Working together

for a safer world

Leak scenarios
TN-4

Technical note for:

Equinor ASA

Technical note no: 107566/R1/TN4 Rev: Final

Date: 6 December 2018
Table of contents Page

1 Introduction .....................................................................................................................................1
2 Definition of leak scenarios considered in a QRA .............................................................................1
2.2 Process leak ...........................................................................................................................3
2.3 Utility leak .............................................................................................................................4
2.4 Riser leak ...............................................................................................................................4
2.5 Pipeline leak ..........................................................................................................................4
2.6 Storage tank leak ..................................................................................................................4
3 Leak scenarios covered by the model ...............................................................................................4
4 Leak scenarios modelled in QRAs .....................................................................................................7
4.1 Process leaks .........................................................................................................................8
4.2 Producing well leaks ..............................................................................................................9
4.3 Gas lift well leaks...................................................................................................................9
4.4 Initial leak rate boundary for leaks considered in a QRA.........................................................9
4.5 Significant leaks vs. Marginal leaks ......................................................................................12
5 Leak scenarios not covered by the model .......................................................................................13
5.1 Zero pressure leaks ..............................................................................................................14
5.2 Limited leaks .......................................................................................................................15
5.3 Vent leaks within design specification..................................................................................17
6 References .....................................................................................................................................18

Technical note no: 107566/R1/TN4 Rev: Final Page ii

Date: 6 December 2018 ©Lloyd’s Register 2018
1 Introduction
NORSOK Z-013 Chapter 7.4.4, Ref. /1/, describes process accidents as a specific category to be
analysed in a QRA, but Z-013 does not define a process accident (it refers to the HAZID).
Although industry practice is quite consistent, it is observed that there may exist differences in
the industry with regard to how “process accidents” are defined by various stakeholders.
To improve consistent application throughout industry, the leak scenarios that are normally
considered in Quantitative Risk Analysis (QRA) for offshore oil and gas facilities are defined in this
technical note (TN). A leak should fall into only one of the defined leak categories.
These definitions form the basis for leak scenarios included in the leak frequency model.
Abbreviations and expressions used in this technical note are described in TN-1 Abbreviations and
expressions.

2 Definition of leak scenarios considered in a QRA

This chapter presents the definition of leak scenarios normally included in a QRA.
A leak from the well system is defined as a leak where a hydrocarbon fluid is released through a
hole located in the well system (classified as either producing well, gas lift well or injection well in
PLOFAM). Leaks from the well system are divided into blowouts and well releases. These releases
are further divided into releases during drilling, well operations and releases during normal
operation. The following barriers define the process system and the well system in this context:
• Process system and producing well or Injection well:
o Production Wing Valve (PWV, see Figure 3.1)
• Process system and gas lift annulus:
o Different configurations are applied in industry (see for instance Ref. /2/), such as
annulus wing valve(AWV)/ESV towards topside and Annulus safety valve (ASV) /Annulus
safety check valve (ASCV) towards well

Technical note no: 107566/R1/TN4 Rev: Final Page 1

Date: 6 December 2018 ©Lloyd’s Register 2018
 AWV

Figure 2.1 - Well barriers schematic for a standard producing well (left) (taken from Ref. /3/
Figure 24), and a gas lift well (right) (taken from Ref. /2/ Figure 1). An item that is coloured red (e.g.
Hydraulic Master Valve (HMV)) indicate that the item is a secondary barrier element towards the
formation fluid, whilst a blue coloured item (e.g. Downhole Safety Valve (DHSV)) indicate that the
piece of equipment is a primary barrier element towards the formation fluid

Technical note no: 107566/R1/TN4 Rev: Final Page 2

Date: 6 December 2018 ©Lloyd’s Register 2018
2.1.1 Blowout
The definition of a blowout, which is in accordance with Ref. /4/, is as follows:
An incident where formations fluid flows out of the well or between formations layers after all
the predefined technical well barriers, or the activation of them, have failed.
Leaks that occur in relation to well intervention operations (e.g. wireline or coiled tubing) are
defined to be a blowout if the leak occurs at the reservoir side of the BOP, or if the BOP does not
close. Furthermore, leaks that occur during normal operation are defined to be a blowout if the
DHSV fails.
2.1.2 Well release
The definition of a well release, which is in accordance with Ref. /4/, is as follows:
An incident where hydrocarbons flow from the well, at some point where flow was not intended
and the flow was stopped by use of the barrier system that was available for the well at the time
of the incident.
Leaks that occur in relation to well intervention operations (e.g. wireline or coiled tubing) are
defined to be a well release if the leak occurs on the platform side of the wireline or coiled tubing
BOP, and the BOP is functioning as intended.
During normal production the following (topside) well releases can occur from the wellhead or
x-mas tree:
• Producing well/Injection well: Release of fluid from the inventory in the production/injection
line between the Downhole safety valve (DHSV, see Figure 1) and the PWV
• Gas lift well: Release of fluid from the annulus inventory between the Annulus Safety Valve
(ASV) and the barrier towards annulus topside (e.g. EV, AWV) (see Figure 2.1). In cases
where no ASV is present, the entire inventory in the gas lift annulus to the GLV may be
released (see Figure 2.1). Incidents causing a topside leak from the gas lift annulus where the
ASV and the ASCV between gas lift annulus and production string fail, are considered to be
a blowout, and therefore not considered as a gas lift well leak. Producing well/injection
well/gas lifted well: Release of hydrocarbon fluid from annuli that are not used for gas lift

