Criterion 3.5 "The safety report should provide details to demonstrate that suitable and sufficient consequence assessment for each major accident scenario has been carried out with respect to people and the environment."
The principal hazards from natural gas storage sites are fires and explosions, resulting from leaks in the vessels themselves and in ancillary equipment such as pressure regulators and pipelines, both of which operate at high pressure. The number of loss of containment-consequence combinations is large but not every one of them needs to be addressed in the safety report.
Assessors can test compliance with Criterion 3.5 by asking the following questions:-
A safety report should discuss external events and site incidents that range in severity from catastrophic failure of a storage vessel to a small leak and should identify the measures and precautions taken to reduce their probability. Catastrophic failure can be caused by aircraft impact, subsidence, earthquake, a freak storm, a nearby explosion and possibly by abnormal operation. Less severe leaks may be the result of mechanical failure, impact damage, lightning, flame impingement or electrical failure.
The accident consequence analysis should be a systematic process comprising the following steps:-
All of the above steps should be clearly documented in the report. However, omission of one or more of them is not a significant failing if overall the consequence analysis is satisfactory.
A minimum accident set for a high pressure gas storage site would be: -
Catastrophic failure - 100% of contents of one bullet released - fireball and flash fire.
Localised failure of a bullet - jet fire, flash fire and possible explosion.
Localised failure of a bullet with knock-on effect resulting in rupture of 50% other bullets - jet fire and fireball.
Pipe failures (rupture, hole diameter equal to pipe radius, flange leak).
Pressure relief valve discharge - jet fire.
Filling/export line failures at worst case locations.
Rupture - fireball, vertical jet fire, horizontal jet fire, flash fire, VCE.
Puncture - fireball, vertical jet fire, horizontal jet fire, flash fire, VCE.
Small hole/leak - jet fire flash fire.
Missile from exploding bullet causes damage to nearby gas holder.
The safety report should not discount any scenario unless it can provide good reasons for doing so. If a VCE of methane is discounted in a safety report there must be justification for this.
High pressure pipeline failures should include the formation of a vertical and horizontal jet and the potential for jet flame impingement. In addition leaks into an enclosed space that may result in a confined explosion should not be forgotten.
The number of fatalities and individuals with severe burns from fires and explosions should be determined. The effect of blast should also be quantified in terms of the number of buildings in each of several damage categories and the envelope of a flash fire should be superimposed on a map so that the effect of wind direction on the number of casualties can be assessed. The accident analysis should address the effect of other variables such as time of year, time of day, day of the week and rain if they have a significant effect on the off-site consequences. A limited analysis that neglects variability in accident consequences may not meet the assessment criteria.
A safety report should include a brief description of the essential features and assumptions of the mathematical models used by the Operator to determine the consequences of major accidents. If the models are part of a well-known software package, then only the name of the software is required, but full details of the input should be provided. In-house models and any validation studies that have been carried out to support them should be described in detail. The main equations of a model should be given in an appendix if they have not been published elsewhere.
The fact that an Operator has used a well-validated model to determine the consequences of an accident does not guarantee that the results are reliable. Assessors should recognise that the predictions of consequence analysis are more important than the means by which they were obtained. Assessors may feel that a safety report that fails to provide input data details for predictions, which appear optimistic, fails to meet the criteria.
The level of detail that should be provided on the calculation of the consequences of an accident that do not extend off-site is less than if the hazard range encompassed a large number of people. It is not possible to be prescriptive on this issue and Assessors are expected to use professional judgement when deciding if the Operator has provided sufficient information on his consequence analysis. However, the following examples may help Assessors make a judgement on this issue.
If the footprint of a flash fire defined by ½ LFL does not encompass any off-site populations, then the flash fire hazardous area can be equated to this area and the flash fire risk dismissed in one or two sentences. On the other hand, if the ½ LFL footprint encompassed a densely populated area, the Operator should provide a more detailed analysis with a discussion of the most appropriate concentration for risk assessment based on ignition probability. Alternatively, consideration should be given to any arguments and data which the company may wish to put forward in support of the use of LFL as the flash fire criterion. The arguments would include a validated peak concentration dispersion model rather than a time averaged model. If the LFL contour fell a few metres short of a densely populated area, then again the Operator should consider the probability of a flash fire extending beyond the LFL boundary.
