"The safety report should provide details to demonstrate that suitable and sufficient consequence assessment for each major accident scenario has been carried out with respect to people and the environment."
The principal hazards from LPG storage systems are fires and explosions, resulting from leaks in vessels, pipes and ancillary equipment such as cylinder filling machines. The number of loss of containment-consequence combinations is large but not every one of them needs to be addressed in the safety report. Assessors can test compliance with Criterion 3.5 by asking the following questions:-
A safety report should discuss external events and site incidents that range in severity from catastrophic failure of a storage vessel to a small leak and should identify the measures and precautions taken to reduce their probability.
The accident consequence analysis should be a systematic process comprising the following steps:-
All of the above steps should be clearly documented in the report. However, omission of one or more of them is not a significant failing if overall the consequence analysis is satisfactory.
The number of accidents that a site can suffer depends on the number and type of vessels, whether cylinder filling takes place and other site specific features, but all safety reports should determine the consequences of the following minimum set of accidents: -
The safety report should not discount any scenario unless it can provide good reasons for doing so. If a VCE of LPG is discounted in a safety report there must be justification for this.
High pressure pipe work failures should include the formation of a vertical and horizontal jet and the potential for jet flame impingement. In addition leaks into an enclosed space that may result in a confined explosion should not be forgotten.
The number of fatalities and individuals with severe burns from fires and explosions should be determined. The effect of blast should also be quantified in terms of the number of buildings in each of several damage categories and the envelope of a flash fire should be superimposed on a map so that the effect of wind direction on the number of casualties can be assessed. The accident analysis should address the effect of other variables such as time of year, time of day and day of the week if they have a significant effect on the off-site consequences. A limited analysis that neglects variability in accident consequences may not meet the assessment criteria.
A safety report should include a brief description of the essential features and assumptions of the mathematical models used by the Operator to determine the consequences of major accidents. If the models are part of a well-known software package, then only the name of the software is required, but full details of the input should be provided. In-house models and any validation studies that have been carried out to support them should be described in detail. The main equations of a model should be given in an appendix if they have not been published elsewhere.
The fact that an Operator has used a well-validated model to determine the consequences of an accident does not guarantee that the results are reliable. Assessors should recognise that the predictions of consequence analysis are more important than the means by which they were obtained. Assessors may feel that a safety report that fails to provide input data details for predictions, which appear optimistic, fails to meet the criteria.
The level of detail that should be provided on the calculation of the consequences of an accident that do not extend off-site is less than if the hazard range encompassed a large number of people. It is not possible to be prescriptive on this issue and Assessors are expected to use professional judgement when deciding if the Operator has provided sufficient information on his consequence analysis. However, the following examples may help Assessors make a judgement on this issue.
If the footprint of a flash fire defined by ½ LFL does not encompass any off-site populations, then the flash fire hazardous area can be equated to this area and the flash fire risk dismissed in one or two sentences. On the other hand, if the ½ LFL footprint encompassed a densely populated area, the Operator should provide a more detailed analysis with a discussion of the most appropriate concentration for risk assessment based on ignition probability. Alternatively, consideration should be given to any arguments and data which the company may wish to put forward in support of the use of LFL as the flash fire criterion. The arguments would include a validated peak concentration dispersion model rather than a time averaged model. If the LFL contour fell a few metres short of a densely populated area, then again the Operator should consider the probability of a flash fire extending beyond the LFL boundary.
If the level of thermal radiation at the site boundary from a jet fire as predicted by a simple 4 point radiator model is not hazardous, the safety report does not need to describe the modelling in great detail. However, if a horizontal jet fire is predicted to extend into a densely populated area, the safety report would need to consider the effect of the ground variation in flux.
"Source terms used should be appropriate and need to have been used correctly for each relevant major accident."
The source term for an accident sequence expresses 'how much', 'for how long' and in 'what form'. For example, a high pressure release from a pipe or vessel is characterised by the release rate, the duration of the release and its form (eg liquid or gas and whether as a vertical jet, horizontal jet or obstructed jet). Assessors can use the following questions to test the adequacy of the description of accidents given in a safety report:-
Since release rate is effectively determined by hole size, the accident consequences described in a safety report should encompass a range of hole size and include the largest possible failure. This means guillotine rupture of a pipe and catastrophic failure leading to an instantaneous release of the whole contents of a vessel.
The 'worst event' should be assumed to occur under 'worst conditions', which for example are when storage vessels are almost full, when a leak of refrigerated LPG clears the bund wall around the storage vessel, or when a stack of cylinders is at maximum capacity.
The flow rate of LPG through a hole or from a pipe depends on the assumptions made about the discharge coefficient, the pipe roughness, the friction factor, etc. The values assigned to these parameters should ensure that the calculated consequences of accidents are not optimistically small. For example, use of a discharge coefficient less than 0.9 for a high pressure release should be justified.If in doubt, the assessor should consult the relevant MSDU topic specialist.
