2017 Failure-Rates PDF

Failure Rate and Event Data for use within
Risk Assessments (06/11/17)

Introduction
1. The Chemicals, Explosives and Microbiological Hazardous Division 5, CEMHD5, has an
established set of failure rates that have been in use for several years. This document details
those items and their failure rates. For items not within this set, or for which no values are
currently available the inspector carrying out the assessment should estimate failure rates after
discussions with Topic Specialists. The failure rates quoted within this document were derived
and are intended for use on Land Use Planning cases. They were NOT originally intended for
use in COMAH Safety Report Assessment because they do not necessarily take account of all
factors that could be relevant and significant at particular installations. However, in the absence
of site specific data, the values given here may serve as a starting point for safety reports.
2. Figure 1 shows the different types of information that are available in this document. For the full
structure, see Figure 2. This introductory section also outlines a framework used in CEMHD5 to
keep references pertaining to failure rates and a system for recording the use of non-generic
failure rates used in particular cases.
Failure rate and event data
Failure rate Event data Human factors

FR ED HF
Figure 1 Information covered in Chapter 6K
3. The first section covers failure rates. CEMHD5 currently has established failure rates or has
some information for most of the items. The items on the diagram in Figure 2 contain a failure
rate value(s) and a brief derivation. For rates that have ranges the derivation also contains a
brief guide on what factors may affect the value.
4. The second section (see page 87) contains information on event data. The derivation of the
rates to be used and how to use them are described.
5. The third section (see page 98) covers human factors. This aim of this section is to help non-
human factors specialists determine whether the use of human reliability analysis, and
associated values, is adequate or not.
Failure rate and event data
Event data Human factors

ED HF
Aircraft strike rates Flooding Lightning

ED1 ED2 ED3
Failure rate
FR
Mechanical Electrical Bulk Transport Moveable storage

FR1 FR2 FR3 FR4
Containers
Vessels Components Pipework Pipelines Tankers Ship Freight FR4.1
FR1.1 FR1.2 FR1.3 FR3.1 FR3.2 FR3.3
Ambient temperature Ship hardarms Drums 1 te

Valves Buried ISO tankers FR4.1.1
and pressure vessels FR3.3.1
FR1.2.1 FR3.1.1 FR3.2.1
FR1.1.1
Above ground in a gas Drums 210l

Pumps Road Tankers FR4.1.2
Large vessels SMATS Non metallic installation
FR1.2.2 FR3.2.2
FR1.1.1.1 FR1.1.1.2 FR1.1.1.3 FR3.1.2
LPG Road Tanker Incompatible Cylinders

Hoses and couplings Above ground outside FR4.1.3
Refrigerated vessels BLEVE Deliveries
FR1.2.3 a gas installation
FR1.1.2 FR3.2.2.1 FR3.2.2.2
FR3.1.3
IBCs
Hard Arms Rail tankers FR4.1.4
FR1.2.4 Compressors FR3.2.3
LNG LOX
FR1.1.2.1 FR1.1.2.2 FR3.1.4
Portable containers
FR4.1.5
Flanges and gaskets
FR1.2.5
Pressure vessels
FR1.1.3
Small containers
FR4.1.6
Chlorine pressure
LPG pressure vessels Spherical vessels
vessels
FR1.1.3.2 FR1.1.3.3
FR1.1.3.1
Chemical reactors
FR1.1.4
Figure 2 Overview of PCAG 6K structure
Page 2 of 102
PCAG chp_6K Version 14 – 06/11/17
Failure Rates
Generic Failure Rates

6. Many of the failure rates used in risk assessments within CEMHD5 are based on values derived
for RISKAT (RISK Assessment Tool) as detailed in the various parts of the Major Hazards
Assessment Unit (MHAU) Handbook (now archived). These generic rates were derived in the
early 1980’s when MHAU was first formed and have an established pedigree. They were
originally derived in the context of assessing risks from chlorine plants. They have been added
to and amended as needed in order to assess different types of plant and operations and Figure
2 has been extended accordingly. The value, type of release and derivation can be found in this
document for items shown in Figure 2. The assessor needs to decide whether or not the generic
failure rates are appropriate for their assessment; if the generic failure rate is inappropriate then
further work is required to derive a suitable specific failure rate.
Non Generic Failure Rates

7. The application of these generic failure rates to items being used for substances, processes and
plant designs that might induce particularly arduous operating conditions or, alternatively,
provide for increased reliability is a matter of judgement by the assessor. The greatest difficulty
in assigning failure rates is the lack of appropriate industry failure rate data but, in the absence
of failure rate data specific to particular plant, processes and substances, the generic values
given in this section should be used as a starting point. These generic values can be modified to
take account of site-specific factors. The specific failure rates are determined by expert
judgement by the Topic Specialist, taking account of significant factors along with any specific
data available. In this case, the Topic Specialist will record the recommended rates in a Failure
Rate Advice (FR) note.
8. When non-generic values are used in CEMHD5 assessments they should be justified and the
reasoning behind their derivation recorded within an FR note. If the assessment case is
panelled for peer review the relevant FR note should be presented with the case so that
CEMHD5 inspectors can endorse the value(s) used. The Topic Specialist will place completed
FR notes on TRIM and a note made alongside the appropriate generic failure rate.
Description of the Information Required

FAILURE RATE ADVICE
Requested By: Request No:
Date:
Request:
Advice:
Basis of Advice:
Associated Documents:
Signed: Date:
Page 3 of 102
Item FR 1 Mechanical
9. Failure rates for equipment classified as mechanical are categorised as follows:
Item FR 1.1 Vessels Page 5

Item FR 1.2 Components Page 31
Item FR 1.3 Pipework Page 48
Page 4 of 102
Item FR 1.1 Vessels
10. Failure rates for vessels are split into four categories that are further subdivided as shown in
Figure 3 below. These vessels refer to fixed storage. Moveable storage (e.g. drums) are
considered under Item FR 4.
Vessels
FR1.1
Ambient temperature
and pressure vessels
FR1.1.1
Large vessels SMATS Non metallic

FR1.1.1.1 FR1.1.1.2 FR1.1.1.3
Refrigerated vessels
FR1.1.2
LNG LOX
FR1.1.2.1 FR1.1.2.2
Chemical
Pressure reactors
vessels
FR1.1.4
FR1.1.3
Chlorine pressure LPG pressure

Spherical vessels
vessels vessels
FR1.1.3.3
FR1.1.3.1 FR1.1.3.2
Chemical reactors
FR1.1.4
Figure 3 Hierarchical Diagram for Vessels
Page 5 of 102
Item FR 1.1.1 Ambient Temperature and Pressure Vessels
11. Ambient temperature and pressure vessels are divided as follows. Ambient pressure may be
extended to cover vessels at slightly elevated pressure.
Item FR 1.1.1.1 Large Vessels Page 7

Item FR 1.1.1.2 Small and Medium Atmospheric Tanks Page 9
Item FR 1.1.1.3 Non Metallic/Plastic Page 11
Page 6 of 102
Item FR 1.1.1.1 Large Vessels
ITEM FAILURE RATES

Type of Release Failure Rate (per vessel yr) Notes
-6
Catastrophic 5 x 10
-4
Major 1 x 10
-3
Minor 2.5 x 10
-3
Roof 2 x 10
RELEASE SIZES
3
Hole diameters for Tank volumes (m )
Category >12000 12000 – 4000 4000 - 450
Major 1000 mm 750 mm 500 mm
Minor 300 mm 225 mm 150 mm
Derivation
12. The failure rates apply to fixed position, single walled vessels with a capacity greater than
450m3, which operate at ambient temperature and pressure.
13. Roof failures includes all failures of the roof and does not include liquid pooling on the ground.
For vessels that are storing flammable liquids, this could lead to a flammable atmosphere being
formed and possible ignition and escalation. For tanks that store toxic chemicals a toxic cloud
could be formed. Most atmospheric storage tanks are specifically designed so that the roof wall
seam will preferentially fail hopefully mitigating the effects of an incident.
14. The above rates are derived from historical data in work carried out by Glossop (RAS/01/06).
They are applicable to large flat-bottomed metal storage vessels where flammable liquids are
stored at atmospheric temperature and pressure. These values are not directly applicable to
vessels storing non-flammable liquids because a different set of failure modes is relevant.
However, they may be used as a basis for such vessels – seek advice from the Topic Specialist.
References
Title Author Date Comments
Failure Rates for Atmospheric Storage Tanks M Glossop 2001
for Land Use Planning. HSL internal report
RAS/01/06.
Failure Rate Advice (Confidential, not in the public domain)

15. See individual advice notes for specific details.
Page 7 of 102
FR No Application Comments
FR128 Large mounded kerosene tanks shrouded in concrete Rates are provided that give
credit for the concrete shroud
Page 8 of 102
Item FR 1.1.1.2 Small and Medium Atmospheric Tanks
16. Small and Medium Atmospheric Tanks (SMATs) have a capacity of less than 450m 3, and can
be made of steel or plastic.
ITEM FAILURE RATES

Type of Release Non Flammable Contents (per Flammable Contents (per vessel
vessel year) year)
-6 -5
Catastrophic 8 x 10 1.6 x 10
-5 -4
Large 5 x 10 1 x 10
-4 -3
Small 5 x 10 1 x 10
17. Large releases are defined as a rapid loss of most or all contents e.g. large hole in a vessel
leaking over several minutes.
18. Small releases are defined as smaller or much slower loss of contents e.g. through a small leak
over 30 minutes.
19. FR117_2 defines hole sizes for tanks of unknown size (large holes are defined as 250 mm
diameter and small holes as 75 mm diameter).
20. To calculate the hole sizes when the size of the tank is known, assume that a large hole would
empty the tank in 5 minutes and a small hole would empty the tank in 30 minutes. What this
equates to in terms of volumetric flow per second (tank volume/ time in seconds) can then be
calculated and, from this, using the substance density, the mass flow in kg/s can be obtained.
Using STREAM, it is then possible to determine what hole sizes would result in the calculated
mass flow rates for small and large holes. The calculated hole sizes should be used unless they
are larger than those specified in paragraph 19 (250/75mm), in which case the default 250mm
and 75mm holes should be chosen.
Derivation
21. Failure rates are taken from RSU/08/14 by Brownless and Keeley. The rates were derived by
fault tree analysis. The analysis suggested that the failure rates are sensitive to whether the
substance stored is flammable or explosive and if so, whether the vessel has a weak roof seam
(giving a preferential failure mode under pressure build up). The results also suggested that for
catastrophic failures and large releases, corrosion is an important cause of failure, with spills
(e.g. due to pipe or valve failure) and overpressure being important for smaller releases. Given
the dominance of corrosion as a causal factor for catastrophic and large releases, consideration
should be given to the applicability of the derived failure rates when considering vessels of
plastic construction.
References
Review of Failure Rates for Small G Brownless and D 2008
Atmospheric Pressure Storage Tanks. HSL Keeley
internal report RSU/08/14.
Page 9 of 102

3
117_2 SMATs, fixed tank up to 400-450m , plastic or metal and range of Revision to FR117. Provides
designs. generic hole sizes for tanks of
unknown capacity.
Page 10 of 102
Item FR 1.1.1.3 Non Metallic/Plastic
23. Currently there are no agreed HSE failure rates for this item. For small tanks, refer to Item FR
1.1.1.2 which also covers plastic tanks. Otherwise, see failure rate advice notes for specific
failure rates, or refer to the Topic Specialist.

101 HDPE spiral wound vertical atmospheric tank for HF acid. Catastrophic, 50 mm and 13
mm diameter hole failure rates
provided.
79 25te plastic wound, double skin vessels and half height containment. Catastrophic, 50 mm, 25 mm,
13 mm and 6 mm diameter hole
failure rates provided.
32 Allibert 5000 (PE) bunded polyethylene tank for HF acid. Failure rates are provided for
the catastrophic failure of the
inner tank, and also for the
inner tank and bund tank
combined.
Page 11 of 102
Item FR 1.1.2 Refrigerated Ambient Pressure Vessels
ITEM FAILURE RATES

Type of release Failure rate (per vessel year)
Single walled vessels
-5
Catastrophic failure 4 x 10
-4
Major failure 1 x 10
-5
Minor failure 8 x 10
-4
Failure with a release of vapour only 2 x 10
Double walled vessels
-7
-5
-5
-4
Failure with a release of vapour only 4 x 10
RELEASE SIZES
3
Category >12000 12000 – 4000 4000 - 450
Derivation
25. All rates are based on the report by J.Gould, RAS/00/10. For the purposes of applying generic
failure rates the various vessel designs have been placed into three categories:
1 Single wall tanks, where there is no outer containment designed to hold the
cryogenic liquid or vapour.
2 Double walled tanks, where on failure of the inner wall the outer wall is
designed to retain the liquid but not the vapour.
3 Full containment tanks, where the outer wall is designed to retain the liquid and
the vapour.
26. A review of literature was performed to identify the failure rates for single walled vessels. The
failure rates derived are based largely on experience from ammonia, LPG and LNG vessels of
around 15000m3. Event trees were produced using expert judgement to take into account the
benefit of double walled tanks in containing releases from the inner tank. No credit should be
given if the outer wall has not been designed to withstand the very low temperatures of the
refrigerated contents.
27. The failure rates of the inner tank were not reduced to take account of any protection the outer
wall and roof might provide, which could be significant for reinforced concrete outer
containment. The review found no record of failures of LNG vessels so it is arguable that the
generic figures should be reduced when applied to LNG facilities. Specific failure rates for
double walled LNG tanks are derived in Item FR 1.1.2.1. The failure rates for double walled
Page 12 of 102
tanks should be used for full containment tanks, although the failure rate for the release of
vapour only should be set to zero.
28. The rates quoted do not include failures due to overpressure as a result of the addition of a
lower boiling point material to one stored at a higher temperature (e.g. the addition of propane
to a butane storage tank). If this is considered a credible scenario the advice of the Topic
Specialist should be sought. Failure rates for semi-refrigerated vessels will be based on those
for pressure vessels and the advice of the Topic Specialist should be sought.
29. BS 7777 states that refrigerated storage vessels built up to the 1970’s were predominantly
single containment tanks. It is also still the practice that liquid oxygen, liquid nitrogen, and liquid
argon are stored in single containment tanks. If a double wall is mentioned in regard to these
vessels its function is generally to support the insulation and the roof, and not to contain the
refrigerated liquid. Also, where other materials are stored refer to the Topic Specialist for advice
on the applicability of these rates.
References
New failure rates for land use planning QRA. J Gould May
HSL internal report RAS/00/10. 2000
BS 7777: Flat-bottomed, vertical, cylindrical British Standards 1993
storage tanks for low temperature service. Institute

105 Cryogenic ethylene (pressurised, semi-refrigerated), 20 te, temperature - Refrigerated pressure vessel.
53°C, pressure 12 barg. BLEVE frequency given.
89 Liquefied HCl. Refrigerated pressure vessel.
Catastrophic failure rate given.
84 Single skinned LPG tanks. Catastrophic failure rate, 2000
mm, 1000 mm and 300 mm
diameter holes and vapour
release failure rates are
provided.
19 Double skinned 66000 l liquid hydrogen vessels. Working pressure of Catastrophic, 50 mm, 25 mm,
inner tank is 12 barg although normal storage pressure is 4-5 barg. 13 mm and 6 mm diameter hole
failure rates are provided.
Bibliography
31. These references represent other sources of information on the subject.

-5
Loss prevention in the process industries. F P Lees 1980 1 x 10 failures/year, catastrophic
failure based on Canvey data. Page
Page 13 of 102

1018.
-3 -7
Bund overtopping – The consequences A Wilkinson Oct 91 8.8 x 10 to 1 x 10 per tank per
following catastrophic failure of large volume year, catastrophic failures of
liquid storage vessels. refrigerated and general purpose
liquid vessels.
-5
Gas terminal study. SRD review of Cremer P L Holden Sep 81 Significant liquid release: 5.8 x 10
and Warner failure rates. Confidential, not in per vessel yr
the public domain.
Benchmark exercise on major hazard S Contini (editor) 1992 Significant vapour release:
analysis, vol. 2, part 1. -4
5.8 x 10 per vessel yr
Survey of catastrophic failure statistics for BOC 1989 Several values are quoted from the
cryogenic storage tanks. Confidential, not in literature; the suggested value is
the public domain. -6
5 x 10 per vessel yr for
catastrophic failure.
-5
A method for estimating the off-site risk from BCGA/HSE/SRD Not A value of 10 per vessel yr is
bulk storage of liquid oxygen (LOX). Working group known quoted for LOX vessels, which are
Confidential, not in the public domain. designed, constructed and
maintained to high standards.
An estimate of operating experience over the J N Edmonson and 1984 Catastrophic tank failure rate:
period 1954-1984 with low pressure, flat P D Michell (AEA -4
5 x 10 per vessel yr.
bottomed, metal tanks storing refrigerated and Technology)
‘Significant’ release frequency:
cryogenic liquids and the associated historical -5
incidence frequencies. Confidential, not in the 5.8 x 10 per vessel yr.
public domain.
An approach to hazard analysis of LNG spills. D H Napier and D 1986 Catastrophic failure of inner tank
R Roopchand leading to outer roof collapse:
-6
0.8 – 2 x 10 per yr.
Partial fracture of outer roof due to
-5
overpressurisation: 2 x 10 per yr.
Catastrophic rupture of primary and
-9
secondary containment: 1 x 10 per
yr.
Serious leak from inner tank:
-5
2 x 10 per yr,
Development of an improved LNG plant D W Johnson & J R 1981 Gives failure rates for major failures
failure rate database. Welker (for gas leaks) for a cryogenic
-6
storage vessel as 1.1 x 10 per hr
-6
For minor failures < 1.4 x 10 per hr
Page 14 of 102
Item FR 1.1.2.1 LNG Refrigerated Vessels
ITEM FAILURE RATES

Type of Release Double wall (per vessel year)
-8
Catastrophic 5 x 10
-6
-6
-5
Vapour release 4 x 10
RELEASE SIZES
3
Category >12000 12000 – 4000 4000 - 450
Derivation
32. The failure rates above are taken from RAS/06/05 by Keeley.
33. RAS/06/05 reviews the basis for refrigerated vessel failure rates in general and considers their
applicability to LNG storage. The report recommends that the double wall vessel failure rates for
LNG tanks should be reduced from the generic values in Item FR 1.1.2.
34. The failure rates for single walled LNG tanks are unchanged and the generic values in Item FR
1.1.2 should be used. The failure rates for double walled tanks should be used for full
containment tanks, although the failure rate for the release of vapour only should be set to zero.
35. Where single walled LNG tanks have reinforced concrete high collared bunds they may be
regarded as equivalent to double walled vessels and the double wall failure rates shown above
may be used in assessments.
References
Review of LNG storage tank failure rates. HSL D Keeley 2006
internal report RAS/06/05. Confidential, not in
the public domain.