If the level of thermal radiation at the site boundary from a jet fire as predicted by a simple 4point radiator model is not hazardous, the safety report does not need to describe the modelling in great detail. However, if a horizontal jet fire is predicted to extend into a densely populated area, the safety report would need to consider the effect of the ground on the flame length and the variation in flux around the flame.
The only dangerous substance at most high pressure gas storage sites is methane, but occasionally other materials are present and must be considered in the safety report if they amount to more than 2% of the COMAH threshold. These could be LPG, an odouriser or HFLs in drums.
Criterion 3.5.1 "Source terms used should be appropriate and need to have been used correctly for each relevant major accident."
The source term for an accident sequence expresses 'how much', 'for how long' and in 'what form'. For example, a high pressure release from a pipe or vessel is characterised by the release rate, the duration of the release and its form (e.g. vertical jet, horizontal jet or obstructed jet). Assessors can use the following questions to test the adequacy of the description of accidents given in a safety report:-
Since release rate is effectively determined by hole size, the accident consequences described in a safety report should encompass a range of hole size and include the largest possible failure. This means guillotine rupture of a pipe and catastrophic failure leading to an instantaneous release of the whole contents of a vessel.
The 'worst event' should be assumed to occur under 'worst conditions', which for example are when a high pressure bullet is full, when the pressure in a pipe is a maximum, and when the filling pressure is a maximum.
The flow rate of gas through a hole or from a pipe depends on the assumptions made about the discharge coefficient, the pipe roughness, the friction factor, etc. The values assigned to these parameters should ensure that the calculated consequences of accidents are not optimistically small. For example, use of a discharge coefficient less than 0.9 for a high pressure release should be justified. If in doubt, the assessor should consult the relevant MSDU topic specialist.
The source terms for accidents should account for site specific features. These relate to: -
and could include parameters such as: -
Criterion 3.5.2 "The material transport models used should be appropriate and need to have been used correctly for each relevant MAH."
The transport models used to determine the consequences of accidents at high pressure bullet sites are likely to be a jet dispersion model and a passive or buoyant gas dispersion model. Both are used to determine the maximum flammable envelope of methane releases. Two types of model are often employed to determine the size of a jet fire. One is based on the physics of gas jets and employs mixing coefficients, while the second is based on correlations for flame length derived from experiment (e.g. Chamberlain). The latter are not well suited for grounded jets, which because of reduced air entrainment, tend to have a longer flame length than the same free jet.
Nearly all models to characterise methane dispersion are complex and make use of several assumptions and input parameters. Therefore, it is often difficult for an Assessor to reach conclusions about the adequacy of the consequence analysis. Answers to the following question may provide the basis for an assessment::-
The agreement between hazard range predicted by HSE models and those in a safety report should be within +-50%. Greater differences are acceptable if the consequences do not include fatalities, but when they do, and the reason for a significance discrepancy is not obvious or is due to an inappropriate assumption, Assessors may judge safety report to be deficient.
Since the molecular weight of methane is much less than that of air, low pressure ambient temperature releases are buoyant. This means the gas rises as it spreads away from the source and the rate of mixing with air is enhanced by the upward motion. Ground level concentrations are smaller than those predicted by a passive dispersion model, therefore any consequence analysis based on the assumption that low pressure methane releases disperse passively is likely to be pessimistic.
Methane released accidentally at ground level has to disperse around and over site buildings surrounding most high pressure gas storage sites, and in doing so it becomes more dilute. This implies that when gas has to move around buildings the concentration at a particular distance from the release point is lower than that predicted by dispersion over a smooth flat terrain. Predictions are acceptable provided they do not over estimate the hazard range to such an extent that off-site emergency procedures would be compromised. On the other hand the concentration will be higher if the gas is constrained from dispersing sideways by buildings on either side of a street. Both of these aspects should be addressed in a safety report.
Jet expansion of methane from a high pressure source lowers the temperature but not sufficiently to make it denser than air. Thus dense gas dispersion programs are rarely appropriate for releases of methane at ambient temperature. If such a program is employed to predict the dimensions of a flash fire, the result may be smaller than if a passive dispersion program was used.