The source terms for accidents should account for site-specific features. These relate to:-
and could include parameters such as:-
"The material transport models used should be appropriate and need to have been used correctly for each relevant MAH."
The transport models used to determine the consequences of accidents at LPG storage sites need to be capable of dealing with jet and dense gas dispersion. The size of a jet fire is often based on the physics of gas jets and mixing coefficients, but correlation's for flame length derived from experiment may be more reliable. This is particularly the case for grounded jets which, because of reduced air entrainment, tend to have a longer flame length than a free jet.
Nearly all models to characterise LPG dispersion are complex and make use of several assumptions and input parameters. Therefore, it is often difficult for an Assessor to reach conclusions about the adequacy of the consequence analysis. Answers to the following questions may provide the basis for an assessment:-
The agreement between hazard range predicted by HSE models and those in a safety report should be within +-50%. Greater differences are acceptable if the consequences do not include fatalities, but when they do, and the reason for a significance discrepancy is not obvious or is due to an inappropriate assumption, Assessors may judge safety report to be deficient.
Since the molecular weight of LPG is greater than that of air, a dense gas dispersion model is required to determine hazard ranges for ambient and low temperature releases. Such predictions by passive dispersion models may be optimistic or pessimistic as the diagram below indicates. A safety report that uses a passive dispersion model will over estimate the down wind extent of a flash fire but under estimate its width. Assessors should expect to see a sound justification for the use of a passive dispersion model and a discussion of the inability of the model to correctly predict the width of the flammable cloud.
LPG released accidentally at ground level has to disperse around site buildings, and in doing so it becomes more dilute. This implies that when gas has to move around buildings the concentration at a particular distance from the release point is lower than that predicted by dispersion over a smooth flat terrain. On the other hand the concentration will be higher if the gas is constrained from dispersing sideways by buildings on either side of a street. Both of these aspects should be addressed in a safety report.
In general, for continuous releases, the higher the wind speeds the more rapid is the dispersion and shorter is the hazard range. D5 weather conditions occur frequently in the UK and should be used to calculate the hazard range for daytime releases. Dispersion is reduced under stable atmospheric conditions, hence F2 weather, which characterises night time conditions, generally produces the greatest hazard range. Under any stability, increases in wind speed tend to decrease the predicted hazard range unless building wake effects are modelled. A safety report should calculate the consequences of accidents under a range of weather conditions including those that maximise the hazard range. For instantaneous releases, these general observations may not be applicable.
The rougher the ground over which a flammable gas is dispersing the more rapid is the rate of air entrainment and the shorter is the flammable hazard range. A ground roughness value of 0.1 corresponding to elements on the ground about 0.5-1 metre high is recommended for dispersion over agricultural land. A roughness value of 0.3 should be used for dispersion over a suburban area. Although higher roughness values may be assigned to some industrial sites, their use results in a reduced hazard range that could, under certain circumstances, be optimistic. An Operator should make a special case for use of a ground roughness value of more than 0.3.
Due to the variability of atmospheric conditions a dispersing gas plume meanders and the concentration at a fixed point down wind of a release fluctuates. Most dispersion models account for this phenomena by introducing an averaging period. The longer this is, the more allowance is made for the variations in wind direction and the smaller is the predicted concentration.
There is not a consensus on the most appropriate averaging period for dispersion calculations, but widespread support exists for use of 600 seconds and 10 seconds for continuous and instantaneous releases. In some passive dispersion models the standard deviations are linked to specific averaging times.
Since criteria 3.5.2 is concerned with the appropriateness of transport modelling assumptions, and averaging time can have a significant affect on the predicted hazard range, it is important that the Operators state the values used in the dispersion analysis. This requirement is not restricted to averaging time; Operators are obliged under criterion 3.5 to provide details of all important modelling assumptions and input.
"Other consequence models (eg BLEVE, warehouse fire, etc), used should be appropriate and need to have been used correctly for each relevant major accident."
Aside from transport models, the consequence analysis for an LPG storage site needs to include models for thermal radiation from different types of fire and for the over pressure produced by explosions. It is important that these models do not under estimate the hazard range, but it is difficult for an Assessor to make judgements about the level of pessimism in a calculation if full details of the model are not supplied. The following questions may help Assessors judge if the consequence analysis is based on appropriate assumptions:-
Wind has the effect of shortening and tilting vertical vapour jet fires. Thus the higher the wind speed the greater is the thermal radiation flux falling on down wind targets, and to a lesser extent, cross wind targets, but the smaller is the flux falling on upwind targets. A safety report should determine the consequences of a 'vertical' jet fire in a high wind speed (e.g. 10-15m/s) otherwise its accident analysis may be deemed optimistic.
