817 0.07398 0 91.517
C_No_People_Escaped_Zone_1 3.1008 0.05703 0 5
Module air speed m/s 0.56419 0.00681 0 1.3853
Max release time in s 10379 288.95 0 49158
V_Hole_Size m 0.0118 5.54E-04 0 0.19981
V_DetectorReliability 0.94884 0.00442 0 1
V_massflow kg/s 5.9736 0.54116 0 271.27
workers in total 39045

3
Half width corresponding to the 95% confidence level around the average.
4
The maximum duration of the simulation is 600 s

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 25

Figure 11 shows the variation of jet flame length across the simulations. The variation can be
explained by the mass flow rate, with minor variation due to wind speed.

Figure 11 Variation of jet flame length across the simulations

Out of the 10 000 simulations, a small number of cases has been extracted to show details per
simulation, see Table 2. An interesting feature shown in this table is that the probability of igni-
tion is seems to be depend on mass flow rate: this is not a feature explicitly modelled, but an
emerging consequence of the modelling of the spatial distribution of ignition points and the size
and development of the flammable clouds.
Both Table 1 and Table 2 demonstrate what type of output can be generated, without being ex-
haustive. It will e.g. be possible to provide distributions on group risk (number of fatalities per
event) and to make a statistical analysis of the relation between release rate and probability of
ignition.

Performing 10 000 simulations took 13 minutes on an ordinary laptop PC. Table 1 contains one
parameter which is a single value and not subject to a distribution, viz. the detector reliability
(set at 95%). This value is reproduced with a half width of 0.5%. The probability distributions of
other parameters may be expected to reproduced with a lower accuracy (because distributions
with higher order parameters require more data) and further work should be done to assess
how many simulations are necessary to reproduce e.g. group risk distributions with sufficient
accuracy. Although full studies involving several modules, process units and more variation in
input data would require more simulations to be performed, the computational effort does not
seem to be prohibitive.

26 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

Table 2 Example of calculation outcomes per run, in the orange cases, the personnel has not been able to escape from the module in time.

5
No. Wind wind direc- Ventilation in module hole size ignition time in s massflow SEPmax Jet flame ASET s (average RSET s (average
uw m/s tion (rad) u_module m/s in m kg/s in kW/m2 length lb m for no of workers) for no of workers)
2 16.4 0.413 1.090 0.1272 0.90 109.9098 0.8000 278.2576
4 5.0 2.390 0.297 0.0508 3.40 17.5152 3.3000 234.2187
5 18.8 2.254 1.037 0.0012 No ignition 0.0095 600.0000 227.9997
6 9.2 0.826 0.526 0.0013 No ignition 0.0118 596.0000 201.0257
7 19.2 1.860 0.710 0.0014 No ignition 0.0139 596.5000 271.2558
8 5.7 2.277 0.318 0.1601 No ignition 174.1864 599.9000 220.0878
9 5.0 2.951 0.344 0.0020 No ignition 0.0279 598.5000 242.5925
10 17.2 2.007 0.775 0.0406 0.80 11.2217 0.7000 232.6303
11 18.5 2.311 1.053 0.0027 0.01 (immediate) 0.0495 43.4363 4.1501 0 227.7665
12 5.0 2.362 0.293 0.0019 No ignition 0.0247 598.3000 218.7077
13 10.0 2.016 0.457 0.0020 No ignition 0.0264 598.4000 228.5326
14 8.6 0.297 0.583 0.0023 No ignition 0.0374 598.9000 237.8085
15 6.5 0.799 0.377 0.0028 0.01 (immediate) 0.0549 33.3542 4.9041 0 225.1228
16 8.9 1.897 0.348 0.0034 No ignition 0.0776 599.4000 262.6267
17 11.9 1.941 0.497 0.0028 No ignition 0.0532 599.2000 230.3137
18 13.0 2.105 0.642 0.0012 0.01 (immediate) 0.0093 32.8078 2.0488 0 204.9413
19 10.2 1.433 0.261 0.1742 0.10 206.2515 0 285.5274
20 5.3 2.708 0.350 0.0023 No ignition 0.0356 598.8000 242.9458

5
Immediate ignition is modelled as ignition at 0.01 s, an ignition at a time > 600 s (the duration of the event simulation) is classified as “No ignition”

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 27

4.4 Further work
In order to make the framework operational, the following work needs to be performed:
• Verification of the calculations with respect to the probability distributions of output parame-
ters and assessment of requirements (number of simulations) to obtain sufficient accuracy.
This might include the development of techniques to optimize the computational efforts by
sing alternative sampling techniques;
• Developing adequate postprocessing and presentation techniques, in order to produce ap-
propriate risk data (IR, PLL, F-N distributions) and for inspection of individual simulations;
• Implementation of a minimum full set of realistic models as a baseline system that is able
to perform realistic risk assessments for offshore platforms;
• Demonstrating validity of the modelling framework, comparing results with results from tra-
ditional risk assessments and peer review and feedback by domain experts.
• Transferring the model to a non-proprietary software platform.
• Dissemination and feedback from practical experiences.

28 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

5. Conclusion
This report describes a preliminary model to perform risk assessment for offshore gas produc-
tion platforms using discrete event simulation.
The framework of the model is based on a number of relatively simple scenario or event dia-
grams, which are used to document the modelling process. Each block and each connection
between two blocks of these diagrams is assigned a model or a set of assumptions, and in that
way, the diagrams also become a framework for documentation of all model elements and other
assumptions that the risk analyst has to make in order to produce the output.
This feasibility study has focused on two aspects. The first aspect has been an attempt to pro-
duce a comprehensive list of all model assumptions, as a kind of catalogue, and included as
Appendix A. At this feasibility stage, a number of models and assumptions are very simple, but
it provides an impression of the type of information that should be available to make the risk as-
sessment verifiable (or at least plausible). In this study we have not yet addressed verification or
validation of the model implementations.
The second aspect has been the demonstration of the concept of using Discrete Event Simula-
tion to address the concurrent phenomena during a loss of containment event on a gas produc-
tion platform, based on the aforementioned simple scenario diagrams. It has been demonstrat-
ed that it is possible to perform risk assessments using Discrete Event Simulation. Simulations
can be performed with acceptable computational effort, and can produce valuable output, e.g.
the model can not only be used to generate ordinary risk data, but it also allows a better under-
standing on e.g. the ignition process by performing parameter studies and implementing differ-
ent models for ignition sources and gas dispersion.

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 29

References

Ignition probability review, model development and look-up correlations. 2006. London: Energy
Institute. Report nr IP Research Report.
Committee for the Prevention of Disasters. 1999. Guidelines for quantitative risk assessment
("purple book"). The Hague, Netherlands: Sdu Uitgevers. Report nr CPR 18E.

Committee for the Prevention of Disasters. 1996, 2005. Methods for the calculation of physical
effects due to the releases of hazardous materials (liquids and gases) 'yellow book'. The
Hague: Publikatiereeks Gevaarlijke Stoffen, Dutch Ministry VROM. Report nr PGS2/CPR
14E, 3rd edition, 2nd revised print.
Kozine I, Markert F, Alapetite A. 2009. Discrete event simulation in support to hydrogen supply
reliability. 3rd International Conference on Hydrogen Safety 3:159.
Markert F and Kozine I. 2012. Computer simulation for risk management: Hydrogen refueling
stations and water supply of a large region. PSAM11&ESREL 2012 Proceedings .
OGP. 2010. Risk assessment data directory - process release frequencies. London/Brussels:
OGP Publications, International Association of Oil & Gas Producers. Report nr 434-1.
Oil & Gas UK. 2007. Fire and explosion guidance - issue 1. 2nd Floor, 232-242 Vauxhall Bridge
Road, London, SW1V 1AU.: Oil & Gas UK.

Vickers D and Mahrt L. 2010. Sea-surface roughness lengths in the midlatitude coastal zone. Q
J R Meteorol Soc 136(649):1089-93.

