- Email: [email protected]
Recommended features of an industrial accident simulator for the training of operators
Journal of Loss Prevention in the Process Industries 24 (2011) 344e355
Contents lists available at ScienceDirect
Journal of Loss Prevention in the Process Industries journal homepage: www.elsevier.com/locate/jlp
Recommended features of an industrial accident simulator for the training of operators Sara Brambilla, Davide Manca* Politecnico di Milano, Dipartimento di Chimica, Materiali e Ingegneria Chimica “Giulio Natta”, Piazza Leonardo da Vinci 32, 20133 Milano, Italy
a r t i c l e i n f o
a b s t r a c t
Article history: Received 1 June 2010 Received in revised form 23 November 2010 Accepted 16 January 2011
When a chemical accident occurs, the release depends on the status of the substance(s) in either the damaged process unit or carrier, i.e. the accident dynamics differs in presence of a compressed gas, a refrigerated liquefied gas, a compressed liquefied gas, or a subcooled liquid. In addition, the release properties (e.g., flow rate, liquid and vapor fractions, temperature, and momentum) may vary dynamically due to the modification of the conditions inside the damaged process unit and/or to the intervention of either the operator or the control system. This manuscript describes the features that an accident simulator should implement to account for the release variability. In particular, the paper focuses on the release of liquids, their spreading, and the formation of pools and pool-fires. The recommended features include the capability to simulate the automatic switch of the liquid pool from spreading to shrinking, its vanishing, the release in a bund, its ignition, the evaluation of the pool-fire geometrical dimensions and the heat flux radiated to the surrounding equipment and field operators. By implementing these features in an accident simulator, it is possible to get a more realistic picture of the accident dynamics, and of its magnitude and consequences. An accident simulator having the aforementioned features can be linked to a dynamic process simulator to evaluate the dynamics of the plant operating conditions during the accident unfolding, for both risk assessment and operators’ training purposes. These features have been implemented in a simulator program, which is based on CPU-efficient models and algorithms, with the scope of demonstrating the feasibility of the discussed approach and its advantages. The importance of the aforementioned features is illustrated by means of some dedicated case-studies. Ó 2011 Elsevier Ltd. All rights reserved.
Keywords: Dynamic accident simulation Dynamic process simulation Chemical accidents Operator training simulation Risk assessment
1. Identification of the problem Since large quantities of potentially hazardous substances are transported, handled, stored, and processed worldwide (e.g., ammonia, chlorine, crude oil derivates), it is recommended to adopt and keep high safety standards by a proper design, management and control of plants, transport systems, and storage sites in order to avoid disastrous accidents. In fact, chemical accidents may imply dramatic consequences, such as the loss of lives among the field operators, the responders, and the population; and the discharge of hazardous substances in the environment. In addition, chemical accidents entail costs for both the company, liable for the accident, and the surrounding community due to reconstruction costs, loss of
* Corresponding author. Tel.: þ39 02 23993271; fax: þ39 02 70638173. E-mail address: [email protected] (D. Manca). 0950-4230/$ e see front matter Ó 2011 Elsevier Ltd. All rights reserved. doi:10.1016/j.jlp.2011.01.009
production, court costs, fines, business interruption, reallocation of production to other sites, cost of on site personnel and contractors, plant redesign, and costs for the civil and health authorities (Fewtrell & Hirst, 1998). According to Fewtrell and Hirst, high-cost accidents share some common features: the lack of understanding and the incompetent management of the storage and/or of the process; the unawareness of the risks associated to the activities that may lead to accidents; problems with isolation valves that are not operated remotely; the combination of inadequate and unreliable process control equipment; the loss of process control (e.g., runaway reactions). Despite it is unrealistic to eliminate the risk associated to hazardous chemicals, the safety policies of companies and the
S. Brambilla, D. Manca / Journal of Loss Prevention in the Process Industries 24 (2011) 344e355
345
research efforts should focus on the reduction, to an acceptable level, of the number of chemical accidents as well as of their magnitude. A hazard analysis allows identifying the unacceptable risks so to intervene selectively to either control or eliminate them. The steps necessary to perform a hazard analysis are:
used to describe the same phenomenon, i.e. the release in the atmosphere of a substance from a process unit due to an accident (e.g., the formation of a hole in the sheet metal of a vessel).
1. identification of potential failures; 2. calculation of the quantity of hazardous material(s) released in each failure; 3. calculation of the impact of the release on the equipment, people, environment, and property.
Chemical accident simulators are software tools used for risk assessment and accident investigation based on well-established steps. Starting from a set of input data, these tools quantify the source term, the spreading of the hazardous material outside of the damaged process unit, and, then, the consequences of the accident event, for instance in terms of concentration profiles to evaluate the distance from the accident epicenter where some risk thresholds are exceeded. Isorisk curves represent concentration thresholds in case of a toxic release, the percentage of lower and/ or upper flammability limits for a flammable release, the heat radiation in case of fire, and the overpressure in case of explosion. The simulation of an accident allows also evaluating the consequences on some specific targets of known geometrical dimensions at given distances from the epicenter. In this context, a target can be a process unit, a building, a structure, an infrastructure, or a human being. Different targets, at the same distance from the accident epicenter, will experience different consequences according to their intrinsic vulnerability. For instance, an overpressure of 0.20e0.27 bar can cause the rupture of an oil storage tank, while human beings in free space are subject to significant and vital effects only when overpressures are as high as 0.7e1 bar (Casal, 2008; Center for Chemical Process Safety, 2000). In addition, the outcomes are due usually to the contribution of both the instantaneous value and the exposure duration, i.e. the dose taken, for instance, by a person. According to Bauer (2009), some caution should be paid when using the dose to evaluate the area where the accident involving a toxic substance may harm people because:
Once the potential failures (also known as top-events) have been identified, a number of software tools can quantify and characterize the accident scenarios to support the actions and decisions of the subjects involved, at different levels, in the emergency preparedness, such as: the local authorities that can superimpose the data about the area involved by the dangerous release with the forecasted population distribution to improve the urban planning; the emergency responders and local authorities who can use the same data to draw external emergency plans according to the real population distribution; the emergency responders who can run an accident simulator when the accident occurs to estimate the consequences and implement the most proper actions; the company liable for the accident that can acknowledge the evaluated accident consequences to modify the design of the plant (in the planning phase), or to arrange the most effective mitigation systems, internal emergency plans, and emergency shutdown procedures, as well as to use these data to negotiate the insurance premium. The simulation of chemical accidents is therefore an important element of the hazard analysis. This manuscript analyzes and discusses the features that an accident simulator should implement to account for the release variability in order to get a more realistic simulation of the accident consequences. Section 2 describes the state-of-the-art in the field of accident simulators to present a reference framework for the reader. Section 3 discusses a different approach to the simulation of industrial accidents that leads to the dismissal and/or to the update of some common hypotheses on the source term. Section 4 shows the implementation of the features discussed in Section 3 in a dedicated simulation program, also with the support of a case-study to illustrate the extension of the proposed approach from the conventional risk assessment to the training of both control room and field operators. The paper discusses the potential and the advantages of adopting a well defined philosophy for the simulation of chemical accidents. The illustration of results obtained with a dedicated simulation code (i.e. AXIMÔ implemented following such specifications) aims at clarifying the aforementioned philosophy by means of practical examples, and not at discussing the details and models of the simulation code itself. Therefore, it is beyond the scopes of this paper to validate the simulation code with experimental data and/or other software packages. AXIMÔ was used with the only purpose of demonstrating the feasibility of the discussed approach and to make the theory clearer by means of some casestudies. In addition, the approach is not bounded to the adopted software tool but can be extended to different tools implementing the features discussed in Sections 3 and 4. It should be noted that, throughout the paper, the terms “outflow”, “emitted substance”, “released substance”, “leakage” are
2. The state-of-the-art in the field of accident simulation
the human body can process and remove almost all toxic substances; the thresholds commonly adopted do not represent adverse health effects on an average person. Instead, they are safe-sided for the most sensitive portions of the population (e.g., elderly and very young people, pregnant women); the indoor and outdoor presence of people should be taken into account and weighted when evaluating the dose. The same is true for an accident involving the heat radiation from a fire. Raj (2008) showed that clothing shelters the human skin, reducing the absorbed heat radiation and its consequences (e.g., lower temperature increase of the skin covered by cloths). In addition, Raj (2008) showed that the thresholds prescribed by law are often too conservative. A number of manuscripts in the literature, technical papers, user manuals, and websites discuss the available accident simulators that differ in their scope, the input data they require, the output data they compute, and the models and hypotheses they adopt. In some cases, accident simulators are designed to simulate only one of the possible accident scenarios, usually the dispersion of gases (e.g., SLAB, Ermak, 1990). Consequently, the user has to run more than one model/simulator to get the whole picture about the sequence of accident phenomena and their consequences. Accident simulators differ also for the level of detail. For instance, only some of them account for the natural topography and the presence of obstacles (e.g., buildings, process units) in the area of the accident (e.g., FLACS, Hansen, Talberg, & Bakke, 1999). The following Sections present and discuss a different approach to the modeling of industrial accidents, as well as the use of the
346
S. Brambilla, D. Manca / Journal of Loss Prevention in the Process Industries 24 (2011) 344e355
