Journal of Hazardous Materials A137 (2006) 692708

Barrier and operational risk analysis of hydrocarbon

releases (BORA-Release)
Part II: Results from a case study
Snorre Sklet a, , Jan Erik Vinnem b , Terje Aven b
a

Department of Production and Quality Engineering, The Norwegian University of Science and Technology (NTNU),
NO-7491 Trondheim, Norway
b University of Stavanger (UiS), NO-4036 Stavanger, Norway
Received 6 December 2005; received in revised form 14 March 2006; accepted 15 March 2006
Available online 22 May 2006

Abstract
This paper presents results from a case study carried out on an offshore oil and gas production platform with the purpose to apply and test
BORA-Release, a method for barrier and operational risk analysis of hydrocarbon releases. A description of the BORA-Release method is given
in Part I of the paper. BORA-Release is applied to express the platform specific hydrocarbon release frequencies for three release scenarios for
selected systems and activities on the platform. The case study demonstrated that the BORA-Release method is a useful tool for analysing the
effect on the release frequency of safety barriers introduced to prevent hydrocarbon releases, and to study the effect on the barrier performance of
platform specific conditions of technical, human, operational, and organisational risk influencing factors (RIFs). BORA-Release may also be used
to analyse the effect on the release frequency of risk reducing measures.
2006 Elsevier B.V. All rights reserved.
Keywords: Risk analysis; Hydrocarbon release; Loss of containment; Safety barrier; Organisational factor

1. Introduction
The Petroleum Safety Authority Norway (PSA) focuses on
safety barriers in their regulations relating to management in the
petroleum activities [1] and requires that it shall be known what
barriers have been established, which function they are intended
to fulfil, and what performance requirements have been defined
with respect to technical, operational, and organisational elements that are necessary for the individual barrier to be effective.
These requirements and a recognition of the insufficient
modelling of human, operational, and organisational factors in
existing quantitative risk analyses (QRAs) were the background
for the BORA project [2]. The aim of the BORA project is to
perform a detailed and quantitative modelling of barrier performance, including barriers to prevent the occurrence of initiating
events (like hydrocarbon release) as well as consequence reducing barriers. One of the activities in the BORA project was to

DOI of original article:10.1016/j.jhazmat.2006.03.049.

Corresponding author. Tel.: +47 73 59 29 02; fax: +47 73 59 28 96.
E-mail address: [email protected] (S. Sklet).

0304-3894/$ see front matter 2006 Elsevier B.V. All rights reserved.
doi:10.1016/j.jhazmat.2006.03.027

develop BORA-Release, a method suitable for qualitative and

quantitative analyses of hydrocarbon release scenarios (see Part
I of the paper [3] and [4]). The method was tested in a case
study on a specific offshore oil and gas producing platform on
the Norwegian Continental Shelf. The purpose of the case study
was to determine the platform specific hydrocarbon release frequencies for selected systems and activities for selected release
scenarios and assess whether or not BORA-Release is suitable
for analyzing the effect of risk reduction measures and changes
that may increase the release frequency.
The objective of this paper is to present and discuss the results
from the case study with emphasis on discussions about whether
or not the method is useful for analysing the effect of safety barriers and risk reducing measures. In the case study, BORA-Release
was used to analyse the release frequency considering the effect
of safety barriers introduced to prevent hydrocarbon release and
analyse the effect on the barrier performance of platform specific
conditions of technical, human, operational, as well as organisational risk influencing factors (RIFs).
This paper contains four main sections where this first section describes the background and the purpose of the paper.

S. Sklet et al. / Journal of Hazardous Materials A137 (2006) 692708

The next section explains how the case study was carried out,
the basis for the case study with respect to selection of release
scenarios for detailed analysis, and relevant descriptions of the
technical systems, operational activities, and conditions. Section
three presents the results from the qualitative and quantitative
analyses of the selected scenarios and the overall results. A discussion of the results and experiences from the case study, and
some conclusions are presented in section four.
2. Case study description
The BORA-Release method is described in Part I of the paper
[3], and the qualitative and quantitative analyses of the risk
related to hydrocarbon releases comprise the following main
steps:
(1) Development of a basic risk model including hydrocarbon
release scenarios and safety barriers.
(2) Modelling the performance of safety barriers.
(3) Assignment of industry average probabilities/frequencies
and quantification based on these probabilities/frequencies.
(4) Development of risk influence diagrams.
(5) Scoring of risk influencing factors (RIFs).
(6) Weighting of risk influencing factors.
(7) Adjustment of industry average probabilities/frequencies.
(8) Recalculation of the risk in order to determine the platform
specific risk.
The basis for development of the basic risk model in the case
study was 20 hydrocarbon release scenarios described in [5].
Three scenarios were selected for detailed analyses:
A. Release due to valve(s) in wrong position after maintenance.
B. Release due to incorrect fitting of flanges or bolts during
maintenance.
C. Release due to internal corrosion.
The selection was made after discussions between personnel
from the oil company and project team members. The main
arguments for selecting these scenarios were: (i) leak statistics
showed that these scenarios are important contributors to the
total leak frequency and (ii) the scenarios provide a good range
of cases to test the method.
The activity flowline inspection was selected as basis for
analysis of scenarios A and B. A flowline is a line segment

693

between an automatic flow valve (AFV) in the valve tree and the
production or test header. There may be up to 3040 flanges
on each flowline, and between 5 and 15 of them are disassembled during a flowline inspection. Flowline inspections are
performed by visual inspections in order to reveal corrosion
in the pipes, flanges, and instrument fittings on the flowlines.
Each flowline is inspected at least twice a year. The inspector
plans the inspection and identifies inspection points. The area
technician is responsible for shutdown of the actual well and isolation, depressurization, and draining of the actual flowline. The
inspections are carried out while the other wells are producing.
The mechanics disassemble and assemble the flowlines zone by
zone and install new bolts and gaskets in the flanges after each
inspection. The inspector carries out the inspection and decides
whether or not some pipe spools need to be changed due to
degradation. Findings from the inspection are documented in a
specific database. The area technician is responsible for execution of a leak test prior to start-up of normal production, while
a central control room (CCR) technician monitors the pressure.
Two service point valves (SP1/SP2) are used during the leak
test and may be left in wrong position after the inspection. The
valves are operated by a single area technician and there is no
isolation plan or valve list showing the valve positions for a
flowline inspection. No procedure describes the activity since
the leak test is a routine operation for the area technicians, but
the result from the final (successful) leak test is documented in
the platform log book.
A hierarchical task analysis (HTA) was performed for the
flowline inspection activity in order to get an understanding of
the work process. The top structure of the HTA is shown in Fig. 1.
The detailed HTA was reviewed by operational personnel and
discussed in a workshop.
In order to develop and make detailed descriptions of the
release scenarios, two workshops were arranged. Draft descriptions of the release scenarios based on review of documentation
were developed prior to the workshops as basis for discussion.
Scenarios A and B were discussed in the first workshop and
scenario C was discussed in the second workshop. Operational
personnel from the platform and safety specialists from the company attended the first workshop while corrosion specialists
from the oil company also attended the second workshop.
The analyses of scenarios A and B were carried out strictly
according to the general method description and are described
in the following. The analysis of scenario C differed somewhat
from the general method description and is described afterwards.

