Indian Oil Corporation Ltd (IOCL) operates a petroleum products terminal at Amausi Tehsil, Lucknow, Uttar Pradesh, receiving Motor Spirit (MS), High Speed Diesel (HSD), Aviation Turbine Fuel (ATF), and Superior Kerosene Oil (SKO) by pipeline, rail wagon, and tank truck, and dispatching product onward by road tanker. iFluids Engineering carried out a Quantitative Risk Assessment (QRA) for this terminal, covering pipeline receipt, tank-truck receipt, storage infrastructure, and loading operations, to identify credible Loss of Containment (LOC) scenarios and benchmark the terminal’s individual and societal risk against the UK Health and Safety Executive’s (HSE) risk acceptance criteria under the ALARP (As Low As Reasonably Practicable) principle. A terminal that receives product through three separate transport modes carries a wider set of failure paths than a single-mode depot, and the QRA had to model pipeline, rail, and road receipt as distinct hazard populations rather than one generic receipt scenario.
| Field | Detail |
|---|---|
| Sector | Oil & Gas (Petroleum Products Distribution) |
| Location | Amausi Tehsil, Lucknow, Uttar Pradesh, India |
| Facility Type | Petroleum products terminal (receipt, storage, distribution) |
| Client | Indian Oil Corporation Ltd (IOCL) |
| Scope of Work | Quantitative Risk Assessment (QRA): pipeline receipt, tank-truck receipt, storage, loading operations |
| Standards / Criteria Applied | UK HSE risk acceptance criteria, ALARP principle, OISD-STD-118 |
| Regulatory Framework | PNGRB Petroleum Product Pipelines Technical Standards and Safety (PPPL T4S) |
| Project Duration | Not publicly disclosed for this engagement |
| iFluids Team Size | Not publicly disclosed for this engagement |
The Engineering Challenge at IOCL’s Lucknow Terminal
IOCL’s Lucknow terminal receives Motor Spirit, High Speed Diesel, Aviation Turbine Fuel, and Superior Kerosene Oil through pipeline, rail wagon, and tank truck simultaneously, a multi-modal receipt configuration that a regulator requires to be assessed as three distinct hazard populations, not one combined storage-and-transfer risk profile.
Pipeline receipt introduces a continuous-flow failure mode: a ruptured or leaking receipt line can release product at a sustained rate for as long as it takes to detect and isolate, producing a pool fire or vapour dispersion event with a different duration profile than a one-off tank-truck spill. Rail-wagon receipt adds a further failure path, since a wagon coupling or bottom-valve failure during transfer happens at a siding that can sit closer to the terminal perimeter than the main tank farm. PNGRB’s Petroleum Product Pipelines Technical Standards and Safety regulations require a documented risk assessment before a pipeline-fed terminal can commission or modify its receipt facilities. That requirement is why the QRA had to treat pipeline receipt as a named, separately modelled scenario rather than folding it into a generic tank-farm hazard list.
Tank-truck receipt and the terminal’s own road-tanker loading operations add a third, higher-frequency but typically smaller-consequence failure population: hose, coupling, and overfill scenarios at the transfer bays. Treating all three receipt modes, and the loading bays, as one undifferentiated “product handling” hazard would understate the frequency contribution from the bays while overstating how independent the pipeline and rail failure paths actually are from the tank farm they feed.
Aviation Turbine Fuel handling adds a further variable: ATF’s flash point and volatility differ from Motor Spirit and High Speed Diesel, which changes which LOC scenarios dominate at the specific tank or transfer point handling it. A QRA that treats every product on site as generically flammable, rather than modelling each product’s own release and ignition behaviour, would misattribute where the terminal’s highest-consequence scenarios actually sit.
iFluids’ QRA Approach and Methodology
iFluids Engineering’s Quantitative Risk Assessment (QRA) service identifies Loss of Containment scenarios across every receipt and dispatch mode a terminal operates, quantifies their consequence and frequency, and benchmarks the resulting individual and societal risk against the UK HSE’s risk acceptance criteria under ALARP.
The methodology followed a standard sequence for the Lucknow terminal:
- Hazard identification: catalogue every credible LOC scenario across pipeline receipt, rail-wagon receipt, tank-truck receipt, storage tankage, and loading bays.
- Consequence modelling: quantify jet fire, pool fire, flash fire, vapour cloud dispersion, and overpressure effect distances for each scenario.
- Frequency analysis: assign failure frequencies to each LOC scenario using recognised process industry failure-rate data, distinguishing continuous-flow pipeline failures from discrete transfer failures.
- Risk quantification: combine consequence and frequency into individual risk contours around the terminal and a societal risk (F-N curve) profile.
- ALARP evaluation: compare the calculated risk levels against the applicable acceptance criteria.