output data for two main scopes: the hazard analysis, and the training of operators working in a facility where hazardous chemical substances are handled, processed, and stored. 3. A different perspective As mentioned in Section 1, a hazard analysis relative to industrial accidents requires the evaluation of the impact of a possible accident on the surrounding process units, people, and environment. However, as far as the accidents occurring in chemical industries are concerned, a further step toward a safety increase can be achieved by considering that the accident dynamics is determined not only by the initial conditions of the damaged process unit but also by its evolving conditions. These conditions may vary because of: 1. the intrinsic phenomenology of the release (e.g., the liquid release from a hole in a tank depends on the liquid head, which decreases progressively if no liquid is fed to the tank); 2. the material, momentum, and energy balances across the process units; 3. the intervention of either the control system or the operators (e.g., by closing a valve, it is possible to cutoff the flow to a broken pipe and interrupt the release); 4. the feedbacks from the accident (e.g., the radiative heat flux from a fire to a process unit). Common existing software like ALOHAÔ (Reynolds, 1992), EFFECTS (TNO, 2007), and PHAST (DNV, 2007) can account for a release variability due to point 1. Actually, these programs can model a release that varies according to a given law, i.e. that can be computed a priori from the initial conditions of the equipment even if some simplifying assumptions are often mandatory. Conversely, the intervention of the control system and the presence of some additional inlet/outlet streams to/from the damaged process unit are not supported by those programs. Moreover, the aforementioned codes cannot account for any interactions between the process dynamics and the accident event. Points 2, 3 and 4 can be accounted for by the event-tree analysis to define the possible accident scenarios, but they are usually omitted in the simulation of the accident. To get a more realistic
picture of the accident dynamics, especially when the control system intervenes to safeguard the plant and the production, it is necessary to include points 2 and 3 in its simulation. The operating conditions of the plant may change also according to the feedbacks from the accident event (point 4) as it may happen in case of fire and explosion. In the former case, the heat flux radiated towards the surrounding process units modifies the process conditions and may also damage those cables that are not fire-proof (in this case, the control system cannot control anymore the process variables). Conversely, explosions usually lead to the destruction of some sections of the plant so it is much more difficult, if not unfeasible, to restore the nominal operating conditions. Actually, an explosion determines only a unidirectional interaction between the accident and the process. This can be accomplished by evaluating the behavior of the process and the control system with a dynamic process simulator, e.g., Aspen HYSYSÔ (AspenTech, 2008), DYNSIMÔ (Simsci-Esscor, 2006), UniSimÒ (Honeywell, 2008). In addition, the dynamic process simulator must be linked to a dynamic accident simulator to make them exchange data (see Fig. 1). In this context, the accident simulator is connoted by the attribute dynamic to stress its capability to account for variable input data, whose variability is unpredictable since they depend not only on the conditions of the damaged process units but also on the intervention of both the control system and the operators. The simultaneous evaluation of the dynamics of the process and the accident, as well as their mutual feedbacks are promising and advisable features to get a more realistic picture of the accident event while assessing the effectiveness of the emergency measures and procedures. This allows also investigating domino effects. Up to this point, the dynamic accident simulator, even if coupled to a dynamic process simulator, was used only to evaluate the accident consequences. In addition, this coupling represents an effective tool for training the operators, i.e. it can be used as an advanced Operator Training Simulator (OTS) that can cover also the too often disregarded world of field operators. As a matter of fact, within the virtual plant, the operators can visualize the process variables, modify the available degree of freedom, and quantify the consequences on the plant conditions without incurring into real risks or compromising the production. In addition, by means of the link showed in Fig. 1, the trainer can ask the trainee(s) to cope with an
Fig. 1. The interaction between a process simulator and an accident simulator. The plant is described by a dynamic process simulator, while the real accident is modeled by a dynamic accident simulator.
S. Brambilla, D. Manca / Journal of Loss Prevention in the Process Industries 24 (2011) 344e355
accident event, such as a leakage. In this case, the dynamic accident simulator would evaluate the accident consequences, which are influenced by the procedures implemented by the operator. By means of this support to training, both control room and field operators are expected to gain experience in the process, and to get used to face malfunctions and deviations from the nominal conditions. In addition, the coupling between the accident and the process dynamics allows testing the effectiveness of mitigation systems, emergency plans, and emergency shutdown procedures. In order to build an advanced OTS for the simulation of industrial accidents, the process and the accident simulators must be coupled into a real-time tool, so that the operators become aware of the time-scales of the occurring phenomena. In addition, the accident simulator must implement the dynamic feature to deal with unpredictable input data that cannot be evaluated from aprioristic considerations on the process variables since they depend on the dynamic evolution of the process. Therefore, the tool proposed in this paper can be used for both risk assessment and operators’ training thanks to its features. Section 4 describes the features that an accident simulator should implement to account for the unpredictable variability of the source term. In particular, this paper focuses on liquid releases, so that the pool spreading and the pool-fire scenarios will be discussed. For the pool scenario, the recommended features are: capability to simulate the automatic switch from spreading to shrinking of a liquid pool; pool evaporation/boiling and vanishing; release within a bund. As far as the pool-fire scenario is concerned, the recommended features are: ignition of the pool at any arbitrary times after the beginning of the release; dynamic evaluation of the geometrical dimensions of the poolfire; dynamic evaluation of the view factors and the quantification of the heat radiation impinging on the surrounding equipment and field operators. The aforementioned features are discussed in detail in the following Section. Subsequently, the paper presents and discusses the results of a dedicated simulation code, implemented in accordance with such features. It should be noted that point 4 can be included in the hazard analysis not only for industrial accidents but also for transport accidents. In fact, the approach used for accidents within the battery limits of a chemical plant can be extended to transport accidents by replacing the dynamic process simulator with a dynamic model of the damaged/punctured/collapsed transport vehicle. 4. Recommended features of an accident simulator The dedicated simulation code that will be used in the following is AXIMÔ (Brambilla & Manca, 2009a, 2009b; Brambilla, 2009). In order to model a general accident scenario (based also on other phenomena not discussed in this manuscript such as the gas dispersion), the following input data are required:
347
time of the accident in terms of hour, day and month; computational domain and its spatial discretization, the latitude, the presence and position of obstacles (e.g., buildings, process units), and the ground topography; source term: the emitted substance (e.g., methane, n-propane, toluene), the flow rates of the liquid and vapor phases or the damaged process unit and hole dimensions, the direction of the emitted jet, the source temperature, the dimension and position of the source within the computational domain; the typology of the surface onto which the emitted substance spreads (e.g., concrete, water), its temperature, and the drainage rate (this allows simulating the presence of gullyholes); the typology and position of the targets (e.g., human beings, process units, structures, and infrastructures) in the computational domain, and their geometrical dimensions; the presence of a bund and its geometrical dimensions; the presence of an ignition source. The user can assign most of the input data (i.e. meteorological conditions, time, computation domain, surface, targets, bund, and ignition source) through a graphical user interface (Fig. 2), which allows increasing significantly the usability of the program and avoiding the input of inconsistent data. Conversely, the data related to the source term may come in part from the dynamic process simulator (e.g., the leakage flow rate). Some of the input variables can be modified in real-time, i.e. the meteorological conditions (wind speed and direction, cloud cover), the discharge rate, direction, velocity, and temperature, the surface temperature and drainage rate, the positions of targets and their number (new detectors and/or operators can exit/enter the simulation environment). AXIMÔ accounts for the spread of the emitted liquid on eight different typologies of surfaces: open water (i.e. sea), isolation concrete, light concrete, heavy concrete, average subsoil with 8%wt of moisture, dry sandy subsoil, wet sand with 8%wt of moisture, and gravel bed. A proprietary database includes information related to the physicochemical properties of these surfaces (density, specific heat capacity, thermal conductivity, thermal diffusivity, and kinematic viscosity, this last only for water), and their reflectivity, moisture content, and average surface roughness. The physicochemical properties of the emitted substance are evaluated according to the DIPPR database (DIPPR, 2004). In particular, the accident simulator uses the molecular weight, critical pressure, critical temperature, boiling temperature, melting temperature, heat of combustion, latent heat, compressibility factor, adiabatic constant, material diffusivity, vapor pressure, reflectivity of the liquid phase, surface tension, lower and upper flammability limits, density, specific heat capacity, thermal conductivity, material diffusivity, and dynamic viscosity. Some properties are evaluated for both the liquid and the vapor phases. The following Sections discuss the features of the pool (Section 4.1), and the pool-fire scenarios (Section 4.2) that allow defining an accident simulator as dynamic. In the following examples, the dynamic accident simulator is not linked to any process dynamic simulator because the main scope is to illustrate accurately each feature, by discussing the benefits deriving from its implementation. Conversely, the link between the dynamic process simulator and the dynamic accident simulator is discussed in Section 4.3 by means of a case-study concerning the release of toluene from a pipe. 4.1. Pool scenario
meteorological conditions: the air temperature, pressure, and relative humidity, the wind speed and its direction, and the cloud cover;
AXIMÔ allows modeling the spreading of a liquid on a flat, unobstructed surface. The algorithm is based on Webber’s model
348
S. Brambilla, D. Manca / Journal of Loss Prevention in the Process Industries 24 (2011) 344e355
Fig. 2. Graphical user interface to assign the input data of AXIMÔ.
representing the solution of the differential equations under specific limiting hypotheses (e.g., constant or instantaneous release) or the differential equations are valid only for spreading. The following subsections illustrate these features through dedicated examples. 4.1.1. Automatic switch from spreading to shrinking Let us consider the release of LNG on water at a rate of 20 kg/s. The accident scenario assumes that the outflow is cutoff after 90 s, and that a second release of 30 kg/s occurs from 110 to 300 s (see Fig. 3).
