Criterion 3.5 "The safety report should provide details to demonstrate that suitable and sufficient consequence assessment for each major accident scenario has been carried out with respect to people and the environment."
The Operator must assess the extent and severity of each identified major accident scenario. The assessment should take account of potential damage to structures as well as hazards to people both on and off site. For each identified major accident scenario, the Operator should assess the chance of death or serious injury to persons at each exposed site on and off the installation. The extent might be conveniently summarised in the form of a map with hazard contours drawn around each potential explosion site. The hazard contours would show the range to specified levels of lethality (for example, 100%, 50%, 10% and 1% fatalities). Such a map would provide an at-a-glance summary of who would be affected in the event of a major accident and to what extent they would be affected. Such information can then be used to determine the severity of the potential major accident hazards.
The Assessors should expect to see evidence that the Operator has selected appropriate explosion effects/consequence models to identify the people and the structures at risk from a major accident.
The harmful effects produced by an explosives event will be governed both by the types of explosives initiated and the type of location in which the event occurs (whether in a building of substantial construction, a building of light construction or in the open). The hazards associated with different types of explosives were previously reviewed in Table 5.
The type of location of the incident is particularly important in regard to determining whether significant debris effects would occur: an explosion inside a brick/concrete building might produce considerable amounts of flying debris, whereas an explosion of fibreboard-packed explosives in the open or inside a wooden building would not produce any significant debris or fragment effects.
Taking account of both Hazard Type and location, the models an Operator will need to assess the harmful effects of a major accident are as follows.
Table 12: Explosion model requirements
| Hazard Type | Location | Models required |
|---|---|---|
|
1 (articles) |
Solid bldg. |
Blast model |
|
1 (articles) |
Open/light bldg. |
Blast model |
|
I (substances) |
Solid bldg. |
Blast model |
|
1 (substances) |
Open/light bldg. |
Blast model |
|
2 |
Solid bldg. |
Blast model |
|
2 |
Open/light bldg. |
Blast model |
|
3 |
Solid bldg. |
Thermal radiation model |
|
3 |
Open/light bldg. |
Thermal radiation model |
Rather than use separate blast, shrapnel, debris and thermal effects models, an Operator may chooses to use a combined model to predict overall levels of lethality from explosives events. However, it should be clear that predictions obtained from such a model make appropriate allowance for each of the harmful effects produced in a major accident.
"Source term models should be appropriate and need to have been used correctly for each relevant major accident hazard."
Strictly speaking, this criterion applies to those processes which could potentially release hazardous materials into air, water or onto land with subsequent dispersion of these materials over some distance. However, for processes involving explosives, it may be interpreted as a requirement for the Operator to assess the effect of fire and explosion phenomena at various distances and locations from the incident.
It should be clear that the Operator has considered the effects listed in Table 5. In considering the harm, which may arise from blast, fragments, debris and thermal radiation, the Operator will need to take account of the type of location of any exposed population, i.e. whether these people are in the open, inside buildings of conventional construction or inside buildings of vulnerable construction. Buildings of vulnerable construction can be defined as those which have extensive external glazing or non-load bearing curtain walling. These buildings may be severely damaged by relatively low levels of blast loading - such that would cause only minor damage to buildings of conventional construction. It follows that at a given range from an explosion, persons located in buildings of vulnerable construction may be much more at risk from blast effects than those inside conventional buildings. Quantitative assessments of damage for vulnerable buildings and quantitative fatality assessments for persons inside may prove difficult, but failure of an Operator to identify any known vulnerable structures in the vicinity of the installation should be viewed as a deficiency.
Injuries caused by blast
Three modes of blast injury can be distinguished:
Primary blast injuries are caused by the direct action of a blast wave on the body. The two most common such injuries are eardrum rupture and lung haemorrhage. Lung haemorrhage is in fact the most likely cause of death in cases where primary blast effects prove fatal. However, such injuries normally only occur at very high levels of overpressure and hence only amongst persons within a scaled distance of about three or so.