Fig. 1. Hierarchical task analysis (top structure) of a flowline inspection.

694

S. Sklet et al. / Journal of Hazardous Materials A137 (2006) 692708

Two additional workshops, with operational personnel from

the platform and safety specialists from the oil company, were
arranged in order to model the performance of the safety barriers,
identify RIFs and develop risk influence diagrams, and weight
the RIFs for scenarios A and B. The RIF-framework described
in Part I of the paper was used as basis for the identification
of RIFs. The weights were established by common agreement
from discussions in the workshop. Firstly, the most important
RIF for each basic event was identified and assigned a relative
weight equal to 10. Thereafter, the other RIFs were given weights
relative to the most important one on the scale 108642 (see
Part I for more details).
The industry average input data were discussed in the workshops and some input data were established based on discussions
during the workshops. The assignment of industry average probabilities for human errors was primarily based on data from
THERP [6].
The scoring of the RIFs was based on an analysis of answers
on a questionnaire from a survey of the risk level on the Norwegian Continental Shelf (RNNS-project) [7]. Further information
about the scoring is given in [8].
Revised input probabilities/frequencies were established by
the analysts as described in the method description (Part I) using
the formula:
Prev (A) = Pave (A)

n

wi Qi

(1)

i=1

where Pave (A) is the industry average probability of occurrence

of event A, wi the weight (importance) of RIF no. i for the event,
and Qi is a measure of the status of RIF no. i. The status varies
from A (best practice in the industry) to F (worst practice in
the industry), where C corresponds to industry average. n is the
number of RIFs for each basic event. The calculation of Qi is
described in detail in Part I of the paper. In formula (1),
n

wi = 1

(2)

i=1

The revised platform specific probabilities/frequencies were

used as input in the risk model in order to recalculate the release
frequencies for the selected scenarios.
Analysis of scenario C focused on the process segment
between the separator and the pipeline. This segment is mainly
made of carbon steel and the pipes are not insulated. The pressure
is 1320 bars upstream of the production pump, and 2335 bars
on the downstream side of the pump. The temperature varies
from 70 C in the main flow pipes to 10 C in the dead legs.
The two main differences in the analysis of scenario C were:
(1) an overall RIF-analysis was not carried out, but the effects
of changes were studied based on sensitivity analyses and (2)
fault tree analysis was not used for quantitative analysis of the
inspection effectiveness. The performance of the safety barrier
inspection was analysed based on a method described by API [9],
and assessment of the practice on the platform. Several workshops were arranged to discuss the method used for analysis of
the corrosion scenario and the current status of corrosion and
inspection on the platform. In addition, results from the last

inspection were reviewed in order to predict the corrosion rate

within the system.
3. Results from the case study
3.1. Scenario A
The following form contains a description of scenario A.
Scenario name
Release due to valve(s) in wrong position after flowline inspection
General description
Release due to valve(s) set in wrong position after flowline inspection may
occur if the area technician forget to close some SP valves prior to start-up
of production
Initiating event
Valve(s) in wrong position after flowline inspection
Operational mode when failure is introduced
During maintenance, i.e., while disconnecting hoses after the leak test
Operational mode at time of release
Release may occur during start-up after maintenance.
Barrier functions
The release may be prevented
if the following barrier
functions are fulfilled:
Detection of valve(s) in
wrong position

Barrier systems
The release may be prevented if
the following barrier systems
function:
The system for self control/use
of checklist in order to detect
possible valve(s) in fail position
The system for third party
control of work (actually, no third
party control of work is required
in this scenario)

Assumptions
On the flowline system, SP1- and SP2-valves may be in wrong position
after the flowline inspection. In addition, the two valves on the closed drain
system connected to the hoses may be in wrong position after the
inspection.
The area technician operates these valves (depressurization, draining, and
pressurization during the leak test).
There is no third party control of the work performed by the area technician.
It is assumed that corrective action is carried out if a valve is revealed in
wrong position.
These valves are used during the leak test where the purpose is to test the
tightness of the flanges, and the valves may be left in open position after
the leak test.
A leak due to an open valve on the flowline system will most probably be
detected during start-up of normal production, either manually by the area
technician, or automatically by gas detectors in the area. The area
technician will stay in the wellhead area during start-up of production and
may manually close the open SP-valve, or close the choke valve.

The barrier block diagram for scenario A is shown in Fig. 2.

The fault trees for the safety barriers Self control of work
(A1) and third party control of work (A2) are illustrated in
Figs. 3 and 4. Further, the risk influence diagrams for the basic
events A02 (see Table 1), A11, A12, and A13 are shown in
Figs. 58, respectively.
Table 1 summarizes all input data, weights, scores for all
RIFs, and the adjustment factors (MF) for scenario A. Plow (A)
denotes the lower limit of Prev (A) and Phigh (A) denotes the upper
limit of Prev (A). si denotes the status of the RIF no i. MF denotes

S. Sklet et al. / Journal of Hazardous Materials A137 (2006) 692708

695

Fig. 2. Barrier block diagram for scenario A.

