"The safety report should provide details to demonstrate that suitable and sufficient consequence assessment for each major accident scenario has been carried out with respect to people and the environment."
The principal hazards from HFL storage systems are fires and explosions, and in the case a few substances like acrylonitrile, toxic gas clouds. The hazards arise from leaks in the tanks themselves and ancillary equipment such as transfer pumps, pipe work and flexible hoses, all of which can release significant quantities of liquid on failure. A vapour cloud explosion may be possible depending on volatility of the liquid, the size of the release, the spillage surface, and the presence of confined volumes or adjacent structures that produce flame acceleration. All of these require detailed assessment in the safety report.
The HFL accidental release scenarios that should be addressed in a safety report include:-
Assessors can test compliance with Criterion 3.5 by asking the following questions:-
A safety report should discuss external events and site incidents that range in severity from catastrophic failure of a storage vessel to a small leak and should identify the measures and precautions taken to reduce their probability. Catastrophic failure can be caused by a variety of off-site and on-site events. Less severe leaks may be the result of mechanical failure, impact damage, lightning, flame impingement or electrical failure.
The accident consequence analysis should be a systematic process comprising the following steps:-
All of the above steps should be clearly documented in the report, however, omission of one or more of them is not a significant failing if overall the consequence analysis is satisfactory.
A minimum accident set for an HFL site would be:-
The safety report should not discount any scenario unless it can provide good reasons for doing so. Safety reports can discount certain types accident on the grounds of experiment and historical data, but this must be summarised.
High pressure pipe work failures should include the formation of a vertical and horizontal jet and the potential for jet flame impingement. In addition leaks into an enclosed space that may result in a confined explosion should not be forgotten.
The number of fatalities and individuals with severe burns from fires and explosions or exposure to concentrations above a specified level of toxicity should be determined. The effect of blast should also be quantified in terms of the number of buildings in each of several damage categories and the envelope of a flash fire should be superimposed on a map so that the effect of wind direction on the number of casualties can be assessed.
The accident analysis should address the effect of other variables such as time of year, time of day and day of the week if they have a significant effect on the off-site consequences. For sites located near an estuary, the tide may have an important influence on the consequences of jetty releases. A limited analysis that neglects variability in accident consequences may not meet the assessment criteria.
A safety report should include a brief description of the essential features and assumptions of the mathematical models used by the Operator to determine the consequences of major accidents. If the models are part of a well-known software package, then only the name of the software is required, but full details of the input should be provided. In-house models and any validation studies that have been carried out to support them should be described in detail. The main equations of a model should be given in an appendix if they have not been published elsewhere.
The fact that an Operator has used a well-validated model to determine the consequences of an accident does not guarantee that the results are reliable. Assessors should recognise that the predictions of consequence analysis are more important than the means by which they were obtained. Assessors may feel that a safety report that fails to provide input data details for predictions, which appear optimistic, fails to meet the criteria.
The level of detail that should be provided on the calculation of the consequences of an accident that do not extend off-site is less than if the hazard range encompassed a large number of people. It is not possible to be prescriptive on this issue and Assessors are expected to use professional judgement when deciding if the Operator has provided sufficient information on his consequence analysis. However, the following examples may help Assessors make a judgement on this issue.
If the footprint of a flash fire defined by ½ LFL or a dangerous dose of toxic vapour contour does not encompass any off-site populations, then the associated risk may be dismissed in one or two sentences. On the other hand, if a hazard footprint encompassed a densely populated area, the Operator should provide a more detailed analysis with a discussion of the most appropriate concentration for risk assessment.
Consideration should be given to any arguments and data which the company may wish to put forward in support of the use of LFL as the flash fire criterion. The arguments would include a validated peak concentration dispersion model rather than a time averaged model. If the LFL contour fell a few metres short of a densely populated area, then again the Operator should consider the probability of a flash fire extending beyond the LFL boundary.
If the level of thermal radiation at the site boundary from a jet fire as predicted by a simple 4 point radiator model is not hazardous, the safety report does not need to describe the modelling in great detail. However, if a horizontal jet fire is predicted to extend into a densely populated area, the safety report would need to consider the effect of the ground variation in flux.
HFL storage facilities frequently hold a variety of other hazardous materials, which may need to be considered in the report. These include a natural gas supply to a boiler, a LPG cylinder, dangerous powders and/or toxic substances in tanks or drums.
"Source terms used should be appropriate and need to have been used correctly for each relevant major accident."