30 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

Appendix A Model Specifications

List of general symbols

2
A Surface area (m )
bo Radius of the source, bo= ½d.
Cd Discharge coefficient of a hole (-)
clfl Lower flammability level (concentration by volume -)
cp Specific heat at constant pressure
cv Specific heat at constant volume
d hole size diameter (m)
Hc Heat of combustion (kJ/kg)
H Height (m)
L length, distance (m)
Lm characteristic length of a module Lm= (Volume)1/3.
M Mass (kg)
m mass flow rate (kg/s)
p Pressure (Pa)
Q Heat flow rate (kW)
2
q Heat flux (kW/m )
r radius (m)
t time (s)
u velocity (m/s)
ua Wind speed (m/s)
um volume-averaged ventilation velocity in a module (m/s)
3
V Volume (m )
W Width (m)
𝐶𝑝
𝛾=
𝐶𝑣
τ Atmospheric transmissivity of heat (-)

Indices:
a ambient condition
m related to a module

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 31

1 DES model layout in Arena®
Input module
Creation of accident events in form of holes of various size and check of detctor

Create release initialize VBA delay accident

events Hole Parameters Detector check
parameters
0
Event development
Deciding between immediate and delayed ignition: The upper branch models the jet fire apply-
ing the Chamberlain jet fire model. The assumption is immediate detection by a flame detector
and therefore also immediate alarm to the crew modelled in the next figure. The lower branch
models delayed ignition using random ignition source points (geographic) on the processing
module on the one hand and random ignition sources (time) as the sources may be only availa-
ble certain periods of time. To trigger the delayed ignition the dispersion model is used calculat-
ing the time to ignition. The time between alarm-time and the ignition time is in the feasibility
study defined as the available safe evacuation time (ASET).
0
immediate_ignition ignition VBA write jetflame
alarm_flame calc_ASET Number jet fires
parameters parameter
0
0

VBA VBA VBA write delayed write dispersioin Number gas

alarm_gas calc__ASET
ignition table explosions
0

Crew generation and evacuation

Randomly members of the crew staff are generated (3 -5 persons for the feasibility calculations)
and distributed randomly at different positions on the platform. The Required safe evacuation
time (RSET) is calculated from a random time to secure working place (e.g. avoid certain igni-
tion sources), the position on the module and further escape from the module to the primary
muster area.
0
Create crew working working place ASET _ RSET rescued workers
initialisation counting_rescued_workers
RS E T
0 0
0

counting_fatalities workers died

The number of facilities will be calculated more accurately in the next version of the model. It will
be assumed that the jet fire and flash fires and explosions will have different effects on the
workers. By that the workers still may escape even after ignition has occurred, e.g. having a
safe distance to the jetfire (heat radiation) and not lethal impacts of a small gas cloud explosion
(heat radiation and pressure impacts). This is shown in the next figure showing a many point es-
timation of the heat radiation form jetflames calculated by the Chamberlain model. In the next
version the heat radiation levels are being transferred into dose effects with distance to the jet
flame and the lethal effects for the workers are estimated by that. A similar approach is thought
of for the gas cloud effects.

32 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 33
2 Basic specifications
2.1 Input and output

2.1.1 Initial conditions

Platform layout: deterministic:
The topological lay-out:
A platform consists of modules; modules are separated from each other by some physi-
cal separation: deck or walls, or the “edge” to the open space around the platform;
Within the modules, we allow to discriminate between “areas”, to allow better topological
resolution, if needed. A module exists of at least one area. Within a module there is no
physical separation between areas, so gas, flames, etc. can disperse from one area to
another within a module.
Consequences or hazardous events in (areas in) one module can affect (areas in) other
modules depending on physical separation or separation by distance.
Bridges, and the space below the platform (e.g. including the areas where the risers or
wells are) are considered as separate modules.
Escape routes can be considered as special areas, e.g. at the outer end of a module.
This would facilitate the assessment whether escape routes are impaired.

2.1.1.1 To be described (input):

Relation between Areas in modules (neighbours, boundaries, distances)
Obstructions, distribution
Walls (closed, open, partly open, integrity)
Escape routes between areas
Relation between modules (neighbours, boundaries, type of boundaries (walls,
panels))
Escape routes outside or between modules

Evacuation means (location of evacuation means, e.g. life boat station, bridges to
other platforms)
The Process lay out
The process equipment can be divided into sections.
We discriminate:
• Isolatable section: process section between Emergency Shutdown valves
(ESDV). The inventory of an isolatable section is the minimum amount to be
released in case of a leak (provisions may be taken to allow for the effect of
blow down for small leaks). We assume that the inventory within an iso-
latable section has the same pressure and temperature (this means that
pumps, compressors and choke valves are also considered to be divisions
between isolatable sections, i.e. the inventory of an isolatable section can in-
clude the “other side” of such equipment, e.g. the high pressure part of a
choke valve), but there may be difference between liquid or gas releases on
e.g. different sides of a separator 6

6
In the feasibility study we consider gas releases only

34 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

For each section, the sections that are linked to that section should be given:
in between these sections there is an ESDV
• Area section: those parts (equipments) of an isolatable section which are lo-
cated in the same area. This means that a release of an area section always
will take place in the same area.
There may be several area sections in one area, if several isolatable sections
cross that area.
• Inventories with the same (chemical) properties are called “streams”
• An area section consists of a set of components: release frequency from the
area section depends on component count and individual component failure
rates

Meteorological conditions: stochastic:

Wind speed and – direction (statistical distribution)
Sea state (wave height) (relation with wind speed and statistical distribution)
Manning distribution (deterministic and/or stochastic)
Number of personnel per module or area (depends on time of day). This is pref-
erably to be described stochastically: procent of time 1 person is presen, 2 per-
sons are present, etc.

2.1.2 Outputs
Statistical description of fatality, discriminating the following informations:
• Origin of the fatalities (in what module/area was the person when the event started?
• Location of fatalities (in what module/area was the person dying)

From this, to be derived the statistical risk criteria (related to hydrocarbon risks):
•
• Potential Loss of Life
• Individual risk for some personnel categories (operators, …)
• Location-based risk (the risk of fatality when being at in some area/module)
• Fatal Accident Rate, for the whole platform and per area/module.
• Group risk distribution (F-N curve)

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 35

3 Model specifications – physical events
This chapter provides the specifications for the models needed to develop the total OPHRA sys-
tem. Most models are related to blocks in the 4 elementary event trees or barrier diagrams, or
describe links between these blocks. The diagrams are included for reference where appropri-
ate.

3.1 Environmental conditions

3.1.1 Wind (wind direction, wind speed, atmospheric stability)

3.1.1.1 Atmospheric stability
Atmospheric stability more than a few kilometres off-coast depends on the temperature differ-
ence between water and air, which is, for the North Sea, dependent on the season. During win-
ter, the air is colder than the water, and the lower layer of the atmosphere is unstable. During
summer, the air is warmer than the water, and the atmosphere is stable. See Fig. 4.12 in
(Committee for the Prevention of Disasters 1996, 2005).
Simplest modelling: Assume neutral stability – within the short distances on a platform, atmos-
pheric stability is not expected to dominate dispersion.

3.1.1.2 Roughness length

The roughness length of the sea depends on the wind speed and sea state. A simple approach
is according to (Vickers and Mahrt 2010), relating roughness length to surface friction velocity.
Simplest modelling: Most offshore platforms are about 20-30 m above sea level. Wind speed
statistics are normally derived for a height of 10 m above the surface. Using the above refer-
ence (Vickers and Mahrt 2010), it can be shown that wind speed at 30 m is 10% higher than at
10 m for a wind speed of about 15 m/s, and this difference is less for lower wind speeds (7% for
4 m/s). So wind speed variation can be neglected, or wind speed at platform height can be set
7% higher than the data from climatological statistics.

3.1.1.3 Wind speed and direction statistics

In principle, wind speed and direction statistics need to be derived from long term (10 years)
statistics measured at a meteorological station nearby (or representative for) the location of the
offshore platform. This data can normally be obtained from the meteorological services, and
some analyses are publicly available on the basis of offshore wind-energy research.
There is meteorological data available from Tyra East from 2008, and platform K13 from 2002
(windfinder.com).
Some data may be incomplete. Some information need to be available about the variation of
wind speed (dispersion is strongly dependent on wind speed, both low wind and high wind con-
ditions need to be included in a QRA). Often data is presented as wind direction statistics, and
average wind speed per direction. Information on wind speed variation can be included using a
Weibull distribution of wind speed. At least 8 wind direction sectors should be distinguished,
normal statistics may distinguish between 8 and 16 wind direction sectors.
Based on publicly available data for the North Sea close to the Dutch coast 7 we conclude that a
reasonable representation of wind speed for dispersion calculations can be obtained using the
following classes. The representative wind speed is based on the average of 1/u (the inverse of

7
“NL3 site”: http://www.ecn.nl/fileadmin/ecn/units/wind/docs/dowec/10047_002.pdf

36 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

wind speed) within the class, as concentration in a passive plume is inversely proportional to
wind speed:
Wind speed class Representative Approximate
wind speed probability, time
(m/s) prevalence (%)
< 4 m/s 2 20
Between 4 and 8 m/s 6 40
> 8 m/s 10 40

Simplest modelling: Uniform wind direction probability over 8 sectors, using the wind speed dis-
tributions from the table above.

Feasibility modelling: Data according to7 as shown below and Figure 12.