Fig. 4. Fault tree for barrier A2.

quantitative fault tree analysis). The release frequency due to

valve(s) in wrong position after flowline inspection by use of
industry average data is 0.028 per year, while the corresponding frequency by use of adjusted input probabilities allowing
for platform specific conditions of the identified RIFs is 0.041
per year. This implies an increase in the release frequency by
46% from scenario A by use of the revised input data. The frequency of the initiating event has increased by 28% (from 0.084
to 0.11 per year), while the probability of failure of barrier A1
(self control) has increased by 14% (from 0.34 to 0.38).
3.2. Scenario B

Fig. 3. Fault tree for barrier A1.

the modification factor calculated by use of formula (1) and is

calculated as:
MF =

n

wi Qi

(3)

i=1

The results from the quantitative analysis of the release frequency due to valve(s) in incorrect position after flowline inspection are shown in Table 2 (see, e.g., [10] for information about

Scenario B, release due to incorrect fitting of flanges or bolts

during flowline inspection, includes leaks due to tightening with
too low or too high tension, misalignment of flange faces, damaged bolts, etc. The initiating event is incorrect fitting of flanges
or bolts after flowline inspection. The operational mode when
failure is introduced is during maintenance, and the release may
occur during start-up after maintenance, or later during normal
production. The release may be prevented if the following safety
functions are fulfilled; detection of incorrect fitting of flanges

Fig. 5. Risk influence diagram for basic event A02.

696

S. Sklet et al. / Journal of Hazardous Materials A137 (2006) 692708

Table 1
Scenario Aindustry average probabilities/frequencies, weights, scores, and revised probabilities/frequencies
Basic event

Pave

Plow

Phigh

A01
A02

nA = 28
0.003

0.001

0.009

A11

0a

A12

0.010

A13

0.33

A21

1.0b

A22

0.01

A23

a
b

0.1

Basic event/RIF

wi

si

No. of flowline inspections per year

P (valve(s) in wrong position after maintenance)
A021 Process complexity
A022 Maintainability/accessibility
A023 HumanMachine interface (HMI)
A023 Time pressure
A024 Competence of area technician
A025 Work permit

2
2
2
10
10
2

C
C
D
D
C
C

P (Failure to perform self control when specified)

A121 Work practice
A122 Time pressure
A123 Work permit

10
10
6

D
D
C

P (Failure to detect valve in wrong pos. by self control)

A131 HMI
A132 Maintainability/accessibility
A133 Time pressure
A134 Competence of area technician
A135 Procedures for self control
A136 Work permit

2
2
10
10
2
4

D
C
D
C
C
C

P (Failure to perform third party control of work)

A221 Work practice
A222 Time pressure
A223 Work permit

10
10
6

D
D
C

P (Checker fails to detect valve in wrong position)

A231 HMI
A232 Maintainability/accessibility
A233 Time pressure
A234 Competence of area technician
A235 Procedures for self control
A236 Work permit

2
2
10
10
2
4

D
C
D
C
C
C

MF

Prev

1.29

0.0039

1.51

0.015

1.13

0.37

2.03

0.02

1.53

0.15

P (Failure to specify self control)

A11 Program for self control
0.003

0.066

0.030

0.66

P (Failure to specify third party control)

A211 Program for third party control
0.002

0.02

0.05

0.5

Self control is specified in this case as the probability of failure to specify self control is 0.
Third party control of work is not specified as the probability of failure to specify third party control is 1.

or bolts during maintenance, and detection of release prior to

normal production. The following barrier systems fulfil these
functions:
A system for self control of work (visual inspection by
mechanic) may detect incorrect fitting of flanges or bolts prior
to start-up of normal production.
Table 2
Scenario Aresults from calculations
Event

Industry average
probabilities/frequencies

Revised
probabilities/frequencies

f(A0)a
PFailure (A1)b
PFailure (A2)c
A d

0.084
0.34
1.0
0.028

0.11
0.38
1.0
0.041

a
b
c
d

Frequency of valves in incorrect position after inspection per year.

Probability of failure to reveal failure by self control.
Probability of failure to reveal failure by third party control.
Release frequency from scenario A per year.

Fig. 6. Risk influence diagram for basic event A11.

S. Sklet et al. / Journal of Hazardous Materials A137 (2006) 692708

Fig. 7. Risk influence diagram for basic event A12.

A system for third party control of work (by inspector or

area technician) may reveal failures prior to assembling of
the system or prior to start-up of production.
A system for leak testing may reveal potential failures prior to
start-up of production. The leak test may be carried out in two
ways: (1) by use of glycol/water or (2) by use of pressurized
injection water.

697

The results from scenario B are not described as detailed as

the results from scenario A since the principles in the method
already is illustrated, but the barrier block diagram for scenario
B is shown in Fig. 9. Neither the fault trees of the barriers, nor
the risk influence diagrams are shown since the principles are
similar as used in scenario A.
Table 3 summarizes all input data, weights, scores for all
RIFs, as well as the adjustment factors for scenario B.
The results from the quantitative analysis of scenario B are
shown in Table 4. The release frequency due to incorrect fitting of flanges or bolts during flowline inspection is 0.0012 per
year by use of industry average data. The corresponding release
frequency by use of adjusted input probabilities allowing for
platform specific conditions of the RIFs is 0.0038 per year. Consequently, the release frequency due to scenario B has increased
by 214%. The frequency of the initiating event (no. of valves in
incorrect position after inspection) has increased by 27% from
0.84 to 1.064 per year. The probability of failure to detect release
by self control has increased by 10% (from 0.34 to 0.37) and the
probability of failure to detect release by third party control has
increased by 36% from 0.11 to 0.15. Finally, the probability of
failure to detect release by leak test has increased by 66% from
0.040 to 0.066.

Fig. 8. Risk influence diagram for basic event A13.

Fig. 9. Barrier block diagram for scenario B.

698

S. Sklet et al. / Journal of Hazardous Materials A137 (2006) 692708

Table 3
Scenario Bindustry average probabilities/frequencies, weights, scores, and revised probabilities/frequencies
Basic event

Pave

B01
B02

nB = 28
0.03

B11

1.0a

B12

0.010

B13

0.33

B21

1.0b

B22

0.01

B23

0.1

B31

1.0c

B32

0.01

B33

a
b
c

0.03

Plow
0.006

Phigh
0.15

Basic event/RIF

wi

si

No. of flowline inspection per year

P (Incorrect fitting of flange or bolts)
B021 Process complexity
B022 Maintainability/accessibility
B023 Task complexity
B024 Time pressure
B025 Competence of mechanician

2
2
10
6
10

C
C
C
D
C

P (Failure to perform self control when specified)

B121 Work practice
B122 Time pressure
B123 Work permit

10
10
6

D
D
C

P (Failure to reveal incorrect fitting by self control)

B131 HMI
B132 Maintainability/accessibility
B133 Time pressure
B134 Competence of mechanician
B135 Procedures for self control

2
2
6
10
10

D
C
D
C
C

P (Failure to perform third party control of work)

