QRA Consequence Modelling: Methodology, Standards, and Regional Compliance

A 4-inch flange leak on a condensate line released roughly 2.3 kg/s of light hydrocarbon vapour into a congested pipe rack. Fifteen seconds later, wind carried the flammable envelope toward an occupied control building 40 metres downwind. The engineer who sized that dispersion distance months earlier had already decided, on paper, whether that building would survive the event. That is the weight consequence modelling carries inside a Quantitative Risk Assessment (QRA): a single hole-size assumption and a single wind speed input can move a risk contour from broadly acceptable to intolerable.

Every downstream number in a QRA, individual risk, societal risk, F-N curves, ALARP justification, is built on the outputs of consequence modelling. Get the source term wrong, pick the wrong weather category, or skip a scenario type, and the entire risk picture shifts, sometimes without anyone downstream noticing the error was ever made.

This article breaks down how consequence modelling methodology actually works inside a QRA study: the sequence from source term to impact assessment, the standards that govern it, how GCC, India, and Southeast Asia regulators expect it to be documented, and the mistakes that most often undermine its defensibility.

Why Consequence Modelling Is the Foundation of a Defensible QRA

Consequence modelling in a QRA quantifies the physical effects of a loss-of-containment event, jet fires, pool fires, flash fires, vapour cloud explosions, toxic dispersion, in terms of heat radiation, overpressure, and concentration versus distance. These outputs feed directly into frequency and risk calculations. Without accurate consequence modelling, every risk number in the study is unreliable.

API 521 governs the design basis for relieving and depressuring systems, and it assumes credible consequence scenarios have already been characterised correctly. A QRA that under-predicts a jet fire’s flame length by even 20% can under-specify a fireproofing rating, an escape route width, or a temporary refuge’s blast rating.

Hazard identification comes first. Isolatable sections of the plant, drawn from P&IDs, are screened for loss-of-containment potential across a range of hole sizes, typically 3 mm, 10 mm, 25 mm, and full-bore rupture. Each hole size at each isolatable section becomes a discrete failure case scenario, sometimes numbering in the hundreds for a mid-sized refinery unit.

Consider a pressure safety valve that fails to reseat after a process upset. The resulting sustained release needs its own source term calculation, distinct from an instantaneous rupture, because the release duration changes the dispersion footprint and the ignition probability window.

A QRA study missing even one credible scenario type, a delayed ignition flash fire following a dense-gas release, for instance, produces a risk contour that looks defensible but is not. Scenario completeness, not modelling sophistication, is usually what separates a defensible QRA from one that fails regulator scrutiny.

The Consequence Modelling Methodology: From Source Term to Impact Assessment

Consequence modelling methodology in a QRA follows four sequential stages: source term calculation, dispersion or radiation modelling, physical effect determination, and impact assessment against harm criteria. CCPS’s Consequence Analysis framework and API 520/521 sizing methods anchor the first two stages. Probit functions convert physical effect levels into probability of harm for each exposed population.

The source term stage calculates release rate, phase, and duration for the selected hole size, using orifice flow equations for liquids and choked-flow equations for gases above roughly twice atmospheric pressure. Get this wrong and every downstream distance is wrong too.

Dispersion modelling then transports the released material downwind, accounting for wind speed, atmospheric stability class, and ground roughness. Three weather categories are typically modelled per scenario: a stable night-time condition, a neutral daytime condition, and an unstable daytime condition, because each produces materially different concentration footprints.

Physical effect modelling then determines the specific hazard: heat radiation contours for jet, pool, and flash fires; overpressure contours for vapour cloud explosions and BLEVEs; and concentration contours for toxic releases. Each effect type uses different governing equations and endpoint criteria, typically 4 kW/m2, 12.5 kW/m2, and 37.5 kW/m2 for thermal radiation, and 0.03 barg, 0.07 barg, and 0.14 barg for overpressure.

Impact assessment closes the loop using probit functions, statistical relationships that convert a physical effect dose into a probability of fatality or injury for an exposed individual. This is where consequence modelling stops being a physics exercise and becomes a risk number.

Consequence Scenario Types: Key Parameters

Scenario Type	Typical Trigger	Key Output Parameter	Governing Endpoint
Jet Fire	Continuous pressurised release, immediate ignition	Flame length, heat radiation contour	12.5 kW/m2 (equipment damage)
Pool Fire	Liquid spill, immediate ignition	Pool diameter, heat radiation contour	4 kW/m2 (personnel escape)
Flash Fire	Delayed ignition of a dispersing vapour cloud	Flammable envelope (LFL) footprint	Lower Flammable Limit boundary
Vapour Cloud Explosion (VCE)	Delayed ignition in a congested or confined area	Overpressure contour	0.14 barg (structural damage)
Toxic Dispersion	Release of a toxic material, no ignition	Concentration versus distance	IDLH / ERPG-3 threshold

Applying Consequence Modelling Under GCC, India, and Southeast Asia Regulatory Frameworks

GCC, India, and Southeast Asia regulators each set distinct expectations for how consequence modelling outputs feed into QRA acceptance criteria. OISD-STD-116 governs QRA methodology for Indian oil and gas installations, PESO regulates hazardous substance storage and transport, and KAHRAMAA reviews consequence modelling assumptions for Qatari facilities near populated areas.