Sector Wind direc- Weibull Weibull Average wind speed frequency8

(centre) tion frequen- scale fac- shape wind
cy (%) tor A factor k speed < 4 m/s Between > 8 m/s
[m/s] [m/s] 4 and 8
m/s
0 6.4 7.6 2.2 6.8 1.38% 2.93% 2.09%
30 6.4 7.4 2.3 6.6 1.38% 3.09% 1.93%
60 6.6 7.9 2.2 7.1 1.32% 2.92% 2.36%
90 6.2 7.8 2.2 7 1.27% 2.77% 2.15%
120 5.9 7.2 2.3 6.5 1.35% 2.90% 1.65%
150 5.5 7.4 2.3 6.6 1.19% 2.65% 1.66%
180 6.7 8.3 2.2 7.5 1.22% 2.82% 2.66%
210 13.2 9.7 2.3 8.8 1.61% 4.64% 6.95%
240 15.4 10.1 2.6 9 1.33% 5.15% 8.93%
270 11.9 9.5 2.1 8.5 1.79% 4.19% 5.93%
300 8.2 8.8 2.1 7.9 1.43% 3.16% 3.62%
330 7.6 8.6 2.2 7.5 1.29% 3.07% 3.24%
Total 100 8.6 2.1 7.8

8
Based on Weibull distribution with the factors per row.

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 37

7
Figure 12 Distribution of wind speed and direction for “NL3” site

3.1.2 Sea state (wave height)

Sea state and wave height has little relevance to hydrocarbon risks if escape to and rescue
from sea are disregarded.
Sea state and wave height are relevant for pool fires on sea. During the feasibility study, only
gas releases are considered, so pool fires are not considered at this moment. As a conse-
quence, sea state is not included in the modelling at this stage.

3.2 Wind speed and ventilation within a module

The module is considered as a rectangular duct, with (more or less) solid top (roof) bottom
(floor) and sidewalls. Front and rear of the duct are open, and here the wind enters or leaves
the module.
− Mass release rate m’ (kg/s) (This may be time dependent)
− Density of the release at ambient conditions ρ0 (kg/m3)
− Ventilation velocity in the module um (m/s)
− Wind speed in the free air: ua (m/s)
− Dimensions of the module: Width (W m), height (Hm), length (Xm), volume (Vm), ground
floor area and a characteristic length Lm= (Volume)1/3.
− Fraction of the rear and front face of the module being open f0 (1 for fully open faces;
default is 0.8)
− Confinement factor f5 (see table)
− Congestion factor f6 (see table)
− Volume blockage ratio in the module vb (default 0.14, the full-scale experiments ranged
from 0.06 to 0.14)

Correlations for ventilation in a module are presented in (Anonymous 2006). According to this
model, the ventilation velocity um is proportional to wind speed ua as:

𝑢𝑚 = 𝑢𝑎 ∙ 𝑓0 ∙ 𝑓4 ∙ 𝑓5 ∙ 𝑓6

38 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

In this description the parameters have the following meaning:
− Fraction of the rear and front face of the module being open f0 (1 for fully open faces;
default is 0.8)
− Confinement factor f5 (see table)
− Congestion factor f6, derived from the volume blockage ratio vb, see below (the volume
blockage ratio has default values of 0.14, the full-scale experiments ranged from 0.06
to 0.14, see table below.)

The factor f 4 in the original model from (Anonymous 2006) has the value of 0.3. Here we try to
make it dependent on wind direction. If wind direction is aligned with the direction of the module
(considered as a duct), wind can enter freely; when wind is perpendicular to the module, there is
no or very little wind driven motion in the module, only due to turbulence or wind direction varia-
tions (here taken as 10 %). We model this by describing f4 as follows:

𝑓4 = max �0.1,0.4 ∙ �|cos(𝛼)|�

Where α is the angle between the ambient wind direction and the direction of the module. Using
square root of the cosine accounts for the guiding effect of the walls for small values of α (al-
most aligned wind). The factor 0.4 is included as to ensure that the average of f4 over all direc-
tions approximates the constant in the original model.
0.5

0.4

0.3
U/Uw

0.2

0.1

0
0 20 40 60 80 100 120 140 160 180
Angle (degrees)

Note that the direction of the wind in the module changes when α passes ±π/2.
In principle, f6 can be calculated by the volume blockage v b and the ratio between the length of
the module lm and the characteristic length-scale for the module, calculated as the square root
of the module’s volume.Lm:
1
𝑓6 = �
𝑙
1 + 29 ∙ 𝑣𝑏 ∙ 𝐿𝑚
𝑚

Alternatively a direct factor for f6 can be used. Guidance for the factors f5 and f6 are according to
the following table:

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 39

Fully En- Partialy Open Fully
En- closed ended Open
closed ended Unit Unit
Unit unit
f5 0.2 0.5 1 1
f6 0.4 0.4 0.4 0.5
vb 0.14 0.06 0.06 0.06

3.3 Loss of containment – Release

3.3.1 Release frequency, hole size, location and direction

The release frequency and hole size depend on the equipment count for the Area-section.
The probability of P(d>D) within a period of time T depends on:
• Equipment type and size of equipment. P increases proportionally with the number of
equipments in the Area section.
• Size of equipment is characterized by the largest internal diameter of the pipe or pipe
connection (flange)
• Probability is derived from failure rate statistics and may be adjusted for design quality
(standard or code), material, maintenance status, exposure to vibration, erosion, corro-
sion, etc.

Location: Release is at the surface of the equipment in question. Possible simplifications with
corresponding assumptions:
1. To assume all releases are in one point (centre) of the Area where the Area-
section is located.
2. To assume the release position is distributed (e.g. uniformly) over the Area in ques-
tion.

Direction: Direction may depend on the orientation of the equipment in question; e.g. holes in
pipes, vessels and flanges can be expected to be radial (normal to the main pipe direction),
while (pipe) ruptures are axial. Possible simplifications:

40 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

1. Uniformly distributed in all directions, if ϕ indicates horizontal direction, and θ the angle
of direction from horizontal, then ϕ is uniformly distributed with probability density 1/(2⋅π)
from 0 to 2⋅π and θ has a probability density function of ½cosθ from -½π to ½π;
2. Uniformly distributed in a horizontal plane; horizontal direction ϕ is uniformly distributed
with probability density 1/(2⋅π), θ=0;
3. One direction (downwind) – this assumption is pragmatic in connection with jet or dis-
persion models that only allow downwind oriented jets.

Simplest modeling – for feasibility we use option 3.

The basic release frequencies for the feasibility studies are taken from (OGP 2010), tables in
section 2.0.
The statistical sampling is performed according to the following algorithm. Firstly, the hole size
range is sampled. It is one the five: [1, 3], [3, 10], [10, 50], [50, 150], [150, full bore] mm. The
frequency attributed to each range is calculated, so that we have five frequencies fi , i=1, …, 5.
Then, one of five integer numbers is sampled according to the weight of the frequency of each
𝑓
range. That is, the weight is 𝑤𝑖 = 𝑖�∑5 . If the sampled number is, for example, 3, this means
𝑖=1 𝑓𝑖

that the hole size lies in range 3 between 10 and 50 mm.

Secondly, an exact hole size is sampled as a number governed by a uniform distribution within
one of the five ranges. That is, if the rage is 3, then a random number is generated in the range
[10, 50] mm.
Maximum hole size is equipment size, note that full bore ruptures are more “likely” than almost
full bore holes.
(Note that release frequencies for wellheads and Christmas trees are not included in OGP re-
port 434-01)

3.3.2 Release rate

Purpose:
The purpose of this model is to estimate the amount of hydrocarbons escaping from the hole;
this amount is input to further consequence assessment.
The section in question has a hole with diameter d [m], starting at time t=0
Model: release rate m(t) [kg/s]
Parameters:
Prop Properties of the fluid stream that affect the outflow, e.g. molecular mass, cp, cv,
...
d Hole size
Cd Discharge coefficient of the hole
P(t) Pressure in the section at time t; P0 is the pressure in the section at t=0.
Mi(t) Array (vector) of masses in the isolatable sections that are in open connection
with the punctured section at time t (i.e. the set of linked isolatable sections for which ESDVik(t)
is not “closed”). Each isolatable section has some statuses according to the status of the ESDV:
“In open connection with the leaking section” and “Open at both (or more) sides”
ESDVik(t) Array (vector) of status of the isolation valves between neighbouring isolatable
sections i and k (status is at least “open” and “closed”; may be extended with “partially closed”
BDVi(t) Array (vector) of status of the Blow Down Valve for each isolatable section.
Modelling principle:

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 41

At t=0, the outflow is determined by the pressure and material properties in the punctured sec-
tion. Outflow reduces due to expansion and flow resistance (depending on location of hole and
pipe sizing) with time, at first all sections are in open connection, but ESD response and Blow
down may reduce mass, thus pressure in the sections that are open with the punctured section.
Simplest modelling (feasibility option)
Flow resistance is ignored, outflow is constant determined by P0, the pressure in the section pri-
or to the leak. Release continues until sections bounded by closed ESD are empty (Blow down
action is ignored on outflow)
Model according to “Yellow Book” (Committee for the Prevention of Disasters 1996, 2005) sec-
tion 2.5.2.3:
while Σ Mi(t)>0
𝛾+1
𝜋𝑑2 2 𝛾
∙ �𝜌0 ∙ 𝑃0 ∙ 𝛾 ∙ �
𝛾−1 𝑃0 𝛾+1
𝑚(𝑡) = 𝑞0 = 𝐶𝑑 ∙ � for critical outflow >( )𝛾−1
4 𝛾+1 𝑃𝑎 2

and
2 𝛾+1
𝜋𝑑 2 2𝛾 𝑃𝑎 𝛾 𝑃𝑎 𝛾
𝑚(𝑡) = 𝑞0 = 𝐶𝑑 ∙ ∙ �𝜌0 ∙ 𝑃0 ∙ 𝛾−1 ∙ �� � − � � � for subcritical outflow.
4 𝑃0 𝑃0
𝐶𝑝
With = , Cd the discharge coefficient (about 0.62 for sharp holes, 0.95 for full-bore ruptured
𝐶𝑣
pipes) and Pa the atmospheric pressure.
Mi(t) is calculated according to the following rule: For all sections open at more than 1 side, and
in open connection with the leaking section, M=M0; for the n sections that are open on one side
and in open connection with (or equal to) the leaking section, Mi(t+dt)= Mi(t)-1/n ⋅ q(t) ⋅ dt.

3.4 Dispersion
Dispersion modelling will be based on the approach from (Anonymous 2006), page 57, for more
details see Appendix B.
Concepts: As for ventilation.
Following parameters are input to the model
− Mass release rate m’ (kg/s) (This may be time dependent)
3
− Density of the release at ambient conditions ρ (kg/m )
− Ventilation velocity in the module u (m/s) (see the description of ventilation above)
− Dimensions of the module: Width, height (Hm), length (Xm), volume (Vm), ground floor
1/3
area and a characteristic length Lm= (Volume) .

The expression for the equilibrium or flammable volume is:

3/2
𝑚′
𝑉𝑓𝑓𝑓𝑓𝑚𝑎𝑎𝑎𝑎 = � � ∙ �𝑐𝑙𝑙𝑙 −3/2 − 𝑐𝑢𝑢𝑢 −3/2 �
𝜌∙𝑢∙𝑘
Here k is an empirical constant that describes the rate of gas transport through the cloud’s
boundaries. It is shown that k = 0.614
The flammable cloud volume in the module can fill at maximum 60% (according to experiments)
of the module.
If the flammable volume is limited by the size of the module, the excess mass would disperse
outside the module (in adjacent units or modules) above clfl. This is not included for the feasibil-
ity study.

42 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

Cloud growth V(t) can be approximated by formula (A22) in the separate appendix on disper-
sion modelling for constant m’. V(t) is the time-dependent flammable cloud, which asymptotically
will approach Vflammable.
−0.7358 ∙ 𝑡 ∙ 𝑚′
𝑉(𝑡) = 𝑉𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓 ∙ �1 − exp � ��
𝑉𝑓𝑓𝑎𝑚𝑚𝑚𝑚𝑚𝑚 ∙ 𝜌 ∙ 𝑐𝑙𝑙𝑙
(A22)
For releases from isolatable sections, we use (for the feasibility) a constant mass flow rate equal
to the maximum mass flow rate. When isolation is initiated, we know the total mass to be re-
leased (this is the mass released up to time to full isolation plus the mass in the isolated sec-
tion). The effective release time tmax is then calculated as the total mass released divided by the
(maximum) mass flow rate – after that, the mass flow rate drops to zero. The development of
the cloud can then be approximated by formulas (A22) and (A23).

𝑡 − 𝑡𝑚𝑚𝑚 3
𝑉(𝑡) = �𝑉𝑚𝑚𝑚 1/3 − 𝑢 ∙ 𝑘 ∙ �
3
(A23)
1/3
valid while t-tmax < (Vmax) . Vmax is the cloud volume according to (A22) at tmax: V(tmax).
Some special rules need to be applied to ensure consistency (the UFL cloud is always smaller
than the LFL cloud) and to obey the observation of a maximum of 60% flammable fill in the
module. The complete calculation rules are in Appendix B.

Example of the evolution of flammable cloud in a module. The decrease after the first peak is
due to the growth of the UFL volume inside the module while the LFL volume has reached the
maximum volume inside the module and is extending outside the module. The second peak is
due to the decrease of the UFL volume while the LFL volume is still extending outside the mod-
ule.

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 43

3.4.1 The calculation scheme
This scheme is adjusted in such a way, that the experimental observation that the fraction of a
module filled with a flammable cloud is no more than 60%. Note that this limitation may be
caused either that a part of the module is below the LFL, either a part is above the UFL.
While m’ is non-zero and constant for 0<t<tmax:
The final (equilibrium) cloud size where LFL is exceeded is:
3/2
𝑚′
𝑉>𝐿𝐿𝐿 = � �
𝜌 ∙ 𝑐𝑙𝑙𝑙 ∙ 𝑢 ∙ 𝑘
And similar for the volume exceeding UFL:
3/2
𝑚′
𝑉>𝑈𝑈𝑈 =� �
𝜌 ∙ 𝑐𝑢𝑢𝑢 ∙ 𝑢 ∙ 𝑘
For the time-dependent cloud where LFL is exceeded (Vm is the volume of the module):
−0.7358 ∙ 𝑡 ∙ 𝑚′
𝑉>𝐿𝐿𝐿 (𝑡) = min(0.82 ∙ 𝑉𝑚 , 𝑉>𝐿𝐿𝐿 ∙ �1 − exp � ��)
𝑉>𝐿𝐿𝐿 ∙ 𝜌 ∙ 𝑐𝑙𝑙𝑙
And similar for UFL:
−0.7358 ∙ 𝑡 ∙ 𝑚′
𝑉>𝑈𝑈𝑈 (𝑡) = min(0.7 ∙ 𝑉𝑚 , 𝑉>𝑈𝑈𝑈 ∙ �1 − exp � ��)
𝑉>𝑈𝑈𝑈 ∙ 𝜌 ∙ 𝑐𝑢𝑢𝑢
(the constant 0.7358 is selected to approximate the analytical solution for time development; the
constants 0.82 and 0.7 are chosen as to obey – in most cases - the maximum of 60% flamma-
ble fraction in the module).
When m’=0 for t>tmax:
−0.7358 ∙ 𝑡𝑚𝑚𝑚 ∙ 𝑚′
V>LFL,max = min(1.8 ∙ 𝑉𝑚 , 𝑉>𝐿𝐿𝐿 ∙ �1 − exp � ��)
𝑉>𝐿𝐿𝐿 ∙ 𝜌 ∙ 𝑐𝑙𝑙𝑙
(the constant 1.8 is chosen to allow different sizes of the LFL and UFL cloud when shrinking,
and is chosen as to allow – in most cases – the maximum of 60% flammable fraction of the
module)
1 𝑡 − 𝑡𝑚𝑚𝑚 3
𝑉>𝐿𝐿𝐿 (𝑡) = max(0, min(0.82 ∙ 𝑉𝑚 , �𝑉>𝐿𝐿𝐿𝐿𝐿𝐿 3 − 𝑢 ∙ 𝑘 ∙ � )
3
And for UFL:
1 𝑡 − 𝑡𝑚𝑚𝑚 3
𝑉>𝑈𝑈𝑈 (𝑡) = max(0, �(𝑉>𝑈𝑈𝑈 (𝑡𝑚𝑎𝑎 ))3 − 𝑢 ∙ 𝑘 ∙ �
3
For the flammable cloud for all t is then:
𝑉𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓 (𝑡) = 𝑉>𝐿𝐿𝐿 (𝑡) − 𝑉>𝑈𝑈𝑈 (𝑡)
For the dimensions of the LFL and UFL clouds use the following rules. Note that the UFL cloud
is always smaller than the LFL cloud. A is the area covered by the cloud: A= Width ⋅ Length; Hm,
and W m are the height and width (perpendicular to the direction of the ventilation flow) of the
module. The following formulae assume that Height<Width<Length:
𝑉(𝑡)
𝐴(𝑡) = max �𝑉(𝑡)2/3 , �
𝐻𝑚
𝑊𝑊𝑊𝑊ℎ(𝑡) = min�𝐴(𝑡)1/2 , 𝑊𝑚 �
𝐴(𝑡)
𝐿𝐿𝐿𝐿𝐿ℎ(𝑡) =
𝑊𝑊𝑊𝑊ℎ(𝑡)
The location of the cloud is starting at the release point and stretching to the downwind side of
the module; if the cloud has reached the downwind side of the module, the upwind side will
move upwind.