B221 Work practice
B222 Time pressure
B223 Work permit

10
10
6

D
D
C

P (Checker fails to detect incorrect fitting)

B231 HMI
B232 Maintainability/accessibility
B233 Time pressure
B234 Competence of checker
B235 Procedures for third party control
B236 Work permit

2
2
4
10
4
4

D
C
D
C
C
C

P (Failure to perform leak test when specified)

B321 Work practice
B322 Time pressure
B323 Work permit

10
10
6

D
D
C

P (Failure to detect incorrect fitting by leak test)

B331 Communication
B332 Methodology
B333 Procedures for leak test
B334 Competence of area technician

10
2
2
10

D
C
C
C

MF

Prev

1.27

0.038

1.51

0.015

1.09

0.36

2.03

0.02

1.31

0.13

2.03

0.02

1.56

0.047

P (Failure to specify self control)

B111 Program for self control
0.003

0.066

0.030

0.66

P (Failure to specify third party control of work)

B211 Program for third party control
0.002

0.02

0.05

0.5

P (Failure to specify leak test)

B311 Program for leak test
0.002

0.006

0.05

0.15

Self control is specified in this case as the probability of failure to specify self control is 0.
Third party control of work is not specified as the probability of failure to specify third party control is 0.
Leak test is specified in this case, as the probability of failure to specify leak test is 0.

3.3. Scenario C
The general description of scenario C is as follows:
Scenario name
Release due to internal corrosion
General description
Releases caused by internal corrosion. The relevant types of internal corrosion within the actual system on the platform are:
(a) CO2 -corrosion (local and uniform)
(b) Microbial Influenced Corrosion (MIC)
Other types of corrosion like H2 S-corrosion are not considered to be a problem on the platform
Two corrosion groups (CG) are defined within the actual system: (CG1) Main flow pipes and (CG2) Dead legs

S. Sklet et al. / Journal of Hazardous Materials A137 (2006) 692708

699

Initiating event
The initiating event for this scenario is Corrosion rate due to internal corrosion beyond critical limit. Quantitatively, the initiating event is defined as Number
of leaks per year due to corrosion if no safety barriers or corrective actions are implemented
Factors inuencing the initiating event
Corrosion resistance of material, corrosion coating, chemical injection/corrosion inhibitor/biocid, internal fluid properties, CO2 -concentration,
allowances/safety margins, platform age, etc.
Operational mode when failure is introduced
During normal production
Operational mode at time of release
During normal production or during process disturbances (resulting in, e.g., increased pressure)
Barrier functions
The release may be prevented if the
following safety functions are fulfilled:
Detection of internal corrosion to prevent
release

Barrier systems
The release may be prevented if the
following safety barriers function:
System for inspection to detect potential
corrosion.
System for condition monitoring of
equipment to detect potential corrosion.
System for area based leak search may
detect diffuse discharges before they develop
into significant leaks.
System for detection of minor hydrocarbon
(HC) releases (automatic or manual gas
detection) may detect minor releases before
they develop into significant leaks.

Detection of diffuse or minor hydrocarbon

release

Assumptions
Critical limit is defined as damage rate (d) greater than critical damage rate (dcritical ). This damage rate will result in wall thickness (t) less than wall thickness
when release is expected (trelease ) before next inspection
A rate model is applied for both CO2 -corrosion and MIC
Uniform CO2 -corrosion is not assessed to be a problem at the actual platform
Corrosion coupons and MIC sample testing are used for condition monitoring. Corrosion coupons are used only in the main flow pipes, while MIC sample
testing is performed in both the main flow pipes and the dead legs
It is assumed that detection of critical corrosion rate by condition monitoring lead to revision of the inspection programme and the assumptions for the
analysis of the release frequency due to corrosion. Due to the revisions of the assumptions, a new analysis should be carried out, and this revision of
assumption may lead to higher release frequency due to, e.g., higher frequency of the initiating event or lower inspection efficiency
Two methods are used for inspection, ultrasonic and radiographic inspection. The inspection method depends on the thickness of the pipe and it is assumed
that the most suitable method is used in the case study
Area based leak search is performed in two ways; (1) Daily generic area inspection performed by the area technician, and (2) Daily system specific leak search
performed by the area technician. The probability of detection of a leak is assumed to be higher for the second type of leak search
Minor releases may be detected automatically by gas detectors or manually by people in the area
It is assumed that corrective actions are implemented when critical corrosion is detected. Detection of critical corrosion therefore leads to a safe state

Fig. 10 shows a barrier block diagram for the release scenario

Release due to internal corrosion.
Figs. 1113 show the basic fault tree modelling of the safety
barriers inspection (C1), condition monitoring (C2), and area
Table 4
Scenario Bresults from calculations

f(B0)a
PFailure (B1)b
PFailure (B2)c
PFailure (B3)d
B e
a
b
c
d
e

Industry average
probabilities/frequencies

Revised
probabilities/frequencies

0.84
0.34
0.11
0.040
0.0012

1.064
0.37
0.15
0.066
0.0038

Frequency of incorrect fitting of flanges or bolts after inspection per year.

Probability of failure to reveal failure by self control.
Probability of failure to reveal failure by third party control.
Probability of failure to detect release by leak test.
Release frequency from scenario B per year.

based leak search (C3) illustrated in the barrier block diagram

in Fig. 10. The system for detection of hydrocarbons has not been
analysed any further in the case study. In principle, the barriers
are equal for both corrosion groups, however, the quantitative
analysis is different.
The barrier block diagram in Fig. 10 is transformed to an
event tree in order to calculate the expected release frequency
due to corrosion. The event tree is illustrated in Fig. 14. Safe
state in the event tree means that the damage rate is under control and corrective actions will be implemented before a release
occurs. The frequency of the initiating event (0C ) expresses a
prediction of the hydrocarbon release frequency per year due
to corrosion if no safety barriers are functioning or no corrective actions are implemented from today. The categorization of
releases as diffuse, minor, or significant releases is based on
a judgment of the relation between hole sizes caused by the
relevant corrosion mechanisms and pressure conditions in the
system [11], together with input from personnel from the oil
company.

700

S. Sklet et al. / Journal of Hazardous Materials A137 (2006) 692708

Fig. 10. Barrier block diagram for scenario C.

