Safety Report Assessment Guide: Chlorine

Criterion 3.3 "The safety report should identify all potential major accidents and define a representative and sufficient set for the purpose of risk assessment."

This criterion reminds Assessors that they need to check that:-

• The safety report meets Schedule 4, Part 2, paragraph 4 of the regulations, which requires identification of all possible major accident scenarios.
• If the major accidents are put into groups, the representative accident sequences are suitable and sufficient for risk assessment purposes.

Ideally, the Operator should summarise, in a proportionate way, the results of hazard studies, the methods used and the expertise of the team involved. The scope of the studies and the HAZID process used should also be described. To provide a convincing demonstration that the list of MAs is complete, the process needs to be systematic, ie each plant and its operational sequences should be considered in turn, including the possibility of interactions. Assessors should judge the completeness and adequacy of the way these issues are dealt with by asking the following questions:-

Q: Is the approach the Operator has adopted to identify all major accidents suitable and fit for purpose?

The report should explain how major accidents have been identified and demonstrate that no important scenarios have been overlooked. When the method of identifying accidents is not systematic or transparent it will be much more difficult to convince the assessor of its completeness. Simple lists of accidents without evidence to show they are comprehensive may be appropriate in some cases, depending of the scale of the risk to off-site populations, but generally Operators will need to demonstrate that no major accident has been overlooked. Assessors should take into account the scale of the hazards when making a decision on this issue (proportionality).

Q: The accidents considered should include those initiated by off-site events.

The accident analysis should identify all potential off-site initiators of major accidents and an indication of their likelihood (see Table 1). On-site accident initiators such as over pressurisation or equipment failure may require a more detailed frequency assessment in order to demonstrate the adequacy of installed safeguard systems.

Q: Have all possible sources of major accident hazard been identified?

The accident identification process should not be limited to the major hazards from chlorine releases. It should also recognise the presence of any other hazardous material with the potential for a major hazard and in particular the potential for accidents on the chlorine facility to initiate other major hazard scenarios.

Q: Are the accidents addressed in the safety report representative of the full spectrum of major hazards presented by the installation?

There is no requirement to repeatedly describe the consequences of accidents that have a similar impact on employees, local populations and the environment. The safety report does not have to describe the consequences of all the major accident hazards, but just to identify them. Instead it may define a representative set of accidents that includes the most severe plant failures and consider all possible type of consequence (eg toxic cloud, chlorine/iron fire, chlorine/hydrogen explosion). In other words, the consequence analysis can be based on a reduced set of accidents that are representative of the hazards from the site.

Q: Does the 'representative sample' of major accidents include the risk dominating accidents?

The Assessor must be satisfied that the accidents considered dominate the risk and encompass the complete spectrum of severity. Table 2 identifies plant items that contain, or are connected to, a large inventory of chlorine and lists the most obvious potential accidents or failure modes. While it may not be completely exhaustive for all installations, it can be used as a check list to assess the completeness of the accident analysis. If there are any unexplained omissions that would significantly change the predicted risks posed by the site, it may be deemed to fail to comply with the assessment criteria.

Q: Are the descriptions of accidents in the safety report sufficiently comprehensive to allow the adequacy of the methods for preventing major accidents and for limiting their consequences to people and the environment to be assessed?

The safety report should determine the consequences of essentially identical accidents in very similar plant if the consequences are likely to be different. For example, if a transfer pipe failure can release chlorine at say 50 kg/s and failure of a pipeline in an enclosed storage area can also give rise to a 50 kg/s release, the safety report should consider both failures because they may have different consequences. The safety report should also consider failures occurring at the 'worse locations' which may be on pipelines through points upstream of emergency isolation systems. A safety report that fails to address the 'worst case' consequences of representative accidents does not meet the assessment criteria.

Q: Have all the potential consequences of each of the reduced accident set been considered?

