Journal of Hazardous Materials 130 (2006) 265–270

The use of generic failure frequencies in QRA: The quality and use of
failure frequencies and how to bring them up-to-date
H.I. Beerens ∗ , J.G. Post, P.A.M. Uijt de Haag
RIVM, P.O. Box 1, 3720 BA Bilthoven, The Netherlands

Available online 18 August 2005

Abstract

Quantitative Risk Assessment (QRA) is a method which is often used in the chemical industry and, in some countries, also in land-use
planning. In QRA calculations the frequency of an accident scenario is most often assessed by a generic failure frequency approach. The
credibility and validity of the failure frequencies used in the Netherlands for land-use planning is evaluated by means of an historical review.
Furthermore, the possibility is presented how these generic data can be revised and updated.
© 2005 Elsevier B.V. All rights reserved.

Keywords: Risk assessment; Failure frequency; Validity

1. Introduction the Netherlands but all over Europe and in fact worldwide.
Thus, there is a necessity for reviewing and updating the fail-
Risk assessment is of great importance in the (petro-) ure frequencies defined in guidebooks, like the Purple Book
chemical industry. Although safety standards are high in this [1], for a number of standard scenarios and installations.
industry, one incident can have a tremendous impact on the In this article, different methods of risk assessment are out-
environment due to the flammable or toxic nature of the chem- lined as well as the use of failure frequencies in these methods.
icals which are processed and stored. To maintain or improve The reliability of the failure frequencies used nowadays is
the safety and to make cost effective choices it is essential to described using the scenarios for pressure vessels as an exam-
know what the risk causing factors are. For this purpose, risk ple. Finally, the present generic failure frequencies are dis-
assessment is an excellent tool. cussed as well as the possibility to update and improve them.
One method widely used in chemical industry is quan-
titative risk assessment (QRA) which produces quantitative
results for the risk of a chemical installation (process, storage, 2. Methods of risk assessment
transport). The QRA method allows adding up the risk of all
installations to the total risk of a site. Moreover, this method There are many methods for risk assessment known in
also makes it possible to distinguish the risk contributions of literature and used in practice [2]. Some of them, like Haz-
various parts of an installation. In this method, scenarios and ard and Operability Study (HAZOP) and Failure Mode and
the corresponding failure frequencies play a significant role. Effect Analysis (FMEA) are used to identify the risk of an
The accuracy of the calculations is determined by the installation and its process. Once the risk is known appropri-
quality of the data used. To use QRA methods for land-use ate steps can be taken to improve the safety. Although these
planning, it is of great importance that the results are standard- methods are very detailed for a specific installation, they are
ized using reliable data. However, the set of available failure not quantitative and not suited to rank the contribution of
frequencies is nowadays not up-to-date anymore, not only in specific installations to the total risk of a chemical plant. The
strength of HAZOP and FMEA is identifying possible haz-
∗ Corresponding author. Tel.: +31 30 2743618; fax: +31 30 2744442. ards when e.g. an installation or the process conditions are
E-mail address: [email protected] (H.I. Beerens). changed.

0304-3894/$ – see front matter © 2005 Elsevier B.V. All rights reserved.
doi:10.1016/j.jhazmat.2005.07.013
266 H.I. Beerens et al. / Journal of Hazardous Materials 130 (2006) 265–270

specifically, the origin of the failure frequencies is investi-

gated, concentrating on the historical data sources used in
the COVO study [3]. Of the six industrial objects analysed in
the COVO study, emphasis is given to the Akzo chlorine stor-
age. The historical outline followed in the literature survey is
depicted in Fig. 2.