Success of inspections implies that the predicted damage rate

is equal to or less than the actual damage rate, thus no release
should occur due to corrosion before the next inspection. Implicit
in the definition of success of inspection is an assumption of
implementation of corrective actions if the remaining time to
release is very short. Further, it is assumed that diffuse discharges
and minor releases will escalate into significant releases if not
revealed.

Findings from condition monitoring usually imply revision

of inspection intervals and the assumptions for the analysis of
the release frequency due to corrosion.
The fault trees for the safety barriers (C1, C2 and C3) are
shown in Figs. 1113. Note that the quantitative analysis of the
inspection node was not made strictly according to the fault
tree in Fig. 11. Quantification of the expected release frequency
due to corrosion and the effect of inspection is build on the

Fig. 11. Fault tree for barrier no. C1, inspection.

S. Sklet et al. / Journal of Hazardous Materials A137 (2006) 692708

701

Fig. 12. Fault tree for barrier no. C2, condition monitoring.

principles that corrosion exists in the system with a damage

rate d (the damage rate is often denoted as corrosion rate). The
damage rate may be modelled as a gamma stochastic process
[10]. To simplify, only the mean damage rate d is used in the
further calculations. If no preventive maintenance or corrective action is performed, the mean time to hydrocarbon release
is trelease .
The wall thickness at time t is denoted Qt . Further, q0 denotes
the wall thickness at time t0 , and qrelease denotes the wall thickness when release is expected to occur. Then:
trelease =

q0 qrelease
d

(4)

The damage rate d is unknown, but may be predicted, e.g., by

using measurements from inspections.

If d denotes the predicted damage rate, a prediction of trelease ,

trelease may be determined from the following:
trelease =

q0 qrelease
d

(5)

However, safety barriers are implemented in order to prevent

release of hydrocarbons. Inspections are planned to be executed
at time ti approximately equal to 0.5 trelease in order to measure
When
the wall thickness and calculate updated damage rates (d).
the wall thickness is less than a critical limit, corrective actions
are implemented.
Hydrocarbon releases may occur if the damage rate d is
greater than dcritical , i.e., the damage rate that will result in
release prior to execution of next inspection (at planned time (ti )
or delayed). If the inspection ti is cancelled, the next planned
inspection will be carried out at time ti+1 .

Fig. 13. Fault tree for barrier no. C3, area based leak search.

702

S. Sklet et al. / Journal of Hazardous Materials A137 (2006) 692708

Fig. 14. Event tree used for quantification.

For further quantification, a simplification is made; the corrosion rate is categorized in three damage rate states si (according
to [9]). The times to leak are here expressed as deterministic
quantities, which is a simplification. The times expressed here
should be considered as expected values:
s1

s2
s3

In this case we will not have release

Predicted rate or less, d = d:
before trelease (because trelease = trelease ). As ti 0.5 trelease , we have
trelease ti+1. Thus, even if the first inspection (ti ) is cancelled, an inspection (ti+1 ) will take place before release will occur.
2 d):
In this case trelease > ti , but
Predicted rate to two times rate, d (d,
ti+1 trelease . A release may occur if an inspection is delayed or cancelled.
In this case, trelease < ti , and a
Two to four times predicted rate, d > 2d:
release will occur prior to the first inspection.

Hence, the probability of failure to reveal that the actual damage rate is greater than the critical damage rate (d > dcritical ) by
inspection may as an approximation be expressed as;
PFailure (C1) = P(s3 )(1 P(delayed)) + P(s2 )P(delayed)

dicted damage rates prior to an inspection, the likelihood that

the inspection results determine the true damage state, and the
confidence in damage rate after inspections.
As mentioned above, the frequency of the initiating event
(0C ) in Fig. 14 expresses a prediction of the release frequency
per year due to corrosion if no safety barriers are functioning or
corrective actions are implemented from today. The frequency
0C is calculated as the number of segments with trelease less than
10 years divided by 10 years. The time limit was set to 10 years
since a company requirement states that the maximum permissible inspection interval is 5 years and ti 0.5 trelease . The

prediction of 0C is based on a prediction of the damage rate (d)

established from results from the last inspection on the platform
and is calculated to be 2.2 per year. Therefore, a consequence of
changes in d is that 0C must be recalculated. We need to calculate 0C for each of the defined corrosion groups, where 0CCG1
relates to corrosion group 1 Main flow pipes, and 0CCG2 related
to corrosion group 2 Dead legs. Based on a rough calculation,
the following numbers were used in this case study:

(6)
where P(delayed) expresses the probability that the planned
inspection at time ti is delayed or cancelled. In formula (6),
P(delayed) corresponds to the probability of occurrence of basic
event C12 in Fig. 11, while P(s3 ) denotes the probability of
occurrence of basic event C13. The effect of poor inspection
reliability (basic event C14 and basic event C15) is not included
in the quantification process in this case study. However, this
may be included as part of further work.
is imporOur confidence in the predicted damage rate (d)
tant by use of this formula. API [9] describes how to calculate
the effect of the inspection program on the confidence level in
the damage rate, and presents data for the confidence in pre-

0CCG1 = 0.8 leaks/year,

0CCG2 = 1.4 leaks/year

In order to quantify the expected release frequency per

year due to internal corrosion, quantitative numbers should be
assigned to the input in formula (1) and all basic events in the
fault trees in Figs. 12 and 13. The assigned numbers are presented
in Table 5 both for corrosion group 1 and corrosion group 2.
Based on the described models and the data in Table 5, the
probabilities of failures of the different barriers and expected
release frequencies per year are calculated as shown in Table 6.
The annual hydrocarbon release frequency due to internal corrosion in the system is 0.043 releases per year.