Secondary blast injuries are defined as those, which occur as a direct consequence of blast damage to buildings and structures. These injuries include lacerations caused by flying glass, blunt trauma caused by crushing and impact of falling masonry, and suffocation caused by asphyxiating dust. Secondary blast injuries can occur at significantly greater distances from an explosion than either primary or tertiary blast injuries, and indeed experience shows that structural collapse is the dominant mode of death and injury from explosions in built-up areas. Thus secondary blast injuries are normally related to degree of building damage.
Tertiary blast injuries are defined as those resulting from body movement induced by the blast wave. Two modes may be distinguished: -
The second of these effects is sometimes called "whole body translation" or "whole body displacement". The extent of injuries caused by this effect is dependent on a number of factors, including: the velocity to which the body is accelerated, the part of the body which impacts the ground or object, the hardness of the ground or impacted object, and whether flailing of the limbs occurs as the body tumbles over the ground.
It follows from the above that the Operator should make separate assessments of blast-induced injuries for persons indoors and outdoors. For persons indoors, the Assessors should expect to see an assessment of secondary blast effects, while for persons outdoors, the Assessors should expect to see an assessment of primary and tertiary blast effects.
Predicted casualty levels from fragment and debris effects will also be dependent on whether exposed persons are outdoors or indoors. Persons indoors will be afforded a certain degree of protection by the walls and roof of the building, while persons in the open, in the direct line of sight of the potential explosion site, will be completely unsheltered. However, other persons outdoors may be more or less protected by intermediate structures and other topographical features of the landscape. The Operator may legitimately choose to make some allowance for shelter and cover provided by any such features.
Whilst all explosives produce heat on ignition, this effect is most significant in the case of explosives of Hazard Type 3 - boxed propellant, for example. These types of explosives do not produce significant blast or fragment effects when initiated in unconfined conditions but burn fiercely and produce considerable radiant heat. It is this feature of intense and rapid release of radiant heat that has the potential to inflict serious burn injury over distance and in a very short time scale.
The heat emitted from Hazard Type 3 events may be capable of igniting secondary fires in nearby buildings. There are two mechanisms by which this may occur:
Unpiloted ignition (also known as spontaneous or auto ignition) occurs when the thermal radiation is sufficiently intense to decompose flammable material and raise the temperature of that material to its auto-ignition temperature.
Piloted ignition is similar to unpiloted ignition except that the flammable vapours given off by the decomposing material are set alight by a nearby source of ignition, such as a lighted cigarette or a gas fire. In general, thermal radiation doses necessary for piloted ignition are lower than those required for unpiloted ignition.
In addition, secondary fires may be started by any firebrands thrown out from the explosives fire. The Operator needs to consider all these possibilities.
For persons indoors, glazing will afford a certain level of protection against thermal radiation. All radiation between the wavelengths of 2.8 μm and 5 μm (thermal - or infra red - radiation has wavelengths between 0.8 μm and 400 μm) is effectively screened out by all types of glass if it is at least 5 mm thick, although the usual thickness of window glass is only between 2 and 3 mm; furthermore glass need only be 1 mm thick to stop all thermal radiation above a wavelength of 5 μm. However, sudden heat pulses can easily break glass by thermal shock and for this reason some models conservatively ignore the possible attenuation of thermal radiation by glazing.
There are various factors, which could significantly influence the thermal radiation dose recorded at targets in the vicinity of an explosives fire. These include wind speed, degree of confinement of the explosives and shielding afforded by structures or other features of the landscape. The Operator should consider all these possibilities.
Criterion 3.5.2
"The material transport models used should be appropriate and need to have been used correctly for each relevant MAH."
Again, this criterion is designed for those sites where there is a risk of the release of hazardous materials into air, water or onto land and with subsequent dispersion over some distance. Generally speaking, the criterion will not be applicable to explosives installations, unless these installations also contain significant quantities of flammable or toxic gases, or if there is a potential for a fire to result in the release of a cloud of toxic smoke. Further guidance on the assessment of this criterion is given in the SRAGS for LPG and chlorine.
