Design-stage summary
A design-stage QRA should be completed while layout and safeguards can still change. The minimum package includes an agreed basis of study, hazardous-material inventory, plot plan and population data, scenario register, frequency basis, consequence models, risk criteria, uncertainty review, risk-reduction actions and documented close-out.
Design-stage Quantitative Risk Assessment is most valuable before equipment locations, separation distances, occupied buildings and emergency arrangements become expensive to change. It supports design decisions; it should not be treated as a report produced after the layout is already frozen.
Design-Stage QRA Checklist
| Gate | Required information | Decision enabled |
|---|---|---|
| Concept / site selection | Inventories, broad process hazards, surrounding population, candidate layouts | Site suitability and major off-site constraints |
| FEED | Equipment list, preliminary PFDs/P&IDs, plot plan, isolation philosophy | Separation, occupied-building and risk-reduction options |
| Detailed design | Confirmed tags, line sizes, safeguards, detection, isolation and occupancy | Final consequence and risk results |
| Pre-start-up | As-built drawings, closed actions, operating and emergency arrangements | Validation that material risk assumptions remain correct |
| Modification | Management-of-change package and affected scenarios | Whether the existing QRA requires partial or full revision |
Comprehensive QRA Input-Data Checklist
Minimum inputs
A defensible QRA needs controlled process, equipment, layout, population, weather, safeguard and frequency data. Each input should have an owner, document number, revision, date and status—confirmed, preliminary, assumed or unavailable. Missing information does not always stop an early design QRA, but every substitute assumption must be visible and tested for sensitivity before decisions are made.
| Input category | Documents and data required | Validation question |
|---|---|---|
| Scope and design basis | Project description, battery limits, operating modes, design capacities, applicable licences, authority requirements, required risk measures and decision dates | Does the scope state exactly which facility, phases, populations and approval decisions the QRA covers? |
| Process drawings | Current PFDs, P&IDs, utility diagrams, cause-and-effect charts, process descriptions, mass balance and equipment list | Are document numbers and revisions controlled, and are all hazardous inventories connected to the correct isolation boundaries? |
| Materials and operating cases | SDS, composition, phase, hazardous properties, normal/design pressure and temperature, maximum credible inventory, start-up, shutdown and upset conditions | Are mixtures and credible worst operating cases represented rather than only normal values? |
| Equipment and release data | Vessel and tank volumes, fill levels, nozzle sizes, line diameters and lengths, pumps, compressors, transfer rates, bunds, drainage, relief, vent, flare and blowdown arrangements | Can every modelled hole size, release rate and duration be traced to an equipment tag and physical boundary? |
| Detection, isolation and safeguards | Gas/flame detector layout, alarm and trip set points, ESD logic, valve type and closure time, manual response assumptions, fire protection and passive barriers | Is every credited safeguard independent, functional, reliable, auditable and supported by design or test evidence? |
| Layout and mapping | Georeferenced plot plan, equipment coordinates, site boundary, elevations, terrain, drainage, buildings, roads, neighbouring facilities, escape routes and muster points | Can consequence zones and risk contours be reproduced on one stated coordinate system and current drawing revision? |
| Meteorology and terrain | Representative wind speed/direction frequencies, atmospheric stability, temperature, humidity, surface roughness, terrain treatment and data period | Is the dataset representative of the site, and are missing or calm conditions handled transparently? |
| Population and occupancy | Indoor/outdoor workforce by shift, building occupancy, public population grid, roads, transient population and sensitive receptors | Are day/night, weekday/weekend, building vulnerability and time-at-location assumptions defined? |
| Hazard and incident information | HAZID, HAZOP, HIRA and LOPA records; management-of-change files; incident and near-miss history; previous QRA and emergency plans | Does the scenario register include credible findings and explain every inclusion or exclusion? |
| Frequency and probability basis | Approved failure-frequency source, equipment population, exposure units, ignition probabilities, event trees, human-reliability assumptions and common-cause treatment | Are units compatible, branches mutually consistent and site-specific adjustments justified? |
| Acceptance and reporting basis | Applicable criteria, endpoint definitions, required contour levels, societal-risk requirement, ALARP process, uncertainty expectations and report format | Has the client or competent authority accepted the basis before final modelling? |
Minimum input register fields
- input ID and QRA model/scenario affected;
- document title, number, revision and date;
- data owner and source organisation;
- status: confirmed, preliminary, assumed, unavailable or excluded;
- unit, coordinate system, time basis and operating case;
- validation check and reviewer;
- uncertainty or conservative substitute used; and
- action owner and date required for model freeze.
What if QRA data are missing?
Record the gap before modelling. For concept or FEED work, a conservative assumption may be used if its source and decision impact are stated and a sensitivity case is run. For final design, regulatory submission or as-built validation, material assumptions should be replaced with controlled project data. An unsupported safeguard should receive no risk-reduction credit merely because it appears on a preliminary drawing.