The source term for an accident sequence expresses 'how much', 'for how long' and in 'what form'. For example, a high pressure release from a pipe or vessel is characterised by the release rate, the duration of the release and its form (eg vertical jet, horizontal jet or obstructed jet). Assessors can use the following questions to test the adequacy of the description of accidents given in a safety report:-
Since release rate is effectively determined by hole size and driving force ( pressure or liquid head), the accident consequences described in a safety report should encompass a range of hole size and include the largest possible failure. This means guillotine rupture of a pipe and catastrophic failure leading to an instantaneous release of the whole contents of a vessel.
The 'worst event' should be assumed to occur under 'worst conditions', which for example are when a storage vessel or tank is full, when the pressure in a pipe is a maximum and when the filling pressure or flow rate is a maximum.
The flow rate of liquid through a hole or from a pipe depends on the assumptions made about the hole or pipe size, pump characteristics, discharge coefficient, the pipe roughness, the friction factor, etc. The values assigned to these parameters should ensure that the calculated consequences of accidents are not optimistically small. For example, use of a low value of discharge coefficient should be justified, and the choice of parameters used to calculate the evaporation of a pool should be explained. If in doubt, the assessor should consult the relevant MSDU topic specialist.
The source terms for accidents should account for site-specific features. These relate to:-
and could include parameters such as:-
"The material transport models used should be appropriate and need to have been used correctly for each relevant MAH."
The transport models used to determine the consequences of accidents include those used to characterise pool evaporation, passive or buoyant gas dispersion and the size of a jet fire. The thermal radiation from pool fires can be calculated using standard equations, but complex models may be required to evaluate transportation through the water of releases from sites located close to rivers or an estuary.
It is often difficult for an Assessor to reach conclusions about the adequacy of the consequence analysis. Answers to the following questions may provide the basis for an assessment:-
The agreement between hazard range predicted by HSE models and those in a safety report should be within +-50%. Greater differences are acceptable if the consequences do not include fatalities, but when they do, and the reason for a significance discrepancy is not obvious or is due to an inappropriate assumption, Assessors may judge safety report to be deficient.
The molecular weight of most HFL vapours is greater than that of air, but the plume from an evaporating pool usually disperses passively. This is not true for extremely volatile HFL's, which evaporate by a process that is more akin to boiling and produce large quantities of heavier that air vapour that disperse as a dense gas. In these cases ground level concentrations fall off more rapidly than those predicted by a passive dispersion model, which produce pessimistic predictions in the far field, but may under estimate the sideways spreading in the near field. Several integrated dispersion models that determine the correct dispersion models from the substance properties and the characteristics of the release are available, but then careful evaluation of the source term assumptions is required. The topic specialists should be consulted if the predictions appear optimistic.
Accidental releases at ground level have to disperse around and over plant, equipment and any buildings surrounding the release site. In general the presence of buildings results in enhanced mixing with air and ground level concentrations predicted by models that do not explicitly include equations and correlations for flow around buildings are likely to be pessimistic in the far field. Such predictions are acceptable provided they do not over estimate the hazard range to such an extent that off-site emergency procedures would be compromised.
In general, for continuous releases, the higher the wind speeds the more rapid is the dispersion and shorter is the hazard range. D5 weather conditions occur frequently in the UK and should be used to calculate the hazard range for daytime releases. Dispersion is reduced under stable atmospheric conditions, hence F2 weather, which characterises night time conditions, generally produces the greatest hazard range. However, buoyant clouds tend to ascend when the wind speed is low and reduce ground level concentrations. Under each stability class, increases in wind speed tend to decrease the predicted hazard range unless building wake effects are modelled. For instantaneous releases, these general observations may not be applicable.
A safety report should calculate the consequences of accidents under a range of weather (temperature and wind speed, type) conditions including those that maximise the hazard range and are most typical at the plant location.
The rougher the ground over which a flammable gas is dispersing the more rapid is the rate of air entrainment and the shorter is the flammable hazard range. A ground roughness value of 0.1 corresponding to elements on the ground about 0.5-1 metre high is recommended for dispersion over agricultural land.
A roughness value of 0.3 should be used for dispersion over a suburban area. Although higher roughness values may be assigned to some industrial sites, their use results in a reduced hazard range that could, under certain circumstances, be optimistic. An Operator should make a special case for use of a ground roughness value of more than 0.3. A value of less than 0.1 may be considered appropriate for dispersion over water i.e. at shore terminals or estuary sites.
Due to the variability of atmospheric conditions a dispersing gas plume meanders and the concentration at a fixed point down wind of a release fluctuates. Most dispersion models account for this phenomena by introducing an averaging period. The longer this is, the more allowance is made for the variations in wind direction and the smaller is the predicted concentration.