3.1. The COVO study (1981)

Part of the COVO study comprised the study of the Akzo

chlorine pressure storage, in which two different approaches
Fig. 1. Bow tie representing the basic failure events, the Loss of Containment were used for the determination of the failure frequencies.
accident and the consequences. Barriers preventing the accident are indicated The catastrophic failure of a tank was derived from fault-
with dashed lines. tree analysis, whereas the other failure types (leakages) were
In case of a QRA, on the other hand, it is possible to quan- based on historical data. The inclusion of failure causes like
tify the risk of an installation. The QRA method is developed human error, corrosion and fatigue due to vibrations in the
and in use from the early eighties of last century [3,4]. In a fault-tree complicates the comparison with the Purple Book
QRA, accident scenarios are used. In Fig. 1, this is schemat- data, in which these failure types are excluded. The leak-
ically presented in the so-called bow tie. The figure shows ages of vessels and pipelines are based on the historical data,
that the scenario starts with a basic failure event and leads to incorporated in Appendix 9 of the COVO study. Only one
the central event (the accident, e.g. the release of a chemical frequency is given for leakages and is defined as “serious
substance). Subsequently from this central event several and leakage” for vessels and “significant leakage” for pipelines.
different consequences can be developed with their specific Because of the lack of an exact definition, the failure causes
outcomes. which are included as well as the hole size must be estimated
There are several levels of detail in which a quantitative to make a comparison with the Purple Book data possible.
risk assessment can be carried out. In the nuclear industry, the In the references cited in the COVO study, failures for
so-called probabilistic safety assessment (PSA) is generally pressure vessels were classified in two categories: potentially
used. In this method, the possibility of having an acciden- and catastrophic failure [7,8] and noncritical and (potentially)
tal failure is developed from the failure frequencies of the disruptive failure [9]. Contrarily, for vessels, the COVO study
basic system components like pumps, pressure sensors and makes a distinction between catastrophic rupture and serious
level gauges. This PSA gives much insight in the different leakage. Although the COVO study refers to these preceding
contributions of all the components in an installation to the studies, there is no clear link between the different types of
resulting risk. However, the method is very elaborate and classifications. The question posed is to what extent potential
requires much credible data for reliability and failure of these failure must be taken into account in a failure frequency study.
components. Furthermore, the values collected by Philips and Warwick
In the chemical industry a QRA, in general, is less detailed. [7], Smith and Warwick [8] and Bush [9] are based mainly on
Failure frequencies are only used for the main components or data for steam generation systems and a very limited number
even only for the accidental event. The frequencies currently of process type vessels. The failures quoted by these UKAEA
used are based on historical data of incidents. Several datasets studies involved only some 10-25% actual catastrophic rup-
of failure frequencies exist, like Oreda and Eireda. Off-shore ture of vessels. In order to obtain an estimate of the base
Reliability Data (Oreda) [5] is an ongoing set of reliability and failure rate for pressure vessels, in the COVO study the range
failure frequencies resulting from cooperation of platform quoted in the above-mentioned references is divided by a
operators of the North Sea and Norwegian Atlantic. European factor 10. However, there is no good basis given for this con-
Industry Reliability Databank (Eireda) is the same kind of version of data.
data, mainly of European power generator companies [6]. Bush [9] reviews different data sources from various coun-
In the next sections, it is presented how the failure fre- tries. An additional limitation in the examination of these
quency data in the Netherlands are developed in the past 25 data is the use of upper limits of confidence levels based
years, using pressure vessels failure frequencies as example, on zero leakage. As a result of the unclear indication of the
and how updating in Europe is anticipated. confidence level used for certain data, some differences in
the reported failure frequencies cannot be explained. Some
data sets are basically subsets of larger extrapolated data sets,
3. History of the pressure vessel failure frequencies which as a consequence can not additionally contribute to the
in the Purple Book determination of an appropriate upper bound value for failure
probability. Moreover, these historical data sets do not give
This section discusses the historical background of the enough information for the assignment of a leak to the vessel
failure data for pressure vessels in the Purple Book. More or to the pipelines connected to the vessels.
 H.I. Beerens et al. / Journal of Hazardous Materials 130 (2006) 265–270 267

Fig. 2. Historical outline started from the COVO study and the references cited therein.