FR126 Failure rates for LNG tanks with reinforced concrete high collar bunds Considered to be equivalent to
double wall tanks
Page 15 of 102
Item FR 1.1.2.2 Liquid Oxygen (LOX) Refrigerated Vessels
ITEM FAILURE RATES

Type of release Failure rate (per vessel year)
Single walled vessels
-5
Catastrophic failure 2.2 x 10
-4
-5
Cluster tanks
-6
Simultaneous catastrophic failure of all tanks in 1 x 10
cluster
-6
Catastrophic failure of single tank in cluster 1 x 10 x number of LOX tanks
in cluster
-5
-5
RELEASE SIZES
3
Hole diameters for tank volumes (m )
Category 4000 – 2000 200 – <2000
Major 400 mm 250 mm
Minor 120 mm 75 mm
Air separation units

Scenario Failure rate (per vessel year)
-5
37. Catastrophic failure is modelled as the instantaneous loss of vessel contents forming a
vaporising pool.
38. A typical cluster tank usually consists of 5 or 7 smaller pressure vessels located inside a
common large skin, which is used to contain the insulation material. The outer vessel is not
designed to contain the vapour or liquid in the event of vessel failure.
Derivation
39. The partitioning between major and minor releases follows that for refrigerated ambient
pressure vessels (Item FR 1.1.2). Scaling is applied to the tank size ranges used for refrigerated
ambient pressure vessels to obtain the hole sizes and tank size ranges shown above. The
values for single walled vessels for major and minor failures for refrigerated ambient pressure
vessels are then used.
40. The cluster tank failure rates, excluding minor failures, are taken from FR 9.
41. The major failure rate for cluster tanks were obtained by summing the failure rates for the larger
two hole sizes (50 mm and 25 mm) for pressure vessels (Item FR 1.1.3). Similarly, the minor
Page 16 of 102
failure rate for cluster tanks was calculated from the summation of the failure rates for the two
smaller hole sizes (13 mm and 6 mm) from pressure vessels (Item FR 1.1.3).
References
Revised LOX risk assessment methodology – G Tickle, AEA 14/01/03 Quotes the rates adopted by panel
HSE Panel Paper. Confidential, not in the Technology on 17 July 2001, which includes the
public domain. single walled catastrophic failure
rate.
LOX methodology modifications to address G Tickle, AEA 22/03/04 This introduces the release sizes,
th
comments from 19 January 2004 MSDU Technology modifies the cluster tank minor
Panel meeting – HSE Panel Paper. failure rate and details its
Confidential, not in the public domain. calculation along with that of major
failures in cluster tanks. Major and
minor failures for single walled
vessels are also discussed.

42. See individual advice notes for specific applications and reasoning.
55 Pressure vessels for LOX storage, 35te, operating pressure Catastrophic, 50 mm and 25
17 bar. Vertical bullets with liquid off-take feeding an air mm diameter hole failure rates
warmed vaporiser delivering oxygen gas under pressure of provided.
around 10 bar.
53 66te LOX vacuum insulated tanks. Uses FR19 which derived
catastrophic failure rates and
rates for holes of size 50 mm,
25 mm, 13 mm and 6 mm.
9 LOX cluster tanks and internal explosions. LOX cluster tanks and internal
explosions. Catastrophic and
major failure rates are derived.
Page 17 of 102
Item FR 1.1.3 Pressure Vessels
43. Failure rates for pressure vessels are further subdivided into those for chlorine vessels, Item FR
1.1.3.1, LPG vessels, Item FR 1.1.3.2, and spherical vessels, Item FR 1.1.3.3. For general
pressure vessels the rates below, which are based on those for chlorine vessels, should be
used as a starting point.
ITEM FAILURE RATES

Type of release Failure rate (per vessel Notes
year)
-6
Catastrophic 6 x 10 Upper failures
-6
Catastrophic 4 x 10 Median
-6
Catastrophic 2 x 10 Lower
-6
50 mm diameter hole 5 x 10
-6
-5
-5
Derivation
44. The cold catastrophic and hole failure rates are taken from the MHAU handbook (now
archived). These are derived in the Chlorine Siting Policy Colloquium and are applicable to
chlorine pressure vessels in a typical water treatment plant. Although they are not applicable to
all types of pressure vessels the values are a good starting point when trying to derive failure
rates for vessels in other applications. The value chosen for catastrophic failure should normally
be 2 chances per million (cpm), assuming that the vessel conforms to BS5500 or an equivalent
standard and that there is good compliance with the HSW etc. act (1974), unless there are site-
specific factors indicating that a higher rate is appropriate (e.g. semi refrigerated vessels
[cryogenic pressure vessels]).
45. The values above take the effects of external hazards into account at a rate of 1 x 10 -6 per
vessel year for catastrophic failures. If site specific conditions are known to result in a higher
external hazard rate then the overall failure rate used should be adjusted as necessary.
Examples of external hazards are shown in Figure 4.
46. Domino effects on adjacent tanks are possible. Assuming a split along a longitudinal seam and
that 50% of such splits are orientated such that the vessel is driven into an adjacent one, then
the rate of impact on a second vessel following a catastrophic failure would be 10 -6. Not all of
these impacts would cause catastrophic failure of the second vessel, however. If it is further
assumed that 25% of the impacts cause catastrophic failure, this gives a total frequency of 1/8
of the catastrophic failure rate. This is very much an estimate and, if the scenario proves to be
dominant in the risk assessment, further advice should be sought.
47. A review of pressure vessel failure rates was carried out in 2006. The outcome of the review
was to recommend that HSE continue to use the current values within PCAG for pressure
Page 18 of 102
vessel failure rates unless new information suggests otherwise. This work is documented in a
HSL report by Keeley and Prinja, RAS/06/04.
48. The HSE pressure vessel failure rates have also recently been reviewed by Nussey (2006). The
review concluded that the HSE failure frequencies for pressure vessels continue to be soundly
based and justified.
References
Components Failure Rates. Confidential, E M Pape 1985 From the Chlorine Siting Policy
not in the public domain. Colloquium
Pressure Vessel Failure Rates – A D Keeley and A 2006
Summary Report. HSL internal report Prinja
RAS/06/04. Confidential, not in the public
domain.
Failure frequencies for major failures of C Nussey 2006 www.hse.gov.uk/comah/highpressure.pdf

high pressure storage vessels at COMAH
sites: A comparison of data used by HSE
and the Netherlands.
FR 87. Confidential, not in the public S C Pointer 2005 Domino failures of adjacent tanks
domain.

139 LNG stored in Vacuum Insulated Tanks (VITs) Catastrophic failure rate given.
135 LNG storage tank BLEVE frequency Use LPG BLEVE rate.
134 Glass lined bromine pressure vessel Catastrophic failure rate given.
105 Cryogenic ethylene (pressurised, semi-refrigerated), 20 te. Temperature BLEVE frequency given.
-53°C, pressure 12 barg.
89 Liquefied HCl, 13.5 bar g and temperature of -40°C. Catastrophic failure rate
produced.
63 High pressure gas bullets. Cold and hot catastrophic, full
manhole, 50 mm and 25 mm
diameter hole failure rates
produced.
55 Pressure vessels for LOX storage, 35te, operating pressure 17 bar. Catastrophic failures, 50 mm
Vertical bullets with liquid off-take feeding an air warmed vaporiser and 25 mm diameter hole
delivering oxygen gas under pressure of around 10 bar. failure rates produced.
19 Double skinned 66000 l liquid hydrogen vessels. Catastrophic failures, 50 mm,
25 mm, 13 mm and 6 mm
holes. Working pressure of
inner tank is 12 barg although
normal storage pressure is 4-5
barg.
14 29.6 te fixed bromine tanks. Catastrophic failure rate
produced.
Page 19 of 102
Bibliography

-6
A literature review of generic failure rates and R Hankin Dec 91 6 x 10 per yr, catastrophic failure,
comparison with the failure rates used in average values for failure rate data.
RISKAT. Confidential, not in the public
domain.
-6
Review of failure rate data used in risk G Simpson Sep 93 7.4 x 10
assessment.
-5
Guidelines for process equipment reliability American Institute 1989 9.5 x 10 , catastrophic failure of
data. of Chemical pressure vessels page 205.
Engineers
-6
“Covo” report. Rijnmond public Nov 81 6 x 10 , catastrophic failures. Table
authority IX.I.
-5
Loss prevention in the process industries. F P Lees 1980 1 x 10 per yr, catastrophic failure
based on Canvey data. Page 1018.
-6
CIMAH safety case. Confidential, not in the W S Atkins Jun 94 2 x 10 per yr, catastrophic failure.
public domain.
-6
CIMAH safety case support. Confidential, not Technica (USA) May 6.5 x 10 per yr, catastrophic data
in the public domain. 1989 (Smith and Warwick data).
-5
A survey of defects in pressure vessels in the Smith and Warwick Dec 81 4.2 x 10 per vessel yr,
UK during the period 1962-1978 and its catastrophic data (includes boilers).
relevance to nuclear primary circuits.
Reliability Technology. Green & Bourne 1972 Two values are given for pressure
vessels:
-6
General – 3.0 x 10 per hr
-6
High standard – 0.3 x 10 per hr
The predicted BLEVE frequency of a selected M Selway August Determines BLEVE frequency of an
3 -7
2000 m butane sphere on a refinery site. 1988 LPG tank to be 9 x 10 per yr (p
24).
An initial prediction of the BLEVE frequency of K W Blything & A B 1988 Uses fault tree analysis (FTA) to
a 100 te butane storage vessel. Reeves determine BLEVE frequency of a
-8 -6
butane tank to be 10 to 10 per
vessel yr.
-7
Failure rates – LPG tanks. Confidential, not in 1994 9.4 x 10 per year, catastrophic
the public domain. failure.
-5
A further survey of pressure vessel failures in T J Davenport 1991 Value of 5.1 x 10 per yr derived for
the UK (1983 – 1988) – public domain all pressure vessels. Also individual
version. values derived for air receivers,
steam receivers and boilers.
-6
Proposed gas terminal. Confidential, not in the Technica Aug 1991 6.5 x 10 per yr, catastrophic failure.
public domain.
-6
CIMAH safety report for gas terminal. Technica Jun 94 6.5 x 10 per yr, rupture. 5, 25 and
Confidential, not in the public domain. 100 mm diameter hole size failure
rates also given.
-6
Gas terminal study. SRD review of Cremer P L Holden Sep 81 1 x 10 per yr, catastrophic, not
and Warner failure rates. Confidential, not in including nozzle failures. Process
the public domain. vessels rise to 3 cpm.
-6
QRA data. Confidential, not in the public Technica May 89 6.5 x 10 per yr catastrophic failure
domain. rate, also contains failure rates for
partial failures.
Page 20 of 102

-6
Risk assessment. Confidential, not in the A D Little Sep 94 6 x 10 per yr catastrophic, 50 mm
public domain. diameter hole size also given.
-5
Safety report R2000 reactor rupture fault tree Not given 1994 3.65 x 10 per yr, reactor bursts.
analysis. Confidential, not in the public
domain.
Safety report. Confidential, not in the public Technica 1994 Split into various causes.
domain.
-8
Estimation of cold failure frequency of LPG W Sooby & J M 1994 A value of 2.7 x 10 per vessel yr is
tanks in Europe. Confidential, not in the public Tolchard derived for the cold catastrophic
domain. failure of LPG pressure vessels.
-8
Calculation of release frequencies. WS Atkins Jul 95 1.2 x 10 per yr for catastrophic
Confidential, not in the public domain. rupture of pressure relief vessel
(intermittent use only).
-6
Chlorine safety report. Confidential, not in the WS Atkins Oct 95 5 x 10 per yr, for bulk storage
public domain. tank.
Loss prevention in the process industries. F P Lees 1986 General pressure vessel: 3
High standard: 0.3
-6
(units of failures x10 per yr)
-6
SR module. Confidential, not in the public Unknown 1978 1 x 10 per yr catastrophic failure.
domain.
-6
Guidelines for the preparation and review of a BP CIMAH Liaisons May 93 Cold failure 6.5 x 10 per yr
report under the CIMAH regulations. Group -6
Hot failure (BLEVE) 26 x 10 per yr
Confidential, not in the public domain.
-6
Handbook of risk analysis. Confidential, not in Hydro Not given 2 x 10 per yr, rupture.
the public domain.
Generic land use planning consultation zones Not given Oct 94 Catastrophic failure of chlorine
-6
- chlorine. Confidential, not in the public storage vessel 2 x 10 per yr (lower
domain. bound).
Some data on the reliability of pressure D C Arulanantham Oct 80 Various vessels; pressure vessels,
equipment in the chemical plant environment. & F P Lees boiler drums etc. (p 328).
Safety cases within the Control of Industrial M L Ang & F P 1989 Value given for chlorine pressure
Major Accident (CIMAH) Regulations 1984. Lees vessel.
The likelihood of accidental release events. Rhône Poulenc Not Various tank failures considered.
Confidential, not in the public domain. Chemicals dated
-4
Quantified risk assessment. Confidential, not AEA Technology 1996 Small leaks (0 – 25 mm): 2 x 10
in the public domain. per vessel yr
Medium leaks (25 – 100 mm):
-5
2 x 10 per vessel yr
-6
Large leaks (> 100 mm): 2 x 10
per vessel yr
A method for estimating the off-site risk from BCGA/HSE/SRD Not given Estimates the failure rate of
bulk storage of liquid oxygen (LOX). Working Group pressure vessels for LOX storage to
-5
Confidential, not in the public domain. be in the order of 10 per yr.
Risks associated with the storage of and use SRD Nov 81 This report derives a value for the
nd
of chlorine at a water treatment plant (2 failure rate for chlorine pressure
draft). Confidential, not in the public domain. vessels. Failure rates are thought to
be over conservative.
Page 21 of 102
Fire engulfment leading to

overpressurisation (negligible if no HFLs
or LPG in the vicinity)
Whole vessel failure
Earthquake
Flooding - see ED 2
Lightning - see ED 3
Damage to the vessel - is

the resulting crack larger
than the critical crack
size? Weather
Ignition probabilities
Vehicle (dependent on
degree of protection,
Part vessel failure movement of site vehicles,
proximity of roads and
railway)
External impacts
Aircraft - see ED 1
Crane loads - risks negligible

if no crane
Collapse of overhead
structures, e.g. due to wind
or fire
Missiles, e.g. from adjacent

plant. Risk none if there is
no such plant
Figure 4 External Hazards for Pressure Vessels
Page 22 of 102
Item FR 1.1.3.1 Chlorine Pressure Vessels
ITEM FAILURE RATES

year)
-6
Catastrophic 4 x 10 Use where site specific factors
increase likelihood of failure
-6
Catastrophic 2 x 10 Normal value
-6
-6
-5
-5
Derivation
51. The cold catastrophic failure rates are taken from the MHAU handbook (now archived). These
are derived in the Chlorine Siting Policy Colloquium and are applicable to chlorine pressure
vessels. The above values have been adopted as the generic failure rates for pressure vessels
for use within RISKAT.
52. The catastrophic failure rate should be taken as 2 x 10 -6 per vessel yr unless site specific factors
are known to increase that value.
55. The HSE pressure vessel failure rates have also recently been reviewed by Nussey (2006). The
review concluded that the HSE failure frequencies for pressure vessels continue to be soundly
based and justified.
References
Components Failure Rates. Confidential, E M Pape 1985 From the Chlorine Siting Policy
not in the public domain. Colloquium
domain.
Page 23 of 102


No specific advice issued.
Bibliography

-6
A Literature Review of Generic Failure Rates R Hankin December 6x10 per yr, catastrophic failure.
and Comparison with the Failure Rates Used 1991 Average values for failure rate
in RISKAT. Confidential, not in the public data. Page 2.
domain.
-5
Guidelines for Process Equipment Reliability Centre for 1989 9.5x10 , catastrophic failure of
Data. Chemical Process pressure vessels page 205.
Safety of the
American Institute
of Chemical
Engineers
-6
Risk Analysis of Six Potentially Hazardous Rijnmond Public November 6x10 , catastrophic failures. Table
Industrial Objects in the Rijnmond Area, a Authority 1981 IX.I.
Pilot Study.
Calculation of Release Events Frequencies. W S Atkins 2 July 1995 Derives a catastrophic failure rate
-6
Confidential, not in the public domain. of 5x10 per yr.
Chlorine Safety Report– The Likelihood of W S Atkins October Derives a catastrophic failure rate
-6
Accidental Chlorine Release Events. 1995 of 5x10 per yr. Probably the same
Confidential, not in the public domain. derivation as above.
-6
Safety Cases Within the Control of Industrial M L Ang and F P 1989 2x10 per yr (instantaneous
Major Accident Hazards (CIMAH) Lees release).
Regulations 1984.
-5
Risks Associated with the Storage of and SRD November 4.1x10 per yr, catastrophic failure.
Use of Chlorine at a Water treatment Plant 1981
nd
(2 Draft). Confidential, not in the public
domain.
Page 24 of 102
Item FR 1.1.3.2 LPG Pressure Vessels
ITEM FAILURE RATES

year)
-6
Catastrophic 2 x 10 Cold vessel failures
-5
BLEVE 1 x 10
-6
-6
-5
Derivation
58. The cold catastrophic and BLEVE failure rates are taken from the MHAU handbook (now
archived). These are standard failure rates for use within RISKAT.
59. The value for catastrophic failure is based on a survey carried out in 1983 by the LPGTA (now
renamed to UKLPG) on LPG releases and vessel populations in the UK. From calculations by
E.M. Pape in the file MHAU/PR/6003/94 the survey gave 280,000 vessel years with no
catastrophic failures. This gave a failure rate of <2.5 x 10-6 per vessel yr. This survey has been
updated assuming no failures up to 1992, which gives a failure rate of 9.4 x 10 -7 per vessel yr.
This failure rate is derived from LPG tanks most of which (95%) are less than 1 te and larger
vessels may have different failure rates. Taking this into account, and the generic failure rates
used within HSE, the value of 2 x 10-6 continues to be used.
60. The cold catastrophic failure rate was reviewed by Nussey in 2006 and the conclusion was that
the value of 2 cpm was still reasonable. The review also concluded that the HSE failure
frequencies for pressure vessels continue to be soundly based and justified.
61. The mounding or burying of LPG tanks gives protection from fire engulfment and significantly
reduces the possibility of a BLEVE. The mounding or burying also changes the likelihood of the
possible causes of cold failure.
62. Where the LPG tank is fully mounded or completely buried, the BLEVE frequency can be taken
as zero. Partially mounded tanks or other tanks that have part of the surface exposed are
assigned the standard BLEVE frequency. In all cases the cold catastrophic failure frequency
and the vessel hole rates remain unchanged unless demonstrated otherwise.
Page 25 of 102
References
domain.