Table 5
Corrosion; summary of industry average probabilities/frequencies
Event description

Assigned probabilities/
frequencies CG1

Assigned probabilities/
frequencies CG2

Data source

0CCG1/2

Initial frequency of release due to corrosion

0.8

1.4

P (BC11 )
P (BC12 )/P(delayed)
P (BC13 )/P (d = s3 )
P (BC14 )/P (d = s2 )
P (BC21 )
P (BC22 )
P (BC23 )
P (BC24 )
P (BC31 )
P (BC32 )
P (BC33 )
P (BC34 )
P (BC35 )
P (BC36 )
P (BC4 )

Probability of failure to specify inspection

Probability of failure to perform inspection as planned
Probability of damage rate in state 3
Probability of damage rate in state 2
Probability of failure to specify condition monitoring
Probability of failure to perform condition monitoring when specified
Probability of failure to detect internal corrosion by corrosion coupons
Probability of failure to detect internal corrosion by MIC sampling
Probability of failure to specify daily area inspection
Probability of failure to perform daily area inspection when specified
Probability of failure to detect a diffuse discharge by daily area inspection
Probability of failure to specify area based leak search
Probability of failure to perform area based leak search when specified
Probability of failure to detect a diffuse discharge by area based leak search
Probability of failure to detect a minor release by HC detection system

0a
0.1
0.11b
0.24
0d
0.1
0.4
0.6
0f
0.1
0.9
0g
0.1
0.75
0.2h

0
0.1
0.047c
0.14
0
0.1
1.0e
0.6
0
0.1
0.9
0
0.1
0.75
0.2h

Prediction based on data

from inspections
Expert judgment
Rough calculation
[9] (Expert judgment)
[9] (Expert judgment)
Expert judgment
Rough calculation
Expert judgment
Expert judgment
Expert judgment
Rough calculation
Expert judgment
Expert judgment
Rough calculation
Expert judgment
Rough calculation

a
b
c
d
e
f
g
h

Inspection is specified in this case as P (BC11 ) = 0.

Basis (prior) is low reliability data and execution of a fairly effective inspection for CG1.
Basis (prior) is low reliability data and execution of a usually effective inspection for CG2.
Condition monitoring is specified in this case as P (BC2 ) = 0.
No use of corrosion coupons in dead legs today.
Daily area inspection is specified in this case as P (BC31 ) = 0.
Area based leak search is specified in this case as P (BC34 ) = 0.
The barrier System for detection of HC is not analysed any further in this case study.

S. Sklet et al. / Journal of Hazardous Materials A137 (2006) 692708

Event notation

703

704

S. Sklet et al. / Journal of Hazardous Materials A137 (2006) 692708

Table 6
Scenario Cresults from calculations
Event

CG1

CG2

0C a
PFailure (C1)b
PFailure (C2)c
PFailure (C3)d
PFailure (C4)e
C f

0.8
0.12
0.32
0.71
0.2
0.016

1.4
0.056
0.64
0.71
0.2
0.027

a
b
c
d
e
f

Predicted release frequency with no safety barriers or corrective actions.

Probability of failure to reveal critical corrosion by inspection.
Probability of failure to reveal critical corrosion by condition monitoring.
Probability of failure to detect diffuse discharge.
Probability of failure to detect minor release.
Release frequency due to corrosion (per corrosion group).

The main approach in order to analyse the effect of RIFs

(technical conditions, human factors, operational conditions
and organisational factors) is use of risk influence diagrams as
applied for scenarios A and B. Qualitative analyses by developing risk influence diagrams has been carried out for a sample of
basic events in the fault trees for scenario C in order to carry out
sensitivity analysis for assessment of the effect of risk reducing
measures, but there was not performed a complete quantitative
analysis of all the risk influence diagrams. A somewhat different approach was used to analyse the efficiency of inspection
programs quantitatively. As previously described, the expected

release frequency due to corrosion depends on our confidence in

the predicted damage rate. The confidence in the predicted damage rate depends on the inspection efficiency; a highly efficient
inspection program will give a higher confidence than a fairly
efficient inspection program. The relation between the inspection program and its efficiency for local CO2 -corrosion and MIC
are described in the literature [9,11]. The confidence will also
depend on the inspection reliability (basic events C14 and C15
in Fig. 11). C14 was not analysed any further in the case study,
while C15 was analysed qualitatively by a risk influence diagram (see Fig. 15). Risk influence diagrams for basic event C33
and C36 is shown in Figs. 16 and 17, respectively.
3.4. Sensitivity analyses
One of the purposes of the case study was to analyse the
effect of changes and assess whether BORA-Release is suitable
to analyse the effect of risk reducing measures and changes that
may increase the hydrocarbon release frequency.
The following risk reducing measures was analysed for scenarios A and B in order to calculate the effect on the release
frequency:
1. Implementation of an additional barrier, third party control of
work (control of closed valves) for scenario A (reduces the
leak frequency). The probability of failure to specify third
party control is 0.1.

Fig. 15. Risk influence diagram for basic event C15.

Fig. 16. Risk influence diagram for basic event C33.

S. Sklet et al. / Journal of Hazardous Materials A137 (2006) 692708

705

Fig. 17. Risk influence diagram for basic event C36.

2. Improvement of the score of all RIFs by one grade (from D

to C, from C to B, etc.) (reduces the leak frequency).
3. Improvement of the score of the RIF Communication (from
D to C) (reduces the leak frequency). This RIF influences
basic event B33 in scenario B.
4. Improvement of the RIF Time pressure (from D to C)
(reduces the leak frequency). This RIF influences several
basic event in scenario A as well as scenario B.

The results of the sensitivity analyses for scenarios A and B

are shown in Table 7. The sum of the release frequencies for
scenarios A and B (A + B from Tables 2 and 4) was used as
base case frequency.
The following sensitivity analyses have been executed for
scenario C in order to analyze the effect on the release frequency
due to changes in RIFs influencing the corrosion scenario:

5. Use of corrosion coupons in dead legs (reduces the leak frequency). The probability of failure to detect critical internal
corrosion by corrosion coupons in dead legs is set to 0.4
(similar to main flow lines).
6. Change of efficiency of inspection programs:
a. From fairly effective to usually effective for corrosion
group 1 (improvement of the effectiveness).
b. From fairly effective to highly effective for corrosion
group 1 (improvement of the effectiveness).
c. From usually effective to highly effective for corrosion
group 2 (improvement of the effectiveness).

d. From usually effective to fairly effective for corrosion

group 2 (reduction of the effectiveness).
7. Change in the status of RIFs:
a. Worsening of the RIFs Programs (for inspection) and
Supervision (increases the leak frequency). The status is
changed from C to D. These RIFs influence basic event
C21.
b. Improvement of the RIFs Painting and Tidiness and cleaning (reduces the leak frequency). The status is changed
from C to A. These RIFs influence the basic events C33
and C36 (see Figs. 16 and 17).
c. Improvement of the RIFs influencing the barrier System
for detection of hydrocarbon releases (reduces the leak
frequency). Since this barrier is not further analysed, the
sensitivity analysis is carried out directly by changing the
probability of failure to detect minor release by system
for HC detection from 0.2 to 0.1.
d. Changes in RIFs influencing the distribution between diffuse, minor, and significant releases (increase the leak
frequency). The sensitivity analysis is carried out directly
by changing the distribution to 10% as diffuse, 40% as
minor, and 50% as significant.
The results from the recalculation of the release frequencies due to corrosion based on the revised input data are shown
in Table 8. The sum of the release frequency due to corrosion
(0CCG1 + 0CCG2 from Table 6) is used as base case frequency
for assessment of the change in %.
The main results from the sensitivity analyses are:

Table 7
Results from sensitivity analyses for scenarios A and B
Sensitivity no.