44 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

3.4.2 Time to reach a detector
In order to define when a cloud is detected, we can use the same formulas, when we exchange
clfl by the detection threshold cdetect, which is typically 20% of LFL. In this case do NOT apply
maximizing the module volume. Note that the empirical constant k is in principal valid for natural
gas’s LFL concentration, it may not be valid for concentrations that are a factor of 10 smaller.
If we know that a detector is mounted 2 m above the floor and 5 m downwind of the release
point, we can explicitly derive the time when the cloud will hit the detector:
First define the equilibrium cloud volume for the threshold concentration Vequil,detect:
3/2
𝑚′
𝑉𝑒𝑒𝑒𝑒𝑒,𝑑𝑑𝑑𝑑𝑑𝑑 = � �
𝜌 ∙ 𝑐𝑑𝑑𝑑𝑑𝑑𝑑 ∙ 𝑢 ∙ 𝑘
Then determine the time for the cloud to grow when plume height (ℎ𝑒𝑒𝑒ℎ𝑡 = 3�𝑉𝑑𝑑𝑑𝑑𝑑𝑑 (𝑡))>2, and
plume length >5 m:
If Hm<5 m, this would lead to (downwind distance being the limiting factor):
𝑉𝑒𝑒𝑒𝑒𝑒,𝑑𝑑𝑑𝑑𝑑𝑑 ∙ 𝜌 ∙ 𝑐𝑑𝑑𝑑𝑑𝑑𝑑 52 ∙ 𝐻𝑚
𝑡𝑑𝑑𝑑𝑑𝑑𝑑 = − ∙ ln(1 − )
0.7358 ∙ 𝑚′ 𝑉𝑒𝑒𝑒𝑒𝑒,𝑑𝑑𝑑𝑑𝑑𝑑

3.5 Ignition

3.5.1 Immediate ignition

The probability of immediate ignition is taken from the EI report (Anonymous 2006), Section
1.6.4.2, as being 0.1%.

3.5.2 Delayed ignition

Ignition is caused by 2 different types of ignition sources: permanent or continuous ignition
sources and intermittent ignition sources.
Continuous sources are sources that, on time frames longer than the whole event sequence,
are permanently present. That means that ignition takes place when a gas cloud with a concen-
tration higher than the Lower Flammability Level (LFL) reaches the position of the ignition
source. Continuous ignition sources can be hot surfaces of open flames, or equipment produc-
ing sparks continuously. The continuous ignition source is characterized by a position (coordi-
nates) and the probability that it exist. The continuous ignition can be linked to a physical
equipment (e.g. compressor), and thus may have a fixed position, or use is made of a density
per unit area, as provided by data in the EI report, giving a probability of a continuous ignition
source being present in some discretely bounded volume. So the process as implemented in
the feasibility model is as follows:
1. Sample whether there is a continuous ignition source in the module where the release takes
place (for the feasibility model no ignition outside the module has been considered). The
probability that there is an ignition source in the module is the probability per unit area (de-
rived from EI report, Table 1.28), times the area of the module.
2. If there is an ignition source, generate a random position for that ignition point.
3. Ignition takes place at the time when the gas cloud (LFL) reaches the ignition point.

Intermittent ignition sources may give sparks at random times. So ignition takes place if a gas
concentration is present AND the intermittent source “fires”. So in addition to the parameters
describing continuous sources, the probability distribution of “firing” need to be known, i.e. typi-
cally characterized by the mean time between sparks (and assuming an exponential distribution
of time between sparks). Also here, use is made of data from the EI report.

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 45

Note that we consider continuous ignition sources by comparison with the time evolution of the
event sequence. The EI model considers “hot work” as an intermittent ignition source, as it hap-
pens only a few hours per year. We argue that hot work is executed continuously over a period
in the order of one hour, while the event development will be faster, and therefore we consider it
as a continuous ignition source, but only being present a limited number of occasions.
For the intermittent ignition, we used the data from the EI report, Table 1.28, and partitioned the
-2 -1
ignition source density in a spatial probability µ [m ], and an ignition rate λ [s ], where λ is the
inverse of mean time between ignitions of the source in question. The probability that ignition
takes place within an area A and within a time t is then
𝑃𝑖𝑖𝑖𝑖𝑖𝑖𝑖𝑖 = 𝐴 ∙ 𝜇 ∙ (1 − 𝑒 −𝜆∙𝑡 )
The values for “discrete” ignition in EI report Table 1.28 have been partitioned into µ and λ by
assuming that the mean time between ignitions is 60 minutes (cf. Table 1.30, where for most
equipment 17 minutes has been used). This leads to the following results:
2
µintermittent (1/m ) λ mean time be-
(1/s) tween ignition
(min)
-4 -4
Electrical equipment 1.23⋅10 2.78⋅10 60
-4 -4
Pump 4.36⋅10 2.78⋅10 60
-3 -4
Compressor 9.80⋅10 2.78⋅10 60
-2 -4
Generator 2.25⋅10 2.78⋅10 60
-5 -4
Other 3.05⋅10 2.78⋅10 60
-4 -4
Personnel 1.02⋅10 2.78⋅10 60
So the process as implemented in the feasibility model is as follows:
1. Sample whether there is an intermittent ignition source in the module where the release
takes place (for the feasibility model no ignition outside the module has been considered).
The probability that there is an ignition source in the module is µ (from table above) times
the area of the module;
2. If there is an ignition source, generate a random position for that ignition point;
3. Sample at what time the source will “fire” an ignition, using λ and an exponential probability
density function;
4. Ignition will take place at time of ignition IF the ignition point at that time is in the flammable
part of the cloud.

The probability of both continuous and intermittent ignition sources can change during the se-
quence of events depending on whether personnel have secured the workplace, and/or have
left the module (not implemented in the feasibility study)

3.6 Jet flame

The purpose of this model is to describe the jetflame following ignition, as function of time and
release rate. The model need to predict: Size and heat transfer to the surroundings in order to
estimate likelihood of detection (by a variety of sensors), direct damage to people (fatality and
injury) and damage to platform structural equipment and/or process equipment.
Different models are available, see e.g. section 6.3.2 in (Committee for the Prevention of Disas-
ters 1996, 2005):
• Single Point models
• Multiple Point models
• Models with a predefined, simplified contour or solid shape (typical cones)

46 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

• Integral models
• Field (CFD) models.

In order to be applicable for OPHRA, the model should either be able to run very fast within the
system, or OPHRA performs an interpolation between predefined results (e.g. from CFD mod-
els).
Two types of heat transfer have to be considered, viz. 1) Radiative heat transfer from the (free)
flame surface to surrounding objects (surfaces) and 2) convective heat transfer from flames hit-
ting (impinging) or engulfing objects or surfaces. Modelling radiative heat transfer involves de-
termination of flame surface temperature and emission coefficient (emissive power), and view
factors from the object to the flame surface; the flame surface can be simplified to a single point.
Modelling convective heat transfer involves determination of flame temperature and convective
heat transfer which depends on the characteristics of the flow of hot or burning gas close to the
object.
Simplest modelling:
The simplest model is the point source model and correlations for heat transfer from chapter 5
in (Oil & Gas UK 2007). This model ignores the influence of wind on the position of the flame,
but this model can be combined with some of the aspects of the “Chamberlain” model, de-
scribed in section 6.5.3 of (Committee for the Prevention of Disasters 1996, 2005).
The point model is a suitable model for radiation heat flux at distances more than 2 flame diam-
eters away. Incident radiative heat flux at a distance r is:
𝜏 ∙ 𝐹 ∙ 𝑚′ ∙ 𝐻𝑐
𝑞𝑟 =
4𝜋 ∙ 𝑟 2
Where τ is the atmospheric transmissivity of heat radiation, F is the fraction of heat from the
flame transferred by radiation, m’ the burning mass flow rate (which is equal to the release rate
from the leak), and Hc the heat of combustion of the gas.
Feasibility study: use has been made of the Chamberlain model as described in section 6.5.3 of
(Committee for the Prevention of Disasters 1996, 2005).

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 47

4 Detection models
4.1 Gas detection
Detectors are located in some array. When the cloud (see section 3.4.2) reaches a detector, the
detector will initiate the response (Alarm) with a probability corresponding to the detector’s reli-
ability.