Bibliography

-6
A Literature Review of Generic Failure Rates R Hankin December 6x10 per yr, catastrophic failure.
and Comparison with the Failure Rates Used 1991 Average values for failure rate
in RISKAT. Confidential, not in the public data. Page 2.
domain.
-6
Review of failure rate data used in risk G Simpson Sep 93 7.4 x 10
assessment.
-5
Guidelines for process equipment reliability American Institute 1989 9.5 x 10 , catastrophic failure of
data. of chemical pressure vessels page 205.
engineers
-6
“Covo” report. Rijnmond public Nov 81 6 x 10 per yr, catastrophic
authority failures. Table IX.I.
-5
Loss prevention in the process industries. F P Lees 1980 1 x 10 per yr, catastrophic failure
based on Canvey data. Page 1018.
-6
CIMAH safety case support. Technica (USA) May 89 6.5 x 10 per yr, catastrophic data
(Smith and Warwick data).
The predicted BLEVE frequency for a M Selway August The predicted BLEVE frequency of
3
sphere. 1988 a selected 2000 m butane sphere
on a refinery site.
An initial prediction of the BLEVE frequency K W Blything & A B 1988 Uses FTA to determine BLEVE
of a 100 te butane storage vessel. Reeves frequency of a butane tank to be
-8 -6
10 to 10 per vessel year.
-7
Failure rates – LPG tanks. Confidential, not 1994 9.4 x 10 per yr, catastrophic
in the public domain. failure.
-8
Estimation of cold failure frequency of LPG W Sooby & J M 1994 A value of 2.7 x 10 per vessel yr
tanks in Europe. Confidential, not in the is derived for the cold catastrophic
Page 26 of 102
public domain. Tolchard failure of LPG pressure vessels.
Guidelines for the preparation and review of BP CIMAH May 93 Quotes value for hot failure
-6
a report under the CIMAH regulations. Liaisons Group (BLEVE) of 26 x 10 per yr,
Confidential, not in the public domain. probably for an LPG vessel.
Page 27 of 102
Item FR 1.1.3.3 Spherical Vessels
ITEM FAILURE RATES

year)
-6
Catastrophic 6 x 10 Upper failures
-6
Catastrophic 4 x 10 Median
-6
Catastrophic 2 x 10 Lower
-6
-6
-5
-5
Derivation
67. The failure rates are taken from RSU/SR/2010/02 by Z Chaplin.
68. No evidence was found in the literature to suggest that the failure rates for spherical vessels
would differ significantly from those used for pressure vessels.
69. However, it was considered that the supporting legs of spherical vessels provide an additional
failure mode for this type of vessel, although there was no firm evidence in the literature.
70. It is therefore recommended that a cautious approach is taken and the median value for
catastrophic failure is used.
References
Failure rates for spherical tanks. HSL short Z Chaplin 2010
report RSU/SR/2010/02. Confidential, not
in the public domain.

Page 28 of 102
Item FR 1.1.4 Chemical Reactors
ITEM FAILURE RATES

General Reactors
Type of release Failure rate (per reactor Notes
year)
-5
Catastrophic 1 x 10
-6
-6
-5
-5
Derivation
72. The catastrophic failure rate is taken from the panel paper by P Betteridge (Panel Paper 1999-
003) and has been reviewed by Chaplin (MSU/LET/2013/37/1). The value is for pressurised
chemical reactors, and includes both batch and continuous, but not non-metallic reactors or
small lab-scale reactors. It includes both reactors that are capable of thermal runaway and
those that are not. The main assumption is that both pressure vessels and reactor vessels will
share a set of common failure modes and that the failure rate due to these will be the same for
both types of vessel. Both types of vessel will also have a set of failure modes that are unique to
that type of vessel.
73. The values proposed for less than catastrophic failure are those for chlorine storage vessels. To
take into account the number of large flanges often found on reactors, each flange should be
given a failure rate of 3 x 10-6 per year with a hole size equivalent to assuming a loss of a
segment of gasket between two bolts. The value obtained should then be added to the
appropriate value from the table above to give the net failure rate. This would mean that for a
reactor with four 8-bolt 200 mm flanges, the failure rate would be 1.2 x 10-5 per reactor year with
an equivalent hole size of 13 mm for a 2 mm gasket.
References
HSE Panel Paper 1999-003. (Confidential, not P. Betteridge 1999
in the public domain)
Chemical Reactor Failure Rates Z. Chaplin 2013
MSU/LET/2013/37/1. Confidential, not in the
public domain.

Page 29 of 102
Page 30 of 102
Item FR 1.2 Components
75. Failure rates for mechanical components are categorised as follows:
Item FR 1.2.1 Valves Page 32

Item FR 1.2.2 Pumps Page 36
Item FR 1.2.3 Hoses and Couplings Page 39
Item FR 1.2.4 Hard Arms Page 43
Item FR 1.2.5 Flanges and Gaskets Page 45
Spray Releases
76. Spray releases covers a specific type of leak that occurs at different kinds of plant and
pipework. Spray releases are normally only considered when assessing risks from toxic
substances that would otherwise have very small hazard ranges because of their low volatility.
77. A spray release is defined as a release where the spray from a hole is broken into droplets
small enough to not rain out, i.e. it is atomised. It could occur in fixed pipework or in a flexible
hose connection (say between a tanker and a storage vessel). Spray releases also arise from
plant such as pumps and valves, particularly around shafts and drives. In order for a spray
release to occur, two conditions are required:
 A very narrow breach in the containment boundary (< 50m)

 A significant pressure (in excess of 1 barg)
78. Only crack-like holes, (i.e. with considerable length) need be considered, because point defects
of 50 m size will have negligible flow rate. Clearly, these small breaches with specific geometry
are a small subset of the range of failures that could occur. No data is available directly from
industry on spray frequencies. Frequencies were estimated by considering sprays as a subset
of all small holes. Data for small holes in the type of plant that might give rise to sprays were
obtained from a variety of sources. The judgements used in deriving the spray release figures
were agreed in an MSDU Panel Paper of 4 February 2004, entitled ‘Spray Releases’ by P J
Buckley (Confidential, not in the public domain). The paper was presented at a panel meeting
on 16 February 2004.
79. Spray releases frequencies are given for Items FR 1.2.1- FR 1.2.3 and FR 1.2.5.
Page 31 of 102
Item FR 1.2.1 Valves
ITEM FAILURE RATES

Type of event Failure rate (per demand) Notes
-4
Failure to close 1 x 10 Manual valve (Exc. Human Error)
-2
Failure to close 3 x 10 ROSOV (Inc. Human Error)
-2
Failure to close 1 x 10 ASOV
-2
Failure to operate 1.3 x 10 XSFV
SPRAY RELEASE FREQUENCY

Frequency Effective length of crack
-4
Valve 2 x 10 per valve per year Shaft circumference
Derivation
80. All rates are taken from the MHAU handbook volume 3 (now archived). These values are
derived in the Components Failure Rates paper, which is a comparison of 12 sources of failure
rates derived elsewhere. The values are for chlorine duty although the review included LPG,
petrochemical, steam/water, nuclear and other data.
81. The failure to close manual chlorine valves is given as 1 x 10 -4 per demand not including human
error. Manual valves are valves that have to be closed in an emergency by the operator taking
suitable precautions, e.g. donning a SCBA (self-contained breathing apparatus).
82. A ROSOV is a remotely operated shut-off valve that allows rapid remote isolation of significant
processes. The failure to close a ROSOV is given as 3 x 10-2 per demand.
83. An ASOV (Automatic shut-off valve) is a valve normally held open and is closed by detection
equipment with no need for manual intervention. The failure to close for ASOVs is given as 1 x
10-2 per demand. The value may be higher if gas detection equipment is used as opposed to a
pressure drop system.
84. Excess flow valves (XSFV) have a failure rate of 1.3 x 10-2 per demand if tested every year and
an order of magnitude higher if tested every 10 years.
85. Where human error is likely to be a significant factor the advice of HID Human Factors
Specialists should be sought. The advice of Control and Instrumentation Specialists should also
be sought where there is a need for a site-specific assessment.
References
Components Failure Rates. Confidential, not E M Pape 1985 From the Chlorine Siting Policy
in the public domain. Colloquium
Page 32 of 102

49 Relief valve for natural gas. Rate per year or per demand.
Bibliography

A literature review of generic failure rates and R Hankin Dec 91 Average values for failure rate data.
comparison with the failure rates used in
domain.
Review of failure rate data used in risk G Simpson Sep 93 Gives the failure (per demand) for
assessment. ASOV, ROSOV and EFV (Excess
Flow Valve).
Major hazard aspects of the transport of Advisory 1991 LPG road tanker: various valve
dangerous substances. Committee on failures (p285-6)
Dangerous Chlorine tanker valves (p205 and
Substances 264)
Ammonia tanker valve failures
(p206)
Guidelines for process equipment reliability American Institute 1989 Sparsely populated database.
data. of chemical
engineers
“Covo” report. Rijnmond public Nov 81 Risk assessment and fault tree
authority analysis. Table IX. I (FTO).
Loss prevention in the process industries. F P Lees 1980 Probably originating from the
“Covo” report. Page 1005.
-4
CIMAH safety case. Confidential, not in the W S Atkins Jun 94 External leak: 2.3 x 10 per yr
public domain. -4
Passing: 3 x 10 per yr
Reliability Technology. Green & Bourne 1972 Gives failure rates for hand
operated, ball, solenoid, control and
relief valves.
An initial prediction of the BLEVE frequency of K W Blything & A B 1988 Various values given for leaks, and
a 100 te butane storage vessel. Reeves failure to close, considers pressure
relief valves, pressure control valve
and EFV.
Proposed gas terminal. Confidential, not in the Technica Aug 1991 Leaks from valves are included in
public domain. the pipework failure rate. Only
failure on demand is given. Failure
of ESD valve to close of 0.1 per
demand including all control
systems.
-5
CIMAH safety report for gas terminal. Technica Jun 94 Derives a value of 1.6 x 10 per
Confidential, not in the public domain. valve year for rupture.
-2
CIMAH safety report. Confidential, not in the WS Atkins May 94 Shut off valve 1.3 x 10 per
public domain. demand.
Manual valve 0.05 (probability).
Page 33 of 102

Risk assessment. Confidential, not in the A D Little Sep 94 Valve seal failure data.
public domain.
Safety report. Confidential, not in the public Technica 1994 Rupture failure frequency for a
-5
domain. valve is given as 8.76 x 10 per yr.
-2
Chlorine safety report. Confidential, not in the WS Atkins Oct 95 EFV failure to close 2.6 x 10 per yr
public domain. probability for fail on demand 6.5 x
-2
10 per yr.
-6
Loss prevention in the process industries. F P Lees 1986 Values given in failures x 10 per hr
Control valves: 30
Ball valves: 0.5
Solenoid valves: 30
Hand operated: 15
Relief valve (leak): 2
Relief valve (blockage): 0.5
-2
HF QRA. Confidential, not in the public Unknown Jul 94 EFV failure 10 per demand (taken
domain. from Covo report).
Handbook of risk analysis. Confidential, not in Hydro Not given ASO: FTO and leak
the public domain. NRV: FTO and leak
Control valve: FTO and leak
Manual shut off: leak
Relief valve: FTO, leak
Transport of dangerous substances. ACDS Mar 90 Internal fischer valve fails (due to
Confidential, not in the public domain. mechanical damage), probability
-4
1 x 10 .
Fault tree illustrating the combination of British Gas 1995 Fault tree analysis, actual values
events leading to a fire during LPG unloading. not given.
Safety cases within the Control of Industrial M L Ang & F P 1989 Failure rate of tanker EFV, 0.01/
Major Accident (CIMAH) Regulations 1984. Lees demand.
Failure data collection and analysis in the K Boesebeck and P Not given Various shut off valves considered
Federal Republic of Germany. Homke p. 18, MOV considered for leaks,
FTO P. 19,
-6
FTO: (300 to 3000) x 10 per
demand
-6
Leak: (6 to 25) x 10 per demand
The likelihood of accidental release events. Unknown Not given Probability valve failure to close
Confidential, not in the public domain. (assuming a proof test period of 3
-2
months), 4 x 10 on demand.
Reliability and maintainability in perspective. D Smith 1988 Ranges of failure rates quoted for
FTO for the following valve types:
ball, butterfly, diaphragm, gate,
needle, non-return, plug, relief,
globe, and solenoid. (p.249).
Quantified risk assessment. Confidential, not AEA Technology 1996 3 leak sizes are considered for 3
in the public domain. valve sizes. Values range from 1 x
-3 -5
10 to 1 x 10 (units are assumed
to be per year)
The likelihood of accidental chlorine release WS Atkins 1994 Valve failure rate quoted as 3.6 x
-5
events (extract from CIMAH safety case). 10 per valve per yr.
Site specific assessment. Confidential, not in AD Little Apr 94 There are several valve failures (to
the public domain. operate) considered in this
Page 34 of 102

reference. Values given for valve
-3
fails closed vary from 1 x 10 to 3 x
-4
10 per yr.
Risks associated with the storage of and use SRD Nov 81 The likelihood of a pipe/valve failure
nd -4
of chlorine at a water treatment plant (2 is estimated to be 10 per yr.
draft). Confidential, not in the public domain. Also the probability of a release
(1kg/s) from the pressure reducing
-2
valve was estimated to be 10 per
yr.
Valve and pump operating experience in J R Aupied, A Le 1983 This reference gives a detailed
French nuclear plants. Coguiec, H treatment of valves and breaks
Procaccia down the data for gate, globe,
check, plug and safety relief valves.
There is also a breakdown of the
medium handled by the valves. It is
claimed that non-operation forms
20% of the failure and that leakage
forms 30% of the failures.
A review of instrument failure data. F P Lees 1976 Failure of control valves and
pressure relief valves to operate
correctly.
Control valve fail shut: 0.2 per yr
Control valve fail open: 0.5 per yr
Pressure relief valve fail shut: 0.001
per yr
Also total fail to danger and fail safe
are given, solenoid and hand valves
are considered.
OREDA – Offshore reliability data handbook. OREDA 1984 Contains a variety of data on valves
of different types and considers a
range of failure modes. Includes
FTO and leakage.
Non-electric parts reliability data. M J Rossi, 1985 Failure rates are given for a range
Reliability Analysis of different valves (ball, butterfly,
Centre check, diaphragm, gate etc.). It is
not clear whether these failures
refer to leaks or failure to operate.
Development of an improved LNG plant D W Johnson & J R 1981 Mean time between failures for
failure rate database. Welker cryogenic valves is 1,569,000 hrs
for major failures, other values also
given.
Interim reliability evaluation. Program D D Carlson Jan 93 Gives mean and median values for
procedures guide. Confidential, not in the failure rates for a wide range of
public domain. valves (motor operated, solenoid,
check, manual, etc.). In many cases
gives values for failure to operate
and leakage. Mean values quoted
for catastrophic leak:
Motor operated and check valve: 5
-7
x 10 per hr.
Page 35 of 102
Item FR 1.2.2 Pumps
ITEM FAILURE RATES

Type of event Failure rate (per year per pump) Notes
-5
Failure of casing 3 x 10

-4
Pump single seal 5 x 10 per pump per Shaft circumference
year
-5
Pump double seal 5 x 10 per pump per Shaft circumference
year
Derivation
88. All rates are taken from the MHAU handbook volume 3 (now archived). The failure rate refers to
the catastrophic failure of the pump casing giving a release rate equivalent to a full bore leak
from the pipework.
References

FR No Values Application
No specific advice
Bibliography

domain.
-4
Review of failure rate data used in risk G Simpson Sep 93 Failure rate of 1 x 10 per yr given
assessment. for guillotine failure (failure of the
pump casing).
Page 36 of 102

Guidelines for process equipment reliability American Institute 1989 Sparsely populated database.
data. of chemical
engineers
authority analysis. Table IX. I .
Loss prevention in the process industries. F P Lees 1980 Probably originating from the
“Covo” report. Page 1005.
CIMAH safety case support. Confidential, not Technica (USA) May 89
in the public domain.
An initial prediction of the BLEVE frequency of K W Blything & A B 1988 Frequency of a small leak (0.5”
-4
a 100 te butane storage vessel. Reeves diameter.) 5.2 x 10 per yr. Other
values also given (p. 32).
Proposed gas terminal. Confidential, not in the Technica Aug 1991 Pump failure rates are given for
public domain. small, large and catastrophic
failures.
CIMAH safety report for gas terminal. Technica Jun 94 As above.
QRA data. Confidential, not in the public Technica May 89 Hole size distribution.
domain.
Risk assessment. Confidential, not in the A D Little Sep 94 Pump seal failure:
public domain. -3
25 mm hole: 2.4 x 10 per yr
-4
Full bore: 6.8 x 10 per yr
-3
Loss prevention in the process industries. F P Lees 1986 Failure to start 1 x 10 per demand
SR module. Confidential, not in the public Unknown 1978 Pump seals: Gland 0.7 per yr
domain. Simple mechanical 0.57 per yr
Double mechanical 0.45 per yr
-3
Guidelines for the preparation and review of a BP CIMAH Liaisons May 93 100 x 10 per yr for catastrophic
report under the CIMAH regulations. Group failure
Handbook of risk analysis. Confidential, not in Hydro Not given Various events considered.
the public domain.
Failure data collection and analysis in the K Boesebeck and P Not given No actual failure data is given but
Federal Republic of Germany. Homke the distributions of the repair times
are shown as graphs.
Reliability and maintainability in perspective. D Smith 1988 Failure rates for:
-6
Centrifugal 10 – 100 x 10 per hr
-6
Boiler 100 – 700 x 10 per hr
Fire water (p. 247).
Benchmark exercise on major hazard S Contini (editor) 1992 A list of pumps and their failure rate
analysis, vol. 2 part 1. is given in table 8.1 (p. 32).
Quantified risk assessment. Confidential, not AEA Technology 1996 3 leak sizes are considered for
-2
in the public domain. pumps. Values range from 6 x 10
-4
to 6 x 10 – units probably
-1
(pump.y) .
The likelihood of accidental chlorine release WS Atkins 1994 For a pump on standby the failure
-4
events (extract from CIMAH safety case). rate is 3.1 x 10 per demand.
Site specific assessment. Confidential, not in AD Little Apr 94 Reflux pump trips off: 2 per yr.
the public domain. Spare pump fails to start on
-2
demand: 1x 10 per yr.
Page 37 of 102