Input data

Base case frequency

Sensitivity frequency

Change (%)

Average
Revised

0.0295
0.0453

0.0068
0.0143

76.9
68.3

Average
Revised

0.0295
0.0453

0.0295
0.0179

0.0
60.5

Average
Revised

0.0295
0.0453

0.0295
0.0443

0.0
2.1

Average
Revised

0.0295
0.0453

0.0295
0.0326

0.0
27.9

706

S. Sklet et al. / Journal of Hazardous Materials A137 (2006) 692708

Table 8
Results from sensitivity analyses for scenario C
Sensitivity no.

5
6a
6b
6c
6d
7a
7b
7c
7d

Release frequency

4. Discussion and conclusions

Change (%)

Original

Revised

0.043
0.043
0.043
0.043
0.043
0.043
0.043
0.043
0.043

0.029
0.034
0.028
0.021
0.074
0.050
0.037
0.039
0.053

31.3
20.7
35.3
51.8
73.3
15.5
13.2
9.5
23.6

Implementation of an additional barrier (third party control

of work) in scenario A reduces the release frequency from
scenarios A and B with 77% by use of industry average data,
and 68% by use of revised data.
Improvement of the scores of all RIFs by one grade reduces
the release frequency from scenarios A and B with 61%.
Improvement of the score of the RIF Communication (from
D to C) reduces the release frequency from scenarios A and
B with 2%.
Improvement of the RIF Time pressure (from D to C) reduces
the release frequency from scenarios A and B with 28%.
Implementation of condition monitoring by use of corrosion
coupons in dead legs reduces the expected release frequency
due to corrosion by 31%.
Improvement of the efficiency of the inspection program has
a relative high influence on the release frequency due to corrosion (see sensitivity 6a, 6b, and 6c). Changing from fairly
effective to usually effective for corrosion group 1 reduces
the expected release frequency by 21%. Changing from fairly
effective to highly effective for corrosion group 1 reduces the
expected release frequency by 35%. Changing from usually
effective to highly effective for corrosion group 2 reduces the
release frequency by 52%.
Reduction of the efficiency of the inspection program
increases the expected release frequency due to corrosion.
Changing from usually effective to fairly effective for corrosion group 2 increases the release frequency by 73%.
Increased probability of occurrence of basic event C12
(inspection specified, but not performed as planned) from 0.1
to 0.2 (i.e., even more of the planned inspections are delayed
or cancelled) leads to an increase in the release frequency due
to corrosion by 16%.
Improvement of the status of the RIFs Painting, and Tidiness
and cleaning has positive impact on the expected release frequency due to corrosion (reduction by 13%).
Changing the probability of failure to detect minor release by
system for HC detection from 0.2 to 0.1 reduces the release
frequency by 10%.
Changes in the distribution between diffuse, minor and significant releases to 10% as diffuse, 40% as minor, and 50%
as significant, increase the release frequency 24%.

BORA-Release was used to analyse three hydrocarbon

release scenarios on an offshore oil and gas production platform
on the Norwegian Continental Shelf. Use of BORA-Release in
the case study to calculate the platform specific release frequency
for scenarios A and B resulted in a higher release frequency
than the results obtained by use of industry average data. The
reason for this difference is that the status of several of the RIFs
measured by the RNNS-data was worse than the industry average standard. If the status of the RIFs had been better than the
average standard, the revised release frequency would become
lower than the frequency calculated by use of industry average
data.
Several sensitivity analyses were carried out in order to evaluate the possibility of using BORA-Release to analyse the effect
on the release frequency of safety barriers and risk reducing
measures. The sensitivities showed the effect on the release frequency expressed as change in % compared to the base case
due to different measures or changes (sensitivity 17). Several types of changes were assessed, ranging from introduction
of a new safety barrier to change in the status of one specific
RIF. Thus, the effects on the release frequencies of the sensitivities varied, however, the results and the variation were
assessed to be reasonable. The sensitivity analyses illustrated
that BORA-Release may be used to analyse the effect on the
release frequency of safety barriers and other types of changes.
The qualitative modelling of the release scenarios by use of
barrier block diagrams initiated discussions among personnel in
the oil company about which type of barriers that most effectively may prevent hydrocarbon release. One example is the
discussion of whether or not third party control of work to reveal
potential valve(s) in wrong position should be implemented as
part of the flowline inspection. Personnel that argued for implementation were supported by the results from the sensitivity
analyses indicating that implementation of an additional barrier
(third party control of work) in scenario A resulted in a significant reduction of the release frequency. Similarly, the qualitative
modelling of barrier performance by use of fault trees and risk
influence diagrams raised the consciousness among the personnel in the oil company about which RIFs that influenced the
barrier performance.
Application of BORA-Release for analysis of the loss of containment barrier generated and systematized knowledge about
factors influencing the release frequency and presented a more
detailed risk picture than traditional QRAs since no analyses of
causal factors of hydrocarbon releases are carried out in existing
QRAs.
A main question with respect to the quantitative results is
whether the calculated release frequencies are trustworthy (i.e.,
whether we have confidence in the frequencies being able to
provide good predictions of the actual number of releases) since
the analysis is based on a number of assumptions and simplifications. These relate to the basic risk model, the industry average
input probabilities/frequencies, the risk influence diagrams, the
scoring of RIFs, the weighting of RIFs, or the adjustment of the
input probabilities. The quantitative results in the case study for

