Criterion 3.5 "The safety report should provide details to demonstrate that suitable and sufficient consequence assessment for each major accident scenario has been carried out with respect to people and the environment."
The principal hazards from a chlorine handling facility are the release of a cloud of toxic gas, chlorine/metal fires and to a lesser degree explosion due to a build up of hydrogen or nitrogen trichloride within the stock tanks themselves or ancillary equipment such as pumps and pipelines. The scenarios that should be covered in a safety report include: -
Leaks to atmosphere from loss of containment from storage plant, process equipment, transport equipment and pipe work.
Releases resultant from the overloading of abatement equipment
Assessors can test compliance with Criterion 3.5 by asking the following questions:-
A safety report should discuss external events and site incidents that may give rise to a release that ranges in severity from catastrophic failure of a chlorine storage tank to a small leak. It should also identify the measures and precautions taken to reduce their probability, duration and impact. Catastrophic failure can be caused by aircraft impact, subsidence, earthquake, a freak storm, a nearby explosion, undetected faults and possibly by abnormal operation. Less severe leaks may be the result of mechanical failure, corrosion, erosion, impact damage, lightning, flame impingement or electrical failure.
The accident consequence analysis should be a systematic process comprising the following steps:-
List the assumptions that will be made about containment failures (size, location).
Describe the essential features of the model that will be used to calculate the rate of outflow of chlorine and the duration of the release.
Describe the effect of accidents on local populations and the environment.
All of the above steps should be clearly documented in the report. However, omission of one or more of them is not a significant failing if overall the consequence analysis is satisfactory.
Q: Has the Operator selected a set of accident scenarios for the safety report that encompass the hazards and risks from the site and that are sufficient to demonstrate that all necessary measures have been taken to minimise risk?
A minimum accident set for a chlorine
The safety report should not discount any scenario unless it can provide good reasons for doing so. Chlorine/metal fires, hydrogen/chlorine fires and explosions as well as nitrogen trichloride explosions in kettle vaporisers should be addressed, or an adequate justification for discounting them should be provided.
The number of fatalities and individuals with severe injuries should be determined. The footprint of a toxic plume should be superimposed on a map so that the effect of wind direction on the number of casualties can be assessed. The accident analysis should address the effect of other variables such as time of year, time of day and day of the week if they have a significant effect on the off-site consequences. A limited analysis that neglects variability in accident consequences may not meet the assessment criteria.
A safety report should include a brief description of the essential features and assumptions of the mathematical models used by the Operator to determine the consequences of major accidents. If the models are part of a well-known software package that has been well validated, then only the name of the software is required, but full details of the input should be provided. In-house models and any validation studies that have been carried out to support them should be described in detail. The main equations of a model should be given in an appendix if they have not been published elsewhere.
The fact that an Operator has used a well-validated model to determine the consequences of an accident does not guarantee that the results are reliable. Assessors should recognise that the predictions of consequence analysis are more important than the means by which they were obtained. Assessors may feel that a safety report that fails to provide input data details for predictions, which appear optimistic, fails to meet the criteria.
The level of detail that should be provided on the calculation of the consequences of an accident that do not extend off-site is less than if the hazard range encompassed a large number of people.
It is not possible to be prescriptive on this issue and Assessors are expected to use professional judgement when deciding if the Operator has provided sufficient information on his consequence analysis. If a chlorine gas plume is predicted to fall just short of a densely populated area, the Operator should consider uncertainties in the analysis and any circumstances, which could lead to extension of the hazard into the populated area.
Criterion 3.5.1 "Source terms used should be appropriate and need to have been used correctly for each relevant major accident."
The source term for an accident sequence expresses 'how much', 'for how long' and in 'what form'. For example, a chlorine release from a pipe or vessel is characterised by the release rate, the duration of the release and its form (eg liquid or gas and whether as a vertical jet, horizontal jet or obstructed jet). Assessors can use the following questions to test the adequacy of the description of accidents given in a safety report:-
Since release rate is effectively determined by hole size, the accident consequences described in a safety report should encompass a range of hole size and include the largest possible failure. This means guillotine rupture of a pipe and catastrophic failure leading to an instantaneous release of the whole contents of a vessel.