Valve and pump operating experience in J R Aupied, A Le 1983 The mean feed water pump failure
-4
French nuclear plants. Coguiec, H rate is found to be 5.6 x 10 per yr.
Procaccia
OREDA – Offshore reliability data handbook. OREDA 1984 Values are given for centrifugal,
diaphragm, and reciprocating
pumps used for a range of
applications.
Non-electric parts reliability data. M J Rossi, 1985 A wide range of pump types are
Reliability Analysis considered (axial piston, boiler feed,
Centre centrifugal, electric motor driven,
engine driven etc.). Various rates
are quoted along with upper and
lower intervals.
Development of an improved LNG plant D W Johnson & J R 1981 Mean time between failures for
failure rate database. Welker cryogenic pumps is 4,000 hrs for
major failures. Other values also
given.
Interim reliability evaluation. Program D D Carlson Jan 93 Mean and median values given for
procedures guide. Confidential, not in the various pump types (motor driven,
public domain. turbine driven, and diesel driven) for
failure to start and failure to run
given start.
Page 38 of 102
Item FR 1.2.3 Hoses and Couplings
ITEM FAILURE RATES

-6
Probability of failure per transfer x 10
Facility Guillotine failure 15 mm diameter hole 5 mm diameter hole

Basic facilities 40 1 13
Average facilities 4 0.4 6
Multi safety system facilities 0.2 0.4 6

-7
Hose and coupling 1.2 x 10 per transfer Hose diameter
Derivation
91. The hose and coupling probabilities of failure apply to road tanker transfers. The guillotine
probabilities of failure are taken from the report by Gould and Glossop, RAS/00/10. An
extension of this work by Keeley (RAS/04/03/1) derived the smaller hole probabilities of failure.
The work was carried out for chlorine transfer facilities but should be applicable to similar
transfer operations. The safety systems applicable to the facilities are pullaway prevention (e.g.
wheel chocks, interlock brakes, interlock barriers), pullaway mitigation that stops the flow in the
event of pullaway (e.g. short airline, but only if it will separate and activate a shut off valve
before the transfer system fails, movement detectors), and hose failure protection (pressure
leak test, hose inspection). Facilities have been divided into three categories to typify the range
of precautions that might be found in practice:
Basic These have one pullaway prevention system such as wheel chocks,
carry out pressure/leak tests to prevent transfer system leaks and
bursts, but have no pullaway mitigation.
Average Two pullaway prevention systems (one of which should be wheel
chocks) as well as inspection and pressure/leak tests to prevent
transfer system leaks and bursts but no effective pullaway mitigation.
Multi safety Two pullaway prevention systems, and also an effective pullaway
systems mitigation system and inspection and pressure/leak tests to prevent
transfer system leaks and burst.
92. Fault trees were produced to reflect the three types of facilities. No additional credit should be
given for duplicate non-redundant safety systems. Note that an emergency shutdown (ESD)
system by itself does not affect the likelihood of a release. Only when used in conjunction with a
movement detector or short airline will the probability be changed. The effect of an ESD system
activated by gas detectors, pressure drop in the transfer system or the operator will be to
change the duration of the releases used in estimating the risk.
93. The failure rates are not applicable to transfers over an extended time period (e.g. from tank
containers to a process), nor do they include transfer by hard arms. Probabilities of failure for
hard arms can be found in Item FR 1.2.4.
Page 39 of 102
References
New Failure Rates for Land Use Planning J Gould and M May
QRA. HSL internal report RAS/00/10. Glossop 2000
Hose and Coupling: Less than catastrophic D Keeley and A 2004
failure rates – Milestone 2. HSL internal report Collins
RAS/04/03/1.

65 Tanker unloading drive away prevention for ethylene oxide or propylene Driveaway failure rate provided.
oxide.
Bibliography

-6
A literature review of generic failure rates and R Hankin Dec 91 1.6 x 10 per connection, average
comparison with the failure rates used in values for failure rate data.
domain.
Review of failure rate data used in risk G Simpson Sep 93 Refinement on reference above.
assessment.
-5
Major hazard aspects of the transport of Advisory 1991 5.5 to 11 x 10 , spills of motor spirit
dangerous substances. Committee on per delivery (p. 256)
Dangerous -7
1 to 9 x 10 spills of LPG per
Substances delivery (p. 258)
-6
0.6 to 1 x 10 , leaks of ammonia
per delivery (p. 260)
-5
0.76 to 1.9 x 10 , ship transfer
accident rates per delivery (p. 131).
-5
Guidelines for process equipment reliability American Institute 1989 5.7 x 10 failure per hour for road
data. of Chemical loading hoses not including
Engineers couplings.
-6
“Covo” report. Rijnmond public Nov 81 4 to 40 x 10 failures per hour for
authority lightly and heavily stressed hoses.
Generic figure used in the risk
assessment and fault tree analysis.
Table IX.I.
-6
Loss prevention in the process industries. F P Lees 1980 4 to 40 x 10 failures per hour for
lightly and heavily stressed hoses.
Generic figure probably originating
from Covo report (p. 1005).
CIMAH safety case. Confidential, not in the WS Atkins Jun 94 Failure rates for flexi pipe:
public domain. -7
Partial failure: 7.6 x 10 per
operation
Page 40 of 102

-8
Guillotine: 7.6 x 10 per operation
Failure rates for coupling:
-5
Partial failure: 4.4 x 10 per yr
-6
Guillotine failure: 4.4 x 10 per yr.
Reliability Technology. Green & Bourne 1972 Gives failure rates for heavily
stressed and lightly stressed hoses
-6 -6
as 40 x 10 and 4 x 10 per hr
respectively.
-6
An initial prediction of the BLEVE frequency of K W Blything & A B 1988 0.77 to 57 x 10 failures per use.
a 100 te butane storage vessel. Reeves Details on the likelihood of various
types of failure p. 11 and 42-44.
Major hazard risk analysis of two proposed Technica Jul 91 Hose spill frequency estimated at
-5
routes for the M56 – M62 relief road. 6.8 x 10 per cargo (for ship to
Confidential, not in the public domain. shore transfers), p. XI.11.
Safety report. Confidential, not in the public WS Atkins May 94 Broken down into pullaway,
domain. coupling failure, hose failure and
pipework failure.
Acrylonitrile safety report. Confidential, not in Technica 1994 Table giving values for a range of
the public domain. hole sizes for flexible hose leaks
(Table IX.3).
-4
Calculation of release event frequencies. WS Atkins Jul 95 2.9 x 10 per yr for guillotine failure.
Chlorine safety report. Confidential, not in the WS Atkins Oct 95 Connection/disconnection error,
public domain. hose pullaway, coupling failure.
Loss prevention in the process industries. F P Lees 1986 Coupling; 5.0, unions and junctions;
-6
0.4 (units: failures x 10 per yr).
-6
Risk assessment acrylonitrile. Confidential, Courtaulds Aug 88 Coupling fail: 3 x 10 per operation.
not in the public domain. Research Two flexihoses quoted: 7.2 x 10
-4
-2
and 3.1 x 10 per yr.
SR module. Confidential, not in the public Unknown 1978 Heavily/ lightly stressed 0.35 per yr
domain. / 0.035 per yr
HF QRA. Confidential, not in the public Unknown Jul 94 Guillotine failure of drum coupling
-5
domain. 10 per operation.
-6
ISO tanker coupling 3 x 10 per op.
-1
Handbook of risk analysis. Confidential, not in Hydro Not given 0.01 yr for flexible hose.
the public domain.
Transport of dangerous substances. ACDS Mar 90 Leak through ‘snap tight’ coupling 4
-7
Confidential, not in the public domain. x 10 per transfer (p. 8).
-6
Generic land-use planning consultation zones Unknown 1994 Probability of 3 x 10 per delivery
- chlorine. Confidential, not in the public operation.
domain.
Fault tree illustrating the combination of British Gas 1995 Fault tree analysis, actual values
events leading to a fire during LPG unloading. are not given.
The likelihood of accidental release events. Rhône-Poulenc Not Catastrophic failure of flexible pipe
-8
Confidential, not in the public domain. Chemicals dated 7.6 x 10 per operation.
Survey of catastrophic failure statistics for BOC 1989 Hose and coupling failure rate of 3 x
-6
cryogenic storage tanks. Confidential, not in 10 per hour operation (p. 14).
the public domain.
-5
The likelihood of accidental chlorine release WS Atkins 1994 Coupling failure (total): 4.4 x 10
events (extract from CIMAH safety case). per yr.
Confidential, not in the public domain. Coupling failure (partial): 4.4 x 10
-4
Page 41 of 102

per yr.
-4 -6
The hazard analysis of the chlorine and Cremer and Nov 77 A value of 10 to 10 per yr has
sulphur dioxide storage installation plant. Warner been assumed for a major rupture
Confidential, not in the public domain. on a loading line.
Non-electric parts reliability data. M J Rossi, 1985 Values quoted for hydraulic hoses:
Reliability Analysis -6 -6
0.2 x 10 per hr and 33 x 10 per
Centre hr.
Values quoted for couplings:
-6 -6
5.3 x 10 per hr and 1.4 x 10 per
hr.
Page 42 of 102
Item FR 1.2.4 Hard Arms

ITEM FAILURE RATES
Type of Release Probability of failure per

transfer
-7
Guillotine failure 2 x 10
-7
-6
Derivation
96. These probabilities of failure apply to hard arms that are used to transfer material between a
road tanker and fixed storage tanks. The values are derived in a report by Keeley,
MSU/LET/2013/20, and are based on the hose and coupling work detailed in Item FR 1.2.3
(Gould and Anderson, 2000, Keeley and Collins, 2004).
97. A simple analysis of the fault trees used to derive the hose and coupling probabilities of failure
was carried out. The hose and coupling fault trees were re-analysed to determine which failure
modes were applicable to hard arm transfers and which were specific to flexible hoses. In
addition, any unique failure modes that were specific to hard arms were also identified.
98. For guillotine failure a number of events were not considered to be relevant for hard arms and
the fault trees were reanalysed with the following events removed:
 hose damaged due to vehicle impact prior to transfer
 hose of incorrect specification
 guillotine failure due to overpressurisation
 brittle hose
99. For less than catastrophic hole sizes the following events were not considered to be relevant to
hard arms and therefore removed from the fault trees:
 vehicle runs over hose
 unrelieved overpressure in hose
 wrong type of hose
100. An additional failure mode for hard arms that needed to included was failure of the swivel joints
and a typical hard arm was assumed to have five swivel joints per arm.
101. The fault trees were re-evaluated and the calculated probabilities of failure were found to be
similar to those for flexible hoses at multi-safety system sites. Given the uncertainty in the
analysis the hose and coupling probabilities of failure have been adopted for sites with multi-
safety systems and average type facilities.
102. For basic type facilities which may not carry out such rigorous inspection, a site specific
probability of failure will need to be calculated.
Page 43 of 102
References
New Failure Rates for Land Use Planning J Gould and M May
QRA. HSL internal report RAS/00/10. Glossop 2000
Hose and Coupling: Less than catastrophic D Keeley and A 2004
failure rates – Milestone 2. HSL internal report Collins
RAS/04/03/1.
Failure rates for hard arms. HSL internal D Keeley 2013
report MSU/LET/2013/20. Confidential, not in
the public domain.
Page 44 of 102
Item FR 1.2.5 Flanges and Gaskets
ITEM FAILURE RATES

Type of event Failure rate (per year per joint) Notes
-6
Failure of one segment of 5 x 10 The hole size is calculated as the
a gasket. distance between two bolts and the
gasket thickness.
-7
Failure of Spiral Wound 1 x 10 Hole size calculated as gasket
Gasket thickness multiplied by pipe
circumference.

-6
Fixed pipe flange 5 x 10 per flange per Pipe diameter (max 150mm crack length)
year
Derivation
103. All rates are taken from the MHAU handbook volume 3 (now archived). The 5 x 10-6 value is
derived in the Components Failure Rates paper, which is a comparison of 9 sources of joint
failure rates derived elsewhere. The values were derived for chlorine duty although the review
included LPG, petrochemical, steam/water, nuclear and other data. Assuming a fibre or ring
type gasket in a 25 mm pipe, four bolt flange and a 3.2 mm gasket the gasket failure will
produce an equivalent hole of 13 mm diameter.
References

No specific advice.
Bibliography

-6
A literature review of generic failure rates and R Hankin Dec 91 2.4 x 10 per join per year, average
comparison with the failure rates used in values for failure rate data.
Page 45 of 102

domain.
-6
Review of failure rate data used in risk G Simpson Sep 93 5 x 10 per yr for significant leak of
assessment. a fibre and ring type gasket
(assumed to only be the loss of a
section of gasket between two
adjacent bolts).
Major hazard aspects of the transport of Advisory 1991 LPG rail wagon (p207):
dangerous substances. Committee on -12
Flange gasket 1.4 x 10 per
Dangerous journey
Substances -9
Manhole gasket 6.4 x 10 per
journey
-10
Ammonia transfer 6.4 x 10 per
gasket per transfer (p259)
-9
Chlorine road tanker 1.3 x 10 per
journey (p264)
LPG tanker p285-6.
Guidelines for process equipment reliability American Institute 1989 Types of failure not given.
data. of Chemical
Engineers
-6
Loss prevention in the process industries. F P Lees 1980 0.1 to 100 x 10 per hr, page 1008.
CIMAH safety case. Confidential, not in the WS Atkins Jun 94 For a pinhole leak through a gasket
-5
public domain. a failure rate of 8.8 x 10 per yr. For
the loss of a piece of gasket
between two adjacent bolts 5.6 x
-6
10 per yr is used.
-5
CIMAH safety case support. Confidential, not Technica (USA) May 89 A failure rate of 1 x 10 per yr is
in the public domain. given for high quality flanges e.g.
raised face, ring type or grey lock
flanges (p. VII.16).
Reliability Technology. Green & Bourne 1972 Failure rate for gaskets is
-6
0.5 x 10 per hr
-6
An initial prediction of the BLEVE frequency of K W Blything & A B 1988 Small (0.5”) leak: 4.7 x 10 per yr
a 100 te butane storage vessel. Reeves -7
Medium (1”) leak: 3.5 x 10 per yr
(p. 28)
Proposed gas terminal. Confidential, not in the Technica Aug 1991 Failure rate taken as filter failure
public domain. rate.
-5
Safety report. Confidential, not in the public WS Atkins May 94 5.6 x 10 per yr.
domain.
QRA data. Confidential, not in the public Technica May 89 Range of values quoted for different
domain. pipe diameters and hole sizes.
-5 -1
Risk assessment. Confidential, not in the A D Little Sep 94 8.4 x 10 y , data for 3 flange sizes
public domain.
-4 -1
Acrylonitrile safety report. Confidential, not in Technica 1994 1.8 x 10 y for rupture. Also
the public domain. values given for smaller hole sizes
-5 -1
Chlorine safety report. Confidential, not in the WS Atkins Oct 95 8.4 x 10 (gasket.y)
public domain.
-6
Loss prevention in the process industries. F P Lees 1986 0.5 failures x 10 per hr.
-3
SR module. Confidential, not in the public Unknown 1978 Failure rate of 4.4 x 10 per yr
domain. given.
-6
Safety cases within the Control of Industrial M L Ang & F P 1989 3 x 10 per yr for 0.6 mm thick
Major Accident Hazard (CIMAH) regs. Lees
Page 46 of 102

-6
5 x 10 per yr for 3 mm thick.
-6
Reliability and maintainability in perspective. D Smith 1988 0.05 – 3 failures x 10 per hr,
gasket type not specified.
Quantified risk assessment. Confidential, not AEA Technology 1996 3 leak sizes are considered for 3
in the public domain. flange sizes. Values range from 1 x
-4 -6
10 to 2 x 10 per yr.
A method for estimating the off-site risk from BCGA/ HSE/ SRD Not given The failure rate of a flange
-3
bulk storage of liquid oxygen (LOX). Working Group connection is given as 2 x 10 per
Confidential, not in the public domain. yr per flange.
-5
The likelihood of accidental chlorine release WS Atkins 1994 Gasket failure 5.6 x 10 per joint
events (extract from CIMAH safety case). per yr.
Non-electric parts reliability data. M J Rossi, 1985 Failure rate quoted for:
Reliability Analysis -6
RFI gasket: 0.4 x 10 per hr
Centre -6
Rubber gasket: 0.5 x 10 per hr
Page 47 of 102
Item FR 1.3 Pipework
ITEM FAILURE RATES

Failure rates (per m per y) for pipework diameter (mm)
Hole size 0 - 49 50 - 149 150 - 299 300 - 499 500 - 1000
-5 -6
3 mm diameter 1 x 10 2 x 10
-6 -7 -7
4 mm diameter 1 x 10 8 x 10 7 x 10
-6 -6 -7 -7 -7
25 mm diameter 5 x 10 1 x 10 7 x 10 5 x 10 4 x 10
-7 -7 -7
1/3 pipework diameter 4 x 10 2 x 10 1 x 10
-6 -7 -7 -8 -8
Guillotine 1 x 10 5 x 10 2 x 10 7 x 10 4 x 10

-6
Fixed pipework 1 x 10 per metre per Pipe diameter (max 150mm crack length)
year
Derivation
106. The original values for pipework diameter < 150 mm were set out in the MHAU handbook
volume 3 (now archived). They were derived in the Components Failure Rates paper, which is a
comparison of 22 sources of pipework failure rates derived elsewhere. The values were derived
for chlorine pipework although the review included LPG, petrochemical, steam/water, nuclear
and other data. This information has been updated and augmented in an MHAU Panel
discussion and Paper presented by the MHAU Topic Specialist on failure rates. The information
presented in the table above is applicable to all process pipework.
107. Failure rates for pipework with a diameter greater than 150 mm are derived in Gould (1997) –
Large bore pipework failure rates, which considers data from 9 other references.
108. Further detail on the derivation of the pipework failure rates is given in FRED, Failure Rate and
Event Data for Use in Risk Assessment (Betteridge and Gould, 1999).
109. For pipework with diameter greater than 1000mm discussion with the topic specialist is required.
References
in the public domain. Colloquium.
Large bore pipework failure rates. J Gould Sep 97 Suggests failure rates for a range of
Confidential, not in the public domain. pipe sizes and failure scenarios.
Failure Rate and Event Data for Use in Risk P Betteridge and J 1999
Assessment Gould
Page 48 of 102

