Criterion 3.3 "The safety report should identify all potential major accidents and define a representative and sufficient set for the purpose of risk assessment."
This criterion reminds Assessors that they need to check that:-
Ideally, the Operator should summarise, in a proportionate way, the results of hazard studies, the methods used and the expertise of the team involved. The scope of the studies and the HAZID process used should also be described. To provide a convincing demonstration that the list of MAs is complete, the process needs to be systematic, i.e. each plant and its operational sequences should be considered in turn, including the possibility of interactions. Assessors should judge the completeness and adequacy of the way these issues are dealt with by asking the following questions:-
The report should explain how major accidents have been identified and demonstrate that no important scenarios have been overlooked. When the method of identifying accidents is not systematic or transparent it will be much more difficult to convince the assessor of its completeness. Simple lists of accidents without evidence to show they are comprehensive may be appropriate in some cases, depending of the scale of the risk to off-site populations, but generally Operators will need to demonstrate that no major accident has been overlooked. Assessors should take into account the scale of the hazards when making a decision on this issue (proportionality).
The accident analysis should identify all potential off-site initiators of major accidents and an indication of their likelihood (see Table 1). On-site accident initiators such as over pressurisation or seal failure require a more detailed frequency assessment in order to demonstrate the adequacy of installed safeguard systems.
The majority of low pressure gas holder sites are unlikely to store hazardous substances other than natural gas, but most will have pipe work and equipment containing methane at high pressure. The accident identification process should not be restricted to gas holder failures, but should address rupture of an incoming high pressure feed, mechanical failures in the compressor house and leaks on a pressure regulator.
Q: Are the accidents addressed in the safety report representative of the full spectrum of major hazards presented by the installation?There is no requirement to repeatedly describe the consequences of accidents that have a similar impact on employees, local populations and the environment. The safety report does not have to describe the consequences of all the major accident hazards, but just to identify them. Instead it may define a representative set of accidents that includes the most severe plant failures and consider all possible consequence (e.g. fireball, jet fire, flash fire, etc). In other words, the consequence analysis can be based on a reduced set of accidents that are representative of the hazards from the site.
The Assessor must be satisfied that the accidents considered dominate the risk and encompass the complete spectrum of severity. Table 2 identifies plant items that contain, or are connected to, a large inventory of methane and lists the most obvious potential accidents or failure modes. While it may not be completely exhaustive for all installations, it can be used as a check list to assess the completeness of the accident analysis. If there are any unexplained omissions that would significantly change the predicted risks posed by the site, it may be deemed to fail to comply with the assessment criteria.
The safety report should determine the consequences of essentially identical accidents in very similar plant if the consequences are likely to be different. For example, if a pipe failure can release gas at say 50 kg/s and failure of a pressure regulator in a small building can also give rise to a 50 kg/s release, the safety report should consider both failures because they may have different consequences. The safety report should also consider failures occurring at the 'worse locations' on pipelines which may include a congested area where the possibility of a VCE can not be ruled out. A safety report that fails to address the 'worst case' consequences of representative accidents does not meet the assessment criteria.
Failures of methane gas storage systems can give rise to a variety of thermal radiation/explosion hazards that must be addressed in the safety report. For example, the consequences of failure of a large diameter, high pressure pipe that should be considered are fireball, jet fire, flash fire and VCE (if possible). Some of these events are more probable than others, but those contributing little to the total risk should not be ignored.
Some accidents at an installation can cause other failures in that they may have as severe or even more severe consequences. The safety report must recognise this possibility and address it by postulating accidents in 'worst case' locations. Of particular concern are:-
The site description should be detailed enough to enable the Assessor to identify the most hazardous locations for component failures and hence determine if the accidents considered are 'worst case'.