The 'worst event' should be assumed to occur under 'worst conditions', for example when the pressure in a pipe is a maximum, when the vessel is filled to its maximum level and when the filling pressure is a maximum
The flow rate of chlorine through a hole or from a pipe depends on the assumptions made about the discharge coefficient, the pipe roughness, the friction factor, etc. The values assigned to these parameters should ensure that the calculated consequences of accidents are not optimistically small. For example, use of a discharge coefficient less than 0.9 should be justified, the appropriate value for a low pressure system is 0.65. A liquid chlorine leak can, depending on the leak path, release pure liquid or a mixture of gas and liquid. Assumptions about the physical form of the release should be justified. If in doubt, the assessor should consult the relevant MSDU topic specialist.
The source terms for accidents should account for site-specific features. These relate to:-
and could include parameters such as:-
Criterion 3.5.2 "The material transport models used should be appropriate and need to have been used correctly for each relevant MAH."
The transport models used to determine the consequences of accidents at chlorine sites are likely to be dense gas or passive dispersion models. Both are used to determine the maximum toxic envelope of chlorine releases.
Nearly all models used to characterise chlorine dispersion are complex and make use of several assumptions and input parameters. Therefore, it is often difficult for an Assessor to reach conclusions about the adequacy of the consequence analysis. Answers to the following questions may provide the basis for an assessment:-
Since the molecular weight of chlorine is greater than that of air, ambient temperature releases are denser than air. This means that the gas falls to the ground and its rate of dispersion is greater than that of a passive release. In addition to being advected by the wind, the gas spreads out sideways, therefore centreline concentrations are lower than for a similar low level passive release, but off-axis ground level concentrations are higher - see the diagram below.
Consequence analysis based on the assumption that a chlorine release disperses passively may be optimistic or pessimistic depending on local conditions. Once a large amount of air has been mixed into a chlorine cloud, it disperses passively.
Chlorine released accidentally at ground level has to disperse around buildings at or near to the chlorine facilities. In general the presence of buildings results in enhanced mixing with air and ground level concentrations predicted by models that do not explicitly include equations and correlation's for flow around buildings are likely to be pessimistic in the far field. The width of the cloud is increased, but generally neglecting buildings is acceptable provided it does not lead to an over estimate of the hazard range to such an extent that off-site emergency procedures would be compromised.
In general, for continuous releases, the higher the wind speeds the more rapid is the dispersion and shorter is the hazard range. D5 weather conditions occur frequently in the UK and should be used to calculate the hazard range for daytime releases. Dispersion is reduced under stable atmospheric conditions, hence F2 weather, which characterises night time conditions, generally produces the greatest hazard range. Under any stability, increases in wind speed tend to decrease the predicted hazard range unless building wake effects are modelled. A safety report should calculate the consequences of accidents under a range of weather conditions including those that maximise the hazard range.
For instantaneous releases, these general observations may not be applicable.
The rougher the ground over which a toxic gas is dispersing the more rapid is the rate of air entrainment and the shorter, but wider is the toxic hazard range. A ground roughness value of 0.1 corresponding to elements on the ground about 0.5-1 metre high is recommended for dispersion over agricultural land. A roughness value of 0.3 should be used for dispersion over a suburban area. Although higher roughness values may be assigned to some industrial sites, their use results in a reduced hazard range that could, under certain circumstances, be optimistic. An Operator should make a special case for use of a ground roughness value of more than 0.3.
Due to the variability of atmospheric conditions a dispersing gas plume meanders and the concentration at a fixed point down wind of a release fluctuates. Most dispersion models account for this phenomena by introducing an averaging period. The longer this is, the more allowance is made for the variations in wind direction and the smaller is the predicted concentration.