90 Blast furnace gas main, diameter between 1.8 m and 2.75 m. Rates for 1000 mm pipe
assumed.
61 Failure of plastic lining of steel pipework. Failure rate per unit given.
40 Solid pipework swivel jointed loading arm for liquid sulphur dioxide. Catastrophic and leak failure
rates given.
Bibliography

domain.
Review of failure rate data used in risk G Simpson Sep 93 Refinement on above reference.
assessment.
Major hazard aspects of the transport of Advisory 1991 Pipework failures for chlorine,
dangerous substances. Committee on ammonia and LPD (p. 205-207).
Dangerous
Substances
6
Guidelines for process equipment reliability American Institute 1989 Gives failure rate of 0.0268 per 10
data. of Chemical hrs (p. 183).
Engineers
authority analysis. Table IX.I.
Loss prevention in the process industries. F P Lees 1980 Probably originating from Covo
report. P 1005.
-7
CIMAH safety case. Confidential, not in the WS Atkins Jun 94 Gives a value of 8.8 x 10 per m
public domain. per yr for guillotine failure.
CIMAH safety case support. Confidential, not Technica (USA) May 89 Failure rates are given for a range
in the public domain. of pipe diameters.
Reliability Technology. Green & Bourne 1972 Failure rate for pipes given here is
-6
0.2 x 10 per hr. Page 568.
IChemE, Major Hazard Assessment Panel, K W Blything & S T Aug 85 Historically derived failure rates.
Draft Report reviewing historical incident data. Parry
Proposed gas terminal report. Confidential, Technica Aug 91 Gives a hole size distribution and
not in the public domain. factors for different types of
pipework.
Major hazard risk analysis of two proposed Technica Jul 91 A detailed numerical analysis of the
routes for the M56 – M62 relief road. pipework failure by pipe size and
Confidential, not in the public domain. hole size for process and transport
pipes is given.
Page 49 of 102

Gas terminal CIMAH safety report. Technica Jun 1994 Appears to be ICI data.
Gas terminal study. SRD review of Cremer P L Holden (SRD) Sep 81 Guillotine failure frequencies for
-6
and Warner failure rates. Confidential, not in protected (x 10 per m per hr):
the public domain. d  50 mm: 0.1 d = 50-150 mm:
0.03
d > 50 mm: 0.01
Safety report. Confidential, not in the public WS Atkins May 94 From Covo report.
domain.
QRA. Confidential, not in the public domain. Technica Jan 89 Pipework and flange rate combined.
-
QRA data. Confidential, not in the public Technica May 89 10 mm holes 3.3 x 10 per m per yr,
-6
domain. 50 mm pipes. FB 7 x 10 per m per
yr, rates not including welds.
-6
Risk assessment. Confidential, not in the A D Little Sep 94 80 mm hole 5.3 x 10 per m per yr,
-7
public domain. 150 mm dia FBR 2.6 x 10 per m
per yr.
Acrylonitrile safety report. Confidential, not in Technica 1994
the public domain.
Calculation of release event frequencies. WS Atkins Jul 95 Various failure rates are given for
Confidential, not in the public domain. different sections of piping.
Chlorine safety report. Confidential, not in the WS Atkins Oct 95 Rupture and leak considered for
public domain. various sections of pipe.
 3”: 1 x 10 per hr,
-9
Loss prevention in the process industries. F P Lees 1986
-10
> 3”: 1 x 10 per hr
rates are for rupture (per section).
Risk assessment acrylonitrile. Confidential, Courtaulds Aug 88 Rates are obtained from fault trees.
not in the public domain. Research
 50 mm: 8.8 x 10 per m per yr
-7
SR module. Confidential, not in the public Unknown 1978
domain. > 50 and  150 mm: 2.6 x 10 per
-7
m per yr
-8
> 150 mm: 8.8 x 10 per m per yr.
HF QRA. Confidential, not in the public Unknown Jul 94 Guillotine failure for ¼” piping 1.1 x
-6
domain. 10 per m per yr.
Guidelines for the preparation and review of a BP CIMAH Liaisons May 93 Pipework failure is collated and
report under the CIMAH regulations. Group expressed as an equation.
Some social, technical and economical J L Hawksley 1984 Graph representing failure rate data
aspects of the risks of large chemical plants. for various pipe diameters.
Handbook of risk analysis. Confidential, not in Hydro Not given For average diameter failure rate is
-7
the public domain. 3 x 10 per m per yr.
Generic land-use planning consultation zones Unknown 1994 For guillotine failure (both liquid and
-6
- chlorine. Confidential, not in the public gas lines) 1 x 10 per m per yr.
domain.
Failure rates for pipework. NW Hurst, et al. Feb 94 Mean value for all the diameters
-7
considered is 4.6 x 10 per m per
yr.
Safety cases within the Control of Industrial M L Ang & F P 1989 Guillotine failure for 25 mm pipe
-6
Major Accident Hazards (CIMAH) regs. Lees given as 0.3 x 10 per m per yr.
Failure data collection and analysis in the K Boesebeck & P Not Various values for different
Federal Republic of Germany. Homke Given materials, table 2 p. 16.
The likelihood of accidental release events. Unknown Not given For catastrophic failures:
Page 50 of 102

 50 mm: 8.8 x 10 per m per yr
-7
-7
> 50 mm: 2.6 x 10 per m per yr.
Piping failures in the United States nuclear HS Bush et al. Jan 96 An examination of failure data by
power plants: 1961 – 1995. pipe size, failure type and failure
mechanism.
Pipe failures in US commercial nuclear power Electric power Jul 92 Historical failures used to derive
plants. research institute failure rates for PWR and BWR for
large, medium and small loss of
containment accidents (p 5-11).
-4 -6
A review of reliability of piping on light water Spencer H Bush Not given A rate of 10 to 10 per reactor per
reactors. Confidential, not in the public yr for large pipes is quoted, with
domain. higher rates for smaller pipes. This
range covers all failure modes.
Quantified risk assessment. Confidential, not AEA Technology 1996 3 different leak sizes are considered
in the public domain. for 6 pipe sizes. Values range from
-4 -7
1 x 10 to 1 x 10 , units are
assumed to be per m per yr.
A method for estimating the off-site risk from BCGA/ HSE/ SRD Not given Serious leakage from pipework
-5
bulk storage of liquid oxygen (LOX). Working Group given as 10 per yr per section (10
Confidential, not in the public domain. ft).
-
The likelihood of accidental chlorine release WS Atkins 1994 Fixed pipework (guillotine): 8.8 x 10
6
events (extract from CIMAH safety case). per m per yr.
Confidential, not in the public domain. Fixed pipework (partial): 8.8 x 10
-5
per m per yr.

Connection pipework (guillotine):
-7
7.6 x 10 per m per yr per
operation.
Connection pipework (partial): 7.6 x
-6
10 per m per yr per operation.
-4
Site specific assessment. Confidential, not in AD Little Apr 94 Line corrosion: 1 x 10 per yr.
the public domain. Several values are given for frost
heaves.
The hazard analysis of the chlorine and Cremer and Nov 77 Assuming that pipework is
sulphur dioxide storage installation plant. Warner reinstated and then checked after
Confidential, not in the public domain. maintenance the failure rate will be
-4 -5
10 to 10 per yr (presumably per
m).
Risks associated with the storage of and use SRD Nov 81 The likelihood of a pipe/valve failure
nd -4
of chlorine at a water treatment plant (2 is estimated to be 10 per yr.
draft). Confidential, not in the public domain.
Development of an improved LNG plant D W Johnson & J R 1981 Mean time between failures is given
6
failure rate database. Welker as: 582 x 10 ft-hrs (if time to repair
-6
is ignored this is approx. 45 x 10
per m per yr), this figure is for
‘major’ failures, other values given.
Page 51 of 102
Item FR 2 Electrical
112. Currently there are no agreed HSE failure rates for this item. The following references
represent other sources of relevant information. A range of equipment will fall under this
category, such as motors, contactors, relays and actuators such as solenoids. Much of the
equipment will fall under IEC 61508 or IEC 61511. This data will be used for SIL (Safety
Integrity Level) assessments and on Layers of Protection Analysis (LOPA).
Bibliography
IEEE Guide to the collection and presentation Institute of Electrical 1983 Covers a wide range of electrical
of electrical, electronic, sensing component and Electronics components
and mechanical equipment reliability data for Engineers Inc
nuclear power generating stations
Reliability Technology Green and Bourne 1972 Average failure rates quoted for a
wide range of electrical components
in table A.7 (p.564)
Loss prevention in the process industries (V2) F P Lees 1986 Variety of electrical components in
table A9.2 and A9.3
Failure data collection and analysis in the Boesebeck and Not Table 7 gives failure rates for
Federal Republic of Germany Homke dated electrical devices
Reliability and maintainability in perspective D J Smith 1988 Table 1 gives failure rates for a
rd
(3 Edition) wide range of electrical and non-
electrical equipment. Table 2 gives
failure rates for micro-electric
components
A review of instrument failure data F P lees 1976 A range of instrumentation
considered
OREDA – Offshore reliability data handbook OREDA 1984, A variety of process control and
1992, electric equipment are included
1997,
2002
Handbook of reliability data for electronic British 1994
components used in communications Telecommunications
systems, HRD5
Reliability data for safety instrumented SINTEF 2006
systems, PDS data handbook
rd
Safety equipment reliability handbook (3 Exida.com LLC 2007 Part 1 Sensors, Part 2 Logic solvers
edition) and interface modules, part 3 Final
elements
IEC 61508: Functional safety of electrical/ International 2005
electronic/ programmable electronic safety- Electrotechnical
related systems. Commission
IEC 61511: Functional safety – safety International 2003
instrumented systems for the process industry Electrotechnical
sector. Commission
Page 52 of 102
Item FR 3 Bulk Transport

113. Failure rates for transport related items are categorised as shown in Figure 5.
Bulk Transport
FR3
Pipelines Tankers Ship Freight

FR3.1 FR3.2 FR3.3
Buried ISO tankers Ship hardarms

FR3.1.1 FR3.2.1 FR3.3.1
Above ground in a gas

Road Tankers
installation
FR3.2.2
FR3.1.2
LPG Road Tanker Incompatible

Above ground outside BLEVE Deliveries
a gas installation FR3.2.2.1 FR3.2.2.2
FR3.1.3
Rail tankers
Compressors FR3.2.3
FR3.1.4
Figure 5 Hierarchical diagram for bulk transport
Item FR 3.1 Pipelines Page 54

Item FR 3.2 Tankers Page 62
Item FR 3.3 Ship Freight Page 72
Page 53 of 102
Item FR 3.1 Pipelines
Introduction
114. Assessors carrying out Land Use Planning assessment may have cause to assess pipelines
carrying a range of substances. The report by Chaplin, RR1035, listed under FR 3.1.1, provides
failure rates for a number of different substances.
115. The failure frequencies fall into three categories, those for buried pipelines, those where the
pipeline is above ground at a gas installation and those where the pipeline is above ground but
not within a gas installation.
116. More information can also be found in PCAG Chapter 6O and PCAS Chapter 6O.
117. Failure rates for this item are categorised as follows:
Item FR 3.1.1 Buried Pipelines Page 55
Item FR 3.1.2 Above Ground Pipelines in a Gas Installation Page 58
Item FR 3.1.3 Above Ground Pipelines That Are Not Within a Gas Installation Page 60
Item FR 3.1.4 Compressors Page 61
Page 54 of 102
Item FR 3.1.1 Buried Pipelines
118. CEMHD5’s PIPIN (PIPeline INtegrity) Version 3 software package calculates failure frequencies
for buried transmission pipelines transporting a range of substances. The failure frequencies are
used as inputs to the pipeline risk assessment program MISHAP12, which is described in
Chaplin, RR1040 and in PCAS 6C. The failure frequencies are automatically calculated by
PIPIN from within MISHAP12, or they may be input manually. PIPIN is described in more detail
in the references and in PCAS 6O.
PIPIN Description
119. PIPIN contains two principal models: -
Operational Experience: using a generic approach derived from historical records of pipeline
releases.
Predictive: a predictive probabilistic approach using a Monte Carlo solution method with
fracture mechanics models to calculate failure frequencies due to third party damage for
transmission pipelines.
Current policy is to use a combination of both models: Operational Experience for Mechanical,
Corrosion, and Ground movement and other failures, and Predictive for Third Party Failures.
An option is available to enable this combination to be calculated automatically.
120. Assessors should refer to PCAG Chapter 6O for details on running the PIPIN software.
Current advice
121. The table illustrates which source of data should be used for each cause of damage. Gasoline,
for example, uses CONCAWE data for mechanical and corrosion failures, UKOPA for natural
failures and the PIPIN predictive model for TPA.
Data set
Cause CONCAWE UKOPA EGIG PIPIN predictive
Mechanical Gasoline Natural Gas LPG
Vinyl Chloride Ethylene
Carbon dioxide Spike crude oil (factored
values based on a ratio
between EGIG and
CONCAWE data)
Natural All commodity types
Corrosion Gasoline Natural Gas LPG
Spike crude oil Ethylene
Vinyl Chloride
Carbon dioxide
TPA All commodity types*
122. *May underestimate values for substances that lead to embrittlement of pipeline, for example,
CO2.
Page 55 of 102
123. PIPIN calculates failure rates for three hole sizes and ruptures, the definitions of which are
shown in the subsequent table. These were selected a number of years ago and represent HID
CEMHD5 policy.
Release name Hole diameter (mm)

Rupture >110
Large Hole >75 – 110
Small Hole >25 mm – 75
Pin Hole 25
References
Rewriting the PIPIN code to use a Monte Z Chaplin 2014

Carlo solution approach. HSE Research
Report RR1036.
Science updates to HSE’s PIPeline INtegrity Z Chaplin 2014

model (PIPIN). HSE Research Report
RR1037.
Data updates to HSE’s PIPeline Integrity Z Chaplin 2014

(PIPIN) model. HSE Research Report
RR1038.
Summary of the rewrite of HSE’s PIPeline Z Chaplin 2014

INtegrity (PIPIN) model. HSE Research
Report 1039.
Gas pipeline failure frequency predictions – D Linkens 1997

probabilistic fracture models. WSA Report No.
AM5076/RSU8000/R1.
Update of pipeline failure rates for land use Z Chaplin 2014

planning assessments. HSE Research Report
RR1035.
Ethylene pipeline failure rates for Land Use Z Chaplin 2008

Planning assessments. HSL report
RSU/SR/08/03. Confidential, not in the public
domain.
Rewriting MISHAP: The development of Z Chaplin 2014

MISHAP12. HSE Research Report RR1040.

124. See individual advice notes for specific details
116-3 Carbon dioxide pipeline Cautious best estimate –
assume rates for hazardous
Page 56 of 102
liquid pipelines
Page 57 of 102
Item FR 3.1.2 Above Ground Pipelines in a Gas Installation
ITEM FAILURE RATES

Failure Category Failure Rate (per m per
year)
-9
Rupture (>110mm diameter) 6.5 x 10
-8
Large Hole (>75 – 110mm 3.3 x 10
diameter)
-8
Small Hole (>25 mm – 75 mm 6.7 x 10
diameter)
-7
Pin Hole (25 mm diameter) 1.6 x 10
Applicability
125. The values above are applicable to general natural gas above ground installations where no site
specific information is available. The values are subject to the following general limitations:
 Pipeline not to be more than 1.5 metres above ground level.