2.2 Process leak

A process leak is defined as a scenario where fluid from a process system is unintentionally
released to the surroundings. The fuel gas system is regarded as part of the process system.
According to this definition, a leak point in a different system than the process system that is
being fed by fluid from the process system is a process leak. Examples of such incidents are leaks
in utility systems (drain systems, vent system and flare systems). However, if process fluid is
released through a hole located in the well system during normal production, the leak is defined
to be a well leak (producing well leak or gas lift well leak).
An unintentional release of fluid from a process system to flare tips and atmospheric vents is in
general not defined as a process leak except in cases where the release rate exceeds the design
specification and poses a fire and explosion hazard to equipment, structures or personnel.
The interface towards the well system is defined in Chapter 2.

Technical note no: 107566/R1/TN4 Rev: Final Page 3

Date: 6 December 2018 ©Lloyd’s Register 2018
2.3 Utility leak
A utility leak is defined as a scenario where fluid from a utility system is unintentionally released
to the surroundings. There is no communication with the main process system at any point in
time during the time span of the leak. Examples of utility system leaks are:
• Leak of hydraulic oil from a hydraulic system
• Leak of TEG from a TEG system
• Leak of diesel from fuel supply system to a power generation system
• Leak for produced water from a produced water system
Note that the list is not exhaustive.

2.4 Riser leak

A riser leak is a leak that is fed from the riser and/or pipeline system. The leak point is in the riser
itself or equipment (e.g. flange, valve) associated with the riser. The boundary between the riser
system and the process system is the topside riser ESD valve.
The boundary between the riser system and pipeline system is a subsea valve, the flange conne-
ction with the pipeline or a spool piece at the sea bed.

2.5 Pipeline leak

A pipeline leak is a leak that is fed from the pipeline, with or without contribution from riser
depending on subsea isolation valve or not is present and functioning. The leak point is in the
pipeline itself or equipment (e.g. flange, valve) associated with the pipeline.
The boundary between the riser system and pipeline system is a subsea valve, the flange
connection with the pipeline or a spool piece at the sea bed.
If there is no subsea isolation valve segregating the riser and the pipeline, the boundary between
the pipeline/riser system and the process system is the topside riser ESD valve.

2.6 Storage tank leak

A storage leak is defined as a scenario where fluid from the storage tank system is unintentionally
released to the surroundings.

3 Leak scenarios covered by the model

Chapter 2 defined leak scenarios normally considered in a QRA. Not all of these scenarios are
covered by the leak frequency model (PLOFAM). This chapter specifies the leak scenarios covered
by the model, which is used to select relevant incidents as basis for frequency estimation and
estimation of hole size distributions for the leak scenarios suggested used for modelling in QRAs,
given in Chapter 4.
The leak frequency model covers topside hydrocarbon process leaks at NCS. Hence, the leak
scenarios covered by the leak frequency model are in accordance with the definition of a process
leak as defined in Chapter 2.2. In addition topside leaks from the well system occurring during
normal production, as defined in Chapter 2.1.2, are covered by the model. Other leak scenarios,
such as leaks from utility systems fed from utility systems (for example diesel from diesel tanks
and MEG from MEG-system) are not included.
The leak scenarios covered by the model may have a leak point associated with well systems,
process systems or utility systems, and are described in Table 3.1. All leak scenarios normally
considered in a QRA (as defined in Chapter 2) and the scenarios covered by the model are
visualized in Figure 3.1.

Technical note no: 107566/R1/TN4 Rev: Final Page 4

Date: 6 December 2018 ©Lloyd’s Register 2018
 Incidents occurring during well interventions/operations, such as wire line and coiled tubing, are
defined as blowouts or well releases, and are covered by Ref. /4/ that is based on the SINTEF
Offshore Blowout Database. These incidents are not covered by the model.
The definition of well releases from producing well (with or without gas lift) and injection well
during normal production ensures that all recorded topside well releases occurring during normal
operation is included in risk assessments based on this model (PLOFAM). Review of recorded
leaks from wells during normal production in HCRD and in the SINTEF Offshore Blowout Data-
base has led to the conclusion that the frequency for such incidents given in Ref. /4/, which is
based on the SINTEF Offshore Blowout Database, is inaccurate. There are recorded leaks in HCRD
that is not found in the SINTEF Offshore Blowout Database. Hence, the frequency for well release
during normal production in Ref. /4/ should not be included in risk assessments based on
PLOFAM, as this is already included.
The design specification of a vent is exceeded when the released amount generate a fluid
concentration that is beyond the hazardous zone classification surrounding the vent. Such
incidents are covered by the model. See also Chapter 5.3 for considerations regarding safety
design of vents, and how risk associated with vent leaks should be managed.