A high wind speed tends to shorten the flame length of a horizontal jet fire and may, depending of the relative orientation of the flame and target, reduce the hazard range. A safety report should therefore consider the consequences of horizontal jet fires in a range of wind speeds including 2 m/s.
The thermal radiation flux to an object from a jet fire usually reaches a peak when the jet fire is pointing directly towards it. A consequence analysis is therefore optimistic if it only considers the thermal radiation from vertical jet fires.
Fireball events dominate the risk from pressure vessels storing LPG, but the ground level fluxes depend on the modelling assumptions and in particular on the assumed height of the fireball. Increasing its elevation reduces the dose to individuals hence the height of the lower edge is an important parameter. HSE assumes that accidents involving an instantaneous release of the whole contents of a vessel produce a fireball that just touches the ground. Assessors may conclude that hazards based upon greatly elevated fireballs are optimistic.
The thermal radiation emitted by a fire is attenuated by water vapour in the atmosphere, therefore the flux at a target is inversely proportional to the humidity. In the UK, humidity varies considerably, but an average value of 60% is often assumed for hazard calculations.
There is general agreement that the surface emissive power of an LPG fireball containing less than 200 tonnes is 270 kW/m2. The value for a jet fire is around 200 kW/m2, although models often make use of a correlation derived by Chamberlain to calculate the fraction of the total heat of combustion that is radiated. Typically this is about 0.2. Any thermal radiation calculations that use significant lower emissive powers than these are likely to be optimistic - see Table 6.
There are several methods of calculating blast over pressure from flammable gas explosions, but assessors should be aware that the TNT model is considered over simplistic because gas explosions have different characteristics to TNT explosions. The multi-energy method based on lines 2 and 7 is preferred, but if a safety report calculates over pressure on the basis of an equivalent mass of TNT, it is reasonable to set the mass of TNT to twice the mass of gas in the confined or congested volume. Major deviations from this require a good explanation.
Table 5 summarises the above and should enable Assessors to deduce if the input data to consequence models has been chosen appropriately.
The models used to calculate the consequences of BLEVEs, jet fires and explosions should account for site specific factors such as:-
| Parameter | Accident type/ phenomena | Acceptable value | Direction to reduce severity of consequences |
|---|---|---|---|
| Wind speed | Passive dispersion | 2 m/s F stability 5 m/s D stability |
+
+ |
| Vertical jet | 10-15m/s towards the target and 5 m/s | - | |
| Horizontal jet | 0-5 m/s with and against the jet | + | |
| Ground roughness | Dense gas and jet dispersion | 0.3m (suburban environment) | + |
| Averaging period | Dispersion of gas cloud | 600s plume 10s puff |
+ + |
| Elevation of fireball | Pressure vessel rupture | touching the ground | + |
| Humidity | Fireball and jet fire | 60% or less | + |
| Surface emissive power | Fireball | 270 kW/m2 | - |
| Jet fire | 200 kW/m2 or 0.3 of heat of combustion | - | |
| Pool fire | 200 kW/m2 over half of the flame height | - | |
| Stored energy in LPG cloud | VCE | 3.5x10 J/m3 | - |
| Substrate | Vaporising pool | substrate heat capacity (on concrete or tarmac) | + |
"The harm criteria or vulnerability models used to assess the impact of each MAH on people and the environment should be appropriate and have been used correctly for each relevant major accident."
A safety report should calculate thermal radiation and explosion over pressure hazard ranges and casualties for several severity levels, which for thermal radiation, may include:-
For over pressure the appropriate hazard ranges correspond to:-
For secondary fires:-
It is very important that the full spectrum of casualties is calculated, not only for risk evaluation, but also for emergency planning purposes.
The following questions may assist the Assessor to judge the adequacy of the accident consequence analysis:-
Although HSE has published its thermal radiation criteria, some safety reports calculate hazard ranges to different dose and flux levels. One of these is 300 tdu, which is the dose to cause blistering of the skin. It extends beyond the 500 tdu range and may be regarded as pessimistic, but any dose implies an exposure duration and Assessors need to understand the assumptions being made before making judgements about acceptability. In particular significant departures from the following assumptions that lead to shorter hazard ranges should be justified:-
Individuals escaping from a source of thermal radiation reduce the dose they receive on two counts. Firstly they increase the distance between them and the fire,(and thereby reduce the level of received thermal flux) and secondly, they can reduce the exposure period by going indoors.