5 Models describing escape and evacuation

5.1 Manning distribution
Personnel are distributed within the different modules. This can be deterministic (fixed number
of personnel in each module) or probabilistic using a probability distribution for each module,
assuring that total Persons On Board (POB) is not exceeded.
Personnel are distributed over the area of the module using a uniform probability distribution.
Note that release frequency may be correlated with personnel being present (e.g. due to
maintenance-related incidents). No information is available at present.

5.2 Model for securing the workplace

It is assumed that the time needed to secure and leave the workplace can be described by a
random variable for each person, where the variable is sampled from a probability distribution. It
can be, for example, a triangular, uniform or any other that is best supported by existing evi-
dence. In the current version, the uniform distribution is implemented that samples random val-
ues from a range of [50, 70] seconds.

5.3 Model of escape from the module.

This model implements the likely decision from the personnel to move to the exit of the module
in a way that always will increase the distance to the point of release. The speed of movement
can be sampled from a distribution that is best supported by existing evidence. In the feasibility
version of the model it is constant and equal to 2 meters per second. Limits in movements can
be implemented, e.g. only routes perpendicular to the walls are possible, to incorporate the
presence of equipment and other obstacles limiting free movement. Movement

5.4 Model to move to muster area

Once outside the module on an escape route, the persons have to decide to move to:
• Muster area
• Secondary muster area
• Escape to sea
• Remain in position (trapped)

These decisions are based on whether routes towards the three positions at the moment of de-
cision are impaired by gas, heat, or smoke.
The speed of movement along the escape routes can be sampled from a distribution. Though,
for the feasibility study it is constant and equal to 2 meters per second.

48 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

6 Models for describing consequences
6.1 Heat radiation impact on persons
For heat radiation due to flash fire and jet fire, the approach as used in the “Purple book”
(Committee for the Prevention of Disasters 1999). This model states:
• If a person is within a flame envelope (either a jet flame or a flash fire), the fatality probabil-
ity is 1;
• If a person at any time is exposed to a heat radiation exceeding 35 kW/m2 (when all clothes
are expected to ignite), the fatality probability is 1;
• If the heat radiation is less than 35 kW/m2, fatality is calculated by the following Probit func-
tion:
4
𝑃𝑃 = −36.38 + 2.56 ∙ ln �𝑞 3 ∙ 𝑡�

Fatality is 14% of the fatality according to this Probit function, where the reduction ac-
counts for the protection of clothing.
4/3
For low radiation levels, the Probit is calculated by integrating the dose q ⋅t while the
person is exposed to radiation (i.e. the collected dose while at the work place and while
escaping).
This model s not implemented in the feasibility study.

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 49

Appendix B Development of a time-dependent dis-
persion model for offshore modules

Overview

Dispersion modelling will be based on the approach from the IP Ignition probability review, page
57.
The expression for the equilibrium flammable volume is:

3/2
𝑚′
𝑉𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓 = � � ∙ �𝑐𝑙𝑙𝑙 −3/2 − 𝑐𝑢𝑢𝑢 −3/2 �
𝜌∙𝑢∙𝑘

This expression states that an equilibrium cloud size is obtained when removal of the flammable
substance by wind over the boundaries of the cloud (proportional to cloud surface area and
wind speed) is equal to the influx m’. Here k is an empirical constant that describes the rate of
gas transport through the cloud’s boundaries. It is shown that k = 0.614
The flammable cloud volume in the module can fill at maximum 60% (according to experiments)
of the module.
If the flammable volume is limited by the size of the module, the excess mass would disperse
outside the module (in adjacent units or modules) above clfl. This is not included for the feasibil-
ity study.
Cloud growth V(t) can be approximated by formula (A22) in the sections below for constant m’.
V(t) is the time dependent flammable cloud, which asymptotically will approach Vequilibrium.

−0.7358 ∙ 𝑡 ∙ 𝑚′
𝑉(𝑡) = 𝑉𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒 ∙ �1 − exp � ��
𝑉𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒 ∙ 𝜌 ∙ 𝑐𝑙𝑙𝑙
(A22)
For releases from isolatable sections, we use (for the feasibility) a constant mass flow rate equal
to the maximum mass flow rate. When isolation is initiated, we know the total mass to be re-
leased (this is the mass released up to time to full isolation plus the mass in the isolated sec-
tion). The effective release time tmax is then calculated as the total mass released divided by the
(maximum) mass flow rate – after that, the mass flow rate drops to zero. The development of
the cloud can then be approximated by formulas (A22) and (A23):

𝑡 − 𝑡𝑚𝑚𝑚 3
𝑉(𝑡) = �𝑉𝑚𝑚𝑚 1/3 − 𝑢 ∙ 𝑘 ∙ �
3

(A23)
1/3
This formula is valid while t-tmax < (Vmax) . Vmax is the cloud volume according to (A22) at tmax:
V(tmax).
Some special rules need to be applied to ensure consistency (the UFL cloud is always smaller
than the LFL cloud) and to obey the observation of a maximum of 60% flammable fill in the
module. The complete calculation rules are in the following sections.

50 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

In order to define when a cloud is detected, we can use the same formulas, when we exchange
clfl by the detection threshold cdetect, which is typically 20% of LFL. In this case do NOT apply
maximizing the module volume. Note that the empirical constant k is in principal valid for natural
gas’s LFL concentration, it may not be valid for concentrations that are a factor of 10 smaller.
If we know that a detector is mounted 2 m above the floor and 5 m downwind of the release
point, we can explicitly derive the time when the cloud will hit the detector:
First define the equilibrium cloud volume for the threshold concentration Vequil,detect:

3/2
𝑚′
𝑉𝑒𝑒𝑒𝑒𝑒,𝑑𝑑𝑑𝑑𝑑𝑑 = � �
𝜌 ∙ 𝑐𝑑𝑑𝑑𝑑𝑑𝑑 ∙ 𝑢 ∙ 𝑘

Then determine the time for the cloud to grow when plume height (ℎ𝑒𝑒𝑒ℎ𝑡 = 3�𝑉𝑑𝑑𝑑𝑑𝑑𝑑 (𝑡))>2, and
plume length >5 m:
If Hm>5, this would lead to (downwind distance being the limiting factor):

𝑉𝑒𝑒𝑒𝑒𝑒,𝑑𝑑𝑑𝑑𝑑𝑑 ∙ 𝜌 ∙ 𝑐𝑑𝑑𝑑𝑑𝑑𝑑 52 ∙ 𝐻𝑚
𝑡𝑑𝑑𝑑𝑑𝑑𝑑 = − ∙ ln(1 − )
0.7358 ∙ 𝑚′ 𝑉𝑒𝑒𝑒𝑒𝑒,𝑑𝑑𝑑𝑑𝑑𝑑

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 51

1. Dispersion in an offshore module

1.1 The free momentum jet model

The basis is the model provided in the Yellow book, section 4.5.4.1
The original model reads:
Centerline concentration cc and velocity uc as for s>max(Cc⋅b0,Cu⋅b0):
𝑏0
𝑐𝑐 (𝑠) = 𝑐0 ∙ 𝐶𝑐 ∙
𝑠
𝑏0
𝑢𝑐 (𝑠) = 𝑢0 ∙ 𝐶𝑢 ∙
𝑠
(A4)
Here bo is the source radius.
Radial distribution of concentration c and velocity u:
𝑦
−𝐶 ( )2
𝑐(𝑦, 𝑠) = 𝑐𝑐 (𝑠) ∙ 𝑒 𝑦𝑦 𝑠
𝑦
−𝐶𝑦𝑦 ( 𝑠 )2
𝑢(𝑦, 𝑠) = 𝑢𝑐 (𝑠) ∙𝑒
(A5)
The model in the Yellow Book is presented as if the coefficient Cc, Cu, Cyc and Cyu are inde-
pendent, but they are connected through the balances of mass and momentum:
1
𝐶𝑦𝑦 = 2∙𝐶𝑢 2
𝐶𝑦𝑦 = 𝐶𝑢 ∙ 𝐶𝑐 − 𝐶𝑦𝑦
(A6)
For the recommended values Cu=12 and Cc=10 it follows that Cyu=72 and Cyc=48. The Yellow
Book recommends experimental values of 94 and 57, respectively. If we want to reproduce the
recommended experimental values from the Yellow Book, we have to introduce some factors,
which represent apparent loss of momentum and mass from the jet as compared to the release
(which may address the processes close to the orifice):
1
𝐶𝑦𝑦 = 1.306 ∙ 2∙𝐶𝑢 2
𝐶𝑦𝑦 = 1.258 ∙ 𝐶𝑢 ∙ 𝐶𝑐 − 𝐶𝑦𝑦
(A7)
Note that Cc and Cu can be adjusted for the density of the released gas (Yellow Book 4.79 and
4.78)
The same mass will pass through a jet with a top-hat profile with uniform values of cc and uc with
a radius of 𝑠� ; for the normally (Gaussian) distributed profile it is adequate to set the ra-
�𝐶𝑢 ∙ 𝐶𝑐
dius of the jet at 𝑠� , this means that almost 80% of mass and momentum will pass
2 ∙ �𝐶𝑢 ∙ 𝐶𝑐
through the jet within this radius, and the values of concentration and velocity are about 10 to
12% of the centerline values.