There is not a consensus on the most appropriate averaging period for dispersion calculations, but widespread support exists for use of 600 seconds and 10 seconds for continuous and instantaneous releases respectively. In some passive dispersion models the standard deviations are linked to specific averaging times. Further guidance on these matters can be obtained from the relevant MSDU topic specialist.
Since criteria 3.5.2 is concerned with the appropriateness of transport modelling assumptions, and averaging time can have a significant affect on the predicted hazard range, it is important that the Operators state the values used in the dispersion analysis. This requirement is not restricted to averaging time; Operators are obliged under criterion 3.5 to provide details of all important modelling assumptions and input.
"Other consequence models (eg BLEVE, warehouse fire, etc), used should be appropriate and need to have been used correctly for each relevant major accident."
Aside from transport models, the consequence analysis for an HFL storage site needs to include models for thermal radiation from different types of fire and for the over pressure produced by explosions. It is important that these models do not under estimate the hazard range, but it is difficult for an Assessor to make judgements about the level of pessimism in a calculation if full details of the model are not supplied. Toxic effects and toxic combustion products should also be included in the report, but their assessment presents problems, which the following sections may alleviate:-
Wind has the effect of shortening and tilting vertical vapour jet fires. Thus the higher the wind speed the greater is the thermal radiation flux falling on down wind targets, and to a lesser extent, cross wind targets, but the smaller is the flux falling on upwind targets. A safety report should determine the consequences of a 'vertical' jet fire in a high wind speed (e.g. 10-15m/s) otherwise its accident analysis may be deemed optimistic.
A high wind speed tends to shorten the flame length of a horizontal jet fire and may, depending of the relative orientation of the flame and target, reduce the hazard range. A safety report should therefore consider the consequences of horizontal jet fires in a range of wind speeds including 2 m/s.
The thermal radiation flux to an object from a jet fire usually reaches a peak when the jet fire is pointing directly towards it. Similarly the thermal radiated received by a target from a pool fire reaches a maximum when the wind is blowing the flames towards it. A consequence analysis is therefore optimistic if it only considers the thermal radiation from vertical jet fires or pool fires in low or zero wind speeds.
Low pressure releases of a HFL generally end up running along the ground until reaching a natural or man made bund or drainage system. Bunds contain and limit pool size and evaporation therefore a report that fails to address bund over topping should be considered to contain serious omissions. Uncontained pools can spread over a large area and cover different surfaces. Their evaporation rate is generally much higher than that of bunded pools, hence their associated hazard range can be significantly greater.
At typical HFL sites, uncontained evaporating pools of up to 50 metres radius should not be discounted without justification. Running pool fires engulfing road tanker loading facilities and other sensitive plant should be included in the report as should their consequences on entry in to drainage systems and/or an interceptor. Pool depth is an important parameter and assumed values should be justified taking account of surface type. A few millimetres may be appropriate for flat smooth concrete, but several centimetres is reasonable for rough hard-core.
Pool fire events often dominate the risk from HFL storage sites. The modelling assumptions and in particular the assumed inventory and dimensions of a pool are of major significance and should not be subject to excessive optimism. Increasing the pool radius significantly increases the evaporation rate, as does reducing pool depth. It is reasonable to assume that accidents involving an instantaneous release of the whole contents of storage vessel produces a surging liquid wave, capable of over topping most bund walls. Uncontained pools have a significantly greater hazard range and knock on effect than potential bunded releases. Catastrophic tank failures should assume the tank is filled to its maximum inventory level and that 50% is capable of over topping the bund. Assessors may conclude that hazards based on less severe accidents are optimistic.
The thermal radiation emitted by a fire is attenuated by water vapour in the atmosphere, therefore the flux at a target is inversely proportional to the humidity. In the UK, humidity varies considerably, but an average value of 60% is often assumed for hazard calculations.
HSE recommends a surface emissive power in the range of 50 - 150 kW/m2 for hydrocarbon pool fires and 150 - 300 kW/m2 for fireballs. The value for a jet fire is around 200 kW/m2, although models often make use of a correlation derived by Chamberlain to calculate the fraction of the total heat of combustion that is radiated. Typically this is about 0.2. Any thermal radiation calculations that use significant lower emissive powers than these are likely to be optimistic - see Table 5.