There is not a consensus on the most appropriate averaging period for dispersion calculations, but widespread support exists for use of 600 seconds and 10 seconds for continuous and instantaneous releases respectively. In some passive dispersion models the standard deviations are linked to specific averaging times.
Since criteria 3.5.2 is concerned with the appropriateness of transport modelling assumptions, and averaging time can have a significant affect on the predicted hazard range, it is important that the Operators state the values used in the dispersion analysis. This requirement is not restricted to averaging time; Operators are obliged under criterion 3.5 to provide details of all important modelling assumptions and input.
Criterion 3.5.3 "Other consequence models (eg BLEVE, warehouse fire, etc), used should be appropriate and need to have been used correctly for each relevant major accident."
Aside from chlorine transport models, the consequence analysis may need to consider other types of accident such as explosions in a vaporiser. It is important that these models do not under estimate the hazard range, but it is difficult for an Assessor to make judgements about the level of pessimism in a calculation if full details of the model are not supplied. The following questions may help Assessors judge if the consequence analysis is based on appropriate assumptions:-
Even if the safety report does not calculate the consequences of explosion resulting from a build-up of nitrogen trichloride or ignition of a chlorine hydrogen mixture, it should describe the measures in place to prevent a hazardous situation arising and present credible arguments as to why an explosion will not occur.
The TNO multi-energy approach is applicable to chlorine-hydrogen explosions and the TNT equivalence method can be used to calculate the consequences of nitrogen trichloride explosions.
The safety report should examine the potential consequences of missiles from exploding pressure vessels such as a chlorine cylinder using the methods outline in part II. In the main the consequences will generally be less severe that those of a release of toxic gas, but the report should examine the potential for accident escalation. For example, an exploding cylinder causing rupture of a much larger chlorine storage vessel.
Table 5 : Effect of input parameters on predicted accident consequences
| Parameter | Accident type/phenomena | Acceptable value | Direction to reduce severity of consequences |
|---|---|---|---|
| Wind speed | Dense and passive gas dispersion | 2m/s F stability
5m/s D stability |
+
+ |
| Ground roughness | Dense & passive gas dispersion | 0.1m- 0.3m (suburban environment) | + |
| Averaging period | Dense and passive gas dispersion | 600s plume
10s puff |
+
+ |
Criterion 3.5.4 "The harm criteria or vulnerability models used to assess the impact of each MAH on people and the environment should be appropriate and have been used correctly for each relevant major accident."
A safety report should calculate the toxic hazard ranges and casualties for several severity levels, which may include:-
The dangerous toxic load based on the HSE published criterion:-
Toxic Load = (Concentration, ppm)2 x time, minutes = 108,000 ppm2 min
Which would result in: -
Susceptible people possibly being killed.
It is very important that the full spectrum of casualties are calculated, not only for risk evaluation, but also for emergency planning purposes. Some safety reports may contain casualty estimates based upon the criteria, such as a dose that relates to a value considered immediately dangerous to life and health (IDLH). Assessors should check that such predictions are not overly optimistic.
The following questions may assist the Assessor to judge the adequacy of the accident consequence analysis:-
Although HSE has published its dangerous toxic load criteria, some safety reports may calculate hazard ranges to different dose levels. Any dose implies a exposure duration and Assessors need to understand the assumptions being made before making judgements about acceptability. In particular outdoor personnel are unlikely to be able to escape indoors at concentrations above 300 ppm.
People can reduce their exposure to toxic gas by escaping indoors but, once the building is surrounded by gas, the concentration inside increases at a rate that is dependent on the ventilation rate. When the release terminates, the outside concentration reduces sharply, but the indoor concentration fall much more slowly and people inside are subjected to a prolonged exposure. Sheltering provides the greatest benefit if people are indoors when the release occurs and move outside as soon as the gas has drifted away. Off-site emergency plans usually assume that members of the public will be advised to go inside and close all windows at the start of the release and that they will be further advised to vacate their houses as soon as the gas cloud has passed. Since this may not happen, the operator needs to justify any reduction in hazard range, which is based on people escaping indoors.