1.1.1 Ambient velocity.

The momentum jet model can be adjusted to a jet in an ambient co-flowing stream by consider-
ing the velocity difference with the co-flowing stream’s velocity ua. So the formulae for u be-
come:
𝑏0
𝑢𝑐 (𝑠) = (𝑢0 − 𝑢𝑎 ) ∙ 𝐶𝑢 ∙ + 𝑢𝑎
𝑠
(A8)

52 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

𝑦 2
−𝐶𝑦𝑦 � 𝑠 �
𝑢(𝑦, 𝑠) = (𝑢𝑐 (𝑠) − 𝑢𝑎 ) ∙ 𝑒 + 𝑢𝑎
(A9)
If the jet is opposite to the ambient flow (i.e. u0 is negative), the model cannot really be used,
because the jet will “flow over itself”. An estimate of the maximum upwind extension of the jet
can anyway be obtained by calculating the point where uc=0, i.e.

𝑢0
𝑠 = 𝐶𝑢 ∙ 𝑏0 ∙ (1 − ) for u0>-ua
𝑢𝑎
(A10)

1.1.2 Time dependent jet

For the evolution of the jet we assume that the jet front proceeds with the speed of the center-
line of the fully developed jet. So at t=0, jet length L(0)=0, and dL(t)/dt=uc(L).
This ODE can be solved to give:

𝐿 = 2�𝑢0 ∙ 𝐶𝑢 ∙ 𝑏0 ∙ 𝑡
(A11)
1.1.3 Explosive limits and volumes
The distance along the jet to some concentration k (e.g. the lower flammability level) is given by:
𝑐0
𝑠𝑘 = ∙ 𝐶𝑐 ∙ 𝑏0
𝑘
(A12)
The radial distance to the concentration k at the edge of the plume is at some position s along
the jet is:
𝑠 𝑏0 𝑐0
𝑦= ∙ �ln( ∙ 𝐶𝑐 ∙ )
�𝐶𝑦𝑦 𝑠 𝑘
(A13)
The mass concentration between c0 and some concentration k (e.g. the lower flammability level)
up to some distance L (which may correspond to the jet length at time t) is given by:

𝜌0 ∙ 𝜋 𝐶𝑐 ∙ 𝑏0
𝑀= ∙ �𝐿3 ∙ �3 ∙ 𝑐0 ∙ − 2 ∙ 𝑘� − 𝐶𝑐 3 ∙ 𝑏0 3 ∙ (3 ∙ 𝑐0 − 2 ∙ 𝑘)�
6 ∙ 𝐶𝑦𝑦 𝐿

for L<sk and where ρ0 is the density of the release at c0, so that ρ0⋅c is the mass concentration in
3
kg/m .
For the mass between two levels, such as the lower and upper flammability level clfl and cufl, re-
spectively, this mass is:

𝜌0 ∙ 𝜋
𝑀= ∙ �𝐿3 − 𝐶𝑐 3 ∙ 𝑏0 3��𝑐𝑢𝑢𝑢 − 𝑐𝑙𝑙𝑙 �
3 ∙ 𝐶𝑦𝑦
(A14)
The total mass between c0 and k, i.e. up to length L= sk is:
3
𝑏03 𝐶𝑐 2 𝑐0
𝑀𝑘 = 𝜌0 ∙ 𝜋 (𝑘 − 𝑐0 )2 � + 2 �
6𝐶𝑦𝑦 𝑘 𝑘
(A15)
The total explosive mass is then:

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 53

3
𝑏03 𝐶𝑐 𝑐0 3 (𝑐𝑢𝑢𝑢 + 𝑐𝑙𝑙𝑙 )
𝑀𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒 = 𝜌0 ∙ 𝜋 �𝑐𝑢𝑢𝑢 − 𝑐𝑙𝑙𝑙 � � − 2�
6𝐶𝑦𝑦 𝑐𝑢𝑢𝑢 2 𝑐𝑙𝑙𝑙 2
(A16)
Note this formula is different from the one in the Yellow Book (4.83), which is derived by inte-
grating along the jet axis starting at s=0; whereas the jet formula is only valid from s>Ccb0,
where we started the integration. The difference is negligible; so one can use the simpler formu-
la from the Yellow Book:

3
𝑏03 𝐶𝑐 𝑐0 2 𝑐0 2
𝑀𝑒𝑒𝑒𝑒𝑒𝑒𝑖𝑣𝑣 = 𝜌0 ∙ 𝜋 𝑐0 �� 2 � − � ��
6𝐶𝑦𝑦 𝑐𝑙𝑙𝑙 𝑐𝑢𝑢𝑢 2
(A17)

This formula can be converted to include the mass flow rate, through the equality of 𝑚 =
𝜋𝑏𝑜 2 𝑐𝑜 𝜌𝑜 𝑢𝑜:

3
𝑏0 𝐶𝑐 𝑐0 2 𝑐0 2
𝑀𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒 =𝑚 �� 2 � − � ��
6𝑢𝑜 𝐶𝑦𝑦 𝑐𝑙𝑙𝑙 𝑐𝑢𝑢𝑢 2
(A17b)
The jet model does not deal with sonic releases and expansion to ambient conditions. Therefore
it is necessary to use the subsonic properties after the jet is expanded to approximately Ma=1/3,
i.e. uo∼100 m/s, and density is at standard conditions. Assuming the release is 100% gas, i.e.
co=1, the pseudo-source radius bo can be calculated from:

𝑚
𝑏𝑜 = �
100 [𝑚/𝑠] ∙ 𝜋 ∙ 𝜌𝑜,𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒
This value is inserted in formula (A17b) together with 100 m/s for uo.

1.2 The JIP workbook model

The original reference cannot be found, but the model is described in the IP ignition probability
review.
The model tries to describe the volume for the cloud exceeding LFL. This can be thought of as a
balance between the mass entering this volume from the release m’, and the mass taken out by
the ventilation or wind though the boundary area of this volume, i.e. the ventilation of the volume
V’ (from the first section above) is modelled as A*u, where A is the area of the volume where
the air is moving outward and the concentration is at LFL, and u the wind or ventilation speed.
The area A is considered proportional with the explosive volume’s characteristic length scale:
2/3
A=k*V .
The mass taken from the boundary where c=clfl is thus: ρ*clfl*u*k*V2/3. So balance between in-
flow and outflow leads to an estimate of the volume V:
3/2
𝑚′
𝑉>𝐿𝐿𝐿 = � �
𝜌 ∙ 𝑐𝑙𝑙𝑙 ∙ 𝑢 ∙ 𝑘
And similar for the volume exceeding UFL:
3/2
𝑚′
𝑉>𝑈𝑈𝑈 =� �
𝜌 ∙ 𝑐𝑢𝑢𝑢 ∙ 𝑢 ∙ 𝑘
(A18)

54 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

(Note that we assume that k does not depend on the level of concentration – this is a simplifica-
tion)
The workbook proposes the correlation for natural gas where clfl = 5% and cufl = 15%:
3/2
𝑚′
𝑉𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓 = 150 � �
𝜌∙𝑢
Vflammable=V>LFL – V>UFL .
This leads to:
2�
3
𝑐𝑙𝑙𝑙 −3/2 − 𝑐𝑢𝑢𝑢 −3/2
𝑘=� �
150
Which leads to k=0.614 or
3/2
𝑚′
𝑉𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓 = 2.077 � � ∙ �𝑐𝑙𝑙𝑙 −3/2 − 𝑐𝑢𝑢𝑢 −3/2 �
𝜌∙𝑢

Note that if the volume was a sphere, and outflow would take place over half of the surface or
the sphere, k would be about 2.4. This can be considered to be the maximum value that k can
take (leading to the smallest volume for a given release/ventilation combination). Note that in
the experiments, the ventilation may have been limited by the walls of the module (that would
not contribute to mixing), thus leading to low values of k.
Now the IP model estimates how long it will take to fill up this flammable volume. The text uses
a build-up time as discussed above, but without considering consistency with the areas and
concentration for the JIP workbook model, giving too low times. The excel sheets use a different
formula, not included in the text, viz ”... based on flammable volume in Area at LFL divided by
volumetric release rate of material, x 2 to allow for some loss during build up of gas in Area”
(comment in IP’s Excel sheet):
2 ∙ 𝑉𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓 ∙ 𝜌 ∙ 𝑐𝑙𝑓𝑙
𝑡=
𝑚′
(A19)
In principle, the evolution of the cloud V>LFL with edge at clfl follows the ODE:
𝑑𝑑 𝑚′
= − 𝑢 ∙ 𝑘 ∙ 𝑉 2/3
𝑑𝑑 𝜌 ∙ 𝑐𝑙𝑙𝑙
(A20)
This ODE has no explicit solution for m’<>0, but t can be expressed explicitly in V (i.e. time to
reach a certain cloud volume V):