Types of accident suffered by methane gas holder sites
Although Operators need to demonstrate the use of a systematic approach to accident identification, Assessors are likely to find that few safety reports present the results of formalised methods such as cause-consequence diagrams or failure modes and effects analysis. An alternative approach that some Operators may adopt involves listing each item of plant and identifying all its failure modes that would give rise to a major accident hazard. Individual thermal radiation or explosion hazard are then identified by reference to the following list: -
Fireball.
Jet fire.
Flash fire.
VCE.
Wall fire (gas holder seal fire).
Missile.
Asphyxiation.
The accidents that gas holders can suffer fall into three main categories: -
Loss of containment due to a failure of one sort or another leading to a fireball, a wall fire, a flash fire, an internal explosion or an external explosion.
Overfilling and subsequent ignition of excess gas released by normal operation of the design protection system.
Pipe/pump/pressure reducer failure resulting in a high pressure release which may be obstructed or unobstructed. The potential consequences of such failures are fireball, jet fire, flash fire and explosion (released into buildings and congested areas).
The different consequences of loss of containment accidents depend on the sequence of events leading to the fire or explosion. A fireball will only result from a massive failure of the holder and immediate ignition of the released gas (e.g. aircraft impact or explosion such as at Warrington). A wall fire occurs as a result of a localised hole in the containment and immediate ignition of the gas, while a flash fire may follow a large release that disperses and then encounters a source of ignition. Explosions caused by releases of methane from low pressure sources are improbable because methane is lighter than air and disperses rapidly upwards. However, a release into a confined area in which there is a source of ignition can result in an explosion. An explosion inside a gas holder is possible if both a flammable mixture and a source of ignition are present. Such a situation can arise following a leaking seal on a waterless holder or before or after maintenance when a water sealed gas holder is being emptied or refilled.
If a gas holder is overfilled there are passive release systems that prevent the structure being over pressurised. In the case of a water sealed gas holder, overfilling displaces the water in the seal around each lift to form a vent with a large effective cross sectional area. If a waterless holder is overfilled, the piston simply moves past large vent holes in the wall of the holder through which the excess gas discharges. Under normal circumstance such releases discharge to atmosphere at a height of several metres and disperse harmlessly, but in stormy conditions the gas can be ignited by a lightning flash. The size and duration of the fire are a function of the rate of overfilling, which depends on the failures that have to occur to allow the holder to be overfilled. A typical filling rate for a large gas holder is 15 m3/s (approximately 10 kg/s), but this could increase by more than a factor of five if failures lead to a direct connection between the gas holder and the high pressure (7 x 105 Pa) filling line.
Failures of a high pressure pipeline can result in a rapid release of gas with severe consequences. Rupture of a 700kPa 600 mm diameter pipeline to a gas holder will produce an initial release rate of approximately 70 kg/s falling to 50 kg/s after about a minute. Immediate ignition of the release results in a fireball approximately 40m in diameter. After about 10 seconds this develops into a jet fire with a flame length of around 100 metres. Delayed ignition of a horizontal jet would produce a flammable cloud extending to about 140 metres. Failure of an Operator to consider any of these events should be justified in the safety report.
Explosion of an unconfined cloud of methane has been found to be virtually impossible. If gas releases from pipelines or vessels operating at >1000kPa enter a semi-enclosed volume with obstructions that aid flame acceleration, ignition may result in an explosion that produces a dangerous side-on pressure at some distance from the seat of the explosion. Either calculations or reference to an authoritative source should be presented if the possibility of a VCE is discounted. The safety report should not overlook the possibility of jet flame impingement on a storage vessel and subsequent escalation of the accident.
Criterion 3.3.1 "The safety report should demonstrate that a systematic process has been used to identify all foreseeable major accidents."
In order to judge compliance with this requirement of the regulations, Assessors can ask the following questions:-
Identification of all major accident scenarios is a very important requirement of the regulations and a safety report that fails in this respect may be considered deficient. Systematic approaches to accident identification include HAZOP, event tree analysis and failure modes and effects analysis. However, the regulations do not specifically require their application. An Operator may be able to demonstrate that all major accidents have been identified without resort to formalised methods by providing a detailed description of the plant and by systematically addressing the hazards from each part in turn.