In some data sets, failure rates for pressure vessels are 3.3. RE-95-1
included originating from defects found at periodic inspec-
tions. One cannot exclude the notion that many of the “fail- The IPO document was amended in the RE-95-1 document
ures” cited were probably generated during the fabrication [11]. In the IPO document, a leak from a hole with an effective
stage and remained virtually unchanged until detected dur- diameter of 50 mm (with a failure frequency of 10−5 per
ing a periodic inspection. These types of failures did not, year) is defined. This Loss of Containment event (LOC) was
however, directly interfere with functional use and do not meant to cover the rupture of the pipe connected to the vessel;
result in emission. In order to prevent confusion, attention however, rupture of pipes is already covered by the LOCs
should be given to imprecise definitions and inconsistent of pipes. To avoid double counting, this LOC is left out in
use of terms such as “failure statistics” and “catastrophic the RE-95-1. and only the class of leakage with a hole size
failure”. of 10 mm is left. One could ask whether this omission can
be justified. This consideration is based on the fact that the
3.2. IPO (1994) frequency of 10−5 per year is considered as the frequency for
serious leakage and therefore probably has a hole size larger
The first document in which standardised failure frequen- than 10 mm. As a consequence, the deletion of the 50 mm
cies were published by the Dutch authorities was the IPO category may be an underestimation.
document [10]. The frequency of catastrophic failure for a The three scenarios for catastrophic failure, defined in the
pressure vessel in the IPO is in good accordance with the IPO document, were reduced to two scenarios in the RE-95-1:
value in the COVO study (10−6 per year). Catastrophic fail- instantaneous release (5 × 10−7 per year) and release of the
ure is modelled as instantaneous release (5 × 10−7 per year), complete inventory from a hole with an effective diameter
release in 10 min (2.5 × 10−7 per year), and release through of 50 mm or, if the duration exceeds ten minutes, a contin-
a diameter of 50 mm (2.5 × 10−7 per year). For leakages uous release with a duration of ten minutes (5 × 10−7 per
the comparison is more complicated. Whereas in the COVO year).
study only “serious leakage” (10−5 per year) is defined, in
the IPO-study two types of leakages are considered: leakage 3.4. Purple Book (1999)
from a hole with a diameter of 50 mm (10−5 per connec-
tion) and leakage from a hole with an effective diameter of The Purple Book is based on the IPO and the RE-95-1. In
10 mm (10−5 per year). In fact, the frequency of 10−5 per the RE-95-1, the LOC of 5 × 10−7 per year is defined as a
year is transformed into (n + 1) 10−5 per year, in which n is release from a hole with an effective diameter of 50 mm or a
the number of connections. Another point of discussion is continuous release in ten minutes. For simplicity, this LOC
that the serious leakage defined in the COVO study as a leak is in the Purple Book defined as a release of the complete
of 50 mm on an arbitrary position on the tank, is transformed inventory in ten minutes at a constant rate of release. In other
in the IPO into a leakage from a hole of 50 mm on the con- words, the catastrophic failure is defined in the Purple Book
nection of the pipelines. On the other hand, in the COVO as an instantaneous release or a release in ten minutes. The
study there is a separate scenario defined for the rupture of total history of the vessel failure frequencies is depicted in
connections on the tank. Fig. 3.
268 H.I. Beerens et al. / Journal of Hazardous Materials 130 (2006) 265–270

Fig. 3. History of vessel failure frequency data.