𝑚′
With A=𝜌∙𝑐 and B= 𝑢 ∙ 𝑘:
𝑙𝑙𝑙
3
𝐴 3 𝐵 √𝑉
𝑡 = 3 ∙ �� 3 ∙ arctanh � √𝑉 ∙ � � − �
𝐵 𝐴 𝐵

(A21)
(note that the cube root of V equals the characteristic length scale L)
It appears that the time to volume according to the simple formula from the IP model is very
close to the theoretical solution, when time to 77.77% of the maximum (asymptotical) volume is
calculated. There is a constant relation between the time as calculated by (A19) and (A21). This
ratio is used to derive an approximate explicit relation for the cloud volume at time t in relation to
the maximum cloud V>LFL as calculated by (A18):

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 55

−0.7358 ∙ 𝑡 ∙ 𝑚′
𝑉>𝐿𝐿𝐿 (𝑡) = 𝑉>𝐿𝐿𝐿 ∙ �1 − exp � ��
𝑉>𝐿𝐿𝐿 ∙ 𝜌 ∙ 𝑐𝑙𝑙𝑙
And thus
−0.7358 ∙ 𝑡 ∙ 𝑚′ −0.7358 ∙ 𝑡 ∙ 𝑚′
𝑉𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓 (𝑡) = 𝑉>𝐿𝐿𝐿 ∙ �1 − exp � �� − 𝑉>𝑈𝑈𝑈 ∙ �1 − exp � ��
𝑉>𝐿𝐿𝐿 ∙ 𝜌 ∙ 𝑐𝑙𝑙𝑙 𝑉>𝑈𝑈𝑈 ∙ 𝜌 ∙ 𝑐𝑢𝑢𝑢
(A22)
Note that (A22) is valid for constant m’ (as calculation of Vflammable assumes constant m’ over the
total development of the cloud). Correct handling of varying m’ requires (numerical) integration
of (A20). Rather simple integration schemes will suffice due to the asymptotic behavior to an
equilibrium condition.
If m’ becomes zero (due to isolation), A20 can be solved to give:
𝑡 − 𝑡𝑚𝑚𝑚 3
𝑉>𝐿𝐿𝐿 (𝑡) = �𝑉𝑚𝑚𝑚 1/3 − 𝑢 ∙ 𝑘 ∙ �
3
(A23)
1/3
This is valid while t-tmax < (Vmax) .
Here Vmax is the maximum flammable cloud size at tmax when the mass flow rate drops to zero
(note that (A23) describes a linear decrease in the characteristic length scale L).

1.2.1 The final calculation scheme

This scheme is adjusted in such a way, that the experimental observation that the fraction of a
module filled with a flammable cloud is no more than 60%. Note that this limitation may be
caused either that a part of the module is below the LFL, either a part is above the UFL.

While m’ is non-zero and constant for 0<t<tmax:

The final (equilibrium) cloud size where LFL is exceeded is:

3/2
𝑚′
𝑉>𝐿𝐿𝐿 = � �
𝜌 ∙ 𝑐𝑙𝑙𝑙 ∙ 𝑢 ∙ 𝑘
And similar for the volume exceeding UFL:
3/2
𝑚′
𝑉>𝑈𝑈𝑈 = � �
𝜌 ∙ 𝑐𝑢𝑢𝑢 ∙ 𝑢 ∙ 𝑘
For the time-dependent cloud where LFL is exceeded (Vm is the volume of the
module):
−0.7358 ∙ 𝑡 ∙ 𝑚′
𝑉>𝐿𝐿𝐿 (𝑡) = min(0.82 ∙ 𝑉𝑚 , 𝑉>𝐿𝐿𝐿 ∙ �1 − exp � ��)
𝑉>𝐿𝐿𝐿 ∙ 𝜌 ∙ 𝑐𝑙𝑙𝑙
And similar for UFL:
−0.7358 ∙ 𝑡 ∙ 𝑚′
𝑉>𝑈𝑈𝑈 (𝑡) = min(0.7 ∙ 𝑉𝑚 , 𝑉>𝑈𝑈𝑈 ∙ �1 − exp � ��)
𝑉>𝑈𝑈𝑈 ∙ 𝜌 ∙ 𝑐𝑢𝑢𝑢
(the constant 0.7358 is selected to approximate the analytical solution for time
development; the constants 0.82 and 0.7 are chosen as to obey – in most cases
- the maximum of 60% flammable fraction in the module).

When m’=0 for t>tmax:

−0.7358 ∙ 𝑡𝑚𝑚𝑚 ∙ 𝑚′
V>LFL,max = min(1.8 ∙ 𝑉𝑚 , 𝑉>𝐿𝐿𝐿 ∙ �1 − exp � ��)
𝑉>𝐿𝐿𝐿 ∙ 𝜌 ∙ 𝑐𝑙𝑙𝑙

56 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility

(the constant 1.8 is chosen to allow different sizes of the LFL and UFL cloud
when shrinking, and is chosen as to allow – in most cases – the maximum of
60% flammable fraction of the module)
1 𝑡 − 𝑡𝑚𝑚𝑚 3
𝑉>𝐿𝐿𝐿 (𝑡) = max(0, min(0.82 ∙ 𝑉𝑚 , �𝑉>𝐿𝐿𝐿𝐿𝐿𝐿 3 − 𝑢 ∙ 𝑘 ∙ � )
3
And for UFL:
1 𝑡 − 𝑡𝑚𝑚𝑚 3
𝑉>𝑈𝑈𝑈 (𝑡) = max(0, �(𝑉>𝑈𝑈𝑈 (𝑡𝑚𝑚𝑚 ))3 − 𝑢 ∙ 𝑘 ∙ �
3

For the flammable cloud for all t is then:

𝑉𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓 (𝑡) = 𝑉>𝐿𝐿𝐿 (𝑡) − 𝑉>𝑈𝑈𝑈 (𝑡)
For the dimensions of the LFL and UFL clouds use the following rules. Note that the UFL cloud
is always smaller than the LFL cloud. A is the area covered by the cloud: A= Width ⋅ Length; Hm,
and W m are the height and width (perpendicular to the direction of the ventilation flow) of the
module.
𝑉(𝑡)
𝐴(𝑡) = max �𝑉(𝑡)2/3 , �
𝐻𝑚
𝑊𝑊𝑊𝑊ℎ(𝑡) = min�𝐴(𝑡)1/2 , 𝑊𝑚 �
𝐴(𝑡)
𝐿𝐿𝐿𝐿𝐿ℎ(𝑡) =
𝑊𝑊𝑊𝑊ℎ(𝑡)
The location of the cloud is starting at the release point and stretching to the downwind side of
the module; if the cloud has reached the downwind side of the module, the upwind side will
move upwind.

1.2.2 Necessity of the limiting of the maximum volumes.

It has been investigated whether it is necessary to maintain the limiting parameters (0.82 and
0.7, respectively) to limit maximum flammable fraction of 60% in the module. The Figure be-
low shows the effect of the limitation. It can be questioned whether these limiting parameters
are necessary to maintain, given the other uncertainties in the model. Without the limiting pa-
rameters the maximum flammable fraction in the module is 80% for a narrow interval of the di-
mensionless release rate instead of 70%, which still may be considered showing sufficient
agreement with the experimental observations.

Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility 57

58 Offshore Platform Hydrocarbon Risk Assessment – OPHRA: Feasibility
This report describes the feasibility demonstration of a new method to perform risk
assessments for offshore platforms. This method simulates concurrent sequences of events
using the Arena® Discrete Event Simulation (DES) software (version 14.50.00), including
release, ignition and fire; detection, shut down and alarm; escape and evacuation; and
exposure and impact on people and equipment The method leads to a transparent
framework for modelling, which helps to demonstrate the correctness and appropriateness of
models and assumptions. The report lists models and data needed for the risk assessment
framework, and provides specific suggestions for some of those models. Some preliminary
calculations with the DES model have been performed to illustrate type of results that can be
obtained and to provide some insight in the accuracy and computational efforts. Finally,
further work is identified in order to develop an operational risk assessment tool.

DTU Management Engineering

Institut for Systemer, Produktion og Ledelse
Danmarks Tekniske Universitet

Produktionstorvet
Bygning 424
2800 Lyngby
Tlf. 45 25 48 00
Fax 45 93 34 35

www.man.dtu.dk