India’s OISD-STD-116 requires QRA studies for major accident hazard installations and expects consequence modelling to use site-specific meteorological data rather than default weather sets, a detail many generic studies skip. PESO’s jurisdiction over explosives, petroleum, and compressed gas licensing means consequence modelling outputs directly influence storage distance approvals and licence renewals.

In the GCC, KAHRAMAA and equivalent authorities in Oman and the UAE increasingly request societal risk (F-N curve) evidence alongside individual risk contours, particularly for facilities within a few kilometres of residential development. Southeast Asian regulators, Malaysia’s DOSH among them, tend to reference UK HSE or Dutch risk criteria directly, which changes which probit functions and endpoint thresholds are acceptable in the study.

A consequence modelling study built for one jurisdiction rarely transfers cleanly to another without re-checking the weather data source, the population density assumptions, and the applicable risk acceptance criteria. Engineers moving between GCC and Indian projects often default to whichever risk criteria they used last, an assumption that regulators increasingly catch during review.

Common Mistakes That Undermine Consequence Modelling Accuracy

The most common consequence modelling mistakes are using a single generic weather category instead of the required three, applying a fire model’s default endpoint criteria without checking local regulatory thresholds, and omitting delayed-ignition flash fire scenarios entirely. Each mistake shifts risk contours in ways that look plausible but understate the actual hazard footprint.

Here’s where most studies fail: treating weather category selection as a formality rather than a scenario driver. A stable night-time condition traps a dense gas cloud closer to the ground and extends its travel distance; skipping it in favour of a single neutral daytime run understates the flash fire and toxic dispersion footprint significantly.

The second common failure is using default probit coefficients without confirming they match the substance in question. Toxic probit functions are substance-specific, ammonia and chlorine do not share the same lethality curve, and a generic substitution can misstate the harm distance by a wide margin.

We are a global authority in process safety and risk engineering, and reviewing consequence modelling packages across GCC and Indian facilities repeatedly surfaces the same root cause: models built once during FEED and never revisited when the plot plan, inventory, or occupancy changed.

The third failure is scope creep in reverse, deliberately narrowing the scenario set to reduce study cost. This invalidates the risk picture the QRA is meant to produce.

Best Practices for Building a Defensible Consequence Modelling Study

A defensible consequence modelling study documents every source term assumption, models a minimum of three weather categories per scenario, cross-checks probit functions against the specific substance released, and traces every hole size back to an isolatable section on a current P&ID. Assumption traceability, not modelling complexity, is what regulators and auditors actually test.

1. Build the assumption register first. Every source term equation, weather category, and probit coefficient belongs in a single traceable document, not scattered across calculation sheets.

2. Confirm the P&ID revision. Isolatable section boundaries drift as plants are modified; a QRA built on an outdated P&ID misses new failure cases.

3. Model all three weather categories per scenario, not one. Skipping the stable night-time case is the single most common shortcut that understates risk.

4. Match probit functions to the actual substance and exposure duration, not a generic toxic release template.

5. Revisit the study whenever occupancy, inventory, or plot plan changes. A consequence modelling package frozen at FEED stage does not track a facility through commissioning and operation.

Emerging Developments: CFD Integration, Domino Effects, and Natech Events

Consequence modelling is shifting from two-dimensional dispersion contours toward three-dimensional CFD integration for congested and confined facilities, alongside growing inclusion of domino escalation effects and Natech scenarios, natural hazards triggering technological accidents, within QRA scope. These additions produce a more realistic, but more computationally demanding, risk picture.

Domino effect analysis is becoming a standard QRA scope item, particularly for tank farms and pipe racks where a fire or explosion at one unit can escalate to an adjacent one. Natech events, floods or seismic activity triggering a loss of containment, are also entering QRA scope in flood-prone GCC and Indian coastal facilities, an area where consequence modelling methodology is still maturing.

Conclusion

Consequence modelling methodology in a QRA is not a formality between hazard identification and risk calculation. It is the technical core that determines whether a facility’s risk contours reflect reality or a set of convenient assumptions. Source term accuracy, complete weather category coverage, substance-specific probit functions, and current P&ID traceability separate a defensible study from one that fails regulator review.

For engineering teams operating across GCC, India, and Southeast Asia, the regulatory expectations attached to consequence modelling differ by jurisdiction, and a study built for one region rarely transfers cleanly to another without revisiting its underlying assumptions.

The practical takeaway: audit your last consequence modelling package against its assumption register before your next QRA update, not after a regulator asks for it.

For a structured review of your facility’s risk picture, explore iFluids Engineering’s Quantitative Risk Assessment (QRA) services, or read how consequence modelling connects into a full integrated HAZOP and QRA study.