Table 3.1 - Leak scenarios covered by the model. They occur in well system, process system or utility
system (process leaks fed through utility systems). Scenarios that are not listed in this table are not
covered by the model
Leak point in well system Leak point in process Leak point in utility system
system
1. Producing well/Injection 4. Leak point in pro- 5. Leak point in flare system (low
well: Topside well release cess system pressure or high pressure flare
where the inventory bet- between PWV and system)
ween DHSV and PWV is topside riser ESDV/- 6. Excessive releases through flare
released during normal storage ESDV. The tips and atmospheric vents that
production. fuel system is exceed the design specification
2. Gas lift well: Topside well regarded as part of and pose a fire and explosion
release where the inven- the process system. hazard to equipment, structures
tory between the ASV or personnel. Such leaks are de-
and the barrier towards noted vent leaks (see also
the process system is Chapter 5.3).
released. In cases where 7. Leak point in utility systems that
no ASV is present, the is fed by hydrocarbons stemm-
entire inventory in the gas ing from process system.
lift annulus to the ASCV Systems covered by the model
may be released. Assu- are:
ming that the check valve
a. Open drain system
ASCV is functioning,
otherwise there is no b. Closed drain system
barrier towards the reser- c. Chemical injection systems
voir. d. Produced water
3. Release of hydrocarbon
fluid from annuli that are
not used for gas lift

Technical note no: 107566/R1/TN4 Rev: Final Page 5

Date: 6 December 2018 ©Lloyd’s Register 2018
 Figure 3.1 - Illustration of leak scenarios normally considered in a QRA (Ref. Chapter 2). The figure shows which scenarios that are covered by the
model and which that are not

Technical note no: 107566/R1/TN4 Rev: Final Page 6

Date: 6 December 2018 ©Lloyd’s Register 2018
4 Leak scenarios modelled in QRAs
The description of leak scenarios covered by the model, described in Chapter 3, gives guidelines
for selection of relevant historical incidents in the data used as basis for estimation of leak fre-
quencies and hole size distributions for process leaks and well releases during normal operation.
In other words, historical incidents that fall within one of the leak scenarios given in Chapter 3,
form the basis for frequency estimation and estimation of hole size distributions for the leak
scenarios modelled in a QRA. The leak frequency model has to define leak scenarios relevant for
QRAs that captures the important risk contributing leak scenarios (given in Chapter 3), and where
leak frequencies can be estimated based on available data material. This chapter defines leak
scenarios suggested for leak modelling in QRA’s performed for oil and gas facilities at NCS. The
leak frequency model gives leak frequencies and hole size distributions for the leak scenarios
defined in this chapter (see TN-6), which covers the leak scenarios described in Chapter 3.
Three main leak scenarios for modelling in QRAs are defined for the leak frequency model. That
is Process leak, Producing well leak and Gas lift well leak. Further details and recommendations
with respect to modelling in QRAs are given for these scenarios in Chapter 4.1, 4.2 and 4.3,
respectively.
0.1 kg/s is recommended as leak rate threshold for estimation of leak duration (both in terms of
calculation of fluid dispersion and fire duration) in a QRA, for all leak scenarios in open areas and
3
leaks in enclosures having a net volume more than 1,000 m and with ventilation rate of 12 ach
or higher. This is explained in detail in Chapter 4.4.
Chapter 4.5 describes the rational for the lower boundary with regard to aggregated released
amount of hydrocarbons (10 kg). The model distinguishes on leak scenarios where the total
released amount of hydrocarbons is ≤10 kg, and >10 kg. These leaks are classified as Marginal
leaks and Significant leaks, respectively.
In total six leak scenarios for modelling in QRAs are defined, that are summarized in Table 4.1,
and Figure 4.1. The table also shows which leak scenarios in Table 3.1 that are put as basis for
estimation of leak frequencies and hole size distributions for the six defined leak scenarios for the
model. In a QRA the risk, in terms of fire- and explosion load exposure to vulnerable equipment
and structures such as safety systems, pressurized equipment, load carrying structures and main
safety functions, associated with Marginal leaks can be neglected. However, the risk to personnel
associated with Marginal leaks should not be neglected. This is further described in Chapter 4.5.
The model does not give separate leak frequencies for scenarios where the initial pressure is
different from the operational pressure. The initial pressure must be assessed as part of the QRA,
but normally the initial pressure is assumed equal to the operational pressure. This is further
discussed in Chapter 5.1. Furthermore the model does not give generic frequencies for limited
leaks (as defined in Ref. /8/), which is discussed in Chapter 5.2. Finally, even if recorded incidents
of releases through vents that represented a potential major accident hazard have been included
as part of the validation of the model to account for the underlying generic risk associated with
such events (see TN-3), this does not mean that the model accounts for the risk associated with
improper safety design or operation of such systems for a specific installation. This is further
explained in Chapter 5.3.
Release of hydrocarbon fluid from annuli that are not used for gas lift (Scenario 3 in Table 3.1), is
not suggested included as a separate scenario for QRAs. Instead these scenarios are included as
part of the frequency for producing well leaks and gas lift leaks.