40 Release rate [kg/s]
(1990), even if a number of modifications were introduced. In fact, Webber’s model is not auto-consistent as discussed in the report of 1990. The reader has to implement his/her own correlations to determine some variables present in the model (the code is not available), and the original formulation of Webber shows some inconsistent behaviors as extensively discussed in Brambilla (2009). In addition, correlations developed by different authors were preferred in the evaluation of some variables. Nonetheless, the main framework proposed by Webber was adopted (i.e. the ODE system). The implemented model can switch automatically from the spreading phase to the shrinking one and vice versa, depending on the balance between the liquid spilled into the pool and the evaporation plus the drainage rates. AXIMÔ can also simulate the vanishing of the pool and the formation of a further pool. In addition, it can simulate the presence of a surrounding bund that limits the extent of the pool and, then, the evaporation rate. The accident simulator can account for these features because it solves six ordinary differential equations (ODEs) describing the time evolution of the pool radius, the radial velocity, the pool volume, the volume discharged into the pool, the evaporated volume, and the pool temperature. These variables refer to bulk properties. A variable step ODE solver (Brown et al., 1989; Buzzi Ferraris & Manca, 1998) integrates the differential system. The variable time step feature is quite efficient in terms of CPU-time. Other commercial programs (e.g., PHAST from DNV, 2007; EFFECTS from TNO, 2007) are not able to account for all these features because they work either on a set of algebraic equations
30
20
10
0
0
100
200
300
Time [s] Fig. 3. Dynamics of the release rate.
400
S. Brambilla, D. Manca / Journal of Loss Prevention in the Process Industries 24 (2011) 344e355
70
10
60 Pool height [mm]
Pool radius [m]
8 6 4 2
50 40 30 20 10 0
0 0
100
200
300
0
400
100
Fig. 4 shows that the pool shrinks when the release stops at 90 s due to the LNG boiling that subtracts mass to the pool, whilst it spreads again when the emission re-starts at 110 s. Fig. 4 shows that the pool radius begins to decrease a few seconds after the cutoff of the release and not at that very moment. To understand this phenomenon, let us remember that the pool spreads until it reaches a minimum height (hmin) that, according to Webber (1990), can be evaluated by two distinct equations. The first equation is based only on the liquid properties (i.e. the density, rL, and the surface tension, s):
rffiffiffiffiffiffiffiffi (1)
and refers to the condition where the gravity force balances the surface tension (Fay, 1969; Webber, 1990). The proportionality sign is usually (and abruptly) substituted by the equal sign without any proportionality constant (e.g., ABSG Consulting Inc., 2004; van den Bosch, 2005). The second equation is based on both the liquid properties (as the kinematic viscosity, nL) and the discharge rate (qs):
hmin ¼
6nL qS pgrL
1 4
300
400
(2)
and refers to an unpublished report (see the references in Webber, 1990). Webber (1990) suggested that the minimum pool depth is the maximum of the values computed by eqs. (1) and (2). However, the correlations reported above can introduce an unphysical discontinuity whenever the release rate changes, and especially for abrupt transitions such as the outflow cutoff. Consequently, AXIMÔ implements only eq. (1) because it computes values that are usually lower than those evaluated by eq. (2). This assumption allows determining conservative results. The minimum pool depth can still vary due to changes in the pool temperature, changes that influence the physicochemical properties. Fig. 5 shows that the pool height is higher than its minimum value when the outflow is cutoff. Consequently, the pool keeps on spreading until it reaches the minimum pool depth. At that moment, since no mass is added to the pool, it starts shrinking and reducing its radius while its height remains at the minimum value. When the release starts again, the pool height increases because the change in volume is higher than the pool capability to expand (due to the pool inertia). The same delay in the spreading can be observed at t ¼ 300 s when the pool radius keeps on expanding until the minimum pool height is reached again. Finally, the pool shrinks until it vanishes at t ¼ 366 s.
Fig. 5. Dynamics of the pool height (blue solid line) and pool minimum height (red dashed line). The vertical dashed lines show the interruption of the releases. (For interpretation of the references to colour in this figure legend, the reader is referred to the web version of this article.)
This scenario is typical of the domino effect, when an accident triggers another accident, and a second release occurs. This scenario assumes that, during the second release, the emitted liquid contributes to the existing pool, even if a separate, different pool may develop. In this example, a constant release rate was used to show some peculiar features of the model, but the accident simulator can deal with arbitrary release profiles also supplied by other programs, e.g., the dynamic process simulator. 4.1.2. Vanishing of the pool Let us now assume that a scenario similar to that discussed previously occurs, but the first release stops at 110 s and the second release starts at 200 s and ends at 300 s (see Fig. 6). In this case, the second pool develops after the first pool has vanished completely (Fig. 7). The capability to account for this feature allows simulating any kind of releases, even those involving the vanishing of the pool and the formation of a new one. In fact, the second pool may spread in a place that is different from the previous one. 4.1.3. Release in a bund Often, a bund surrounds one or more process units to set a physical limit to the liquid spreading in case of accident. In this case, the maximum pool diameter corresponds to the bund diameter (for further details see also Brambilla and Manca, 2008). When the liquid reaches the bund, it stops spreading while, if the discharge rate is larger than the evaporation and drainage rates, the
40
Release rate [kg/s]
Fig. 4. Dynamics of the pool radius for a varying release rate: 20 kg/s up to 90 s when it is interrupted, then 30 kg/s from 110 to 300 s when it is finally cutoff. The dashed vertical lines show the instants when the outflow is cutoff.
s rL g
200 Time [s]
Time [s]
hmin f
349
30
20
10
0
0
100
200 Time [s]
300
Fig. 6. Dynamics of the release rate.
400
350
S. Brambilla, D. Manca / Journal of Loss Prevention in the Process Industries 24 (2011) 344e355
10
Pool radius [m]
8 6 4 2 0
0
100
200
300
400
Time [s] Fig. 7. Formation of a second pool after the first pool has vanished. Fig. 9. Geometrical representation of a pool-fire.
liquid height increases up to the bund top. Afterwards, the liquid flows out of the bund. At present, AXIMÔ does not account for the bund overflow (i.e. the liquid that starts spreading beyond the bund when the top of the bund is reached). Let us suppose that a continuous release of 75 kg/s of toluene on concrete is confined within a bund of 5 m radius. In this case, when the pool reaches the bund wall, it stops spreading and its height increases. Fig. 8 shows the comparison between the dynamics of a confined (solid line) and an unconfined (dashed line) pool. 4.2. Pool-fire scenario
30
350
25
300 Pool height [mm]
Pool radius [m]
The original model of Webber (1990) considered only the dynamics of a liquid pool. It was extended with models describing the ignition of vapors for flammable substances, i.e. the pool-fire scenario. According to Rew and Hulbert (1996), there are two approaches for modeling a pool-fire: the Computational Fluid Dynamics (CFD) algorithm, and semi-empirical models. Since an OTS works at least in real-time, the CFD approach is not practicable due to the amount of CPU-time required. Semi-empirical models are discussed for instance by Engelhard (2005), Koseki and Mulholland (1991), McGrattan, Baum, and Hamins (2000), Pula, Khan, Veitch, and Amyotte (2005), Raj (2006, 2007a, 2007b), Rew and Hulbert (1996), Society of Fire Protection Engineers (1999a, 1999b), and Zhou and Gore (1996). These models differ for the methodology adopted to evaluate the flame shape, the fuel burning rate, the emissive power, the atmospheric attenuation, and the view factors, i.e. the variables that determine the hazard related to the pool-fire event.