Has the Operator identified any buildings of vulnerable construction on or near to the installation?
Criterion 3.5.3
"Other consequence assessment models (e.g. BLEVE, Warehouse fire, etc.) used should be appropriate and need to have been used correctly for each relevant major accident."
The modelling requirements for explosion effects were described in the discussion of the evaluation of Criteria 3.5 and 3.5.1. In addition to blast, fragment and thermal radiation models, the Operator may also need models to predict dispersion of toxic gases and acidic fumes if these effects might possibly be generated in accident conditions and pose a threat to persons on or off site. The Operator should name and describe any models used to assess non-explosion effects. The Operator should also provide a justification for the use of these models.
In cases where an explosives installation contains significant quantities of dangerous substances other than explosives, the consequences of accidents involving these substances will also need to be modelled. Further guidance is given in the SRAGS for LPG and chlorine.
"The harm criteria or vulnerability models used to assess the impact of each MAH on people and the environment should be appropriate and have been used correctly for each relevant major accident."
The safety report should contain assessments of the damage and harm that would result from ignitions of explosives materials.
A few simple rules of thumb can be applied to obtain reasonable estimates for the casualties that would occur amongst personnel in explosives workrooms in the event of an accidental initiation of explosives materials. The table below provides a guide to the likely outcome of accidents involving small quantities of explosives within small workrooms (of the order of 4 metres by 4 metres).
Table 13: Effects of small explosions
| Quantity of explosive initiated (g) | Effect of initiation |
|---|---|
|
1 |
Any person holding the explosives could receive serious injury. |
| 10 | Any person close to this quantity of explosives at the time of the initiation would receive very serious injuries. |
| 100 | Any persons standing approximately 1.5
metres away would be liable to a 1 per cent chance of eardrum
rupture. 50% of windows in the room (size 6m x 6m) likely to be
blown out. Approximately 1% chance of eardrum rupture at a distance of 3.5 metres. Approximately 50% chance of eardrum rupture at 1.5 metres. Persons in very close proximity to the explosion (e.g. holding the explosives) almost certainly killed. |
| 500 | Inside a 6m x 6m brick building,
structural collapse is most likely; considerable damage to panels
between steel or concrete frames in other structures. Persons
very close to the blast almost certainly killed. Persons close
to the blast sustain lung and hearing damage, and injuries from
fragmentation effects and being thrown bodily. Almost all persons in the room will sustain perforated eardrums. |
There are a number of models that might be used to assess lethality from explosions of larger quantities of explosives. Two such models which have been used in studies undertaken by the Health and Safety Commission’s Advisory Committee on Dangerous Substances are the ESTC Outdoor and Indoor Blast Models, these provide estimates of lethality for persons in the open and indoors respectively at various ranges from a detonation of Hazard Type 1 explosives.
This is a theoretical model based on a review of the available literature on primary and tertiary blast effects. The model gives a single prediction of the probability of death (P) as a function of range and quantity of explosives. detonated, viz.:
where R is measured in units of metres and Q in units of kilograms. The ratio R/Q1/3 is the scaled distance (S) from the detonation. This model is valid within the limits:
2.5 < S < 5.3 m kg-1/3
A 100% fatality probability can be assumed below a scaled distance of 2.5 m kg-1/3, while the fatality probability for persons located at a scaled distance greater than 5.3 m kg-1/3 can be taken as zero.
For example, persons located in the open at a range of 30m from a detonation of 1000 kg of explosives are predicted by the model to have the following probability of being killed:
i.e. about a 5% chance of death
This is an empirical model based on an analysis of casualty data collated from records of a number of major incidents of accidental explosion. The data on which the model is constructed do not distinguish between those people killed by blast and those killed by fragments. It is assumed that blast effects were the cause of most of the fatalities recorded in these incidents but the model implicitly makes some allowance for fragment effects. The model gives a single prediction of fatality probability (P) as a function of scaled distance (S) for persons located inside conventional buildings: -
log P = 1.827 - 3.433.(log S) - 0.853.(log S)2 + 0.356.(log S)3
within the limits 3 < S < 55
For example, the range at which indoor population would be exposed to a 0.01 fatality probability (i.e. a 1% chance of death) from the blast effects from a 1000 tonne detonation of explosives is estimated by the model to be about 950 m.