- Risk reduction recommendations: where a scenario sits outside the acceptable band, recommend engineering or procedural mitigation specific to the receipt mode driving it.
The UK HSE’s tolerability-of-risk framework defines an individual risk above 1 in 10,000 per year to a member of the public as unacceptable and a risk below 1 in 1,000,000 per year as broadly acceptable, leaving the ALARP principle to govern the region between those two limits. Societal risk is presented separately as an F-N curve, plotting incident frequency against the number of people potentially affected, so a low-frequency, high-consequence pipeline scenario can be compared directly against a higher-frequency, lower-consequence bay incident on the same basis.
Consequence distances for vapour cloud dispersion also depend on atmospheric stability class and wind speed, both selected from meteorological data representative of the terminal’s location in the Indo-Gangetic plain rather than a single generic weather assumption. A terminal sited on flat, inland terrain disperses a release differently than a coastal or hill-terrain site, and the QRA has to reflect that local condition rather than reuse a default dispersion input from an unrelated project.
Recognized for excellence.
PROJECTS DELIVERED ACROSS THE GLOBE
Technical Decisions and Engineering Rationale
IOCL’s Lucknow terminal’s three separate receipt modes, pipeline, rail wagon, and tank truck, shape the QRA’s scenario architecture: OISD-STD-118 spacing requirements determine how close each receipt facility sits to the main tank farm, and that layout decision changes which scenarios drive the terminal’s risk profile.
OISD-STD-118 specifies minimum spacing between a terminal’s tankage, process areas, and its rail or road receipt facilities, a separation distance that directly limits how a fire or dispersion event at one receipt point could escalate into the tank farm or an adjoining receipt facility. Where a rail siding sits closer to the tank farm boundary than the standard’s spacing tables allow for the wagon capacity handled, the QRA has to check that domino potential explicitly rather than assume the layout is compliant by default. The tank-truck loading bays introduce a separate consideration again: because loading is a manual, operator-attended activity repeated many times a day, its failure frequency is driven by human factors and equipment wear rather than the design-margin questions that dominate pipeline and rail receipt. Modelling all three modes against the same generic “storage terminal” template would have missed which specific layout and operating decisions actually control the terminal’s individual and societal risk.
Outcomes and Deliverables
The QRA delivered IOCL a documented risk register benchmarking the Lucknow terminal’s pipeline, rail, and road receipt operations, storage tankage, and loading bays against UK HSE risk acceptance criteria, with the ALARP demonstration and any risk-reduction recommendations needed to support continued safe operation.
| Deliverable | Standard / Criteria | Outcome |
|---|---|---|
| QRA report (LOC identification, consequence and frequency analysis) | UK HSE risk acceptance criteria | Individual and societal risk quantified separately for pipeline, rail, road, and loading-bay scenarios |
| ALARP demonstration | ALARP principle | Risk levels benchmarked against the acceptable, ALARP, and unacceptable bands |
| Risk reduction recommendations register | OISD-STD-118 / PNGRB PPPL T4S | Mitigation measures identified for any scenario falling outside the acceptable band |
PNGRB’s PPPL T4S framework requires a pipeline-fed terminal operator to close out QRA-driven risk-reduction recommendations as a condition of retaining its pipeline receipt authorisation, which is why the recommendations register functions as a compliance deliverable rather than a supplementary suggestion.
Lessons and Applicability for Multi-Modal Petroleum Terminals
Terminals receiving product by more than one transport mode, including IOCL’s Doimukh Depot that iFluids has also assessed, share a lesson worth generalising from Lucknow: the receipt mode with the tightest OISD-STD-118 layout margin, not the one with the largest single-event consequence, often drives the site’s individual risk contour.
For a terminal planning a new pipeline connection or an additional rail siding, that means the QRA needs revisiting whenever a receipt mode is added or its layout changes, rather than being treated as a one-time exercise valid for the terminal’s full operating life. OISD-STD-118 governs the spacing baseline uniformly, but it does not model how three receipt modes interact operationally at one site, so that interaction has to be assessed case by case. Any terminal combining pipeline, rail, and road receipt should treat a single-mode QRA template as a starting point to adapt, not a finished methodology to copy across.
Conclusion and Next Steps
iFluids Engineering’s QRA for IOCL’s Lucknow terminal benchmarked pipeline, rail-wagon, and tank-truck receipt, storage tankage, and loading-bay operations against UK HSE risk acceptance criteria and closed the ALARP loop PNGRB’s PPPL T4S framework expects from a pipeline-fed terminal. This project is representative of iFluids’ work for multi-modal petroleum terminals across India that need a defensible, standards-referenced risk assessment rather than a generic hazard checklist. If your terminal needs a Quantitative Risk Assessment benchmarked against UK HSE, OISD, or PNGRB criteria, contact iFluids Engineering to discuss scope.