Technical note no: 107566/R1/TN4 Rev: Final Page 7

Date: 6 December 2018 ©Lloyd’s Register 2018
 Table 4.1 - Defined leak scenarios for QRAs
Modelled leak scenario Leak scenarios included
Significant Scenario 4-7 in Table 3.1, released quantity >10 kg
Process leak
Marginal Scenario 4-7 in Table 3.1, released quantity ≤10 kg
1
Producing well leak Significant Scenario 1 and 3 in Table 3.1, released quantity >10 kg
Marginal Scenario 1 and 3 in Table 3.1, released quantity ≤10 kg
Gas lift well leak Significant Scenario 2 and 3 in Table 3.1, released quantity >10 kg
Marginal Scenario 2 and 3 in Table 3.1, released quantity ≤10 kg

Figure 4.1 - Illustration and summary of the leak scenarios to be modelled in a QRA

4.1 Process leaks

As defined in Table 4.1, Process leaks cover leak scenario 4-7 in Table 3.1. Note that the leak
frequency for process leaks estimated by the model does also account for leaks occurring in the
utility system, but being fed from the process system. This is done by including process leaks fed
through utility systems, but not equipment counts from utility systems as basis for the model
validation. This implies that utility equipment should not be counted as basis for estimation of
process leak frequencies. Furthermore the model does not give separate leak frequencies for
process releases through utility systems and through process system. This means that the QRA,
based on the frequency model, will not reflect the potential location of the leak sources, and that
the leak frequency contribution from utility systems will scale with the number of equipment
counts for process system.

1
The frequency for producing wells and injection wells are assumed to be identical. The leak scenario is
denoted producing well only

Technical note no: 107566/R1/TN4 Rev: Final Page 8

Date: 6 December 2018 ©Lloyd’s Register 2018
 Significant process leaks should be modelled as full pressure leaks, i.e. normal operational
conditions should be assumed. The released amount is restricted by the emergency shutdown
system (ESD system) and blow down system (BD system) if such systems are in place and
functioning as intended. The time to initiation of these systems are to be defined in the QRA, and
based on that the leak duration and released quantity should be estimated as part of the QRA.

4.2 Producing well leaks

As defined in Table 4.1, Producing well leaks cover leak scenario 1 and 3, in Table 3.1. A
significant producing well leak should be modelled as a full pressure topside well release of the
inventory between the DHSV and PWV at normal operational conditions. The released amount is
restricted and controlled by the DHSV towards the well (which is closed from the onset of the
leak). On the downstream side the segment will be controlled by the PWV. The time to closure of
the DHSV and PWV is to be defined in the QRA.
Producing well leaks and gas injection well leaks are modelled equally, and the leak frequencies
for these wells are judged to be identical.

4.3 Gas lift well leaks

As defined in Table 4.1, Gas lift well leaks cover leak scenario 2 and 3 in Table 3.1. A Significant
gas lift well leak should be modelled as a full pressure topside well release where the inventory
between the ASV and the barrier towards the process system is released. In cases where no ASV
is present, or the ASV is not functioning, the entire inventory in the gas lift annulus may be
released. Thus, the released amount is restricted and controlled by the ASV towards the well if
present/functioning. Otherwise the check valve ASCV is the only barrier towards the well, if
functioning. If the check valve is not functioning and the ASV is not present/functioning there are
no barriers towards the well. On the upstream side the segment may be controlled by the
Annulus Wing Valve (AWV), Annulus master valve or topside ESV. In addition, it could also be
controlled by the emergency shutdown system (ESD system) and blow down system (BD system)
if such systems are in place, they are functioning as intended, and are connected to the gas lift
system. The time to initiation of all these systems is to be defined in the QRA.