3.5. Conclusions 4. The current generic data set and the necessity for
updates and revision
This study pointed out that it is rather difficult to judge
the reliability of the sources. Both the link between the 4.1. In the Netherlands
IPO and the COVO study, as well as the derivation of
the failure frequencies from the references of the COVO An important source of uncertainty in the results of risk
study, are not evident. This can be attributed to various assessments is the use of different data sets for failure fre-
aspects: quencies by risk assessors.
The problem of repeatability in risk assessments can be
• There is no univocal terminology used for the classifi- solved to a certain level by giving a fixed standard value for
cation of the failures, which complicates the compari- release frequencies for different types of equipment. In the
son of the data. Moreover, the expression “catastrophic Netherlands, this is described in the Purple Book, including
failure” has different meanings in the different reports, standard scenarios and failure frequencies. These frequen-
which shows the difficulties in the application of uniform cies are set as default values; it is recognised that these data
criteria. will only be seen as an approximation for any specific plant.
• Besides real failure, a lot of potential failure fre- Deviation is possible, but only on the condition that it can be
quency data were considered. Failures during inspec- motivated and approved by the competent authorities. Lower
tion and testing (pressure) are also included. This con- frequencies can be used if there are special provisions addi-
tradicts the Purple Book, where these failures are not tional to the standard provisions. Higher frequencies should
included. be used if standard provisions are missing or under uncom-
• The information in the data sets is often limited and does mon circumstances. In fact, the use of generic data requires a
not always give an indication of the kind of failure causes determination of the conditions under which the data would
included and the confidence upper boundary of the fail- be appropriate, something which is not well-defined to date.
ure numbers. Furthermore, the underlying assumptions As a consequence, data are used outside the context for which
and relationships to certain causes are not unambigu- they are originally collected.
ously described. Some of the studies are not representa- Besides the uncertainties mentioned in the previous sec-
tive, because they are based on an extremely small data tion, another disadvantage of the current set of standard
set. failure frequencies, which should not be underestimated, is
• Rough estimates are made in order to convert data from one the fact that they are based on outdated numbers. Most data
type of industry (steam generators), into data for another were published around 1970, which means that most of the
type of industry. data are at least 25 years old. It could be argued that because
 H.I. Beerens et al. / Journal of Hazardous Materials 130 (2006) 265–270 269

of the changes of design rules, materials and experience the accidents which can possibly happen at ‘Seveso’ sites (major
failure frequencies have changed since then. However, at the chemical installations). To facilitate countries in develop-
moment there is no real proof of this from the data found in ing and carrying out this policy the competent authorities
literature. It is unknown to what extent these data are repre- of the member states decided to develop or identify appropri-
sentative for the current standard in the chemical industry. ate methods and data sets. A Land-Use-Planning project was
The failure frequencies are based on a limited number of started for this purpose [16]. One of the first activities in this
characteristics. For vessels, there is only a distinction between project was gathering information from EU member states
storage vessels and process vessels, and for pipes only the about the use and availability of failure frequencies data in
length and the diameter is relevant. As a consequence, spe- their country. It turned out that in most countries where fail-
cial provisions directed to integrity of the installation and ure frequencies are used, there is no standard set of up-to-date
significant for safety are not included in the failure numbers. failure frequencies available. In many cases, the Purple Book
Moreover, review studies have been published that show a or UK HSE data are used. Therefore in the Netherlands, as
tendency for some systems towards higher failure frequen- well as in Europe, there is an urgent need for revised failure
cies than the ones reported in the Purple Book [12,13]. These frequency data.
figures clearly underline the need to have a better understand- After many communications with experts both from gov-
ing of the actual failure data and the underlying assumptions. ernmental organisations as well as from industry, it was felt
To meet this objective a study to revise and update the stan- that there is a widely shared need to improve the status of
dard failure data has been started [14]. One of the goals of the failure frequencies for (on shore) chemical installations. To
study is to throw some light on the way in which equipment- meet this demand there was a meeting of experts in this field
release frequencies vary according to the standards of design, (in March 2005), with the aim of starting the development of
construction, operations and maintenance and to the actual an up-to-date failure frequency data set. As a result of this
operating conditions. The intention is also to give some guid- meeting a working group will update the failure frequency
ance on the way the release and accident frequencies depend data. For this purpose the available ‘public’ data, as well as
on the underlying assumptions. ‘private’ data of the members will be used.
The approach used involves the selection of baseline fre-
quencies for different equipment types in combination with
modification factors. The baseline frequencies can be cor- 5. Conclusion
rected by these factors to obtain a more realistic risk estimate
of the actual frequency. The failure frequencies obtained in Quantitative Risk Assessment is widely used for improv-
this way will be very useful for non-standard applications. ing safety and for land use planning. For this purpose, there
When choosing modification factors for release frequencies is a strong need for failure data that are actual, reliable and
it is necessary to decide in relation to what the modifica- generally accepted.
tion is made. A baseline of design, construction, operations This study shows the difficulty of tracing back failure data
and maintenance standards is needed. In order to determine due to the lack of univocal terminology. The failure data of
the reference standards, it is necessary to look at the data pressure vessels in the Purple Book have been copied from
sources. The main sources of data in this study are of recent the IPO. The unclear links between the IPO and the COVO
date and varied: company data from the oil, petrochemi- study, as well as between the references of the COVO study
cal and chemical industries covering the mid-1970s to the and the COVO study itself, seriously hamper the validation
present day are included. As model for failure rate prediction of failure data in the Purple Book.
a fault-tree-based model will be used in combination with To obtain validated failure data we initiated a study based
a checklist-based algorithm. Algorithms will be made only on recent data and a fault-tree-based model with algorithms
for the causes of failure that arise most frequently. For the and modification factors. This initiative should ultimately
modification factors care should be taken that some factors, lead to failure data that can be easily applied in current-day
like special corrosion, are not taken into account twice. More practice and gives opportunity to obtain appropriate data for
specifically, when a correction is made for the application of non-standard applications. This study will be discussed in
the equipment item, it is not always necessary to provide an the meeting of experts which will be organized, in spring
additional correction for corrosion. 2005, to consider the collective need for an updated failure
At the time of writing work is still in progress to determine frequencies data set and to explore the possibilities to achieve
appropriate baseline values, modification factors and to apply this.
the above-mentioned approach [14].