 Above ground section of pipeline under assessment to be entirely within a secure
compound.
 Sites containing high speed rotating machines (e.g. compressor stations) should be
referred to the Topic Specialist for advice.
 Sites where the presence of the pipeline is ancillary to the main activity (e.g. process
plants) should be referred to the Topic Specialist for advice.
 The Topic Specialist should be informed on each occasion that these failure frequencies
are used.
126. Where site specific information (e.g. pipeline diameter, wall thickness, pipeline length, number
of lifts and vehicle movements) is known, a spreadsheet (Chaplin, 2011), which calculates site
specific failure rates, is available from the topic specialist.
Derivation
127. The generic failure rates are taken from a panel paper by S Pointer.
References
Above ground pipelines. HSL letter report Z Chaplin 2011
MSU/LET/2011/36. Confidential, not in the
public domain.
Failure frequencies for above ground natural S Pointer 2004
gas pipelines.
Page 58 of 102

Page 59 of 102
Item FR 3.1.3 Above Ground Pipelines That Are Not Within a Gas
Installation
129. CEMHD5 have a software package to calculate the failure rates associated with above ground
pipelines that are not contained within an installation. The program can be used for the same
substances currently considered for buried pipelines in PIPIN (Item FR 3.1.1).
Above Ground Pipelines That Are Not Within a Gas Installation Program
Description
130. The program calculates contributions to the failure rates from roads and railways in the vicinity
of the pipeline. These are combined with historical information on failures due to corrosion,
mechanical, ground movement and other natural causes. The program can also incorporate
aircraft crash frequencies into the calculations.
131. Failure rates are derived for three hole sizes and ruptures, the definitions of which are shown in
the subsequent table. These were selected a number of years ago for buried pipelines and
represent HID CEMHD5 policy.
Release name Hole diameter (mm)

Rupture >110
Large Hole >75 – 110
Small Hole >25 mm – 75
Pin Hole 25
Derivation
132. The derivation of the computer program is detailed in a report by Chaplin (2016).
References
Failure rates for above ground pipelines that Z Chaplin 2016 To be published as an HSE
are not within an above ground installation Research Report
(AGI)

Page 60 of 102
Item FR 3.1.4 Compressors
ITEM FAILURE RATES

Failure Rate (per compressor year)
Failure Category
Centrifugal Reciprocating
-6 -5
Rupture (>110mm diameter) 2.9 x 10 1.4 x 10
Large Hole (>75 – 110mm -6 -5
2.9 x 10 1.4 x 10
diameter)
Small Hole (>25 mm – 75 mm -4 -3
2.7 x 10 3.3 x 10
diameter)
-2 -2
Pin Hole (25 mm diameter) 1.2 x 10 8.6 x 10
Derivation
134. The above values are taken from MSU/LET/2012/16 by Chaplin.
135. MSU/LET/2012/16 reviews compressor failure rates available in the literature and accident
databases. The recommended failure rates are derived from incident data in the HSE
Hydrocarbons Release database.
136. The choice of hole size categories is based on those defined for pipelines in the absence of any
other data. However, it is recommended that, if known, the size of the inlet or outlet to the
compressor should be used as the rupture size.
References
Compressor failure rates MSU/LET/2012/16. Z Chaplin 2012

Page 61 of 102
Item FR 3.2 Tankers
138. Failure rates for this item are categorised as follows:
Item FR 3.2.1 Tank Containers (ISO Tankers) Page 63

Item FR 3.2.2 Road Tankers Page 65
Item FR 3.2.3 Rail Tankers Page 71
Page 62 of 102
Item FR 3.2.1 Tank Containers (ISO Tankers)
ITEM FAILURE RATES

Type of event Failure rate Notes
-6
Catastrophic failure 4 x 10 per vessel year With no pressure relief system
-6
Catastrophic failure 3 x 10 per vessel year With a pressure relief system
-5
50 mm diameter hole 3 x 10 per vessel year This includes releases due to
-5 the valve being left open by the
25 mm diameter hole 3 x 10 per vessel year
operator.
-5
-4
-4
Vapour release 5 x 10 per vessel year 50 mm diameter hole
-7
50 mm diameter hole 6 x 10 per lift Failures due to dropping of the
tank < 5 metres.
-8
Catastrophic failure 3 x 10 per lift Failures due to dropping of the
tank > 5 metres.
-7
50 mm diameter hole 6 x 10 per lift Failures due to dropping of the
tank > 5 metres
-11
50 mm diameter hole 9 x 10 per pass Failures due to a container
being dropped on to the tank.
Derivation
139. Failure rates are based on the report by J.Gould, RAS/00/10. Tank containers are tanks built
within an ISO standard frame, 8 ft square and either 20 or 40 ft in length, allowing them to be
fitted on several modes of transport and stacked. The failure rates apply to cold failures of
pressure vessels not induced by fire engulfment or impingement. Empty tank containers are
expected to contribute little to the off-site risk and should be excluded.
140. A literature search was performed to identify failure events of the tank containers and lifting
equipment. It is assumed that tank containers dropped from up to about one ISO container high
(less than 5m) such as when stacking two-high will only produce a 50 mm hole. Tank containers
dropped from a greater height such as when lifted above two-high stacks are assumed to suffer
catastrophic failure 5% of the time, and a 50 mm hole for the remainder.
References
New Failure Rates for Land Use Planning J Gould 2000
QRA. HSL internal report RAS/00/10.

Page 63 of 102
133 ISO tanks storing LNG Rates derived from the generic
rates with open valve
contribution removed.
132 Liquid hydrogen tanker offloading facility Use generic rates ignoring
those associated with lifting.
Rates for hose and coupling
failure also given.
121 Liquid hydrogen isotank used as semi-permanent storage tank Use generic rates ignoring
those associated with lifting
Bibliography

Tank container failures. A B Harding Mar 96 Various failure values given as per
yr and per lift.
-6
HF QRA. Confidential, not in the public Not given Jul 94 Catastrophic: 6.5 x 10 per yr, also
domain. gives rates for lesser leaks.
Page 64 of 102
Item FR 3.2.2 Road Tankers
ITEM FAILURE RATES

Failure Category Failure Rate (per km)
-7
Serious accident rate 2.2 x 10
Derivation
143. Failure rate is based on a report by Z. Chaplin, RSU/SR/2009/10. The rate was derived from
MOD data for “serious” on-site accidents involving vehicles of over 4 tonnes in weight, for the
period 1997 - 2008. A serious accident was defined as one for which the cost of repair was at
least £10,000.
References
Derivation of an on-site failure rate for road Z Chaplin 2009
tankers. HSL internal report RSU/SR/2009/10.

66 Unloading Ethylene oxide from road tankers Catastrophic failure rate
13 Road tanker unloading rates for chlorine and bromine tank containers Catastrophic failure rate
Bibliography

Major hazard aspects of the transport of Advisory 1991 Frequency of spills from various
dangerous substances. Committee on initiating events (p237).
Dangerous Frequencies for punctures and
Substances small spills during stopovers (p252).
Unloading event frequencies for
LPG (p258).
Gaskets, coupling and joint failures
for ammonia (p259).
Gasket and valves for chlorine
(p264 and 285-6).
Hose and coupling failure for
Page 65 of 102

ammonia unloading (p288).
CIMAH Safety Case. Confidential, not in the W S Atkins June Assuming 600 deliveries per year
public domain. 1994 the catastrophic failure rate is given
-6
as 3.6x10 per yr.
-6
Calculation of Release Events Frequencies. W S Atkins 2 July Serious accident rate of 1.2x10
Confidential, not in the public domain. 1995 per km, used to derive a
catastrophic rupture frequency of
-8
3.9x10 per yr.
-7 -
Chlorine Safety Report – The Likelihood of W S Atkins October Accident rate 1.8x10 per journey
-6
Accidental Chlorine Release Events. 1995 estimated frequency 2.2x10 per yr.
Risk Assessment Acrylonitrile. Risk Courtaulds August Tanker failure for acrylonitrile
-8 -6
Assessment Butadiene. Confidential, not in Research 1988 delivery; 9x10 – 3.3x10 per yr.
the public domain.
The Major Hazard Aspects of the Transport of D Leeming and F August Compares different data sources for
Chlorine. Confidential, not in the public Saccomanno 1993 road and rail tanker accident rates
domain. and fault probability.
-6
The Likelihood of Accidental Release Events. Rhone-Poulenc Not Given A value of 1x10 per yr for
Confidential, not in the public domain. Chemicals Ltd – catastrophic failure of a road tanker.
Avonmouth Site
-7
The Likelihood of Accidental Chlorine Release W S Atkins 1994 Catastrophic rupture: 2.9x10 per
Events (Extract From a CIMAH Safety Case). yr.
-6
Confidential, not in the public domain. Partial rupture: 2.9x10 per yr.
-5
Risks Associated with the Storage of and Use SRD November Assumes 5x10 per yr as a base
of Chlorine at a Water treatment Plant (2
nd
1981 rate for catastrophic failure.
Draft). Confidential, not in the public domain.
Page 66 of 102
Item FR 3.2.2.1 LPG Road Tanker BLEVE
ITEM FAILURE RATES

Failure Category Failure Rate (per Applicability
delivery)
-7
Sites with small tanks 1 x 10 Few/no mitigation measures
-8
Sites with large tanks 1.1 x 10 Significant number of mitigation
measures present
TYPICAL MITIGATION MEASURES

Fixed water sprays/ deluge system
Passive fire protection coating on vessels
Portable fire fighting equipment
Fire wall
Storage compound protection (e.g. fencing)
Control of ignition sources
Hazard warning notices
Derivation
146. All rates are based on the report by Z. Chaplin, MSU/LET/2011/38. Typical mitigation measures
are detailed in the LP Gas Association Code of Practice 1.
147. Small tanks are considered to typically have a capacity of less than 5 tonnes. Such tanks are
likely to be found at domestic or educational sites and are unlikely to have any built-in mitigation
systems.
148. Large tanks are more likely to be found at larger industrial installations and have capacities of
around 25 tonnes or greater. These types of site are likely to contain a significant number of the
mitigation measures listed.
149. If a site has manifolded tanks, then this should be treated as one visit, otherwise, each
individual tank will be counted as a tanker delivery operation.
References
LPG road tanker BLEVE frequencies. HSL Z Chaplin 2011
internal report MSU/LET/2011/38.
LP Gas Association 2009
Code of practice 1. Bulk LPG storage at fixed
installations. Part 1:2009. Design, installation
and operation of vessels located above
ground.
Page 67 of 102

108 BLEVE of road tanker carrying 26 te LPG
Page 68 of 102
Item FR 3.2.2.2 Incompatible Deliveries
ITEM FAILURE RATES

Site type Failure Frequency
(per delivery)
-6
Below Average 6 x 10
-7
Average 1 x 10
-8
Above Average 5 x 10
Derivation
151. The incompatible deliveries failure rates apply to scenarios whereby two incompatible
substances are accidentally mixed during a delivery, for example, the contents of a tanker being
offloaded into the wrong tank. The failure rates are based on the report by Bell and Keeley,
MSU/LET/2011/39.
152. Three site type classifications have been defined based on safety management system
standards:
Below average The process of receiving a tanker to site and the delivery itself is not
always well managed. The offloading points are not locked and are not
clearly separated, well laid out or well labelled. Incompatible connectors
are generally used.
Average The process of receiving a tanker to site and the delivery itself are well
controlled by operating procedures. The offloading points are normally
locked and are well laid out and labelled. Incompatible connectors are
used.
Above average The process of receiving a tanker to site and the delivery itself are well
controlled by operating procedures. In addition, there is evidence that the
site is working to maximise the safety and reliability benefits of the
acknowledged operating conditions and to continuously improve. The
offloading points are normally locked and keys are controlled. The
offloading points are physically separated, well laid out and clearly
labelled. Incompatible connectors are used.
153. For all site types, work is completed free of unreasonable time pressures.
154. The site type definitions do not refer to the site’s ability to comply with their legal requirements
but to their success at meeting their own safety management standards. The choice of site type
will be an operational issue.
References
Failure frequency for incompatible deliveries J Bell and D Keeley 2011
MSU/LET/2011/39.
Page 69 of 102

Page 70 of 102
Item FR 3.2.3 Rail Tankers
156. Currently there are no agreed HSE failure rates for this item. The following references
represent another source of information on the subject.
Bibliography
Major hazard aspects of the transport of Advisory 1991 Frequency of spills from various
dangerous substances. Committee on initiating events (p237).
Dangerous Frequencies for punctures and
Substances small spills during stopovers (p252).
Unloading event frequencies for
LPG (p258).
Gaskets, coupling and joint failures
for ammonia (p259).
Gasket and valves for chlorine
(p264 and 285-6).
Hose and coupling failure for
ammonia unloading (p288).
The Major Hazard Aspects of the Transport of D Leeming and F August Compares different data sources for
Chlorine. Confidential, not in the public Saccomanno 1993 road and rail tanker accident rates
domain. and fault probability.
Page 71 of 102
Item FR 3.3 Ship Freight
157. The transfer of substances via ship hardarms is covered in Item FR 3.3.1.
Page 72 of 102
Item FR 3.3.1 Ship Hardarms
158. The item failure rates are relevant to transfer operations via ship hardarms.
159. The first table is for the transfer of liquefied gases.
ITEM FAILURE RATES

Failure frequencies per transfer operation
Cause of failure (1) Guillotine break Hole = 0.1 cross Simultaneous guillotine
sectional area of breaks (for multiple
pipe arms)
Connection failures (2)
Arm 3.4e-7 3.1e-6
Coupler (3) 5.1e-6 -
Operator error (4) 5.4e-7 4.9e-6
Sub-total per arm 6.0e-6 8.0e-6
Ranging failures (5)
Mooring fault 6e-7 -
Passing ships (6) 2e-7 -
Sub-total per system 0.8e-6 0.8e-7 When multiple
arms used (7)
Total failure rate when one arm used (8) 7e-6 8e-6 -
Total failure rate when 2 arms used (8) 13e-6 16e-6 1e-7
Total failure rate when 3 arms used (8) 19e-6 24e-6 1e-7
160. The second table is for the transfer of liquid cargo.
ITEM FAILURE RATES

Failure frequencies per transfer operation for liquid cargo
Cause of failure (1) Guillotine break Hole = 0.1 cross Simultaneous guillotine
sectional area of breaks (for multiple
pipe arms)
Connection failures (2)
Arm 3.2e-6 29.0e-6
Coupler (3) 5.1e-6 -
Operator error (4) 3.6e-6 3.6e-6
Sub-total per arm 1.2e-5 3.3e-5
Ranging failures (5)
Mooring fault 19.2e-6 -
Passing ships (6) 6.6e-6 -
Sub-total per system 2.6e-5 2.6e-6 When multiple
arms used (7)
Total failure rates when one arm used (8) 3.8e-5 3.3e-5 -
Total failure rates when 2 arms used (8) 5.0e-5 6.6e-5 2.6e-6
Page 73 of 102
Total failure rates when 3 arms used (8) 6.2e-5 9.9e-5 2.6e-6
161. Notes to both tables are as follows:
1 The table does not include failures on the ship itself e.g. pipes, pumps, valves, flanges.
Incidents of overfilling of the ship during transfers to a ship are not included. Some of the
failure frequencies are dependent on the length of transfer time and a 12-hour transfer time
has been assumed.
2 Connection failures apply to every unloading arm that is used during the transfer operation.
Failure may lead to flow from both ends of the disconnected arm.
3 It is assumed that all unloading arms handling liquified gases have emergency release
couplings (ERC) designed to achieve a quick release with a minimum of spillage. The
coupler failures specified here are events where the ERC parts without the valves in the
coupling closing. Incidents where the coupling parts correctly will lead to minimal spillage.
4 This includes not making a connection correctly, opening the wrong valve or at the wrong
time, or spilling cargo when disconnecting or venting.
5 Ranging failures are due to gross movement of the ship at the jetty. It is assumed that the
unloading system is fitted with ranging alarms. (Absence of ranging alarms is assumed to
increase the failure frequency due to Mooring faults by a factor of 5 and absence of ERC
couplings would increase the Passing ships frequency by a factor of 5).
6 The failure frequency due to passing ships assumes 10 passing ships during offloading.
7 Ranging failures may simultaneously affect more than one connection where multiple hard
arms are in use (i.e. the ship moves and more than one hard arm becomes disconnected).
When ranging incidents occur where multiple hard arms are connected it is assumed that
10% of the failures will lead to flow from two of the connections.
8 The totals in the last three rows indicate how the data should be used. If there is only one
arm then it is not possible to have two simultaneous guillotine breaks. If two are used then
the probability of the connection failures is doubled, the ranging failures probability remains
the same and there is now a probability that two simultaneous guillotine breaks can occur.
If three hard arms are used then the probability of a connection failure is tripled, the
probability of a ranging failure remains the same, and the probability of any two out of the
three hard arms suffering a simultaneous guillotine break is assumed to be the same as
when two hard arms are used.
Derivation
162. The failure rates presented here are based on the panel paper by P Buckley ‘Failures during
ship transfers’ 8/11/04, 10/01/05 and 27/06/05 that reviewed a number of available reports and
data sources. Failure Rate Advice note 124 summarises the derivation of the failure rates.
References
Major hazard aspects of the transport of Advisory 1991
dangerous substances, HSC HMSO1991 Committee on
ISBN 0-11-885676-6. Dangerous
Substance
Risk assessment of QEII dock, Eastham. DNV 1992
340/CD/1024/2001. Confidential, not in the
Page 74 of 102
public domain.
Failures during ship transfers, Panel Paper P Buckley 08/11/04
Panel minutes. Confidential, not in the public 08/11/04
domain.
Failures during ship transfers – Proposal for P Buckley 10/01/05
PCAG 6K, Panel Paper. Confidential, not in
the public domain.
domain.
Failures during ship transfers – Proposal for P Buckley 27/06/05
PCAG 6K, Panel Paper. Confidential, not in
the public domain.
domain.

FR 124 Ship hardarms. Guillotine and hole failure rates
due to a number of causes.
Page 75 of 102
Item FR 4 Moveable Storage
164. Moveable storage is further subdivided as follows:
Item FR 4.1.1 Drums 1 te Page 77

Item FR 4.1.2 Drums 210 litre Page 79
Item FR 4.1.3 Cylinders Page 81
Item FR 4.1.4 IBCs Page 82
Item FR 4.1.5 Portable Containers Page 84
Item FR 4.1.6 Small Container Page 86
165. For Items FR 4.1.3 and FR 4.1.6 there are currently no agreed HSE failure rates but relevant
advice notes have been included in each section.
Page 76 of 102
Item FR 4.1.1 Drums 1 te
ITEM FAILURE RATES

Type of event Failure rate Modifier Notes
-1
(cpm yr )
Spontaneous drum failure 2 l Liquid and gas off-take plants
Holes in drum (large) 1.2  m.n Liquid and gas off-take plants
Holes in drum (small) 5  m.n Liquid and gas off-take plants
Sheared liquid valve 4.5  m.n Liquid and gas off-take plants
Increased by a factor of 5 if valve
points towards centre of room
Sheared vapour valve 4.5  m.n Liquid and gas off-take plants
Increased by a factor of 5 if valve
points towards centre of room
Coupling failure (guillotine) 10 m Liquid and gas off-take plants
Coupling failure (leak) 90 m Liquid off-take plants
Coupling error (liquid) 1 m Liquid off-take plants
x 10 for sites with automatic
change over
Coupling error (liquid) 0.01 m Gas off-take plant
Coupling error (vapour) 1 m Liquid and gas off-take plants
Uncoupling error (liquid) 10 m Liquid off-take plant
Uncoupling error (vapour) 100 m Gas off-take plant
Pipework 3 p Liquid and gas off-take plants
166. Where:
l is the average number of drums stored on site

m is the total number of drums used on the site per year
n is the number of movements per drum
p is the length of liquid or vapour line in metres
Derivation
167. The original values were taken from the MHAU handbook volume 3 (now archived) for chlorine
drums, and are applicable to other 1 te pressure vessel drums. Fault and event trees are used
with a review of previous work and expert judgement to derive the failure rates. Drum failure is
derived from static chlorine storage vessel failure rates, while those for holes and sheared
valves are derived from a drum dropping frequency.
Page 77 of 102
References

Bibliography

Risk assessment of chlorine transport. Technica Jun 90 Historical data from Hong Kong and
Confidential, not in the public domain. the US transport of drums
-7
HF QRA. Confidential, not in the public Not given Jul 94 2 x 10 per drum per yr.
domain.
-6
Generic land use planning consultation zones Not given Oct 94 Catastrophic failure rate 1.5 x 10
- chlorine. Confidential, not in the public per drum per yr.
domain.
Page 78 of 102
Item FR 4.1.2 Drums 210 litre
ITEM FAILURE RATES

Type of event Failure Rate (per year)
Catastrophic (2  drum contents released) 8.4  10 T/4
-5
Catastrophic (1  drum contents released) 2.0  10 T/4

-6
3.6  10 T/4
-5
Major failure of 2 drums (10 mm hole)
2.0  10 T/4
-6
Major failure of 1 drum (10 mm hole)
6.0  10 T/4 + 8.0  10 Q
-6 -5
Minor failure of 1 drum (5 mm hole)
170. Where:
T is the throughput per year

Q is the maximum number of drums in storage at any time
Derivation
171. The assumptions in the derivation of the failure rates are:
 The drums are constructed in steel;
 The drums have a dimension of 585 mm in diameter and 880 mm in height;
 Four drums are stored on a wooden pallet;
 Pallets may be stored on top of each other;
 A maximum of two pallets form a stack;
 The drums are not secured to the pallet;
 The drums have openings on the top that are sealed or capped, but no valves;
 Two movements are associated with each drum, both by fork-lift truck (FLT);
 The drums are on a storage site; and
 If a FLT driver misjudges the location of the pallet, there is the potential for the forks to
impinge on 2 drums simultaneously.
172. Values for 210 l drums have been derived using a combination of information in the FR notes,
the Vectra work on Intermediate Bulk Containers (IBCs), and the review of the IBC Vectra work.
The hole sizes are the same as those used for IBCs.
173. A large hole in the base of the drum could lead to the release of all the contents. This will have
similar effects to a catastrophic failure. Assessors should model a catastrophic failure as an
instantaneous release, rather than a hole.
Page 79 of 102
References
Review of Failure Rates for Drums Storing Zoe Chaplin 2014
Hazardous Materials, MSU/2014/16.
Failure rates for Intermediate Bulk Containers Zoe Chaplin 2013
(IBCs) MSU/2013/21. Confidential, not in the
public domain.
Report No. 300-232-R01, Revision A. Vectra 2001

Page 80 of 102
Item FR 4.1.3 Cylinders
175. Currently there are no agreed HSE failure rates for this item. See failure rate advice notes for
specific failure rates, or refer to Topic Specialist.