4.4 Initial leak rate boundary for leaks considered in a QRA

The lower initial leak rate boundary suggested for quantitative risk analysis that is used as basis
for the definition of Marginal leaks (see Chapter 4.5) is set to 0.1 kg/s for typical offshore process
modules. The initial leak rate is the leak rate at the onset of the leak (t = 0). This is in accordance
with industry practice in Norway (Ref. /1/). The threshold is in accordance with the threshold for
reporting of leaks to the Petroleum Safety Authority in Norway.
The associated limitation with regard to geometry is stated below, i.e. the validity of the term
“typical offshore process module”.
The threshold of 0.1 kg/s is based on the following:
• The generated volume of the flammable cloud from a stationary 0.1 kg/s leak is less than 1
3
m (calculated in Phast) except cases where the natural ventilation is poor and the module
3
volume is small. A flammable volume of 1 m implies an insignificant probability for delayed
ignition caused by exposure to objects intended for use in explosive atmospheres. The basic
3
ignition probability per m free flow volume is according to the MISOF ignition model
-6 3
(Ref. /5/ ) 8.0∙10 per m exposed to flammable gas for 5 minutes
•
3
The generated explosion loads in case of ignition of a flammable volume of 1 m is
considered negligible except in marginal enclosures (see below)

Technical note no: 107566/R1/TN4 Rev: Final Page 9

Date: 6 December 2018 ©Lloyd’s Register 2018
 • The flame length generated from a 0.1 kg/s leak is about 5 meter. The probability for ex-
posure to neighbouring equipment causing rupture of the exposed equipment is considered
to be significant, but small. 0.1 kg/s is defined as the lower cut off in Ref. /6/. The probability
for immediate fatal exposure to personnel is considered to be small for such fires
• The probability for immediate ignition of a 0.1 kg/s release is small. According to the MISOF
ignition model (Ref. /5/), the immediate ignition probability is 0.00015 for all types of
equipment types. For pumps, an additional ignition probability of 0.007 applies
Leaks less than 0.1 kg/s may in some cases constitute a significant risk, and should be considered
in such cases. An example of such a situation is enclosures, where leaks less than 0.1 kg/s is likely
to constitute a significant risk contribution (Ref. /7/). This applies in particular to explosions, but
also the consequences from fires may become severe in such cases, in particular with regard to
exposure to personnel as the entire enclosure may be exposed to intolerable fire loads (which will
depend on the available air for the combustion process). Explosions in such enclosures may give
fragments resulting from disintegration of the enclosure itself causing escalation and fatalities to
personnel in the vicinity of the enclosure. In addition, a hydrocarbon fluid concentration close to
the flammability range may be fatal due to asphyxiation. Such concentrations may arise quickly in
small enclosures. Lastly, the leak statistics shows that operational causes are dominant, which
means that in many cases personnel are present at the scene of the leak, for instance occurring
due to improper operation. The combined effect of personnel being present inside the enclosure
and the quickly arising accidental loads thus should be considered for incidents enclosures.
Based on the above discussion, the lower initial leak rate boundary for small enclosures should be
evaluated specifically in each case.
3
The 0.1 kg/s boundary applies for leaks in enclosures having a net volume more than 1,000 m
and with ventilation rate of 12 ach or higher. The volume in this context is the free flow volume
within the boundary of the area being studied (e.g. walls, ceiling and floor). For enclosure volu-
3
mes less than 1,000 m and/or smaller natural ventilation rates than 12 ach, initial leak rates less
than 0.1 kg/s may generate a significant flammable cloud. The housing around compressors for
noise protection is one example of a small enclosure that may have a net volume less than
3
1,000 m .
The relation between enclosure volumes, leak rate, forced ventilation rate and resulting average
steady-state gas concentration inside an enclosure is shown Figure 4.2. Figure 4.3 gives the
resulting total mas of gas in the enclosure. The calculation of the relations is based on the
following properties of the natural gas:
•
3
Density: 0.76 kg/m
•
3 3
Lower Flammability Limit: 4 vol% (= 0.03 kg fuel per m given a fuel density of 0.76 kg/m )
The leak frequency model can be used to estimate the frequency for leaks having an initial leak
rate less than 0.1 kg/s, but the results should be interpreted in light of the fact that model vali-
dation has been focusing on leaks having an initial leak rate greater than 0.1 kg/s. Special
considerations may therefore have to be performed in each case.
The maximum initial leak rate should be assessed based on the frequency of full rupture and
properties of the system being studied.