4.2. In Europe
References
In Europe, since the ‘Seveso-2’ directive [15] came into [1] Committee for the Prevention of Disasters (CPR), Guidelines for
force, EU-member states are required to develop a land use Quantitative Risk Assessment—“Purple Book” CPR18E, SDU, The
policy in which their residents are protected against major Hague, 1999.
270 H.I. Beerens et al. / Journal of Hazardous Materials 130 (2006) 265–270

[2] J. Tixier, G. Dusserre, O. Salvi, D. Gaston, Review of 62 risk analy- its Relevance to Nuclear Primary Circuits, United Kingdom
sis methodologies of industrial plants, J. Loss Prevention Procc. Ind. Atomic Energy Authority, Warrington, SRD-R-30, UKAEA Report,
15 (2002) 291–303. 1974.
[3] COVO Commission, Risk Analysis of Six Potentially Hazardous [9] S.H. Bush, Pressure vessel reliability, J. Pressure Vessel Technol.
Industrial Objects in the Rijnmond Area, A Pilot Study. A Report (1975) 54–69.
to the Rijnmond Public Authority, Central Environmental Control [10] IPO, Guidelines for the Preparation of Off-site Safety Indus-
Agency, Schiedam, The Netherlands, 1981. trial Sites, Report IPO Project A-73, The Hague, 1994 (in
[4] F.P. Lees, Loss Prevention in the Process Industries, second ed., Dutch).
Butterworth-Heinemann, 1996. [11] RE-95-1, Version 2-2-1996, KO-95, KO-96, KO-100 performed by
[5] Offshore Reliability Data Handbook (Oreda), third ed., Det Norsk TKO Working Group, 1996.
Veritas, Høvik, Norway 1997. [12] M.Th. Logtenberg, Derivation of Failure Frequencies for LOC Cases,
[6] H. Procacaccia, S.P. Arsenis, P. Aufort, European Industry Reliability TNO, Apeldoorn, The Netherlands, 1998.
Databank (Eireda), third ed., Crete University press, Iraklion, Greece, [13] Handboek kanscijfers voor het opstellen van een veiligheidsrapport,
1998. Co-ordinated Version 2.0, AMINAL Dienst gevaarlijke stoffen en
[7] C.A.G. Philips, R.G. Warwick, A Survey of Defects in Pressure risicobeheer, Brussels, 2004.
Vessels Built to High Standards of Construction and its Rele- [14] J.R. Taylor, Hazardous materials release and accident frequencies for
vance to Nuclear Primary Circuit Envelopes, Authority Health and process plant, Draft version, 2004.
Safety Branch, Risley, Warrington, Lancashire, UK, AHSB (S) R162, [15] Council Directive 96/82/EC of 9 December 1996 on the control of
UKAEA Report, 1969. major-accident hazards involving dangerous substances, Office for
[8] T.A. Smith, R.G. Warwick, The Second Survey of Defects in official publications of the EC, Luxembourg, 1996.
Pressure Vessels Built to High Standards of Construction and [16] Website http://landuseplanning.jrc.it.