1. Basis of Study
- facility and battery-limit boundaries;
- normal, start-up, shutdown and credible upset cases;
- study purpose, required outputs and decision owners;
- approved risk criteria and regulatory context;
- weather, population and occupancy treatment;
- software versions, frequency sources and modelling assumptions; and
- limitations, exclusions and update triggers.
A design QRA can be preliminary, but it must clearly distinguish confirmed inputs from assumptions.
2. Hazardous-Material and Equipment Data
- material composition and hazardous properties;
- maximum credible inventory, pressure and temperature;
- vessel, tank, pump, compressor and piping data;
- transfer, loading and unloading arrangements;
- relief, vent, drain and flare philosophy; and
- automatic and manual isolation capabilities.
Normal operating values should not be substituted for credible design or upset conditions without justification.
3. Layout and Receptor Data
- georeferenced plot plan and equipment coordinates;
- site boundary and adjacent land use;
- control room, offices, workshops and other occupied buildings;
- shift-wise indoor and outdoor populations;
- public receptors, roads and neighbouring facilities; and
- escape routes, muster points and emergency-control locations.
OISD lists OISD-STD-118, Layouts for Oil and Gas Installations, with a June 2025 edition. Projects using it must check the current purchased standard and facility-specific applicability rather than relying on a generic layout table.
4. Scenario Register
Each scenario should identify the equipment tag, material, release location, hole size, operating case, isolation assumption, release duration and possible outcomes. The register should connect to HAZID, HAZOP and design-review findings.
Typical outcome categories include toxic dispersion, flash fire, jet fire, pool fire, fireball or BLEVE, and vapour-cloud explosion. Inclusion and exclusion decisions must be traceable.
5. Frequency and Event-Tree Basis
- state whether data are per item-year, metre-year, demand or operating hour;
- match the source to the equipment type and service;
- document detection, isolation and ignition probabilities;
- check that event-tree branches are mutually consistent; and
- identify assumptions that materially control the result.
See the QRA calculations guide for formulas and a worked example.
6. Consequence and Risk Outputs
- source-term and release-rate summaries;
- toxic, thermal-radiation and overpressure distances;
- individual-risk contours on a readable plot plan;
- societal-risk F-N curves where required;
- dominant-scenario and receptor rankings;
- domino or escalation review where applicable; and
- uncertainty and sensitivity results.
Contours such as 10−4 to 10−7 per year are outputs, not universal acceptance criteria. The applicable criteria must be declared in the study basis.
7. Design Decisions to Test
| Design issue | QRA test |
|---|---|
| Equipment spacing | Compare dominant fire, explosion and escalation cases |
| Control-room location | Check occupancy, toxic, thermal and overpressure exposure |
| Isolation philosophy | Test release duration and conditional outcome frequencies |
| Detection and shutdown | Confirm reliability, coverage and response-time assumptions |
| Inventory reduction | Re-model source term and consequence reduction |
| Emergency planning | Check muster points, escape routes and off-site effects |
8. Action Register and Close-Out
Every recommendation should identify the scenario, proposed action, owner, due date and closure evidence. Material design changes should be reflected in drawings and, where necessary, re-modelled. A recommendation marked “closed” without a changed input or verifiable safeguard should not automatically receive risk credit.
Design Freeze Acceptance Questions
- Are the latest plot plan, inventories and operating cases modelled?
- Have HAZOP and design-review actions affecting QRA assumptions been closed?
- Are occupied buildings, muster points and public receptors represented?
- Are dominant scenarios technically credible and reproducible?
- Have practical layout and safeguard alternatives been compared?
- Does the report show residual risk after accepted mitigation?
- Is responsibility assigned for post-QRA actions and future updates?
When Must a Design QRA Be Updated?
Review the QRA when inventory, material, pressure, temperature, equipment location, line size, isolation, population or surrounding land use changes materially. It should also be reconsidered after a major incident, significant HAZOP finding or regulatory/layout change.
The UK Health and Safety Executive’s plant-modification guidance emphasises risk assessment before modifications are implemented. For Indian oil and gas projects, current OISD and PNGRB requirements must be checked against the project scope.
Frequently Asked Questions
At what design stage should QRA begin?
Begin with a screening or layout QRA during concept/FEED, then update it as equipment, safeguards and population data mature.
Can a preliminary QRA be used for approval?
Only if the receiving authority accepts its maturity and limitations. Preliminary assumptions must not be presented as confirmed as-built data.
Does design-stage QRA replace HAZOP?
No. HAZOP identifies deviations and safeguards; QRA quantifies selected major-accident scenarios. Use the combined QRA–HAZOP workflow.
Who should review the QRA?
The review should involve process, mechanical, instrumentation, layout, operations, emergency-response and project personnel, with independent technical checking of key calculations.
Official Sources
- OISD — Current Standards List
- PNGRB — Notified T4S and ERDMP Regulations
- UK HSE — Plant Modification and Change Procedures
For complete deliverables, use the QRA report review checklist. For project support, review Elion’s QRA services for industrial facilities.