Technical note no: 107566/R1/TN4 Rev: Final Page 10

Date: 6 December 2018 ©Lloyd’s Register 2018
 Figure 4.2 - Average steady-state gas concentration in enclosure as a function of enclosure volume
for three different constant leak rates

Figure 4.3 - Mass gas in module at LFL at steady-state condition in enclosure as a function of enclo-
sure volume, given for three different leak rates. In addition the mass gas in enclosure if the gas
concentration= LFL, is given as a function of enclosure volume

Technical note no: 107566/R1/TN4 Rev: Final Page 11

Date: 6 December 2018 ©Lloyd’s Register 2018
4.5 Significant leaks vs. Marginal leaks
As described above, Marginal leaks are defined as leak scenarios where the total released amount
of hydrocarbons is ≤10 kg, while Significant leaks are defined as leak scenarios where the total
released amount of hydrocarbons is >10 kg. This is based on the lower boundary with regard to
aggregated released amount of hydrocarbons, which is set to 10 kg for typical offshore process
modules. The boundary applies with regard to calculation of risk in terms of exposure to
vulnerable equipment and structures such as safety systems, pressurized equipment, load carrying
structures and main safety functions. Marginal leaks will not impair these safety functions/objects,
and do only pose a risk to personnel.
The threshold of 10 kg follows from:
• The longest duration of a marginal leak down to the lower initial leak rate boundary
(0.1 kg/s, see Chapter 4.4) becomes 100 seconds (10 kg divided by 0.1 kg/s), which only will
in very unfavourable conditions have sufficient duration to cause rupture of pressurized
equipment and/or impair to safety critical equipment. Furthermore, the probability for
exposure to vulnerable equipment in such a scenario is considered remote
• The largest possible combustible cloud resulting from an instantaneous release of 10 kg will
generate marginal explosion loads. Assuming that 50 % of the amount (5 kg) is forming a
cloud having a homogenous concentration somewhat above than the lower flammability
3 3
limit (0.05 kg/m ) gives a gas cloud with a volume of 100 m (which is considered to be an
upper estimate). The resulting combustible fluid for such releases is expected to in the range
3 3
10 – 100 m . A cloud having a volume of 10-100 m will in typical offshore process modules
generate marginal explosion loads. However, for small enclosures this should be investigated
specifically according to below
•
3
A flammable volume of 100 m (or significantly less in most cases) having a short duration
implies an insignificant probability for ignition due to exposure to objects intended for use in
explosive atmospheres (that potentially possess a failure mode that cause ignition upon
3
exposure). The basic ignition probability per m free flow volume is according to the MISOF
-6
ignition model (Ref. /1/) 8.0∙10 given 300 seconds exposure time
• An instantaneous release of 10 kg may expose internal escape ways inside the area where
the leak occur and in some cases also external evacuation routes to the evacuation means.
The exposure time of intolerable fire loads would be very short, and will in practice have no
significance for the actual performance of the evacuation ways to mustering area/life boats
The threshold does not apply for exposure to personnel. The leak statistics shows that operational
causes are prominent. In some of these cases, personnel were present at the scene of the leak,
which should be reflected in the consequence model.
According to available leak statistics, the number of leaks where the released amount is less than
10 kg is significant. Examples of such scenarios are:
• A leak caused by erroneous opening of a valve that is closed immediately upon detection by
the operator of the valve (either at location or remotely by operator in control room)
• A leak point arising in an isolated segment of the process system (e.g. unintentional leak of
small amount of pressurized gas inside valve house when valve drain plug is opened in initial
stage of valve maintenance operation)
The causes for marginal leaks could be both technical and related to activity (e.g. maintenance),
but it is judged that activity is a dominant factor, and probably greater than for significant leaks.
Hence, it is reasonable to argue that the actual underlying frequency for marginal leaks will be
specific to platform specific organisational factors. The estimate for marginal leaks provided by
the model is generic and cannot be adjusted according to installation specific properties. This
means that the frequency for marginal leaks should not be broken down into sub categories of
incidents in terms of causes or successful vs. non-successful operator intervention. The estimate is
to be considered generic, and should only be combined with an analysis of the ignition control
barrier (i.e. to set the ignition probability) and the consequences to personnel.

Technical note no: 107566/R1/TN4 Rev: Final Page 12

Date: 6 December 2018 ©Lloyd’s Register 2018
 In order to estimate the fire frequency, it is recommended to use the stated probabilities for
immediate ignition in the MISOF ignition model (i.e. Pim and Pim,pump). This does not mean that the
analysis does not have to confirm that delayed ignition can be neglected.
As for the lower initial leak boundary, the boundary of 10 kg for marginal leaks does not apply
3
for enclosures having a net volume less than 1,000 m . Further description of the basis for this
limitation can be found in Chapter 4.4. Small enclosures are common at installations at NCS. Risk
3
related to explosions in such enclosures (i.e. < 1000 m ) should be carefully evaluated, as ignition
probability is high (Ref. /5/), and the required leak rate and/or total leaked mass to form an
ignitable cloud in small enclosures are small. Explosions in such enclosures may give fragments
causing escalations and fatalities to personnel in the vicinity.