It is possible for chlorine containment failures to give rise to thermal radiation/explosion hazards, all of which must be addressed in the safety report. For example, if a safety report identifies high temperature distillation column failure as one of the accidents requiring consideration, the consequences that should be addressed are chlorine gas emissions, of varying scale, and chlorine/iron fire. In such a case, explosion is unlikely in the absence of high levels of hydrogen or nitrogen trichloride, but accidents considered to contribute little to the total risk should not be completely ignored.

Q: Has the potential for escalation been properly addressed?

Some accidents at an installation can cause other failures in that they may have as severe or even more severe consequences. The safety report must recognise this possibility and address it by postulating accidents in 'worst case' locations. Of particular concern are:-

• Incapacitation of operators in adjacent plant preventing effective shutdown procedures in plant enveloped by the toxic plume.
• Explosions (nitrogen trichloride, hydrogen/chlorine, or pressure burst) that can cause a variety of mechanical failures.
• Radiation from chlorine/metal fires that can impinge on vital elements of adjacent plant and equipment.

  The site description should be detailed enough to enable the Assessor to identify the most hazardous locations for component failures and hence determine if the accidents considered are 'worst case'.

Types of Accident suffered by Chlorine sites

Although Operators need to demonstrate the use of a systematic approach to accident identification, Assessors are likely to find that few safety reports present the results of formalised methods such as cause-consequence diagrams or failure modes and effects analysis. An alternative approach that some Operators may adopt involves listing each item of plant and identifying all its failure modes that would give rise to a major accident hazard.

The primary accident that chlorine facilities can suffer is the loss of containment leading to a major toxic release of a dense gas, which disperses over a wide area. Additional accident scenarios include:-

• Fire - from the exothermic reaction of chlorine with metals and certain organic materials.
• Explosion - from accumulated nitrogen trichloride or chlorine/hydrogen mixtures.

The loss of containment accidents that chlorine facilities can suffer fall into two main categories: -

• Vessel, process equipment or transport equipment failure leading to a release of chlorine.
• Overloading of scrubber equipment leading to a release of chlorine.

The consequences of a loss of containment accident will be influenced by the process conditions immediately prior to the release as well as the actual release location. Releases that take place inside buildings will result in a different source term to that which take place in the open environment.

• COMAH guidance
• Safety reports assessment guides
  Within chlorine manufacturing facilities, explosions can occur if flammable mixtures of hydrogen/chlorine meet an ignition source. Such a situation can occur if hydrogen concentrations are allowed to rise to high levels within liquifier and absorption facilities. UV Light, electrical equipment or hot surfaces can initiate ignition.
• COMAH guidance
• Safety reports assessment guides

Explosions can occur if the system has the potential to accumulate quantities of nitrogen trichloride, which is a shock sensitive material.

Overloading of abatement equipment such as absorption facilities can lead to a chlorine release at elevated temperatures and elevated release points. Failure of an Operator to consider any of these events should be justified in the safety report.

Criterion 3.3.1 "The safety report should demonstrate that a systematic process has been used to identify all foreseeable major accidents."

In order to judge compliance with this requirement of the regulations, Assessors can ask the following questions:-

Q: Is it obvious that all major accident scenarios have been identified?

Identification of all major accident scenarios is a very important requirement of the regulations and a safety report that fails in this respect may be considered deficient. Systematic approaches to accident identification include HAZOP, event tree analysis and failure modes and effects analysis. However, the regulations do not specifically require their application. An Operator may be able to demonstrate that all major accidents have been identified without resort to formalised methods by providing a detailed description of the plant and by systematically addressing the hazards from each part in turn.

Q: Have all of the hazard phenomenon associated with each major release been identified?