AXIMÔ sketches the flame as a tilted elliptical cylinder characterized by a larger diameter in the wind direction, due to the drag exerted by the wind (see also Raj, 2007a, 2007b). In addition, the smoke produced by the partial combustion of the vapors obscures the top of the flame (see Fig. 9). The wind exerts an influence on the flame not only because it tilts the flame in the wind direction, but also because it enhances the burning rate (Brambilla & Manca, 2009a; Muñoz, Arnaldos, Casal, & Planas, 2004). The models implemented in AXIMÔ come from different authors (e.g., Raj, 2009; Rew & Hulbert, 1996). Consequently, even if the correlations are not strictly new, their combination is original. In addition, the pool-fire features change in time following the pool dynamics. Correlations originally developed for risk assessment, whose interest is focused on the worst-case scenarios, are used here also to train both control room and field operators, where the dynamic attribute is essential. AXIMÔ simulates both the immediate and delayed ignitions of flammable liquid pools. In the latter case, the user has to specify either the instant or the condition (e.g., a given pool radius) that determines the ignition of the pool. The user can also simulate a sudden extinction of the fire. The simulator computes the geometrical dimensions of the flame to evaluate the heat radiated towards the surrounding targets. AXIMÔ takes into account two contributes, one from the lower visible portion of the flame, and the other from the upper portion that is obscured by the smoke and, consequently, radiates less heat. Finally, it computes also the dose absorbed by the targets, i.e. the time-integral of the radiation incident on a given target.
20 15 10 5 0
250 200 150 100 50
0
100
200 Time [s]
300
0
0
100
200
300
Time [s]
Fig. 8. Comparison between the dynamics of a pool confined in a bund of 5 m radius (solid blue line) and an unconfined pool (dashed red line). The confined pool stops spreading radially when it reaches the bund wall. (For interpretation of the references to colour in this figure legend, the reader is referred to the web version of this article.)
S. Brambilla, D. Manca / Journal of Loss Prevention in the Process Industries 24 (2011) 344e355
25
F la m e h e ig h t [ m ]
Flame and pool diameter [m]
15
351
10
5
20 15 10 5
0
0 0
20
40 60 Time [s]
80
100
0
20
40 60 Time [s]
80
100
Fig. 10. Delayed ignition of an n-butane pool at 10 s from the beginning of the release and its sudden extinction at 80 s. On the left: pool (blue solid line) and flame (red dashed line) diameters. On the right: total flame height (solid line) and clear flame height (dash dotted line). (For interpretation of the references to colour in this figure legend, the reader is referred to the web version of this article.)
The following Sections illustrate some case-studies on the delayed ignition and the sudden extinction of a pool-fire, the dynamic evaluation of the flame geometrical dimensions, and the heat radiated to the surrounding targets. 4.2.1. Ignition of a pool Let us suppose that a pool forms due to the emission of 10 kg/s of n-butane at its boiling point (272.65 K) and it reaches an ignition source after 10 s. Let us suppose also that the mitigation system suppresses the fire after 70 s from the ignition. In this case, no bunds confine the pool spreading. Fig. 10 shows that both the flame diameter and height are null before 10 s and after 80 s. On the contrary, the pool diameter increases after the fire extinction because the evaporation rate is lower than the burning rate. Real mitigation systems take time to suppress fires (if possible). Nonetheless, the modeling of a sudden extinction allows evaluating their effectiveness in reducing the damages to the structures and process units in the neighborhood of the flame. 4.2.2. Pool-fire geometrical dimensions AXIMÔ evaluates not only the flame diameter and height (as shown in the previous example), but also the clear and obscured flame heights, and the flame tilt. Let us suppose that a 5 kg/s release of n-butane is ignited 10 s after the beginning of the release. As shown in Fig. 11, during the release phase the diameter increases until it reaches a steady-state, when the burning rate compensates the release rate. Both the total and clear flame heights show a trend
similar to that of the flame diameter because they depend on it (see Raj, 2006, 2007a, 2007b). 4.2.3. Heat radiation Under the same hypotheses of previous Section, Fig. 12 shows the heat radiated to an operator standing at 25 m downwind the flame center, and the dose he/she absorbs (under the hypothesis that the frontal area of a human being is w1 m2). These bits of information allow determining the maximum distance where a human being can stand without suffering any injuries. In fact, the literature (e.g., EPA & NOAA, 2006) reports that a 60 s exposure to a radiative flux of 10 kW/m2 is potentially lethal; a thermal flux of 5 kW/m2 may cause second degree burns; a radiation of 2 kW/m2 causes pain (see also Raj, 2008). These data relate to the bare skin, whilst the cloths can reduce significantly the radiative heat flux (Raj, 2008). In this example, an operator at 25 m from the flame center experiences pain and probably some burns. Therefore, he/she is not at a safe distance. The absorbed dose in Fig. 12 is the time-integral of the radiative heat flux impinging on the operator. Even if not obvious from the picture, the absorbed dose increases rapidly at the beginning, and slows down afterwards. 4.3. Link with a dynamic process simulator This section discusses a specific case-study to illustrate the interfacing of the dynamic process simulator and accident simulator.
25
10 Flame hei ght [m]
Flame and pool diameter [m]
12
8 6 4
20 15 10 5
2 0
0 0
100
200 Time [s]
300
0
100
200
300
Time [s]
Fig. 11. Features of a pool-fire generated by igniting an n-butane pool 10 s after the beginning of the release. On the left: flame (red dashed line) and pool (blue solid line) diameters. On the right: total flame height (solid line) and clear flame height (dash dotted line). (For interpretation of the references to colour in this figure legend, the reader is referred to the web version of this article.)
S. Brambilla, D. Manca / Journal of Loss Prevention in the Process Industries 24 (2011) 344e355
5
1200
4
1000
Absorbed dose [kJ]
2
Radiative heat flux [kW/m ]
352
3 2 1 0
800 600 400 200
0
100
200
300
0
0
Time [s]
100
200
300
Time [s]
Fig. 12. Heat radiated to an operator at 25 m from the pool-fire and the corresponding absorbed dose (in case of bare skin, assuming that the frontal area of a man is ∼1 m2).
Table 1 Geometrical dimensions of the intermediate vessel affected by the accident. The “Distance” term is measured from the center of the flame to the center of the process unit. Intermediate vessel Diameter [m] Height [m] Initial liquid height [%] Distance [m] Initial temperature [K] Initial pressure [atm]
2 2.5 20 8 300 12.4
The case-study does not refer to any industrial accidents happened in the past. However, it is noteworthy because, despite its simplicity, it clarifies the complexity and advantages of the risk assessment technique based on the simultaneous simulation of the plant and of the accident dynamics. The case-study implies the release of toluene from a pipe. The spilled liquid forms a pool on the concrete floor of the chemical plant, and is ignited immediately. The case-study assumes that the release is cutoff after 10 min. The scope is to analyze the variation of the process conditions due to the heat radiation from the pool-fire. In particular, the
manuscript discusses the variation of the operating conditions of an intermediate vessel, i.e. a vessel that compensates the variation of the feed flow rate acting as a mass buffer. Table 1 shows the geometrical dimensions of the intermediate vessel. The heat exchange between the process unit and the external air (at 25 C) is considered by means of an overall exchange coefficient. In addition, the simulation assumes that the heat radiation impinging on the process unit is transferred to the liquid hold-up. Fig. 13 shows the UniSimÒ (Honeywell, 2008) flowsheet, which is arranged to simulate two different accident scenarios, involving the formation of a hole in two different sections of the same pipe. In particular, the streams “To Atm 1” and “To Atm 2” represent the points of release to the atmosphere. The “TEE-101” and “TEE-102” are two splitters, i.e. units that divide a flow into two or more streams. The flow rate in the streams “Leakage 1” and “Leakage 2” attached to them is greater than zero only when the hole in the pipe forms. The outflows from the holes are evaluated by the spreadsheets “SPRDSHT-1” and “SPRDSHT-2” with the literature models that can be found for instance in the Yellow Book (TNO, 2007), i.e. on the basis of the pressure difference between the pipe and the atmosphere since the release is liquid. The computed outflows become the specifications for the streams “Leakage 1” and “Leakage 2”. Therefore, when one of the holes
Fig. 13. UniSimÒ flowsheet.
S. Brambilla, D. Manca / Journal of Loss Prevention in the Process Industries 24 (2011) 344e355
the user has to arrange the UniSimÒ flowsheet so that it can simulate the desired accident scenarios (see Fig. 13); the user has to input the data mentioned in the introduction of Section 4 in the GUI of the accident simulator, e.g., AXIMÔ (see Table 2 for the details pertaining this case-study); when all the input data are assigned, the simulation starts. Control routines check for the consistency of the input data before activating the two simulators, i.e. AXIMÔ and UniSimÒ; at each time step, the dynamic process simulator computes the plant dynamics, by taking into account a possible heat radiation impinging on the process units. If the hole is present, it computes also the leakage flow rate and properties; in the meantime, the dynamic accident simulator computes the evolution of the accident scenario with the source term determined by the user defined formulas implemented in the dynamic process simulator. In particular, AXIMÔ computes the heat radiated to the intermediate vessel. Specifically, the exchange of data from/to the simulators is done by AXIMÔ that exploits the object oriented approach of UniSimÒ, which exposes the input/output data of the flowsheet by means of the OLE (Object Linking and Embedding) protocol. In addition, a supervising layer in AXIMÔ synchronizes the execution of the two simulators (i.e. the process and the accident ones) and coordinates the exchange of data and time-marching procedures between these simulators. The case-study here discussed focuses on the second point of release. Therefore, the stream “To Atm 2” will be greater than zero when the hole forms. Since a valve is present on the release stream, it has to be a huge one to avoid the pressure drop in the valve determining the flow rate rather than conforming to the implemented literature model. The valve opening degree is set to 100% but there is a flow rate through it only when the release scenario is activated (flow specification). Fig. 14 shows the leakage flow rate computed with the model. The discharge of about 0.53 kg/s of toluene leads to the formation of a liquid pool of about 3 m in diameter, a flame drag diameter of about 5 m, and a flame height of about 7.6 m. Fig. 15 shows the heat radiation to the intermediate vessel, which is as high as 60 kW.