5 Leak scenarios not covered by the model

Zero pressure leaks and limited leaks are leak scenarios that have been frequently used in the
industry, as process leaks were divided into Full pressure leaks, Limited leaks and Zero pressure
leaks in the previous model, Ref. /8/. This is illustrated in Figure 5.1. Significant process leaks as
defined in this model are modelled similar as Full pressure leaks in the previous model (see
Chapter 4.1). Limited leaks and zero pressure leaks are not included in PLOFAM. The reason is
explained in Chapter 5.1 and 5.2 below.
Considerations regarding safety design of vents and how risk associated with vent leaks should
be handled in a QRA are given in Chapter 5.3.

Figure 5.1 - Illustration and summary of the leak scenarios to be modelled in a QRA, together with
the leak scenarios Full pressure leaks, Limited leaks and Zero pressure leaks defined in the previous
model. Previous model refers to SHLFM Ref. /8/

Technical note no: 107566/R1/TN4 Rev: Final Page 13

Date: 6 December 2018 ©Lloyd’s Register 2018
5.1 Zero pressure leaks
Zero pressure leaks are in Ref. /8/ defined as scenarios where the overpressure is virtually zero
(0.01 barg or less). This may be because the equipment has a normal operating overpressure of
zero (e.g. open drains), or because the equipment has been depressurised for maintenance.
Figure 5.2 and Figure 5.3, gives the fraction and number of leaks that were classified as Limited
leaks, ESD isolated leaks, Late isolated leaks and Zero pressure leaks in Ref. /8/, that in PLOFAM is
classified as Marginal leaks (<10 kg) and Significant leaks (>10 kg). Only leaks that were included
both in Ref. /8/ and in this analysis are included. 4.4 % were classified as Zero pressure leaks,
where 2.6 % of these are in PLOFAM classified as Marginal leaks. Due to the small fraction of
Zero pressure leaks with a released quantity above 10 kg, and the small risk contribution from
zero pressure leaks, zero pressure leaks are in PLOFAM included as process leaks, i.e. handled as
process leaks with back pressure similar to the operating pressure. Hence the model does not
give separate leak frequencies and hole size distributions for zero pressure leaks, as defined in
Ref. /8/.

Figure 5.2 - Fraction of leaks that were classified as Limited leaks, ESD isolated leaks. Late isolated
leaks and Zero pressure leaks in Ref. /8/, that in PLOFAM is classified as Marginal leaks (<10 kg) and
Significant leaks (>10 kg)

Technical note no: 107566/R1/TN4 Rev: Final Page 14

Date: 6 December 2018 ©Lloyd’s Register 2018
 Figure 5.3 - The number of leaks that were classified as Limited leaks, ESD isolated leaks. Late
isolated leaks and Zero pressure leaks in Ref. /8/, that in PLOFAM is classified as Marginal leaks
(<10 kg) and Significant leaks (>10 kg)

5.2 Limited leaks

Limited leaks are in Ref. /8/ included to take into account scenarios that have a reduced released
quantity and/or a reduced duration (compared to process leaks as defined in Chapter 4.1) due to:
2. Restrictions in the flowline.
3. Operator intervention (valve closed by operator intervention)
4. The leak is at a favourable location in terms for pressure conditions. This is relevant for liquid
releases if, for instance, the leak point is above the lowest point in the segment, or the
amount of liquid is limited by high points in the segments
In addition it is reasonable to believe that many of the limited leaks have occurred in connection
with human operations. In these cases the released quantity may be significantly reduced (as
compared to a Process leak as defined in Chapter 4.1), as the volume and/or pressure is likely to
be less than at normal operation. In case of leaks caused by human operations, recorded inci-
dents have demonstrated that the leak is often terminated by the operator (for example if a valve
is opened erroneously, it can be closed by the operator within a short time). These leaks are likely
to be classified as marginal leaks using the suggested leak scenario definitions in this technical
note. Figure 5.4 gives the fraction of leaks that were classified as Limited leaks, ESD isolated
leaks, Late isolated leaks and Zero pressure leaks in Ref. /8/, that in PLOFAM is classified as
Marginal leaks (<10 kg) and Significant leaks (>10 kg). Figure 5.5 gives the fraction of leaks that
in PLOFAM is classified as Marginal leaks (<10 kg) and Significant leaks (>10 kg) that in Ref. /8/
were classified as Limited leaks, ESD isolated leaks, Late isolated leaks and Zero pressure leaks.
From Figure 5.4 it is seen that 62 % of the Limited leaks are in PLOFAM classified as Marginal
leaks. Thus the remaining 38 % that were classified as Limited leaks that are now modelled as
significant process leaks, were probably classified as limited leak due to one of the above reasons
(point 1-3 above). It is however not recommended to model limited leaks on a general basis in
QRAs based on this. Instead it is recommended that other physical restrictions in the process
system than the ESD and PSD valves, such as check valves, gravity (high leak points or high points
for oil leaks) and other flow restrictions should only be reflected if an explicit model of the system
is established. The properties of the restrictions including reliability, if relevant, must be described
as part of the analysis, and should also include human interventions.