S. Sklet et al. / Journal of Hazardous Materials A137 (2006) 692708

scenarios A and B based on industry average data were assessed

to be reasonable compared to release statistics. This view was
supported by the answers from the personnel from the actual oil
company when they were asked whether or not the results were
trustworthy. The confidence in the results based on the revised
input probabilities/frequencies was not as good due to use of the
RNNS-data for scoring of RIFs. Since the scoring was based
on few and generic questions not originally meant to be used as
basis for RIF-scoring, the validity (i.e., whether or not it measures what it is supposed to measure [12]) of the scoring was
assessed to be low. The main reason for use of RNNS-data to
assess the status of RIFs in the case study was the demand for
use of existing data in order to minimize the use of resources
from the industry representatives in the steering group for the
BORA project. Since the revised release frequency to a high
degree was influenced by the results from the RNNS-survey, the
approach chosen for scoring of RIFs should be discussed in the
further work.
Another aspect of the scoring is how specific the assessment
of the status of RIFs needs to be. This may be illustrated by an
example; is it sufficient to assess the competence in general for
all groups of personnel on a platform, or is it necessary to assess
the competence for each group in order to reflect differences
between the groups? As far as possible, the level of detail should
be sufficiently detailed and specific to reflect scenario specific
factors, but in practice, it may be necessary to be somewhat more
general.
The confidence in the quantitative results from the corrosion
scenario by personnel from the actual oil company is lower than
for scenarios A and B. The corrosion phenomenon is a complex
and dynamic scenario and several assumptions made during the
work should be further discussed. The present version is a test
model and further research is required to better reflect how more
aspects of the corrosion scenario influence the release frequency,
e.g., the effect of the inspection reliability (see [13] for a discussion of attributes characterizing barrier performance).
The case study has demonstrated that BORA-Release is a
useful tool for analysing the effect on the hydrocarbon release
frequency of safety barriers introduced to prevent hydrocarbon
releases, and to study the effect on the barrier performance of
platform specific conditions of technical, human, operational,
and organizational RIFs. In the case study, the sensitivity analyses were used to illustrate this topic, and the results from the
sensitivity analyses supported this conclusion. One of the main
application areas of BORA-Release may be to study the effect on
the release frequency of risk reducing measures or risk increasing changes.
When it comes to further work, BORA-Release should be
applied for analysis of the other release scenarios described in
[5]. This set of release scenarios is considered to constitute a
comprehensive and representative set of hydrocarbon release
scenarios where the initiating events cover the most frequent
causes of hydrocarbon releases. The scenarios include the
most important barrier functions and barrier systems introduced
to prevent hydrocarbon releases. A detailed analysis of all these
scenarios will increase the knowledge about how safety barriers influence the release frequency, and how technical, human,

707

operational, and organisational RIFs influence the barrier performance on a platform.

The main focus on the further development of BORA-Release
should be on other methods for assessment of the status of RIFs.
Two possible ways are use of results from the TTS project [14],
or to develop specific scoring schemes for the different RIFs
similar to Behaviourally Anchored Rating Scales (BARS) as
described by Jacobs and Haber [15]. Since the main focus of
the TTS project is on technical aspects of technical barriers, a
combination of these two methods may be a possible approach.
However, TTS projects are not carried out on all platforms on
the Norwegian Continental Shelf. A more detailed discussion of
BORA-Release in general and the different steps is presented in
Part I of the paper.
As stated, this case study has focused on analysis of the loss
of containment. Further development of BORA-Release should
also make an attempt to apply the method on consequence reducing barriers in order to test how suitable the method is for an
overall risk analysis. An overall risk model including preventive,
controlling, and protective barriers will also make it possible
to analyse the effect of potential dependencies (common-cause
failures) between different barriers in the event sequence.
Acknowledgements
The case study is carried out as part of the BORA-project
financed by the Norwegian Research Council, The Norwegian
Oil Industry Association, and Health and Safety Executive in
UK. The authors acknowledge personnel from the actual oil
company that attended the workshops, and Helge Langseth
at SINTEF for valuable input as regards quantification of the
inspection effectiveness.
References
[1] PSA, Regulations relating to management in the petroleum activities
(The Management Regulations). Petroleum Safety Authority Norway, Stavanger, September 3, 2001.
[2] J.E. Vinnem, T. Aven, S. Hauge, J. Seljelid, G. Veire, Integrated barrier
analysis in operational risk assessment in offshore petroleum operations,
in: PSAM7 - ESREL04, Berlin, 2004.
[3] T. Aven, S. Sklet, J.E. Vinnem, Barrier and operational risk analysis of
hydrocarbon releases (BORA-Release); Part I Method description, J. Hazard. Mater. 137 (2006) 681691.
[4] S. Sklet, T. Aven, S. Hauge, J.E. Vinnem, Incorporating human and organizational factors in risk analysis for offshore installations, ESREL 2005,
Gdynia, 2005.
[5] S. Sklet, Hydrocarbon releases on oil and gas production platforms: release
scenarios and safety barriers, J. Loss Prevent. Process Ind. 19 (2006)
481493.
[6] A.D. Swain, H.E. Guttmann, Handbook of Human Reliability Analysis with
Emphasis on Nuclear Power Plant Applications: Final Report NUREG CR1278, SAND80-200, Sandia National Laboratories Statistics Computing
and Human Factors Division, Albuquerque, 1983.
[7] PSA, Trends in risk levels on the Norwegian Continental Shelf Main report
Phase 4 2003 (Utvikling i risikoniva norsk sokkel Hovedrapport Fase 4
2003), The Petroleum Safety Authority, Stavanger, 2004 (in Norwegian).
[8] J.E. Vinnem, S. Sklet, T. Aven, P.. Braarud, Operational Risk
AnalysisTotal Analysis of Physical and Non-Physical Barriers. H2.6
Quantification of Leak Frequency with BBD methodology. Draft 0, Rev.
8, Preventor, Bryne, Norway, April 2005.

708

S. Sklet et al. / Journal of Hazardous Materials A137 (2006) 692708

[9] API, Risk-Based Inspection Base Resource Document. API Publication 581, first ed., American Petroleum Institute, Washington, USA,
2000.
[10] M. Rausand, A. Hyland, System Reliability Theory: Models, Statistical Methods, and Applications, Wiley-Interscience, Hoboken, NJ,
2004.
[11] DNV, Risk Based Inspection of Offshore Topsides Static Mechanical
Equipment, Recommended Practice, Det Norske Veritas, Norway, 2002.

[12] Statistics, Britannica Student Encyclopedia, Encyclopdia Britannica

Online. http://search.eb.com/ebi/article-208648, 10 November 2005.
[13] S. Sklet, Safety barriers: definition, classification, and performance, J. Loss
Prevent. Process Ind. 19 (2006) 494506.
[14] O. Thomassen, M. Srum, Mapping and monitoring the technical safety
level. SPE 73923, 2002.
[15] R. Jacobs, S. Haber, Organisational processes and nuclear power plant
safety, Reliabil. Eng. Syst. Saf. 45 (1994) 7583.