0.8 Discharge flow rate [kg/s]
forms, either valve “VLV-104” or valve “VLV-106” is opened, and the flow rate to the reaction section (i.e. stream “To Reaction Section”) decreases accordingly to the outflow. During the simulation of the accident scenario, the following data exchange occurs:
353
0.6
0.4
0.2
0
0
200
400
600 800 Time [s]
1000 1200
Fig. 14. Comparison of the leakage flow rate computed with the literature model (red dashed line) and the one released by the valve that describes schematically the hole (blue solid line). (For interpretation of the references to colour in this figure legend, the reader is referred to the web version of this article.)
Fig. 16 shows the dynamics of the pressure and temperature of the intermediate vessel. During the release, the vessel temperature increases due to the incoming heat radiation. When the outflow is interrupted (or significantly reduced), the pool-fire goes on burning up to the extinction. In the meantime, the dynamics of the vessel temperature depends on both the liquid flow (and the related enthalpy flux) and the incoming heat radiation. In this case, the vessel temperature decreases because of the heat balance on the process unit. The pressure inside the vessel is influenced by two conflicting factors. On one hand, it should decrease because the leakage causes the depressurization of the pipe and, consequently, of the upstream process units. On the other hand, the temperature rise of about 11 K should cause a pressurization of the vessel due to the increase of the vapor pressure. Fig. 16 shows that the net effect is a depressurization of the intermediate vessel of about 0.4 atm. This analysis allows determining the highest internal pressure reached during the accident and, then, the stress conditions that allow assessing whether the heat radiation can cause either the rupture or the total collapse of the process unit. Therefore, this analysis can, therefore, be used to estimate the possibility of a domino effect. The discontinuity point shown in Fig. 16 corresponds to the interruption of the release. This Paragraph did not present any accident scenarios involving a vapor cloud explosion because it is less interesting from the training point of view. In fact, in case of explosion, it is not possible to train operators for either restoring the nominal operating conditions or carrying out an emergency shutdown. Nonetheless, it can be interesting to show to the operators both the dramatic
Table 2 Input data for the simulation of the accident scenario.
70 293 K 1 atm 50% 1.5 m/s 30% Isolation concrete 293 K Toluene 5 mm
60 Heat radiation [kW]
Meteorological conditions Air temperature Air pressure Relative humidity Wind speed Cloud cover Surface Type Temperature Source term Emitted substance Hole equivalent diameter Other data Latitude Date Ignition at simulation time
50 40 30 20 10 0
45 20 Apr, 11 AM 0s
0
200
400
600 800 Time [s]
1000 1200
Fig. 15. Heat flux impinging on the intermediate vessel.
354
S. Brambilla, D. Manca / Journal of Loss Prevention in the Process Industries 24 (2011) 344e355
12.4
315
Pressure [atm]
Temperature [K]
12.3 310
305
12.2 12.1 12
300 0
200
400
600 800 Time [s]
1000 1200
11.9
0
200
400
600 800 Time [s]
1000 1200
Fig. 16. Dynamics of the operating conditions of the intermediate vessel.
consequences of a vapor cloud explosion due to plant malfunctions and the operating conditions that may trigger the accident. 5. Conclusions This manuscript discussed the features that an accident simulator must implement to be connoted by the dynamic attribute. The dynamic feature is related to the capability of an accident simulator to follow the evolution of an accident scenario, in particular, when unpredictable variations of the source term are concerned. By implementing a model accounting for these features, the accident event is better characterized, simulated, and understood. The manuscript showed a new paradigm in the field of accident simulation for risk assessment, emergency preparedness, and accident investigation. In fact, by coupling a dynamic accident simulator to a dynamic process simulator, it is possible to account for the influence of the actions of both the control system and the operators on the source term. Furthermore, this link allows accounting for the feedbacks between the plant and the accident. In addition, the possibility to simulate dynamically the interactions between the process and the accident event allows increasing and enhancing the training features of the OTS tool. Finally, the manuscript showed the implementation of the aforementioned features in a program called AXIMÔ. The manuscript discussed only the modeling of a liquid release, although the proposed accident simulator can account also for jet-streams, gas dispersions (either dense or passive), and vapor cloud explosions. Symbols g h hmin qs t
nL rL s
gravity constant, [m/s2] pool height, [m] minimum pool height, [m] discharge rate, [kg/s] time, [s] liquid kinematic viscosity, [m2/s] liquid density, [kg/m3] surface tension, [N/m]
References ABSG Consulting Inc.. (2004). Consequence assessment methods for incidents involving releases from liquefied natural gas carriers. for the FERC (Federal Energy Regulatory Commission) under contract number FERC04C40196. AspenTech. (2008). http://www.aspentech.com/hysys/. Bauer T. J. (2009). Issues with use of toxicity values for emergency response. 89th American Meteorological Society Annual Meeting, Phoenix, Arizona (AZ, USA), paper J14.3, 1e6, January 11e15. Brambilla, S. (2009). A dynamic approach to the quantification of chemical accident consequences. Ph.D. thesis in Chemical Engineering, Politecnico di Milano, Italy.
Brambilla, S., & Manca, D. (2008). On pool spreading around tanks: geometrical considerations. Journal of Hazardous Materials, 158, 88e99. Brambilla, S., & Manca, D. (2009a). Accidents involving liquids: a step ahead in modeling pool spreading, evaporation and burning. Journal of Hazardous Materials, 161, 1265e1280. Brambilla, S., & Manca, D. (2009b). Dynamic process and accident simulations as tools to prevent industrial accidents. Chemical Product and Process Modeling, 4, 1e15. Brown, P. N., Byrne, G. D., & Hindmarsh, A. C. (1989). VODE: a variable-coefficient ode solver. SIAM Journal of Scientific & Statistical Computing, 10, 1038e1051. Buzzi Ferraris, G., & Manca, D. (1998). BzzOde: a new Cþþ class for the solution of stiff and non-stiff ordinary differential equation systems. Computers & Chemical Engineering, 22, 1595e1621. Casal, J. (2008). Evaluation of the effects and consequences of major accidents in industrial plants. In Industrial safety series, Vol. 8. Amsterdam, The Netherlands: Elsevier. Center for Chemical Process Safety. (2000). Guidelines for chemical process quantitative risk analysis (2nd ed.). New York, NY, USA: Center for Chemical Process Safety, American Institute of Chemical Engineers. DIPPR. (2004). Thermophysical property database for pure chemical compounds e DIPPR 801. Design Institute for Physical Properties. DNV. (2007). PHAST e Theory manual. Version 6.5. Engelhard, W. F. J. M. (2005). Heat flux from fires. In C. J. H. van den Bosch, & R. A. M. P. Weterings (Eds.), Methods for the calculation of physical effects due to releases of hazardous materials (liquids and gases). The Netherlands. EPA (Environmental Protection Agency), & NOAA (National Oceanic and Atmospheric Administration). (2006). ALOHAÒ areal locations of hazardous atmospheres e User’s manual. Ermak, D. L. (1990). User’s manual for SLAB: An atmospheric dispersion model for denser-than-air-releases. UCRL-MA-105607. Livermore, CA, USA: Lawrence Livermore National Laboratory. Fay, J. A. (1969). The spread of oil slick on calm sea. In D. P. Hoult (Ed.), Oil on the sea. Cambridge, MA, USA. Fewtrell, P., & Hirst, I. L. (1998). A review of high-cost chemical/petrochemical accidents since Flixborough 1974. IChemE Loss Prevention Bulletin, 140, 1e12. Hansen, O. R., Talberg, O., & Bakke, J. R. (September 28eOctober 1, 1999). CFD-based methodology for quantitative gas explosion risk assessment in congested process areas: examples and validation status. In Proceedings of the AIChE/CCPS international conference and workshop on modeling the consequences of accidental releases of hazardous materials (pp. 457e477), ISBN 0-8169-0781-1, San Francisco, CA, USA. Honeywell. (2008). UniSimÒ Design user guide. http://www51.honeywell.com/ honeywell/. Koseki, H., & Mulholland, G. W. (1991). The effect of diameter on the burning rate of crude oil pool fires. Fire Technology, 27, 54e65. McGrattan, K. B., Baum, H. R., & Hamins, A. (2000). Thermal radiation from large pool-fires. Fire Safety Engineering Division Building and Fire Research Laboratory. NISTIR 6546. Muñoz, M., Arnaldos, J., Casal, J., & Planas, E. (2004). Analysis of the geometric and radiative characteristics of hydrocarbon pool fires. Combustion and Flame, 139, 263e277. Pula, R., Khan, F. I., Veitch, B., & Amyotte, P. R. (2005). Revised fire consequence models for offshore quantitative risk assessment. Journal of Loss Prevention in the Process Industries, 18, 443e454. Raj, P. K. (2006). Spectrum of fires in an LNG facility. Assessments, models and consideration in risk evaluations e Final technical report. U.S. Department of Transportation Pipeline & Hazardous Materials Safety Administration. Contract number: DTRS56-04-T-0005. Raj, P. K. (2007a). Large hydrocarbon fuel pool fires: physical characteristics and thermal emission variation with height. Journal of Hazardous Materials, 140, 280e292. Raj, P. K. (2007b). LNG fires: a review of experimental results, models and hazard prediction challenges. Journal of Hazardous Materials, 140, 444e464.