In general, for continuous releases, the higher the wind speeds the more rapid is the dispersion and shorter is the hazard range. D5 weather conditions occur frequently in the UK and should be used to calculate the hazard range for daytime releases. Dispersion is reduced under stable atmospheric conditions, hence F2 weather, which characterises night time conditions, generally produces the greatest hazard range. However, buoyant clouds tend to ascend when the wind speed is low and reduce ground level concentrations. Under any stability, increases in wind speed tend to decrease the predicted hazard range for low pressure releases unless building wake effects are modelled, in which case the hazard range may peak at a wind speed above 2 m/s. A safety report should calculate the consequences of accidents under a range of weather conditions including those that maximise the hazard range. For instantaneous releases, these general observations may not be applicable.
The rougher the ground over which a flammable gas is dispersing the more rapid is the rate of air entrainment and the shorter is the flammable hazard range. A ground roughness value of 0.1 corresponding to elements on the ground about 0.5-1metre high is recommended for dispersion over agricultural land. A roughness value of 0.3 should be used for dispersion over a suburban area. Although higher roughness values may be assigned to some industrial sites, their use results in a reduced hazard range that could, under certain circumstances, be optimistic. An Operator should make a special case for use of a ground roughness value of more than 0.3.
Due to the variability of atmospheric conditions a dispersing gas plume meanders and the concentration at a fixed point down wind of a release fluctuates. Most dispersion models account for this phenomena by introducing an averaging period. The longer this is, the more allowance is made for the variations in wind direction and the smaller is the predicted concentration.
There is not a consensus on the most appropriate averaging period for dispersion calculations, but widespread support exists for use of 600 seconds and 10seconds for continuous and instantaneous releases. In some passive dispersion models the standard deviations are linked to specific averaging times.
Since criteria 3.5.2 is concerned with the appropriateness of transport modelling assumptions, and averaging time can have a significant affect on the predicted hazard range, it is important that the Operators state the values used in the dispersion analysis. This requirement is not restricted to averaging time; Operators are obliged under criterion 3.5 to provide details of all important modelling assumptions and input.
Criterion 3.5.3 "Other consequence models (eg BLEVE, warehouse fire, etc), used should be appropriate and need to have been used correctly for each relevant major accident."
Aside from transport models, the consequence analysis for an high pressure bullet site needs to include models for thermal radiation from different types of fire and for the over pressure produced by explosions. It is important that these models do not under estimate the hazard range, but it is difficult for an Assessor to make judgements about the level of pessimism in a calculation if full details of the model are not supplied. The following questions may help Assessors judge if the consequence analysis is based on appropriate assumptions:-
Wind has the effect of shortening and tilting vertical vapour jet fires. Thus the higher the wind speed the greater is the thermal radiation flux falling on down wind targets, and to a lesser extent, cross wind targets, but the smaller is the flux falling on upwind targets. A safety report should determine the consequences of a 'vertical' jet fire in a high wind speed (e.g. 10-15m/s) otherwise its accident analysis may be deemed optimistic.
A high wind speed tends to shorten the flame length of a horizontal jet fire and may, depending of the relative orientation of the flame and target, reduce the hazard range. A safety report should therefore consider the consequences of horizontal jet fires in a range of wind speeds including 2 m/s.
The thermal radiation flux to an object from a jet fire usually reaches a peak when the jet fire is pointing directly towards it. A consequence analysis is therefore optimistic if it only considers the thermal radiation from vertical jet fires.
Fireball events often dominate the risk from methane storage sites, but the ground level fluxes depend on the modelling assumptions and in particular on the assumed height of the fireball. Increasing its elevation reduces the dose to individuals hence the height of the lower edge is an important parameter. It is reasonable to assume that accidents involving an instantaneous release of the whole contents of a bullet or array of bullets produce a fireball that just touches the top of the vessels. However, for ruptures of an incoming high pressure main it is reasonable to assume that the lower edge of the fireball is in contact with the ground. Assessors may conclude that hazards based of greatly elevated fireballs are optimistic.
The thermal radiation emitted by a fire is attenuated by water vapour in the atmosphere, therefore the flux at a target is inversely proportional to the humidity. In the UK, humidity varies considerably, but an average value of 60% is often assumed for hazard calculations. This figure is probably overly optimistic for F2 weather conditions, but an Operator should justify the use of significantly higher values that could result in optimistic predictions.