Criterion 3.5.5 "Are the assumptions in the accident analysis justified and not unduly optimistic."
The assumptions being referred to here are those made about the response/effectiveness of accident consequence mitigation systems and include such things as the time to detect a large release of gas and the probability that a ROSOV will close on demand.
The safety report should determine the consequences of worst accident scenarios on the assumption that all control and mitigation systems fail on demand and operational conditions correspond to worst case. Such a scenario should have a very low probability. The analysis should also consider the effect of various combinations of partial success of the control and mitigation systems in order to determine the risk dominating accidents.
A safety report that minimises accident consequences on the assumption that installed mitigation systems work perfectly is underestimating risk. Assessors can judge this aspect of safety reports by reference to the following questions:-
An chlorine facility safety report should consider an instantaneous release of the whole contents of storage vessels and various other scenarios that result in a continuous release of several 10s of kg/s and give rise to a variety of toxic clouds. In addition, it should address failure of associate plant such as the vaporiser giving rise to a variety of hazards.
The consequences of many severe accidents depend on the environmental conditions, the state of the plant at the moment of failure and the location and type of failure. Since there are many combinations with roughly equal probability, the safety report must determine the consequences of each accident under a range of conditions that encompass the full severity range.
Accidents can occur any time although their probability is not usually constant. It is important that a safety report describes the consequences of the worst conceivable accidents at a site, which occur when the vessel is full of chlorine and high pressure pipes and vessels are at their maximum operating pressure. If the accident analysis in a safety report is based on average inventories, it may be judged as incorporating too much optimism.
Failures on plant can occur almost anywhere, but with variable probability. The safety report should consider failures in the "worst" locations, which include failures up stream of an isolation system, which will maximise the release period before remedial action can be effective. A safety report that does not calculate the consequences of worst case accidents may fail to comply with the assessment criteria.
A safety report should describe the mathematical models used to predict the consequences of accidents. If the Operator or his consultant used well known software to calculate the consequences of accidents, information on the input data files should be provided so that Assessors can check its appropriateness and degree of conservatism both of which provide an insight into the Operators approach to accident consequence analysis. If doubts remain, entering the Operator's input data into an HSE model can check the predictions in the safety report.
A difference in opinion about the severity of accident consequences may occur from time to time. It does not imply a major failing of the safety report but one which the Assessor should try to resolve by communication with the MSDU topic specialist, and, if necessary, with the Operator.
Criterion 3.5.6 "Estimates of the severity and extent of each major accident consequences are realistic."
COMAH Regulations Schedule 4, Part 2, Section 4(b) requires operators to provide an "assessment of the extent and severity of the consequences of identified major accidents".This is extended by SRAM Criterion 3.5.6 which requires that this assessment is realistic.
Duty holders should provide information (perhaps in tabular form) which links each scenario with the number of people who may be affected (as a minimum) and preferably estimates of the number of fatalities and hospitalisations and those receiving minor injuries for each wind direction (where appropriate). This will provide the assessor with the information needed to determine the significance of each scenario.
We believe it is necessary if we are to be able to make a judgement on "all necessary measures" and the suitability of the information provided for offsite emergency plans (Schedule 4, Part 1, Section 4 and SRAM Part 2, Chapter 1.
Safety reports should determine the consequences of the worst accidents, but the analysis should not be overly conservative. If unrealistic hazard ranges are predicted, the off site emergency plan devised by the Local Authority may be ill conceived and under some circumstances, lives could be put at risk by spreading emergency services too thinly. The Assessor can gauge the degree of conservatism in the calculations by asking the following questions:-
Use of widely different values for toxic load to that generally accepted should be justified, otherwise the accident consequences may be deemed unrealistic.
Reasonable values for some of the more important input data for accident consequence modelling are shown in Table 6. Assessors should compare these values with those used by the Operator and make judgements about the realism of the consequence predictions.
Public Register of COMAH Establishments