S. Brambilla, D. Manca / Journal of Loss Prevention in the Process Industries 24 (2011) 344e355 Raj, P. K. (2008). Field tests on human tolerance to (LNG) fire radiant heat exposure, and attenuation effects of clothing and other objects. Journal of Hazardous Materials, 157, 247e259. Raj, P. K. (2009). A physical model and improved experimental data correlation for wind induced flame drag in pool fires. Fire Technology, doi:10.1007/ s1069400901077. Reynolds, R. M. (1992). ALOHAÔ 5.0 theoretical description. Seattle, WA, USA: National oceanic and atmospheric administration (NOAA). Rew, P. J., & Hulbert, W. G. (1996). Development of a pool-fire thermal radiation model. HSE. Contract research report n. 96/1996. Simsci-Esscor. (2006). Dynamic simulation suite user guide. http://www.simsciesscor. com/. Society of Fire Protection Engineers. (1999a). Assessing flame radiation to external targets from pool-fires. Engineering guide, m06/26355.
355
Society of Fire Protection Engineers. (1999b). Engineering guide: Assessing flame radiation to external targets from pool-fires. Society of Fire Protection Engineers Society of Fire Protection Engineers. TNO. (2007). TNO safety software EFFECTS version 7 user and reference manual. The Netherlands: Apeldoorn. van den Bosch, C. J. H. (2005). Pool evaporation. In C. J. H. van den Bosch, & R. A. M. P. Weterings (Eds.), Methods for the calculation of physical effects due to releases of hazardous materials (liquids and gases). Netherlands. Webber, D. M. (1990). A model for pool spreading and vaporization and its implementation in the computer code G*A*S*P. AEA Technology. SRD/HSE/R507. Zhou, X. C., & Gore, J. P. (1996). Measurements and prediction of air entrainment rates of pool fires. InCombustion Institute, Symposium (International) on combustion, 26th Proceedings, Napoli (Italy), Vol. 1 (pp. 1453e1459). Pittsburgh, PA, USA: Combustion Institute.
Contents lists available at ScienceDirect
Journal of Loss Prevention in the Process Industries journal homepage: www.elsevier.com/locate/jlp
Recommended features of an industrial accident simulator for the training of operators Sara Brambilla, Davide Manca* Politecnico di Milano, Dipartimento di Chimica, Materiali e Ingegneria Chimica “Giulio Natta”, Piazza Leonardo da Vinci 32, 20133 Milano, Italy
a r t i c l e i n f o
a b s t r a c t
Article history: Received 1 June 2010 Received in revised form 23 November 2010 Accepted 16 January 2011
When a chemical accident occurs, the release depends on the status of the substance(s) in either the damaged process unit or carrier, i.e. the accident dynamics differs in presence of a compressed gas, a refrigerated liquefied gas, a compressed liquefied gas, or a subcooled liquid. In addition, the release properties (e.g., flow rate, liquid and vapor fractions, temperature, and momentum) may vary dynamically due to the modification of the conditions inside the damaged process unit and/or to the intervention of either the operator or the control system. This manuscript describes the features that an accident simulator should implement to account for the release variability. In particular, the paper focuses on the release of liquids, their spreading, and the formation of pools and pool-fires. The recommended features include the capability to simulate the automatic switch of the liquid pool from spreading to shrinking, its vanishing, the release in a bund, its ignition, the evaluation of the pool-fire geometrical dimensions and the heat flux radiated to the surrounding equipment and field operators. By implementing these features in an accident simulator, it is possible to get a more realistic picture of the accident dynamics, and of its magnitude and consequences. An accident simulator having the aforementioned features can be linked to a dynamic process simulator to evaluate the dynamics of the plant operating conditions during the accident unfolding, for both risk assessment and operators’ training purposes. These features have been implemented in a simulator program, which is based on CPU-efficient models and algorithms, with the scope of demonstrating the feasibility of the discussed approach and its advantages. The importance of the aforementioned features is illustrated by means of some dedicated case-studies. Ó 2011 Elsevier Ltd. All rights reserved.
Keywords: Dynamic accident simulation Dynamic process simulation Chemical accidents Operator training simulation Risk assessment
1. Identification of the problem Since large quantities of potentially hazardous substances are transported, handled, stored, and processed worldwide (e.g., ammonia, chlorine, crude oil derivates), it is recommended to adopt and keep high safety standards by a proper design, management and control of plants, transport systems, and storage sites in order to avoid disastrous accidents. In fact, chemical accidents may imply dramatic consequences, such as the loss of lives among the field operators, the responders, and the population; and the discharge of hazardous substances in the environment. In addition, chemical accidents entail costs for both the company, liable for the accident, and the surrounding community due to reconstruction costs, loss of
* Corresponding author. Tel.: þ39 02 23993271; fax: þ39 02 70638173. E-mail address: [email protected] (D. Manca). 0950-4230/$ e see front matter Ó 2011 Elsevier Ltd. All rights reserved. doi:10.1016/j.jlp.2011.01.009
production, court costs, fines, business interruption, reallocation of production to other sites, cost of on site personnel and contractors, plant redesign, and costs for the civil and health authorities (Fewtrell & Hirst, 1998). According to Fewtrell and Hirst, high-cost accidents share some common features: the lack of understanding and the incompetent management of the storage and/or of the process; the unawareness of the risks associated to the activities that may lead to accidents; problems with isolation valves that are not operated remotely; the combination of inadequate and unreliable process control equipment; the loss of process control (e.g., runaway reactions). Despite it is unrealistic to eliminate the risk associated to hazardous chemicals, the safety policies of companies and the
S. Brambilla, D. Manca / Journal of Loss Prevention in the Process Industries 24 (2011) 344e355
345
research efforts should focus on the reduction, to an acceptable level, of the number of chemical accidents as well as of their magnitude. A hazard analysis allows identifying the unacceptable risks so to intervene selectively to either control or eliminate them. The steps necessary to perform a hazard analysis are:
used to describe the same phenomenon, i.e. the release in the atmosphere of a substance from a process unit due to an accident (e.g., the formation of a hole in the sheet metal of a vessel).
1. identification of potential failures; 2. calculation of the quantity of hazardous material(s) released in each failure; 3. calculation of the impact of the release on the equipment, people, environment, and property.