MSDU recommends a surface emissive power of 270kW/m2 for methane fireballs containing less than 300 tonnes. The value for a jet fire is around 200kW/m2, although models often make use of a correlation derived by Chamberlain to calculate the fraction of the total heat of combustion that is radiated. Typically this is about 0.2. Any thermal radiation calculations that use significant lower emissive powers than these are likely to be optimistic - see Table 5.
There are several methods of calculating blast over pressure from flammable gas explosions, but assessors should be aware that the TNT model is considered over simplistic because natural gas explosions have different characteristics to TNT explosions. The multi-energy method based on lines 2 and 7 is preferred, but if a safety report calculates over pressure on the basis of an equivalent mass of TNT, it is reasonable to set the mass of TNT to twice the mass of gas in the confined or congested volume. Major deviations from this require a good explanation.
Table 5 summarises the above and should enable Assessors to deduce if the input data to consequence models has been chosen appropriately.
The models used to calculate the consequences of jet fires and explosions should account for site specific factors such as: -
Table 5 : Effect of input parameters on predicted accident consequences
|
Parameter |
Accident type/ phenomena |
Acceptable value |
Direction to reduce severity of Consequences |
|---|---|---|---|
|
Wind speed |
Passive dispersion |
2 m/s F stability |
+ |
|
Vertical jet |
10-15m/s towards the target |
- |
|
|
Horizontal jet |
5 m/s |
+ |
|
|
Ground roughness |
Passive and jet dispersion |
0.3m (suburban environment) |
+ |
|
Averaging period |
Passive dispersion of gas cloud |
600s plume |
+ |
|
Elevation of fireball |
Bullet rupture |
Touching top of bullet |
+ |
|
Humidity |
Fireball and jet fire |
60% or less |
+ |
|
Surface emissive power |
Fireball |
270 kW/m2 |
- |
|
Jet fire |
200 kW/m2 or 0.3 of heat of combustion |
- |
|
|
Stored energy in methane cloud |
VCE |
3.5x10 J/m3 |
- |
Criterion 3.5.4 "The harm criteria or vulnerability models used to assess the impact of each MAH on people and the environment should be appropriate and have been used correctly for each relevant major accident."
A safety report should calculate thermal radiation and explosion over pressure hazard ranges and casualties for several severity levels, which for thermal radiation, may include:-
For over pressure the appropriate hazard ranges correspond to:-
For secondary fires:-
It is very important that the full spectrum of casualties is calculated, not only for risk evaluation, but also for emergency planning purposes.
The following questions may assist the Assessor to judge the adequacy of the accident consequence analysis:-
Although HSE has published its thermal radiation criteria, some safety reports calculate hazard ranges to different dose and flux levels. One of these is 300 tdu, which is the dose to cause blistering of the skin. It extends beyond the 500 tdu range and may be regarded as pessimistic, but any dose implies an exposure duration and Assessors need to understand the assumptions being made before making judgements about acceptability. In particular significant departures from the following assumptions that lead to shorter hazard ranges should be justified:-
Individuals escaping from a source of thermal radiation reduce the dose they receive on two counts. Firstly they increase the distance between them and the fire, (and thereby reduce the level of received thermal flux) and secondly, they can reduce the exposure period by going indoors.
HSE has two criteria for thermal radiation flux to buildings based on the ignition of American Whitewood (see Consequence Assessment in the Hazard Section), and while these are useful for assessing risk to occupants of houses, they provide little information on hazard range for plant such as a high pressure storage vessel. In this context the actions of the local fire service are important because they may be able to keep adjacent items of plant cool with water sprays. However, a safety report should assume that plant in the vicinity of a major fire do not receive water spray protection for 20 minutes. Predictions based on a much shorter response time for the fire brigade are likely to be optimistic. Operators must consider the consequences of late arrival of fire fighting services, but it is permissible for them to make judgements about the probability of such an occurrence.
The effects of blast over pressure on buildings and on people cannot be predicted precisely, but HSE has published tables of the consequences of a range of side-on over pressure. Different over pressures can be used in consequence calculations provided they convey a realistic picture of the scale and extent of the damage from an explosion. To this end, the following data are useful: -
A safety report that presents hazard ranges corresponding to higher over pressures than those above is not providing the full picture of the potential damage caused by explosions following accidental releases of natural gas.
Criterion 3.5.5 "Are the assumptions in the accident analysis justified and not unduly optimistic."