Technical note no: 107566/R1/TN4 Rev: Final Page 15

Date: 6 December 2018 ©Lloyd’s Register 2018
 The duration of limited leaks follows from the developed specific model of the process system
accounting for the actual flow restrictions.

Figure 5.4 - Fraction of leaks that were classified as Limited leaks, ESD isolated leaks, Late isolated
leaks and Zero pressure leaks in Ref. /8/, that in PLOFAM is classified as Marginal leaks (<10 kg) and
Significant leaks (>10 kg)

Figure 5.5 - Fraction of leaks that in PLOFAM is classified as Marginal leaks (<10 kg) and Significant
leaks (>10 kg) that in Ref. /8/ were classified as Limited leaks, ESD isolated leaks, Late isolated leaks
and Zero pressure leaks

Technical note no: 107566/R1/TN4 Rev: Final Page 16

Date: 6 December 2018 ©Lloyd’s Register 2018
5.3 Vent leaks within design specification
Excessive releases through flare tips and atmospheric vents that exceed the design specification
and pose a fire and explosion hazard to equipment, structures or personnel are included in the
model. However, vent leaks where the release is within the design specification are not included.
In general, the safety design of vents is to be verified through other safety studies than the QRA.
Such studies include Hazard Operability Studies and specific assessments of the dispersion of the
fluid being released.
The safety design of the vents should be raised in the hazard identification process in a QRA
where the leak frequency model is applied. If there are known design issues with vent systems,
specific assessments should be performed (for example reliability of systems preventing overfilling
diesel tanks). The result should be considered included in the QRA if no technical solution that
rectifies the issue is found and the risk is judged to be significant. A generic frequency for vent
leaks that represent a significant risk is however not meaningful in the context of a QRA, i.e. pro-
viding additional information on how to control the risk associated with such systems.
Recorded incidents of releases through vents that represented a potential major accident hazard
have been evaluated as part of the project (see TN-3). Such known incidents have been included
as part of the validation of the model to account for the underlying generic risk associated with
such events. However, this does not mean that the model accounts for the risk associated with
improper safety design or operation of such systems for a specific installation. It must be noted
that the uncertainty associated with logging of vent releases is judged to be prominent as it is
expected that such leaks tend to only be reported if they are detected automatically by exposure
to detectors. Furthermore, it may be difficult to filter out such events in the data basis. As opera-
tional failures tend to be a dominate cause for vent leak scenarios it is difficult to establish a vent
release frequency even if the number of releases should be known due to lack of reliable
exposure data, i.e. number of vents and tank operations.

Technical note no: 107566/R1/TN4 Rev: Final Page 17

Date: 6 December 2018 ©Lloyd’s Register 2018
6 References

/1/ Standard Norge (2010). Risk and emergency preparedness assessment. Edition 3,
October 2010. NORSOK standard Z-013. Standards Norway (www.standard.no).

/2/ ESRA seminar, September 3, 2014, Stavanger, Per Holand, ExproSoft, “Introduksjon til
gassløftbrønner for risikoanalytikere” (see http://esra.no/wp-content/uploads/2015/04/2-
Holand-Intro.-til-gassløftbrønner.pdf)

/3/ Norwegian oil and gas association: An introduction to well integrity, Rev. 0, Date: 4
December 2012 (see https://www.norskoljeoggass.no)

/4/ Lloyd’s Register Consulting, “Blowout and well release frequencies based on SINTEF
offshore blowout database 2014”, 17 March 2015, Report No: 19101001-8/2015/R3
Rev: Final

/5/ Lloyds Register Consulting Norway. “Modelling of ignition sources on offshore oil and
gas Facilities - MISOF”, Report no: 102657/R1, Date: 18. September 2014.

/6/ Scandpower Risk Management AS" Guidelines for the Protection of Pressurized Systems
exposed to Fire", Report No. 19101002/R1, Version 2. Date:1 January 2011

/7/ Stian Høiseth, Statoil Hydro ASA, Ingar Fossan, Scandpower AS, Øyvind Kaasa, Statoil
Hydro ASA; “Managing Explosion Risk in Arctic Areas”, SPE 111583, 2008 SPE Interna-
tional Conference on Health, Safety and Environment in Oil and Gas Exploration and
Production held in Nice, France, 15-17 April 2008.

/8/ DNV, Offshore QRA – Standardised Hydrocarbon Leak Frequencies, report number 2009-
1768, rev. 1, Date. 16.01.2009.

Technical note no: 107566/R1/TN4 Rev: Final Page 18

Date: 6 December 2018 ©Lloyd’s Register 2018