Chemical accident simulators are software tools used for risk assessment and accident investigation based on well-established steps. Starting from a set of input data, these tools quantify the source term, the spreading of the hazardous material outside of the damaged process unit, and, then, the consequences of the accident event, for instance in terms of concentration profiles to evaluate the distance from the accident epicenter where some risk thresholds are exceeded. Isorisk curves represent concentration thresholds in case of a toxic release, the percentage of lower and/ or upper flammability limits for a flammable release, the heat radiation in case of fire, and the overpressure in case of explosion. The simulation of an accident allows also evaluating the consequences on some specific targets of known geometrical dimensions at given distances from the epicenter. In this context, a target can be a process unit, a building, a structure, an infrastructure, or a human being. Different targets, at the same distance from the accident epicenter, will experience different consequences according to their intrinsic vulnerability. For instance, an overpressure of 0.20e0.27 bar can cause the rupture of an oil storage tank, while human beings in free space are subject to significant and vital effects only when overpressures are as high as 0.7e1 bar (Casal, 2008; Center for Chemical Process Safety, 2000). In addition, the outcomes are due usually to the contribution of both the instantaneous value and the exposure duration, i.e. the dose taken, for instance, by a person. According to Bauer (2009), some caution should be paid when using the dose to evaluate the area where the accident involving a toxic substance may harm people because:
Once the potential failures (also known as top-events) have been identified, a number of software tools can quantify and characterize the accident scenarios to support the actions and decisions of the subjects involved, at different levels, in the emergency preparedness, such as: the local authorities that can superimpose the data about the area involved by the dangerous release with the forecasted population distribution to improve the urban planning; the emergency responders and local authorities who can use the same data to draw external emergency plans according to the real population distribution; the emergency responders who can run an accident simulator when the accident occurs to estimate the consequences and implement the most proper actions; the company liable for the accident that can acknowledge the evaluated accident consequences to modify the design of the plant (in the planning phase), or to arrange the most effective mitigation systems, internal emergency plans, and emergency shutdown procedures, as well as to use these data to negotiate the insurance premium. The simulation of chemical accidents is therefore an important element of the hazard analysis. This manuscript analyzes and discusses the features that an accident simulator should implement to account for the release variability in order to get a more realistic simulation of the accident consequences. Section 2 describes the state-of-the-art in the field of accident simulators to present a reference framework for the reader. Section 3 discusses a different approach to the simulation of industrial accidents that leads to the dismissal and/or to the update of some common hypotheses on the source term. Section 4 shows the implementation of the features discussed in Section 3 in a dedicated simulation program, also with the support of a case-study to illustrate the extension of the proposed approach from the conventional risk assessment to the training of both control room and field operators. The paper discusses the potential and the advantages of adopting a well defined philosophy for the simulation of chemical accidents. The illustration of results obtained with a dedicated simulation code (i.e. AXIMÔ implemented following such specifications) aims at clarifying the aforementioned philosophy by means of practical examples, and not at discussing the details and models of the simulation code itself. Therefore, it is beyond the scopes of this paper to validate the simulation code with experimental data and/or other software packages. AXIMÔ was used with the only purpose of demonstrating the feasibility of the discussed approach and to make the theory clearer by means of some casestudies. In addition, the approach is not bounded to the adopted software tool but can be extended to different tools implementing the features discussed in Sections 3 and 4. It should be noted that, throughout the paper, the terms “outflow”, “emitted substance”, “released substance”, “leakage” are
2. The state-of-the-art in the field of accident simulation
the human body can process and remove almost all toxic substances; the thresholds commonly adopted do not represent adverse health effects on an average person. Instead, they are safe-sided for the most sensitive portions of the population (e.g., elderly and very young people, pregnant women); the indoor and outdoor presence of people should be taken into account and weighted when evaluating the dose. The same is true for an accident involving the heat radiation from a fire. Raj (2008) showed that clothing shelters the human skin, reducing the absorbed heat radiation and its consequences (e.g., lower temperature increase of the skin covered by cloths). In addition, Raj (2008) showed that the thresholds prescribed by law are often too conservative. A number of manuscripts in the literature, technical papers, user manuals, and websites discuss the available accident simulators that differ in their scope, the input data they require, the output data they compute, and the models and hypotheses they adopt. In some cases, accident simulators are designed to simulate only one of the possible accident scenarios, usually the dispersion of gases (e.g., SLAB, Ermak, 1990). Consequently, the user has to run more than one model/simulator to get the whole picture about the sequence of accident phenomena and their consequences. Accident simulators differ also for the level of detail. For instance, only some of them account for the natural topography and the presence of obstacles (e.g., buildings, process units) in the area of the accident (e.g., FLACS, Hansen, Talberg, & Bakke, 1999). The following Sections present and discuss a different approach to the modeling of industrial accidents, as well as the use of the
346
S. Brambilla, D. Manca / Journal of Loss Prevention in the Process Industries 24 (2011) 344e355
output data for two main scopes: the hazard analysis, and the training of operators working in a facility where hazardous chemical substances are handled, processed, and stored. 3. A different perspective As mentioned in Section 1, a hazard analysis relative to industrial accidents requires the evaluation of the impact of a possible accident on the surrounding process units, people, and environment. However, as far as the accidents occurring in chemical industries are concerned, a further step toward a safety increase can be achieved by considering that the accident dynamics is determined not only by the initial conditions of the damaged process unit but also by its evolving conditions. These conditions may vary because of: 1. the intrinsic phenomenology of the release (e.g., the liquid release from a hole in a tank depends on the liquid head, which decreases progressively if no liquid is fed to the tank); 2. the material, momentum, and energy balances across the process units; 3. the intervention of either the control system or the operators (e.g., by closing a valve, it is possible to cutoff the flow to a broken pipe and interrupt the release); 4. the feedbacks from the accident (e.g., the radiative heat flux from a fire to a process unit). Common existing software like ALOHAÔ (Reynolds, 1992), EFFECTS (TNO, 2007), and PHAST (DNV, 2007) can account for a release variability due to point 1. Actually, these programs can model a release that varies according to a given law, i.e. that can be computed a priori from the initial conditions of the equipment even if some simplifying assumptions are often mandatory. Conversely, the intervention of the control system and the presence of some additional inlet/outlet streams to/from the damaged process unit are not supported by those programs. Moreover, the aforementioned codes cannot account for any interactions between the process dynamics and the accident event. Points 2, 3 and 4 can be accounted for by the event-tree analysis to define the possible accident scenarios, but they are usually omitted in the simulation of the accident. To get a more realistic
picture of the accident dynamics, especially when the control system intervenes to safeguard the plant and the production, it is necessary to include points 2 and 3 in its simulation. The operating conditions of the plant may change also according to the feedbacks from the accident event (point 4) as it may happen in case of fire and explosion. In the former case, the heat flux radiated towards the surrounding process units modifies the process conditions and may also damage those cables that are not fire-proof (in this case, the control system cannot control anymore the process variables). Conversely, explosions usually lead to the destruction of some sections of the plant so it is much more difficult, if not unfeasible, to restore the nominal operating conditions. Actually, an explosion determines only a unidirectional interaction between the accident and the process. This can be accomplished by evaluating the behavior of the process and the control system with a dynamic process simulator, e.g., Aspen HYSYSÔ (AspenTech, 2008), DYNSIMÔ (Simsci-Esscor, 2006), UniSimÒ (Honeywell, 2008). In addition, the dynamic process simulator must be linked to a dynamic accident simulator to make them exchange data (see Fig. 1). In this context, the accident simulator is connoted by the attribute dynamic to stress its capability to account for variable input data, whose variability is unpredictable since they depend not only on the conditions of the damaged process units but also on the intervention of both the control system and the operators. The simultaneous evaluation of the dynamics of the process and the accident, as well as their mutual feedbacks are promising and advisable features to get a more realistic picture of the accident event while assessing the effectiveness of the emergency measures and procedures. This allows also investigating domino effects. Up to this point, the dynamic accident simulator, even if coupled to a dynamic process simulator, was used only to evaluate the accident consequences. In addition, this coupling represents an effective tool for training the operators, i.e. it can be used as an advanced Operator Training Simulator (OTS) that can cover also the too often disregarded world of field operators. As a matter of fact, within the virtual plant, the operators can visualize the process variables, modify the available degree of freedom, and quantify the consequences on the plant conditions without incurring into real risks or compromising the production. In addition, by means of the link showed in Fig. 1, the trainer can ask the trainee(s) to cope with an
Fig. 1. The interaction between a process simulator and an accident simulator. The plant is described by a dynamic process simulator, while the real accident is modeled by a dynamic accident simulator.