119 Chlorine cylinders Catastrophic and valve shear
Page 81 of 102
Item FR 4.1.4 IBCs
ITEM FAILURE RATES

Type of event IBC failure rates (cpm/yr)
Catastrophic 71n + 14N
Major (10 mm hole) 113n + 13N
Minor (5 mm hole) 52n + 930N
177. Where:
N is the average number of containers continuously in store

n is the number of containers passing through the site per year
Derivation
178. Values for IBCs were initially derived by Vectra in 2001 using a fault tree approach, but the
failure rates were never formally adopted. Various FR notes have been issued since the Vectra
analysis to provide failure rates for non-UN IBCs and to allow for 2 movements per container on
site. A review of the FR notes and the Vectra analysis was performed in 2013, leading to a
restructure of the fault trees and revised failure rates. A review of the representative hole sizes
was also performed which concluded that the definitions for the minor, major and catastrophic
releases should be revised to 5 mm for minor releases, 10 mm for major releases and 25 mm
for catastrophic releases. The advice has since been modified so that catastrophic failures
should be modelled as an instantaneous release, rather than a hole. It was found that there was
minimal difference in the failure rates calculated for UN and non-UN IBCs and so the same
failure rates should be applied to all types of IBC.
179. The failure rates include leaks from the cap and valves as well as from the main body of the
IBC. They are split between failures that may occur during movement (e.g. fork lift truck
puncture) and those that may occur during storage (e.g. degradation of the body of the IBC over
time). The failure rate due to movement should be multiplied by the number of IBCs passing
through the site per year, and assumes that each IBC will be subject to two movements on the
site. The failure rate due to storage should be multiplied by the average number of IBCs
continuously in store.
180. It should be noted that a large hole half way up an IBC will lead to the loss of approximately half
the contents. If the hole is in the base of the IBC, however, the full contents of a 1 m 3 IBC will be
lost within 30 minutes. This will have similar effects to a catastrophic failure for this size of IBC.
Some IBCs can have larger volumes and hence assessors should model a catastrophic failure
as an instantaneous release, rather than a hole.
181. In order to derive a value for N, the applied for quantity should be divided by the density of the
substance (either named or exemplar). For example, for 50 te of B1 very toxic material,
assuming methyl chloroformate as the exemplar, N will be 41 (50000 kg of substance divided by
the density of methyl chloroformate at 15C, which is 1229 kg m-3).
References
Page 82 of 102
Failure rates for Intermediate Bulk Containers Zoe Chaplin 2013

(IBCs) MSU/2013/21. Confidential, not in the
public domain.
Report No. 300-232-R01, Revision A. Vectra 2001

Page 83 of 102
Item FR 4.1.5 Portable Containers
ITEM FAILURE RATES

Type of event Failure rate Modifier
-1
(cpm yr )
Catastrophic container failure 2 N
Holes in container (large -10 mm) 1.2 n
Holes in container (small – 5 mm) 5 n
183. Where:
N is the average number of containers stored on site

n is the number of movements per container x the total number of containers passing through
the site per year
Derivation
184. The values have been derived in a Failure Rate Advice Note (FR 136) where a portable
container has been defined as:
 Having a test pressure from 1.5 bar to 10 bar;
 Having a minimum shell thickness in stainless steel (typically 6 mm);
 Being required to have a pressure release device (disk, gauge and PRV or just PRV);
and
 If a bottom opening is allowed, there have to be 3 independent shut offs.
185. A typical portable container is 1 m3 and rated to ~5 bar, containing very toxic or volatile
substances.
186. The failure rates are based on the 1 te drum failure rates (see Item FR 4.1.1), and the hole
sizes are consistent with IBCs.
187. A large hole in the base of the portable container could lead to the release of all the contents.
This will have similar effects to a catastrophic failure. Some portable containers can have larger
volumes and hence assessors should model a catastrophic failure as an instantaneous release,
rather than a hole.
References

Page 84 of 102
138 800 litre portable cylinders, operating at 9.8 barg. Catastrophic, large and small
hole rates derived, together
with valve and coupling failures
and errors.
137-2 Portable storage tanks, type T22, for acrolein, pressurised to a minimum Catastrophic, large and small
of 10 bar. hole rates derived.
136 Portable stainless steel containers, pressurised between 1.5 and 10 bar. Catastrophic, large and small
hole rates derived.
Page 85 of 102
Item FR 4.1.6 Small Container
189. Currently there are no agreed HSE failure rates for the different types of small containers. See
failure rate advice notes for specific failure rates, or refer to Topic Specialist.

106 52 l containers, rated to 200 bar, of pressurised liquid WF6 and 8 l toxic Catastrophic and 50 mm, 25
containers`, rated to 200 bar, of pressurised liquid Cl2. mm, 13 mm and 6 mm hole
failure rates provided for 52 l
and 8 l containers.
67 5 l UN-certified HF drums. Catastrophic (2 types of
release), major and minor
57 25 l HF plastic carboys, delivered by lorry, removed to storage by FLT Catastrophic (2 release rates),
and transported on wooden pallets with 16 carboys to a pallet. major and minor failure rates
provided.
50 Plastic containers for hydrogen peroxide transported by lorry on wooden Catastrophic, major (90 mm)
pallets and transferred on site by FLT. and minor (25 mm) failure rates
provided.
Page 86 of 102
Event Data
191. Event data consists of external hazards that need to be taken into consideration when deriving
an overall probability of failure for an item. The event data are split as follows:
Item ED 1 Aircraft Strike Rates Page 88

Item ED 2 Flooding Page 94
Item ED 3 Lightning Strike Rates Page 95
Page 87 of 102
Item ED 1 Aircraft Strike Rates
Introduction
192. The following is taken from Chaplin (2017), with additional information taken from Chaplin
(RSU/SR/2009/06). The background crash rates quoted should be used for all sites whereas
the remainder of the methodology need only be used when a site lies close to an airfield or
beneath a flight path.
Background Crash Rate

The first stage in calculating the frequency of an aircraft striking an installation is to establish a
background crash rate. The values in
193. Table 1 have been derived by Chaplin (2017) and are updates to Chaplin (RSU/SR/2009/06).
The earlier work was based on Atkinson and Thompson (2008), which was an update to the
report by Byrne (1997).
Table 1 Aircraft crash rates

-2 -1 -5
Aircraft Category Crash rate (km yr x10 )
Light aircraft 1.85
Helicopters 1.03
Small transport aircraft 0.22
Large transport aircraft 0.07
Military combat aircraft 0.67
Total 3.84
Airfield Rates
The values reported in
194. Table 1 assume that the site is not within 5 miles of an airfield. For sites within this distance, a
different set of values has been derived. According to the report by Byrne, consideration should
only be given “to airfields within 10 km of the site unless the airfield is particularly busy (>
20,000 movements annually), or if the runway orientation is unfavourable for the site (i.e. the
runway is pointing roughly in the direction of the site)”. Table 2 reports the probability of an
aircraft crashing on take-off or landing as calculated by Chaplin (2017).
Table 2 Airfield-related crash rates

Aircraft Category Crash rate (per take-off or
-6
landing x10 )
Light Aircraft 2.5
Civil helicopters 2.4
Small transport 3.8
Large transport 0.08
Page 88 of 102
Military combat 3.50
195. Using the values in Table 2 is not straightforward as it depends on the direction of the site from
the airfield and the directions of the runways. The equation that determines the frequency, g,
with which a unit ground area at position (r,) relative to the runway would suffer an impact as a
result of N runway movements per year is given by:
g  NRf (r , ) (1)
where R is the probability per movement of a landing or take-off accident and f(r,) is the probability of
unit ground area at (r,) suffering an impact, given that an accident has occurred. Unit ground area is
defined as 1 km2 whilst r is measured in km from the runway threshold and  is the angle measured in
degrees between the extended runway centreline and a vector parallel to r (see Figure 6). R can be
found from Table 2 whilst different expressions exist for calculating f(r,) depending on the category of
aircraft. For some categories of aircraft, alternative equations have been derived using an (x,y)
coordinate system to generate probabilities of accidents for take-offs and landings separately (FT(x,y)
and FL(x,y) respectively). See Byrne for more detail. The calculated values of g would need to be
added to those in
196. Table 1 to provide a total crash rate for a specific location if it is near an airfield.
Figure 6 The r,  coordinate system for accident locations in the vicinity of an airfield
Flight Paths
197. It is possible to calculate crash rates associated with particular airways so that a specific rate
may be derived if the site lies beneath a flight path. This will also take into account whether the
site is below an upper or lower airway. The calculation is based on the assumption that crashes
are normally distributed about the airway centreline, with a standard deviation equal to the
airway altitude. The actual equations can be found in Byrne but the in-flight reliabilities for each
aircraft category are also required and these are shown in Table 3. These values have not been
updated and are taken from Byrne.
Table 3 In-flight aircraft reliabilities

Aircraft Category Reliability (crashes per flight km)
-7
Light Aircraft 1 x 10
-7
Civil helicopters 1 x 10
-10
Small transport 3.9 x 10
-11
Large transport 4.7 x 10
-8
Military combat 2 x 10
Page 89 of 102
Worked Example
The values in
Table 1 can be used to calculate catastrophic failures and leaks from different hole sizes for vessels.
The methodology illustrated in
198. Table 4 can also be seen in FR19.
The consequences of a crash within a specified distance of the vessel are assumed for various aircraft
types. For example, it is assumed that a light aircraft crashing within a 50 m radius of the vessel will
cause a catastrophic failure, whereas, if it falls between 50 m and 70 m from the vessel, it will generate
a 50 mm hole, etc. The values are shown in
Table 4. Note that the values calculated differ from FR19 as there were errors in the original work,
which have been corrected in
199. Table 4. Also, the distances used are for the purposes of illustration only. Each site will require
a specific assessment to determine at what distance each aircraft type is likely to cause
damage. This may depend on the construction of the site, the topology of the land or any other
factor that could affect how much damage an aircraft crash would cause.
Table 4 Example of how to use the background crash rates

-3
Aircraft Type Failure Distance (m) Area (x 10 Background Vessel Rate (x
2 -6 -8 -1
km ) Rate (x 10 10 yr )
-2 -1
km yr )
Light Cat  50 7.85 18.5 14.5
50 mm 50 < distance  70 7.54 18.5 13.9
25 mm 70 < distance  90 10.1 18.5 18.7
13 mm 90 < distance  100 5.97 18.5 11.0
6 mm 100 < distance  120 13.8 18.5 25.5
Helicopter Cat  50 7.85 10.3 8.1
50 mm 50 < distance  70 7.54 10.3 7.8
25 mm 70 < distance  90 10.1 10.3 10.4
13 mm 90 < distance  100 5.97 10.3 6.1
6 mm 100 < distance  120 13.8 10.3 14.2
Small Transport Cat  60 11.3 2.2 2.5
50 mm 60 < distance  100 20.1 2.2 4.4
25 mm 100 < distance  125 17.7 2.2 3.9
13 mm 125 < distance  150 21.6 2.2 4.8
6 mm 150 < distance  170 20.1 2.2 4.4
Large Transport Cat  100 31.4 0.7 2.2
50 mm 100 < distance  150 39.3 0.7 2.8
25 mm 150 < distance  200 55.0 0.7 3.9
13 mm 200 < distance  220 26.4 0.7 1.8
6 mm 220 < distance  230 14.1 0.7 1.0
Military Combat Cat  30 2.83 6.7 1.9
Page 90 of 102
50 mm 30 < distance  60 8.48 6.7 5.7

25 mm 60 < distance  90 14.1 6.7 9.4
13 mm 90 < distance  120 19.8 6.7 13.3
6 mm 120 < distance  150 25.4 6.7 17.0
Total Catastrophic Failure 29.2
Total 50 mm hole 34.5
A second example illustrates the use of the values in
200. Table 1, Table 2 and Table 3. Assume a site of 1 km2 that is located 1 km to the west and 1 km
to the north of an airfield where the prevailing winds mean that aircraft take-off from east to west
at all times, meaning that only take-offs need to be considered for this exercise. This is
equivalent to an r value of 2 km and a  of 45. Using equation (6) from Byrne gives a value of
f of 0.021, which should be used for light aircraft and can be applied to either take-offs or
landings. For the other aircraft categories (excluding helicopters), as only take-offs need to be
considered, equation (8) from Byrne should be used. This gives a value for FT of 0.013. Next it
is necessary to have information on the number of movements at the airfield. Example values
for an imaginary airfield are shown in Table 5.
Table 5 Aircraft movements at imaginary airfield

Aircraft Category Number of movements (take-offs and
landings)
Light aircraft 200
Small transport aircraft 200
Large transport aircraft 200
Military combat aircraft 0
201. These values are then halved to take into account that it is only take-offs that are of interest
(landings occur in the same direction as take-offs so it is assumed that they do not pass over
the site) and they are then multiplied by the relevant f or F value and the values in Table 2. This
is shown in Table 6.
Table 6 Calculation of the frequency of an area suffering an impact

-6 -6
Aircraft Category No. of take-offs F or f value Crash rate (x10 ) Frequency (x10 /year)
Light aircraft 100 0.021 2.5 5.25
Small transport aircraft 100 0.013 3.8 4.94
Large transport aircraft 100 0.013 0.08 0.10
Military combat aircraft 0 0.013 3.5 0
Page 91 of 102
The total frequency can be found by adding these together, giving a rate of 10.29 x 10-6 /year. Next the
values in
202. Table 1 need to be added to this value to take into account the background crash rate. This
gives a new total of 4.87 x 10-5 /year.
203. The final step is to calculate the contribution from an airway. Assume the site is directly below a
lower airway (i.e. the aircraft altitude is 5 km). This gives, according to Byrne, an area factor of
0.395. The in-flight reliabilities (Table 3) can then be multiplied by the number of movements on
that airway per year to give a crash rate. This is shown in Table 7, assuming values for the
number of movements for each of the aircraft types.
Table 7 Crash rates below an airway

-7
Aircraft Category No. aircraft Area factor In-flight Crash rate (x10 )
-10
using airway reliability (x10 )
Light aircraft 500 0.395 1000 197.5
Helicopters 200 0.395 1000 79.0
Small transport aircraft 1000 0.395 3.9 1.54
Large transport aircraft 2000 0.395 0.47 0.37
Military combat aircraft 100 0.395 200 7.9
204. The total crash rate below an airway is 2.86 x 10-5 /year. This can then be added to the previous
total to give an overall rate of 7.73 x 10-5 crashes/year
References
Update of aircraft crash rates used in HSE’s Chaplin Z 2017
Failure Rate and Event Data document.
MSU/2015/19. To be published on HSE’s
website.
Aircraft crash rates, HSL internal report Chaplin Z 2009
RSU/SR/2009/06. Confidential, not in the
public domain.
Review of aircraft crash rates for the UK up to Atkinson T and 2008 This is an update of the report by
2006. ESR/D1000646/001/Issue 1. Thompson P Byrne
The calculation of aircraft crash risk in the UK. Byrne JP 1997
AEA Technology, Contract Research Report
150/1997.