There are several methods of calculating blast over pressure from flammable gas explosions, but assessors should be aware that the TNT model is considered over simplistic because gas explosions have different characteristics to TNT explosions. The multi-energy method based on lines 2 and 7 is preferred, but if a safety report calculates over pressure on the basis of an equivalent mass of TNT, it is reasonable to set the mass of TNT to twice the mass of gas in the confined or congested volume. The TNT equivalent of most hydrocarbons is 0.42M, where M is the mass of vapour in the cloud. and major deviations from this require a good explanation. A much higher figure should be assumed for energetic substances such as hydrogen and ethylene oxide.
Table 5 summarises the above and should enable Assessors to deduce if the input data to consequence models has been chosen appropriately.
The models used to calculate the consequences of fires and explosions should account for site specific factors such as:-
|Parameter||Accident type/phenomena||Acceptable value||Direction to reduce severity of consequences|
dense or buoyant dispersion of flammable and or toxic vapour.
5m/s D stability
10 - 15m/s towards the target.
|Ground roughness.||cloud and jet dispersion.||0.3m (suburban environment).||+|
|Averaging period.||Passive dispersion.||600s
|Elevation of fireball||Gasoline
touching the top of storage tank.
|Humidity.||Fireball and jet fire.||60% or less||+|
|Surface emissive power.||Fireball.
200 kW/m2 or 0.2 of heat of combustion
50 - 150 kW/m2
|Stored energy in hydrocarbon cloud.||VCE||0.42 TNT equivalence||-|
|Variation in pool depth and radius.||Evaporating pool.||1- 10 cm
or depth as dictated by containment area and release volume.
Up to 50m diameter unless plant detail justifies a lesser radius.
|Spillage surface.||Evaporating pool.||Must
reflect spillage surface.
Typically concrete for bunds.
Tarmac for roads and other areas.
Loose chipping in other areas.
"The harm criteria or vulnerability models used to assess the impact of each MAH on people and the environment should be appropriate and have been used correctly for each relevant major accident."
A safety report should calculate thermal radiation and explosion over pressure hazard ranges and casualties for several severity levels, which for thermal radiation, may include:-
For over pressure the appropriate hazard ranges correspond to:-
Toxic gas exposure estimates for indoor and out of doors should be based on the dangerous toxic load Cn t = A (ppmn min) relationship where concentration is raised to a power "n" depending on the hazardous substance. A "dangerous toxic load" typically represents, a dose that would result in:-
However the "A" value can be modified to account for populations of different sensitivity. A lower value of "A" may be appropriate for predicting the effects of a release into an old persons home.
For secondary fires:-
It is very important that the full spectrum of casualties is calculated, not only for risk evaluation, but also for emergency planning purposes. Some safety reports may contain casualty estimates based upon other criteria such as a dose that relates to a value considered immediately dangerous to life and health (IDLH). Assessors should be check that such predictions are not overly optimistic.
The following questions may assist the Assessor to judge the adequacy of the accident consequence analysis:-
Although HSE has published its thermal radiation criteria, some safety reports calculate hazard ranges to different dose and flux levels. One of these is 300 tdu, which is the dose to cause blistering of the skin. It extends beyond the 500 tdu range and may be regarded as pessimistic, but any dose implies an exposure duration and Assessors need to understand the assumptions being made before making judgements about acceptability. In particular significant departures from the following assumptions that lead to shorter hazard ranges should be justified:-
Individuals escaping from a source of thermal radiation reduce the dose they receive on two counts. Firstly they increase the distance between them and the fire, (and thereby reduce the level of received thermal flux) and secondly, they can reduce the exposure period by going indoors.
HSE has two criteria for thermal radiation flux to buildings based on the ignition of American Whitewood (see Consequence Assessment in part 2), and while these are useful for assessing risk to occupants of houses, they provide little information on hazardous flux for a HFL storage facility. In this context the actions of the local fire service are important because they may be able to keep adjacent items of plant cool with water sprays. However, a safety report should assume that plant in the vicinity of a major fire do not receive water spray protection for 20 minutes. Predictions based on a much shorter response time for the fire brigade are likely to be optimistic. Operators must consider the consequences of late arrival of fire fighting services, but it is permissible for them to make judgements about the probability of such an occurrence.
The effects of blast over pressure on buildings and on people cannot be predicted precisely, but HSE has published tables of the consequences of a range of side-on over pressure. Different over pressures can be used in consequence calculations provided they convey a realistic picture of the scale and extent of the damage from an explosion. To this end, the following data are useful: -
A safety report that presents hazard ranges corresponding to higher over pressures than those above is not providing the full picture of the potential damage caused by explosions.
"Are the assumptions in the accident analysis justified and not unduly optimistic."