HSE has two criteria for thermal radiation flux to buildings based on the ignition of American Whitewood (see Consequence Assessment in part 2), and while these are useful for assessing risk to occupants of houses, they provide little information on hazard range for LPG fires. In this context the actions of the local fire service are important because they may be able to keep adjacent items of plant cool with water sprays. However, a safety report should assume that plant in the vicinity of a major fire do not receive water spray protection for 20 minutes. Predictions based on a much shorter response time for the fire brigade are likely to be optimistic. Operators must consider the consequences of late arrival of fire fighting services, but it is permissible for them to make judgements about the probability of such an occurrence.
The effects of blast over pressure on buildings and on people cannot be predicted precisely, but HSE has published tables of the consequences of a range of side-on over pressure. Different over pressures can be used in consequence calculations provided they convey a realistic picture of the scale and extent of the damage from an explosion. To this end, the following data are useful: -
A safety report that presents hazard ranges corresponding to higher over pressures than those above is not providing the full picture of the potential damage caused by explosions following accidental releases of LPG.
"Are the assumptions in the accident analysis justified and not unduly optimistic."
The assumptions being referred to here are those made about the response/effectiveness of accident consequence mitigation systems and include such things as the time to detect a large release of gas and the probability that a ROSOV will close on demand. The safety report should determine the consequences of worst accident scenarios on the assumption that all control and mitigation systems fail on demand and operational conditions correspond to worst case. Such a scenario should have a very low probability. The analysis should also consider the effect of various combinations of partial success of the control and mitigation systems in order to determine the risk dominating accidents.
A safety report that minimises accident consequences on the assumption that installed mitigation systems work perfectly is underestimating risk. Assessors can judge this aspect of safety reports by reference to the following questions:-
An LPG storage site safety report should consider an instantaneous release of the whole contents of storage vessels and various other scenarios that result in a continuous release of several 10s of kg/s and give rise to a variety of fires. In addition, it should address failure of associate plant such as the vaporiser and cylinder filling machine giving rise to a variety of hazards including a confined explosion.
The consequences of many severe accidents depend on the environmental conditions, the state of the plant at the moment of failure and the location and type of failure. Since there are many combinations with roughly equal probability, the safety report must determine the consequences of each accident under a range of conditions that encompass the full severity range.
Both day time and night time conditions should be considered for accidents affected by stability (ie those involving dispersion), but because wind speed shortens the hazard range, only D5 and F2 conditions need to be considered. A wide range of wind speeds should be considered for jet fire events.
Accidents can occur any time although their probability is not usually constant. It is important that a safety report describes the consequences of the worst conceivable accidents at a site that occur when a vessel is full. If the accident analysis in a safety report is based on average inventories, it may be judged as incorporating too much optimism.
Failures on plant can occur almost anywhere, but with variable probability. The safety report should consider failures in the 'worst' locations, which include jet flames pointing towards vulnerable plant and populated areas, knock-on effects when pressure vessels are in close proximity and explosions in the cylinder filling plant. A safety report that does not calculate the consequences of worst case accidents may fail to comply with the assessment criteria.
A safety report should describe the mathematical models used to predict the consequences of accidents. If the Operator or his consultant used well known software to calculate the consequences of accidents, information on the input data files should be provided so that Assessors can check its appropriateness and degree of conservatism both of which provide an insight into the Operators approach to accident consequence analysis. If doubts remain, entering the Operator's input data into an HSE model can check the predictions in the safety report.
A difference in opinion about the severity of accident consequences may occur from time to time. It does not imply a major failing of the safety report but one which the Assessor should try to resolve by communication with the topic specialist, and, if necessary, with the Operator.
"Estimates of the severity and extent of each major accident consequences are realistic."
COMAH Regulations Schedule 4, Part 2, Section 4(b) requires operators to provide an "assessment of the extent and severity of the consequences of identified major accidents".This is extended by SRAM Criterion 3.5.6 which requires that this assessment is realistic.
Duty holders should provide explicit information (perhaps in tabular form) which links each scenario with the number of people who may be affected (as a minimum) and preferably estimates of the number of fatalities and hospitalisations and those receiving minor injuries for each wind direction (where appropriate). This will provide the assessor with the information needed to determine the significance of each scenario.
We believe it is necessary if we are to be able to make a judgement on "all necessary measures" and the suitability of the information provided for offsite emergency plans (Schedule 4, Part 1, Section 4 and SRAM Part 2, Chapter 1.
Safety reports should determine the consequences of the worst accidents, but the analysis should not be overly conservative. If unrealistic hazard ranges are predicted, the off site emergency plan devised by the Local Authority may be ill conceived and under some circumstances, lives could be put at risk by spreading emergency services too thinly. The Assessor can gauge the degree of conservatism in the calculations by asking the following questions:-
Reasonable values for some of the more important input data for accident consequence modelling are shown in Table 5. Assessors should compare these values with those used by the Operator and make judgements about the realism of the consequence predictions.
Public Register of COMAH Establishments