The assumptions being referred to here are those made about the response/effectiveness of accident consequence mitigation systems and include such things as the time to detect a large release of gas and the probability that a slam-shut valve will close on demand. The safety report should determine the consequences of worst accident scenarios on the assumption that all control and mitigation systems fail on demand and operational conditions correspond to worst case. Such a scenario should have a very low probability. The analysis should also consider the effect of various combinations of partial success of the control and mitigation systems in order to determine the risk dominating accidents.
A safety report that minimises accident consequences on the assumption that installed mitigation systems work perfectly is underestimating risk. Assessors can judge this aspect of safety reports by reference to the following questions:-
A safety report for high pressure bullets should consider an instantaneous release of 50% of the contents of all vessels and 100% of the contents of one vessel . It should also address various other scenarios that result in a continuous release of several 10s of kg/s and give rise to a variety of fires. In addition it should address failure of the incoming high pressure supply line in the worst location giving rise to a variety of hazards, and failure of other items of plant such as a compressor or pressure regulator that can have severe consequences.
Any large release of natural gas is likely to give rise to hazards ranging from fireball to explosion and, with the exception of an unconfined vapour cloud explosion, a safety report should address each one. It should , for example, consider releases of methane into confined or congested areas where significant over pressure can follow ignition, and it should examine the consequences of a horizontal jet fire in the "worst" location.
The consequences of many severe accidents depend on the environmental conditions, the state of the plant at the moment of failure and the location and type of failure. Since there are many combinations with roughly equal probability, the safety report must determine the consequences of each accident under typical daytime and night time conditions and a range of conditions that encompass the full severity range.
In the case of weather conditions, both day and night time conditions should be considered for accidents affected by stability (i.e. those involving dispersion). is important that a safety report describes the consequences of the worst conceivable accidents at a site, and this probably involves simultaneous failure of more than one bullet. If the accident analysis in a safety report is based only on single vessel failures, it should be judged as incorporating too much optimism.
Failures on plant can occur almost anywhere, but with variable probability. The safety report should consider failures in the "worst" locations, which include the common header, an incoming main and a vessel in the centre of an array. It should also determine the consequences of jet fires pointing off-site and towards other vessels. A safety report that does not calculate the consequences of worst case accidents fails to comply with the assessment criteria.
A safety report should describe the mathematical models used to predict the consequences of accidents. If the Operator or his consultant used well known software to calculate the consequences of accidents, information on the input data files should be provided so that Assessors can check its appropriateness and degree of conservatism both of which provide an insight into the Operators approach to accident consequence analysis. If doubts remain, entering the Operator's input data into an HSE model can check the predictions in the safety report.
A difference in opinion about the severity of accident consequences may occur from time to time. It does not imply a major failing of the safety report but one which the Assessor should try to resolve by communication with the topic specialist, and, if necessary, with the Operator.
Criterion 3.5.6 "Estimates of the severity and extent of each major accident consequences are realistic."
COMAH Regulations Schedule 4, Part 2, Section 4(b) requires operators to provide an "assessment of the extent and severity of the consequences of identified major accidents".This is extended by SRAM Criterion 3.5.6 which requires that this assessment is realistic.
Duty holders should provide explicit information (perhaps in tabular form) which links each scenario with the number of people who may be affected (as a minimum) and preferably estimates of the number of fatalities and hospitalisations and those receiving minor injuries for each wind direction (where appropriate). This will provide the assessor with the information needed to determine the significance of each scenario.
We believe it is necessary if we are to be able to make a judgement on "all necessary measures" and the suitability of the information provided for offsite emergency plans (Schedule 4, Part 1, Section 4 and SRAM Part 2, Chapter 1).
Safety reports should determine the consequences of the worst accidents, but the analysis should not be overly conservative. If unrealistic hazard ranges are predicted, the off site emergency plan devised by the Local Authority may be ill conceived and under some circumstances, lives could be put at risk by spreading emergency services too thinly. The Assessor can gauge the degree of conservatism in the calculations by asking the following questions:-
Use of widely different vulnerability criteria for thermal radiation to those generally accepted should be justified otherwise the accident consequences may be deemed unrealistic.
Reasonable values for some of the more important input data for accident consequence modelling are shown in Table 5. Assessors should compare these values with those used by the Operator and make judgements about the realism of the consequence predictions.