A major release of a flammable gas can result in different types of fire depending on the source and time to ignition. A safety report must consider all possible types of fire (fireball, jet fire, flash fire, etc) and the potential for an explosion. If failure of pipework is identified as a major accident and the report only considers a fireball and jet fire event, the Assessor would be justified in requesting further information on flash fires and explosion potential.
Criterion 3.3.2 "The hazard identification methods used should be appropriate for the scale and nature of the hazards."
Hazard studies employing HAZID techniques are widely used in the chemical industry and can be carried out at various stages during the lifecycle of a plant. They are systematic way of managing hazard over time, from the business requirement stage through to demolition and disposal. HAZID techniques seek to identify hazards in an absolute or relative way. Relative methods use checklists or hazard indices based on experience and lessons from incidents. Absolute methods are based on deviations from design intent e.g. HAZOP. Details can be found in Lees (1996), Kletz (1999) and CCPS (1989).
Methods (listed in increasing proportionality) that might be used include:-
Whatever approach is used, it must be documented as part of the safety report, or separately - in which case the main findings should be summarised in the report. As proportionality increases, and particularly in the case of new novel plant, some use of absolute methods is normally required. Both type of method need to consider 'common cause/mode' failures such as loss of power, or other services.
In order to test compliance with this criterion the Assessor can ask the following questions:-
The safety report should describe and justify the method used to identify major accident hazards. Assessors who are not convinced that all accident scenarios have been identified may deem the report 'non compliant'. However, use of a formalised accident identification process is not essential and an approach that is not completely systematic, but is seen as 'fit for purpose' is acceptable.
In the main, accidental releases of methane from low pressure storage systems give rise to fires and possibly explosions. The hazard ranges associated with them do not always extend off-site and the risk to the public can be quite low. In such cases the risk assessment need not be as detailed as that for an identical site close to a busy shopping centre and the use of industry standard frequencies is acceptable. However, all major accident sequences should be identified and the consequences of "worst case" releases quantified.
If, for example an instantaneous release of the whole contents of a gas holder on the site gives rise to a fire ball that does not produce any fatalities off-site, then the safety report need not evaluate the consequences of smaller fireballs. A poorly documented frequency assessment resulting in coarse estimates would be acceptable, and the effectiveness of safeguards would not need to be described in detail.
Table 2: Gas holder accident scenarios.
| Plant Item Failure | Accident Scenarios | |||||
|---|---|---|---|---|---|---|
| Holder | Rupture Fireball Elevated flash fire |
Seal
failure (water seal). Decoupled lift can give rise to a fireball seal fire flash fire (18 metres) |
Seal
failure (waterless)
internal explosion |
Hole in
holder wall wall flame flash fire |
Crown
failure explosion flash fire |
Overfilling Ignited flare flash fire |
| High Pressure filling line | Rupture fireball jet fire horizontal jet fire crater fire dome fire flash fire VCE |
Puncture fireball jet fire horizontal jet fire crater fire dome fire flash fire VCE |
Small hole jet fire flash fire VCE |
Flange leak | ||
| Export line | Rupture fireball jet fire horizontal jet fire crater fire dome fire flash fire VCE |
Puncture fireball jet fire horizontal jet fire crater fire dome fire flash fire VCE |
Small hole jet fire flash fire VCE |
Flange leak | ||
| Pressure
regulator/
reduction station |
Disintegration fireball jet fire flash fire VCE |
Leak into
enclosed space confined explosion missiles leading to escalation |
Loss of
control overfilling of holder |
|||
| Pumps | Disintegration fireball jet fire flash fire VCE |
Leak jet fire flash fire VCE (leak into enclosed space) |
Loss of
control over pressurisation of holder |
|||