Page 92 of 102
19 Liquid hydrogen vessels Demonstrates methodology
Page 93 of 102
Item ED 2 Flooding
206. The first stage when trying to derive a value for frequency of flooding for a specific site is to
determine whether or not the site falls within a coastal or river flood plain. The Environment
Agency (EA) website, which covers England and Wales, or the Scottish Environment Protection
Agency (SEPA) website, can be used to assess where a particular site falls. If it is outside a
flood plain then the risk from flooding can be considered to be negligible and the contribution
from this event can be ignored.
207. If the site does fall within a flood plain, then more information on the probability of flooding per
year can be obtained from either the EA or the SEPA. In the case of the former, they identify
three areas to which they assign low, moderate or significant likelihood categories. Low
likelihood areas correspond to a 1 in 200 chance per year or less of flooding, moderate is
between a 1 in 200 chance per year and a 1 in 75 chance per year and significant likelihood
corresponds to a greater than 1 in 75 chance per year of flooding. The SEPA website indicates
areas in Scotland with a greater than 1 in 200 chance per year of flooding.
208. Even if the site is considered to be within one of the areas at risk of flooding, further information
would be required to assess the likelihood of flood waters reaching a level at which damage
could be caused to the site. This would require expert judgement and liaison with the relevant
environment regulatory body. Once a probability of reaching this level of flooding has been
determined, it would then be necessary to use further expert judgement to determine the level
of plant damage sustained, e.g. the relative chance of a catastrophic failure occurring, or holes
of differing sizes. It is not possible to produce a generic value as each site will have a different
level of flood protection in place and will be potentially subject to different levels of flooding.
References
http://www.environment-agency.gov.uk/default.aspx accessed on 2 Specifically, the
September 2009. flood maps were
viewed.
http://www.sepa.org.uk/flooding/flood_map.aspx accessed on 2
September 2009.
Page 94 of 102
Item ED 3 Lightning Strike Rates
209. The British Standards Institute document, BS EN 62305-2:2006, details the calculations
required to determine the frequency with which lightning will strike a structure and cause
damage to it. The first stage is to calculate the average annual number of events that have the
potential to cause damage. In order to do this, it is first necessary to calculate the collection
area around the structure in question. For isolated structures on flat ground, this is defined as
“the intersection between the ground surface and a straight line with 1/3 slope which passes
from the upper parts of the structure (touching it there) and rotating around it” (in BS EN 62305-
2:2006). For the simplest structure of a cylinder with height H and radius R, this would equate to
an area, A, enclosed by the radius 3H + R, i.e.
A   (3H  R)2 (2)
210. This is illustrated in Figure 7 and all dimensions are measured in metres. As the shape of the
structure becomes more complex, so approximations may need to be made to calculate the
collection area but the general principle remains the same. Refer to BS EN 62305-2:2006 for
more detail. For complex sites it is possible to divide the site into various zones, calculate the
collection area of each zone and then follow all further calculations for each of the zones. The
results from each zone are then summed together to give an overall damage probability.
3H
3H
Figure 7 Collection area of an isolated cylindrical structure
Page 95 of 102
211. The second stage is to calculate the number of dangerous events, ND, for a structure using the
equation:
N D  Lgfd  A  Floc  10 6 (3)
where:
Lgfd = lightning ground flash density (/km2/year)

Floc = location factor of the structure
A = collection area calculated in equation 1 (m2).
212. The lightning ground flash density varies across the UK, from 0.02 /km 2/year in the north of
Scotland, to 1.0 /km2/year in parts of central England. The values can be found from Figure 1 in
BS EN 62305-2:2006. The location factors are listed in Table 8 and were obtained from BS EN
62305-2:2006.
Table 8 Location factors

Location Floc
Surrounded by higher objects or trees 0.25
Surrounded by objects or trees of the same height or 0.5
smaller
No other objects in the area 1
No other objects in the area and on top of a hill or knoll 2
213. To calculate the probability that a structure will be damaged, given a lightning strike, it is first
necessary to consider whether there is a lightning protection system (LPS) in place. According
to BS EN 62305-1:2006 there are four levels of protection that these systems can offer, I
through to IV with I offering the highest level of protection. These are detailed in Table 5 of BS
EN 62305-1:2006. The probabilities of damage being caused are listed in Table 9 and were
obtained from BS EN 62305-2:2006.
Page 96 of 102
Table 9 Probabilities of damage given a lightning strike, depending on the lightning protection measures in
place
Details of structure Class of lightning protection system Probability
(LPS)
Not protected by LPS - 1
Protected by LPS IV 0.2
III 0.1
II 0.05
I 0.02
Air-termination system conforming to LPS I and a continuous metal or reinforced 0.01
concrete framework acting as a natural down-conductor system.
Metal roof or an air-termination system, possibly including natural components, with 0.001
complete protection of any roof installations against direct lightning strikes and a
continuous metal or reinforced concrete framework acting as a natural down-conductor
system.
214. These probabilities can then be multiplied by the number of dangerous events, ND, to produce
an overall frequency of damage to a structure. The type of failure associated with the damage is
likely to be structure dependent. Expert judgement may be required to produce factors that can
be used as multipliers to the existing results to determine the likelihood of catastrophic failures
and holes of varying sizes.
Worked example
215. To show how the data in Table 8 and Table 9 and equations 2 and 3 may be used, consider a
storage tank of radius 10 m and height 20 m. Using equation 2, the collection area is 15394 m2.
Assume there are nearby structures of the same height, which will give a location factor of 0.5
(from Table 8) and also assume that the site is located in an area with a lightning ground flash
density of 0.7 per km2 per year. The value of ND is then 0.0054 per year (from equation 3). Next
assume that the structure has a lightning protection system of class I, which implies a probability
of damage, given a lightning strike, of 0.02 (from Table 9). When multiplied by ND, this gives an
overall frequency of damage of 1.08x10-4 per year. This number can then be multiplied by
factors to give frequencies of different types of failure.
References
Protection against lightning – Part 2: Risk management. BS EN 62305- British 2006
2:2006. Standard
Protection against lightning – Part 1: General principles. BS EN 62305- British 2006
1:2006. Standard
Page 97 of 102
Human Factors
Guidance for assessors on the use of human reliability data in quantified

risk assessments
216. The aim of this document is to help non-human factors specialists determine whether the use of
human reliability analysis (HRA), and associated values, is adequate or not. Often, human
factors specialists are not available to comment on HRA and, for example during COMAH safety
report assessments, it is the predictive assessor who makes the judgement. This document
provides
 A comment on the use of human error potential (HEP) values; both observed and generated by HRA
techniques
 A brief description of the techniques that are commonly used for determining human reliability values
 Guidance on the limits that should be placed on the use of those techniques
Overview
217. In most cases, a human error potential of 0.1 can be considered a conservative or cautious
estimate of the risk of human failure. This value can generally be accepted as appropriate for
use in order of magnitude tools, like Layers of Protection Analysis (LOPA). However, human
factors specialists would still expect to see the duty holder demonstrate a thorough
understanding of the tasks being undertaken and the conditions in which they are performed.
218. Claims of reliability beyond 0.1 will require significantly more demonstration and justification;
typically this is when a site might use a human reliability assessment tool but quantification is
not always necessary. The HID Human Factors Specialist Inspectors team advocate using a
qualitative approach to ensure the duty holder has a thorough understanding of the issues.
Where quantified methods are used, HSE has found that values are often taken from publicly
available data sources and HRA methods without any justification or consideration of the site-
specific conditions that might influence their applicability. For example, documents such as ‘BS
EN 61511-3:2004 (annex F) and the Center for Chemical Process Safety (CCPS) book on
LOPA have tables that provide examples of HEPs. While these values are probably appropriate
in many situations, the associated text to describe the context is extremely limited; duty holders
need to consider how applicable the data are to the situation being assessed and to justify their
use. If a duty holder has adequate site-specific performance data regarding human reliability,
this data could be used to support HEPs obtained from HRA methods and other sources. This
historical data can be considered adequate if it has been collected over a sufficient timescale to
be statistically significant. However, in many cases such data are not readily available and duty
holders, having decided on a quantitative analysis, must draw upon their knowledge of the task
to work through a HRA method.
219. In order to complete a HRA correctly, qualitative knowledge is essential because without a
thorough analysis of the site-specific issues the assessor cannot adequately assess the risk,
determine a realistic HEP or identify ways to improve safety. It is important to note that even
with a good qualitative underpinning to the assessment, the uncertainties inherent in all HRA
techniques mean that the generated HEP can only ever be an estimate. Therefore, when using
HEP data, for example in COMAH safety reports, we should expect to see the duty holder
express caution about the claims they make and how data have been used in risk assessments.
Page 98 of 102
Expectations of a HRA tool generated value

220. If a duty holder has used human reliability data we would expect to see the details of the
assessment and not just the values. Ideally, this should include:
1. A description of the safety critical task

2. A task analysis to break it into its component parts and identify the conditions in which the task is
completed
3. Human error identification to demonstrate an understanding of how and when errors could occur
4. Details of how the HRA method was applied to identify the human error potential. This should
include details of the selected performance influencing factors (the factors that make an error
more likely) and how influential they are judged to be (based on human factors knowledge).
5. Ideally, and particularly where human action is safety critical or reliability is assessed as being
poor, the assessment should lead to recommendations for improving reliability.
221. At a minimum, it is realistic to expect that the duty holder has provided information about points
1 and 4, with reference to points 2 and 3.
Techniques for determining human reliability values

222. This section provides an overview of the main approaches to generating human error potential
(HEPs), a brief summary of some of the most commonly used techniques, comment on their
appropriateness/ suitability and what an assessor should expect to see from an assessment.
Overview of methods
223. There are a large number of HRA techniques and approaches available, many are publicly
available but others are proprietary methods.Typically, tools are assigned into the following
three groups.
First generation tools (e.g. THERP and HEART)

224. These were the first methods developed to help risk assessors predict and quantify the
likelihood of human error. They encourage the assessor to break a task into component parts
and then consider the potential impact of modifying factors such as time pressure, equipment
design and stress etc. By combining these elements the assessor can determine a nominal
HEP. First generation methods focus on the skill and rule base level of human action and are
often criticised for failing to consider such things as the impact of context, organisational factors
and errors of commission. Despite these criticisms they are useful and many are in regular use
for quantitative risk assessments.
Expert judgement methods (e.g. APJ and PC)

225. Expert judgement methods were developed around the same time as the first generation tools.
These methods are popular, particularly in less safety critical environments than major hazard
industries. They provide a structured means for experts to consider how likely an error is in a
particular scenario. The validity of some approaches has been questioned, but they continue to
be used and also to inform the development of new tools.
Second generation tools (e.g. CREAM and ATHEANA)

226. The development of ‘second generation’ tools began in the 1990s and is on-going. They attempt
to consider context and errors of commission in human error prediction, however due to the lack
Page 99 of 102
of uptake in the UK the benefits of the second generation over first generation approaches are
yet to be established. They have also yet to be empirically validated.
227. New tools are emerging based on earlier first generation tools such as HEART, and are being
referred to as third generation methods.
A summary of the most commonly used tools

HEART - Human Error Assessment and Reduction Technique (First
generation tool, outlined by Williams, 1985)
228. HEART is designed to be a relatively quick and simple method for quantifying the risk of human
error. It is a generic method that is applicable to any situation or industry where human reliability
is important; it was primarily used by the nuclear industry when first developed. Elements of the
technique are highly subjective, so, like many other methods, a human factors specialist should
be involved in the process to ensure appropriate consideration of the issues.
229. There are 9 Generic Task Types (GTTs) described in HEART, each with an associated nominal
HEP, and 38 Error Producing Conditions (EPCs) that may affect task reliability, each with a
maximum amount by which the nominal HEP can be multiplied. The assessor must determine
an Assessed Proportion of Affect (APOA) for each EPC; APOA is a concept that relates to how
‘present’ each EPC is.
What an assessor should expect to see

230. The basics of a qualitative assessment are required to demonstrate a good understanding of
the tasks; this should support the justification of the choice of GTT and EPC(s). In addition,
some explanation should be provided for assigning the APOA.
231. The assessment should not contain more than a maximum of 3 to 4 EPCs; if there are more it
indicates a problem with either the analysts’ understanding of HEART or a poorly designed task
that is highly likely to fail. If an assessment truly reveals a high number of EPCs, the task should
be investigated further and appropriate changes made to address the issues.
THERP - Technique for Human Error Rate Prediction first developed by

Swain (1983).
232. THERP is a total methodology for assessing human reliability that deals with task analyses (e.g.
documentation reviews and walk/ talk through), error identification and representation, as well
as the quantification of human error potential (HEPs). The THERP handbook is extensive and
presents methods, models and estimated HEPs to enable qualified analysts to make
quantitative or qualitative assessments of occurrences of human errors in nuclear power plants.
233. The handbook presents tabled entries of HEPs that can be modified by the effects of plant
specific Performance Shaping Factors (PSFs) using other tables. HSE has found data is taken
from the tables without following the THERP methodology and applied without appropriate
justification for its applicability to the task being assessed.

 Decomposition of tasks into elements
 Assignment of nominal HEPs to each element
Page 100 of 102

 Determination of effects of PSF on each element
 Calculation of effects of dependence between tasks
 Modelling in an HRA event tree
 Quantification of total task HEP
SPAR-H Simplified Plant Analysis Risk Human Reliability Assessment

(Gertman et al, 2004).
234. The SPAR-H method is similar to HEART but assigns human activity to one of only two general
task categories: action or diagnosis.
235. Action tasks – carrying out one or more activities indicated by diagnosis, operating rules or
written procedures. For example, operating equipment, performing line-ups, starting pumps,
conducting calibration or testing, carrying out actions in response to alarms, and other activities
performed during the course of following plant procedures or work orders. (Generic error rate of
0.001)
236. Diagnosis tasks – reliance on knowledge and experience to understand existing conditions,
planning and prioritising activities, and determining appropriate courses of action. (Generic error
rate 0.01)
237. Eight PSFs were identified as being capable of influencing human performance and are
accounted for in the SPAR-H quantification process. When using SPAR-H for general purposes,
only three of the eight PSFs are evaluated: time available, stress and stressors, and complexity.
The remaining five PSFs are generally considered to be event, plant or personnel specific and
would be evaluated when a plant-specific model is being developed.

238. The basics of a qualitative assessment are required to demonstrate a good understanding of
the tasks; this should support the justification of the choice of task and performance shaping
factors
Absolute Probability Judgements (APJ) and Paired comparisons (PC)

239. The APJ approach is conceptually the most straightforward human reliability quantification
approach. It simply assumes that people can estimate the likelihood of a human error. There
are different APJ approaches that can be applied to determine human reliability. A ‘single expert
APJ’ would require one expert to make their own judgements on the chances of a human error.
An arguably better approach is a ‘group APJ’ (e.g. Aggregated individual method, Delphi
method, Nominal group technique, Consensus-group method).
240. The APJ technique is prone to biases, as well as to personality/group problems and conflicts,
which can significantly undermine the validity of the technique. The technique is often likened to
‘guessing’, and therefore, has a low degree of ‘face’ validity.
241. The PC approach differs from APJs in that subject matter experts (SMEs) make simple
comparative judgements rather than absolute judgements. Each expert compares pairs of error
descriptions and decides, in each case, which of the two errors is more probable. When
comparisons made by different experts are combined, a relative scaling of error likelihood can
then be constructed. This is then calibrated using a logarithmic calibration equation, which
Page 101 of 102

requires that the HEPs be known for at least two of the errors within the task set. Paired
comparisons are relatively easy for the experts to carry out, however, there is no good evidence
of predictive validity and it is heavily dependent on the knowledge of the SMEs.

242. Users of expert judgement techniques should demonstrate a structured approach with clear
task definitions and scale values that reflect the estimated range of the true probabilities of the
tasks. If using a group APJ, then an analysis of variance should be performed to determine
inter-judge consistency. If using a single expert APJ, calculating the geometric mean should
aggregate the individual’s estimates.
243. If using PC, the SMEs should have experience of the tasks being assessed. Each pair of tasks
should be presented on its own, so that the expert only considers one pair at any one time. The
process should include a determination of the within-judge level of consistency and the inter-
judge level of consistency. As with APJ, to determine the levels of consistency between SMEs
an analysis of variance could be performed. Some estimation of the uncertainty bounds should
also be made.
Further information on HRA Methods

244. More detail on each of the tools described above is provided in the HSL review of HRA methods
(Bell and Holroyd, 2008). The review also includes information on some of the many other tools
available.
References
Review of Human Reliability Assessment J Bell and J 2009 Overview of the various HRA
Methods. HSL internal report RSU/08/20 Holroyd methods and their applicability for
use by HSE
BS EN 61511-3:2004 (annex F) Functional British Standard 2004
safety —Safety instrumented systems for the
process industry sector — Part 3: Guidance
for the determination of the required safety
integrity levels. Incorporating Amendment No.
1 to BS IEC 61511-3:2003
Layer of Protection Analysis. Simplified Center for 2001
Process Risk Assessment Chemical Process
Safety
A Guide to Practical Human Reliability B Kirwan 1994 Details the HRA process including
Assessment useful techniques and approaches
for each stage of an assessment.
Page 102 of 102

2017 Failure-Rates PDF

Uploaded by

Copyright:

Available Formats

2017 Failure-Rates PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

2017 Failure-Rates PDF

Uploaded by

Copyright:

Available Formats

Failure Rate and Event Data for use within

Risk Assessments (06/11/17)

Failure rate and event data

Failure rate Event data Human factors

Figure 1 Information covered in Chapter 6K

Event data Human factors

Aircraft strike rates Flooding Lightning

Mechanical Electrical Bulk Transport Moveable storage

Ambient temperature Ship hardarms Drums 1 te

Above ground in a gas Drums 210l

LPG Road Tanker Incompatible Cylinders

Figure 2 Overview of PCAG 6K structure

Generic Failure Rates

Non Generic Failure Rates

Description of the Information Required

Requested By: Request No:

9. Failure rates for equipment classified as mechanical are categorised as follows:

Item FR 1.1 Vessels Page 5

Item FR 1.1 Vessels

Large vessels SMATS Non metallic

Chlorine pressure LPG pressure

Figure 3 Hierarchical Diagram for Vessels

Item FR 1.1.1 Ambient Temperature and Pressure Vessels

Item FR 1.1.1.1 Large Vessels Page 7

Item FR 1.1.1.1 Large Vessels

ITEM FAILURE RATES

Failure Rate Advice (Confidential, not in the public domain)

Item FR 1.1.1.2 Small and Medium Atmospheric Tanks

ITEM FAILURE RATES

Failure Rate Advice (Confidential, not in the public domain)

Item FR 1.1.1.3 Non Metallic/Plastic

Failure Rate Advice (Confidential, not in the public domain)

Item FR 1.1.2 Refrigerated Ambient Pressure Vessels

ITEM FAILURE RATES

Failure Rate Advice (Confidential, not in the public domain)

Title Author Date Comments

Title Author Date Comments

Item FR 1.1.2.1 LNG Refrigerated Vessels

ITEM FAILURE RATES

Failure Rate Advice (Confidential, not in the public domain)

Item FR 1.1.2.2 Liquid Oxygen (LOX) Refrigerated Vessels

ITEM FAILURE RATES

Air separation units

Failure Rate Advice (Confidential, not in the public domain)

Item FR 1.1.3 Pressure Vessels

ITEM FAILURE RATES

Failure frequencies for major failures of C Nussey 2006 www.hse.gov.uk/comah/highpressure.pdf

Failure Rate Advice (Confidential, not in the public domain)

Title Author Date Comments

Title Author Date Comments

Fire engulfment leading to

Whole vessel failure

Damage to the vessel - is

Crane loads - risks negligible

Missiles, e.g. from adjacent

Figure 4 External Hazards for Pressure Vessels

Item FR 1.1.3.1 Chlorine Pressure Vessels

ITEM FAILURE RATES

Failure frequencies for major failures of C Nussey 2006 www.hse.gov.uk/comah/highpressure.pdf