The assumptions being referred to here are those made about the response/effectiveness of accident consequence mitigation systems and include such things as the time to detect a large release of HFL and the probability that a slam-shut valve will close on demand or an operator will act in a predetermined way. The safety report should determine the consequences of worst accident scenarios on the assumption that all control and mitigation systems fail on demand and operational conditions correspond to worst case. Such a scenario should have a very low probability. The analysis should also consider the effect of various combinations of partial success of the control and mitigation systems in order to determine the risk dominating accidents.
A safety report that minimises accident consequences on the assumption that installed mitigation systems work perfectly is underestimating risk. Assessors can judge this aspect of safety reports by reference to the following questions:-
The safety report for a HFL facility should consider an instantaneous release of the whole contents of a storage vessel that releases 50% of the contents to an uncontained evaporating pool with and without early ignition and with subsequent dispersion of the vapour and fire.
Various other scenarios that result in a continuous release of several 10s of kg/s and give rise to a variety of fires which may engulf other plant and escalate the accident should also be considered. In addition the safety report should address failure of import and export lines at "worst" locations, and failure of other items of plant such as a transfer pumps or flexible connections. The conditions that could give rise to a VCE or BLEVE should be identified and the consequences of these events determined. Environmental hazards must also be adequately addressed.
Any large release of HFL is likely to give rise to a variety of hazards that may include pool fire, jet fire, explosion, toxic gas exposure, discharge to water course and contamination due to fire water run off. A safety report should address each one paying particular attention to releases of vapours into confined or congested areas where significant over pressure can follow ignition. It should also examine all the potential consequences of a horizontal jet fire in the "worst" location.
The consequences of many severe accidents depend on the environmental conditions, the state of the plant at the moment of failure and the location and type of failure. Since there are many combinations with roughly equal probability, the safety report must determine the consequences of each accident under a range of conditions that encompass the full severity range.
Both day time and night time conditions should be considered for accidents affected by stability (ie those involving dispersion), but because wind speed shortens the hazard range, only D5 and F2 conditions need to be considered. A wide range of wind speeds should be considered for jet fire events.
Accidents can occur any time although their probability is not usually constant. It is important that a safety report describes the consequences of the worst conceivable accidents at a site that occur when tanks are full and transfer pipes and buffer vessels are at their maximum operating pressure and inventory. If the accident analysis in a safety report is based on average inventories, it may be judged as incorporating too much optimism.
Failures on plant can occur almost anywhere, but with variable probability. The safety report should consider failures in the 'worst' locations, which include jet flames pointing towards vulnerable plant and populated areas or knock-on effects when vessels are in close proximity. A safety report that does not calculate the consequences of worst case accidents may fail to comply with the assessment criteria.
A safety report should describe the mathematical models used to predict the consequences of accidents. If the Operator or his consultant used well known software to calculate the consequences of accidents, information on the input data files should be provided so that Assessors can check its appropriateness and degree of conservatism both of which provide an insight into the Operators approach to accident consequence analysis. If doubts remain, entering the Operator's input data into an HSE model can check the predictions in the safety report.
A difference in opinion about the severity of accident consequences may occur from time to time. It does not imply a major failing of the safety report but one which the Assessor should try to resolve by communication with the topic specialist, and, if necessary, with the Operator.
"Estimates of the severity and extent of each major accident consequences are realistic."
COMAH Regulations Schedule 4, Part 2, Section 4(b) requires operators to provide an "assessment of the extent and severity of the consequences of identified major accidents".This is extended by SRAM Criterion 3.5.6 which requires that this assessment is realistic.
Duty holders should provide information (perhaps in tabular form) which links each scenario with the number of people who may be affected (as a minimum) and preferably estimates of the number of fatalities and hospitalisations and those receiving minor injuries for each wind direction (where appropriate). This will provide the assessor with the information needed to determine the significance of each scenario.
We believe it is necessary if we are to be able to make a judgement on "all necessary measures" and the suitability of the information provided for offsite emergency plans (Schedule 4, Part 1, Section 4 and SRAM Part 2, Chapter 1).
Safety reports should determine the consequences of the worst accidents, but the analysis should not be overly conservative. If unrealistic hazard ranges are predicted, the off site emergency plan devised by the Local Authority may be ill conceived and under some circumstances, lives could be put at risk by spreading emergency services too thinly. The Assessor can gauge the degree of conservatism in the calculations by asking the following question:-
Reasonable values for some of the more important input data for accident consequence modelling are shown in Table 5. Assessors should compare these values with those used by the Operator and make judgements about the realism of the consequence predictions.