A major release of chlorine can behave in different ways depending upon the nature of the source. For example, its original temperature and pressure significantly influenced the impact of a release of liquid chlorine. Catastrophic failure of a pressure vessel containing liquid chlorine at ambient temperature results in flashing, which dominates the source term. The contribution from evaporation of a pool that may be formed may be negligible. However, when chlorine is stored at sub-ambient temperatures and low pressure, source terms are dominated by pool evaporation. In both instances the plume exhibits dense gas characteristics. Chlorine utilised within a process at elevated temperatures may, however, initially exhibit a buoyant phase before cooling down to then act as a dense gas. In the absence of such considerations, the Assessor would be justified in requesting further information.

Criterion 3.3.2 "The hazard identification methods used should be appropriate for the scale and nature of the hazards."

Hazard studies employing HAZID techniques are widely used in the chemical industry and can be carried out at various stages during the lifecycle of a plant. They are systematic way of managing hazard over time, from the business requirement stage through to demolition and disposal. HAZID techniques seek to identify hazards in an absolute or relative way. Relative methods use checklists or hazard indices based on experience and lessons from incidents. Absolute methods are based on deviations from design intent eg HAZOP. Details can be found in Lees (1996), Kletz (1999) and CCPS (1989).

Methods (listed in increasing proportionality) that might be used include:-

• Industry standard or bespoke checklists for hazard identification.
• Safety reviews and studies of the causes of past major accidents and incidents.
• FMEA (Failure Mode and Effect Analysis).
• HAZOP (Hazard and Operability Studies).
• Job safety analysis (eg Task Analysis).

Human error identification methods.

Whatever approach is used, it must be documented as part of the safety report, or separately - in which case the main findings should be summarised in the report. As proportionality increases, and particularly in the case of new novel plant, some use of absolute methods is normally required. Both type of method need to consider 'common cause/mode' failures such as loss of power, or other services.

In order to test compliance with this criterion the Assessor can ask the following questions:-

Q: Does the safety report describe a hazard identification process that instils confidence in its completeness?

The safety report should describe and justify the method used to identify major accident hazards. Assessors who are not convinced that all accident scenarios have been identified may deem the report 'non compliant'. However, use of a formalised accident identification process is not essential and an approach that is not completely systematic, but is seen as 'fit for purpose' is acceptable.

Q: Is the depth and detail of the accident analysis commensurate with the scale of the hazard?

The safety report should consider the potential domino effects, but Assessors should recognise that many accidents do not give rise to a hazard range that extends off-site. In the main, the consequences of accidental releases of chlorine are limited to toxic gas clouds with a hazard range that can extend well beyond the site boundary. Risks to the public should be addressed in as much detail as the situation warrants.

Where chlorine inventories are limited and the site is situated well away from local populations the risk to the public may be relatively low. In such circumstances the risk assessment need not be as detailed as that for an identical situation close to a busy shopping centre. However, all major accident sequences should be identified and the consequences of "worst case" releases quantified.

If an instantaneous release of the whole contents of a chlorine vessel is predicted to gives rise to a toxic cloud that does not produce any off-site fatalities, then the safety report need not evaluate the off-site consequences of smaller toxic clouds, although on-site consequences would still need to be considered.

Table 2: Chlorine facility major accident scenarios

Plant item failure	Accident scenarios
Storage or Transport Vessel	Catastrophic failure Toxic gas cloud	Hole in vessel wall Toxic gas cloud
Filling line	Rupture Toxic gas cloud	Puncture Toxic gas cloud	Small hole Toxic gas cloud	Flange leak
Export line	Rupture Toxic gas cloud	Puncture Toxic gas cloud	Small hole Toxic gas cloud	Flange leak
Process Equipment, Compressors, liquifiers, vaporisers pumps	Disintegration Toxic gas cloud	Leak Toxic gas cloud	Loss of control Toxic gas cloud Hydrogen/ chlorine fire. Nitrogen trichloride explosion
Abatement Equipment	Disintegration Toxic gas cloud	Leak Toxic gas cloud	Loss of control Toxic gas cloud Hydrogen/ chlorine fire	Overload Toxic gas cloud