Further investigation will be required in the event that the results predicted by the Operator are significantly optimistic in comparison with the results given by models used by the HSE.
Criterion 3.5.5
"Are the assumptions in the accident analysis justified and not unduly optimistic."
The assumptions referred to here are those made about the response/effectiveness of any measures designed to mitigate the consequences of accidents. These measures might include fire-extinguishing systems, shields and guards within processing buildings, and unitization of danger buildings. The safety report should consider the consequences that might be expected should all control and mitigation systems fail in the event of an accident, though such a scenario should have a very low probability. However, a safety report that assesses accident consequences on the basis that mitigation systems work perfectly will underestimate risk. The Assessors might ask the following three questions in order to come to a judgement on this issue.
The accident analysis should not be based solely on average inventories for danger buildings. The analysis should include estimates for the outcomes of accidents involving the maximum quantities of explosives that could be present in danger buildings.
The outcome of an accident may depend on the circumstances pertaining at the time. The analysis should consider the potential outcome of an accident occurring in the worst possible circumstances, for example, at the time of day when the population density in and around the installation is at a maximum. The Operator should clearly state any assumptions made regarding the relative likelihood of accidents occurring at different times.
The Operator should also state any assumptions made with regard to the evacuation of personnel. Whereas some mishaps may result in an immediate explosives event (an impact-type accident, for example), others may result in a gradual escalation to an explosives event (an outbreak of fire initially involving only non-explosives materials, for example). The Operator may legitimately make an allowance for evacuation for the latter type of incident, but any assumptions made should be clearly stated and justified. The Operator should carry out sensitivity tests to identify the effect that any such assumptions could have on the final results.
The safety report should specify which models have been used to predict the consequences of accidents. If well-known and established models have been used, then the Operator should list the input data so that the Assessors can independently check the results.
The Assessors may wish to compare the consequence estimates reported by the Operator with those given by models currently used by the HSE. Should any discrepancies be found between the two sets of results, the reasons for the discrepancies should be explored.
Criterion 3.5.6
"Estimates of the severity and extent of all major accident consequences are realistic."
COMAH Regulations Schedule 4, Part 2, Section 4(b) requires operators to provide an "assessment of the extent and severity of the consequences of identified major accidents". This is extended by SRAM Criterion 3.5.6, which requires that this assessment is realistic. The HID semi-permanent circular SPC/Permissioning/06 provides detailed advice on this.
The presentation of the severity information which is the minimum information required by schedule 4 part 2 para 4 (b), can be in several forms:
Reports may provide hazard ranges and maps of the site and surrounding area. Some may super-impose the hazard ranges onto the maps. This may be acceptable for omni-directional events only if there is accompanying text providing a commentary on the extent and severity of the scenarios. However for sites which may have major hazard scenarios involving for flash fires, toxic gas dispersion and other directional events such as jet fires, simple maps with hazard ranges are insufficient. The report must discuss the importance of typical cloud widths, wind direction, atmospheric conditions and location of on-site and off-site personnel.
The level of demonstration required is determined from the level of risk predicted including any societal risk (i.e. killing or harming large numbers of people in one event). The report should draw the information together to establish what are the risk dominating scenarios. The next step is for the operator to have a process by which it decides whether the measures they have in place are those that are necessary given the circumstances of their site. Where there is potential for large numbers of fatalities or injuries, the demonstration that the measures in place are all that are necessary needs to be clear and robust. Criterion 1.7 covers the demonstration aspects.
As previously mentioned, the safety reports should specify consequences for the worst accidents. However, the analysis should not be overly conservative. If unrealistic hazard ranges are predicted, the off-site emergency plan devised by the Local Authority may be ill conceived and under some circumstances, lives could be put at risk by spreading emergency services too thinly.
Public Register of COMAH Establishments
