Quantitative risk assessment, tolerability and ALARP

Quantitative risk assessment (QRA), also called quantitative risk analysis or, in some industries, probabilistic risk assessment, puts numbers on both sides of risk: how often harmful outcomes are expected and how severe they would be, usually expressed as the risk of death to individuals and to groups of people. It is the most demanding method in this course, used mainly for major hazard facilities such as refineries, chemical plants, LNG terminals, pipelines and explosives sites, for land use planning around them, and for decisions about expensive safety investments. Lesson 1 introduced risk criteria and ALARP. This lesson shows how a QRA is built, how its results are presented and judged against criteria, and how cost-benefit analysis supports ALARP decisions.

Most safety professionals will never run a QRA themselves; it requires consequence modeling software, failure data and specialist expertise. But many will commission one, review one, or have to explain its results to managers, regulators or the public. The aim here is to understand the logic and the outputs well enough to ask the right questions.

The steps of a QRA

A QRA follows a standard sequence, described in the CCPS Guidelines for Chemical Process Quantitative Risk Analysis and in the Dutch Purple Book. First, identify hazards and select representative release scenarios, such as small, medium and large leaks and full rupture for each major item. Second, estimate the frequency of each release using failure data, fault trees and event trees. Third, model the consequences: discharge rate, dispersion of toxic or flammable clouds, fire and explosion effects, and their effects on people using probit or threshold models. Fourth, combine frequencies and consequences across all scenarios, weather conditions and wind directions. Fifth, present the results as individual and societal risk and compare them with criteria. Finally, identify the main contributors and test risk reduction options.

Individual risk

Individual risk is the frequency at which a person at a given location would be expected to be killed, usually per year. Location-specific individual risk (LSIR) assumes a person is present outdoors at that point all the time, so it is a property of the place and is used for land use planning. Individual risk per annum (IRPA) for a worker takes account of the time actually spent in each area, so it is a property of a person or job and is used to judge worker risk. Results are often drawn as risk contours on a site map, joining points of equal individual risk, such as \( 10^{-4} \), \( 10^{-5} \) and \( 10^{-6} \) per year.

Societal risk and F-N curves

Individual risk does not show how many people could be harmed at once. A facility next to a stadium may have the same individual risk contours as one next to a field, but a single accident could kill hundreds. Societal risk captures this. It is usually shown as an F-N curve: a graph with the number of fatalities N on the horizontal axis and the cumulative frequency F of accidents causing N or more fatalities on the vertical axis, both on logarithmic scales. Criterion lines on the graph define intolerable, ALARP and broadly acceptable regions.

Criterion lines usually have a slope of minus one or steeper. A slope of minus one means an accident killing 10 people is tolerable at one tenth the frequency of one killing a single person, so the expected number of deaths per year is the same. A slope of minus two, as in the Dutch criterion of \( 10^{-3}/N^2 \) per year for new establishments, builds in aversion to large accidents: 10 deaths must be 100 times less frequent than one. Whether such aversion is justified is debated, but it reflects public and political reaction to disasters.

Land use planning criteria

In the US, there is no federal risk-based land use criterion. EPA RMP requires facilities to model worst-case and alternative release scenarios and report the distance to toxic or flammable endpoints, which local emergency planners use, and some states and municipalities set their own siting rules. Many companies and consultants use international criteria, such as the UK HSE's or the Canadian MIACC guidelines, for example individual risk of \( 10^{-6} \) per year for residential areas, when advising on siting. API RP 752 and 753 address the siting of occupied buildings within facilities.

ALARP and cost-benefit analysis

Between the intolerable and broadly acceptable regions, risk must be reduced as low as reasonably practicable. In practice, this means a measure must be implemented unless its cost is grossly disproportionate to the risk reduction it achieves. Cost-benefit analysis gives a structured way to judge this. The benefit of a measure is the reduction in expected fatalities per year, multiplied by the value of a statistical life (VSL) and by the remaining life of the facility, often with discounting. The cost includes capital, operating and maintenance costs over the same period. If the cost is less than the benefit multiplied by a disproportion factor, the measure is reasonably practicable and should be done.

The value of a statistical life is not the value of any person's life. It is the amount society is willing to pay to reduce risk so that, on average, one fewer death is expected. It is derived from studies of how much people accept in wages for riskier jobs or pay for safety features, and it is used so that safety spending is consistent across decisions.

In the US, the Department of Transportation's guidance set the VSL at $14.2 million for the 2025 base year, and other federal agencies use similar values. The disproportion factor (DF) is not set by US law; companies often borrow the UK practice of factors from about 2 for low risks to 10 or more for risks near the intolerable limit, and OSHA's feasibility test under the General Duty Clause is a related but separate idea.

Cost-benefit analysis supports judgment; it does not replace it. It cannot justify keeping a risk in the intolerable region, it should not be used to remove existing controls that are good practice, and the numbers are uncertain. Regulators such as the UK HSE warn against using it to argue away recognized good practice. It is most useful for choosing among options and for documenting why a measure was or was not adopted.

Uncertainty and limitations

QRA results are uncertain, often by an order of magnitude or more. Different consultants analyzing the same facility have produced results differing by factors of 10 to 100, as shown in the European ASSURANCE benchmark study in the early 2000s. Sources include failure data, release scenario choice, dispersion models, ignition probabilities and assumptions about people's presence and escape. A QRA should state its assumptions, show which scenarios dominate, and include sensitivity analysis. Results near a criterion line should be treated with caution in both directions: a result just below a line is not proof of safety, and one just above is a signal to look closely, not automatic proof of danger.

Commissioning a QRA well matters as much as reading one. The terms of reference should state the purpose, such as land use advice or comparing design options, the criteria to be used, the scenarios and populations to include, and the level of detail. The client should ask for the input data and assumptions to be listed, for the dominant contributors to be identified and for sensitivity cases on the most uncertain inputs.