S. Brambilla, D. Manca / Journal of Loss Prevention in the Process Industries 24 (2011) 344e355
accident event, such as a leakage. In this case, the dynamic accident simulator would evaluate the accident consequences, which are influenced by the procedures implemented by the operator. By means of this support to training, both control room and field operators are expected to gain experience in the process, and to get used to face malfunctions and deviations from the nominal conditions. In addition, the coupling between the accident and the process dynamics allows testing the effectiveness of mitigation systems, emergency plans, and emergency shutdown procedures. In order to build an advanced OTS for the simulation of industrial accidents, the process and the accident simulators must be coupled into a real-time tool, so that the operators become aware of the time-scales of the occurring phenomena. In addition, the accident simulator must implement the dynamic feature to deal with unpredictable input data that cannot be evaluated from aprioristic considerations on the process variables since they depend on the dynamic evolution of the process. Therefore, the tool proposed in this paper can be used for both risk assessment and operators’ training thanks to its features. Section 4 describes the features that an accident simulator should implement to account for the unpredictable variability of the source term. In particular, this paper focuses on liquid releases, so that the pool spreading and the pool-fire scenarios will be discussed. For the pool scenario, the recommended features are: capability to simulate the automatic switch from spreading to shrinking of a liquid pool; pool evaporation/boiling and vanishing; release within a bund. As far as the pool-fire scenario is concerned, the recommended features are: ignition of the pool at any arbitrary times after the beginning of the release; dynamic evaluation of the geometrical dimensions of the poolfire; dynamic evaluation of the view factors and the quantification of the heat radiation impinging on the surrounding equipment and field operators. The aforementioned features are discussed in detail in the following Section. Subsequently, the paper presents and discusses the results of a dedicated simulation code, implemented in accordance with such features. It should be noted that point 4 can be included in the hazard analysis not only for industrial accidents but also for transport accidents. In fact, the approach used for accidents within the battery limits of a chemical plant can be extended to transport accidents by replacing the dynamic process simulator with a dynamic model of the damaged/punctured/collapsed transport vehicle. 4. Recommended features of an accident simulator The dedicated simulation code that will be used in the following is AXIMÔ (Brambilla & Manca, 2009a, 2009b; Brambilla, 2009). In order to model a general accident scenario (based also on other phenomena not discussed in this manuscript such as the gas dispersion), the following input data are required:
347
time of the accident in terms of hour, day and month; computational domain and its spatial discretization, the latitude, the presence and position of obstacles (e.g., buildings, process units), and the ground topography; source term: the emitted substance (e.g., methane, n-propane, toluene), the flow rates of the liquid and vapor phases or the damaged process unit and hole dimensions, the direction of the emitted jet, the source temperature, the dimension and position of the source within the computational domain; the typology of the surface onto which the emitted substance spreads (e.g., concrete, water), its temperature, and the drainage rate (this allows simulating the presence of gullyholes); the typology and position of the targets (e.g., human beings, process units, structures, and infrastructures) in the computational domain, and their geometrical dimensions; the presence of a bund and its geometrical dimensions; the presence of an ignition source. The user can assign most of the input data (i.e. meteorological conditions, time, computation domain, surface, targets, bund, and ignition source) through a graphical user interface (Fig. 2), which allows increasing significantly the usability of the program and avoiding the input of inconsistent data. Conversely, the data related to the source term may come in part from the dynamic process simulator (e.g., the leakage flow rate). Some of the input variables can be modified in real-time, i.e. the meteorological conditions (wind speed and direction, cloud cover), the discharge rate, direction, velocity, and temperature, the surface temperature and drainage rate, the positions of targets and their number (new detectors and/or operators can exit/enter the simulation environment). AXIMÔ accounts for the spread of the emitted liquid on eight different typologies of surfaces: open water (i.e. sea), isolation concrete, light concrete, heavy concrete, average subsoil with 8%wt of moisture, dry sandy subsoil, wet sand with 8%wt of moisture, and gravel bed. A proprietary database includes information related to the physicochemical properties of these surfaces (density, specific heat capacity, thermal conductivity, thermal diffusivity, and kinematic viscosity, this last only for water), and their reflectivity, moisture content, and average surface roughness. The physicochemical properties of the emitted substance are evaluated according to the DIPPR database (DIPPR, 2004). In particular, the accident simulator uses the molecular weight, critical pressure, critical temperature, boiling temperature, melting temperature, heat of combustion, latent heat, compressibility factor, adiabatic constant, material diffusivity, vapor pressure, reflectivity of the liquid phase, surface tension, lower and upper flammability limits, density, specific heat capacity, thermal conductivity, material diffusivity, and dynamic viscosity. Some properties are evaluated for both the liquid and the vapor phases. The following Sections discuss the features of the pool (Section 4.1), and the pool-fire scenarios (Section 4.2) that allow defining an accident simulator as dynamic. In the following examples, the dynamic accident simulator is not linked to any process dynamic simulator because the main scope is to illustrate accurately each feature, by discussing the benefits deriving from its implementation. Conversely, the link between the dynamic process simulator and the dynamic accident simulator is discussed in Section 4.3 by means of a case-study concerning the release of toluene from a pipe. 4.1. Pool scenario
meteorological conditions: the air temperature, pressure, and relative humidity, the wind speed and its direction, and the cloud cover;
AXIMÔ allows modeling the spreading of a liquid on a flat, unobstructed surface. The algorithm is based on Webber’s model
348
S. Brambilla, D. Manca / Journal of Loss Prevention in the Process Industries 24 (2011) 344e355
Fig. 2. Graphical user interface to assign the input data of AXIMÔ.
representing the solution of the differential equations under specific limiting hypotheses (e.g., constant or instantaneous release) or the differential equations are valid only for spreading. The following subsections illustrate these features through dedicated examples. 4.1.1. Automatic switch from spreading to shrinking Let us consider the release of LNG on water at a rate of 20 kg/s. The accident scenario assumes that the outflow is cutoff after 90 s, and that a second release of 30 kg/s occurs from 110 to 300 s (see Fig. 3).
40 Release rate [kg/s]
(1990), even if a number of modifications were introduced. In fact, Webber’s model is not auto-consistent as discussed in the report of 1990. The reader has to implement his/her own correlations to determine some variables present in the model (the code is not available), and the original formulation of Webber shows some inconsistent behaviors as extensively discussed in Brambilla (2009). In addition, correlations developed by different authors were preferred in the evaluation of some variables. Nonetheless, the main framework proposed by Webber was adopted (i.e. the ODE system). The implemented model can switch automatically from the spreading phase to the shrinking one and vice versa, depending on the balance between the liquid spilled into the pool and the evaporation plus the drainage rates. AXIMÔ can also simulate the vanishing of the pool and the formation of a further pool. In addition, it can simulate the presence of a surrounding bund that limits the extent of the pool and, then, the evaporation rate. The accident simulator can account for these features because it solves six ordinary differential equations (ODEs) describing the time evolution of the pool radius, the radial velocity, the pool volume, the volume discharged into the pool, the evaporated volume, and the pool temperature. These variables refer to bulk properties. A variable step ODE solver (Brown et al., 1989; Buzzi Ferraris & Manca, 1998) integrates the differential system. The variable time step feature is quite efficient in terms of CPU-time. Other commercial programs (e.g., PHAST from DNV, 2007; EFFECTS from TNO, 2007) are not able to account for all these features because they work either on a set of algebraic equations
30
20
10
0
0
100
200
300
Time [s] Fig. 3. Dynamics of the release rate.
400
S. Brambilla, D. Manca / Journal of Loss Prevention in the Process Industries 24 (2011) 344e355
70
10
60 Pool height [mm]
Pool radius [m]
8 6 4 2
50 40 30 20 10 0
0 0
100
200
300
0
400
100
Fig. 4 shows that the pool shrinks when the release stops at 90 s due to the LNG boiling that subtracts mass to the pool, whilst it spreads again when the emission re-starts at 110 s. Fig. 4 shows that the pool radius begins to decrease a few seconds after the cutoff of the release and not at that very moment. To understand this phenomenon, let us remember that the pool spreads until it reaches a minimum height (hmin) that, according to Webber (1990), can be evaluated by two distinct equations. The first equation is based only on the liquid properties (i.e. the density, rL, and the surface tension, s):
rffiffiffiffiffiffiffiffi (1)
and refers to the condition where the gravity force balances the surface tension (Fay, 1969; Webber, 1990). The proportionality sign is usually (and abruptly) substituted by the equal sign without any proportionality constant (e.g., ABSG Consulting Inc., 2004; van den Bosch, 2005). The second equation is based on both the liquid properties (as the kinematic viscosity, nL) and the discharge rate (qs):
hmin ¼
6nL qS pgrL
1 4
300
400
(2)
and refers to an unpublished report (see the references in Webber, 1990). Webber (1990) suggested that the minimum pool depth is the maximum of the values computed by eqs. (1) and (2). However, the correlations reported above can introduce an unphysical discontinuity whenever the release rate changes, and especially for abrupt transitions such as the outflow cutoff. Consequently, AXIMÔ implements only eq. (1) because it computes values that are usually lower than those evaluated by eq. (2). This assumption allows determining conservative results. The minimum pool depth can still vary due to changes in the pool temperature, changes that influence the physicochemical properties. Fig. 5 shows that the pool height is higher than its minimum value when the outflow is cutoff. Consequently, the pool keeps on spreading until it reaches the minimum pool depth. At that moment, since no mass is added to the pool, it starts shrinking and reducing its radius while its height remains at the minimum value. When the release starts again, the pool height increases because the change in volume is higher than the pool capability to expand (due to the pool inertia). The same delay in the spreading can be observed at t ¼ 300 s when the pool radius keeps on expanding until the minimum pool height is reached again. Finally, the pool shrinks until it vanishes at t ¼ 366 s.
Fig. 5. Dynamics of the pool height (blue solid line) and pool minimum height (red dashed line). The vertical dashed lines show the interruption of the releases. (For interpretation of the references to colour in this figure legend, the reader is referred to the web version of this article.)
This scenario is typical of the domino effect, when an accident triggers another accident, and a second release occurs. This scenario assumes that, during the second release, the emitted liquid contributes to the existing pool, even if a separate, different pool may develop. In this example, a constant release rate was used to show some peculiar features of the model, but the accident simulator can deal with arbitrary release profiles also supplied by other programs, e.g., the dynamic process simulator. 4.1.2. Vanishing of the pool Let us now assume that a scenario similar to that discussed previously occurs, but the first release stops at 110 s and the second release starts at 200 s and ends at 300 s (see Fig. 6). In this case, the second pool develops after the first pool has vanished completely (Fig. 7). The capability to account for this feature allows simulating any kind of releases, even those involving the vanishing of the pool and the formation of a new one. In fact, the second pool may spread in a place that is different from the previous one. 4.1.3. Release in a bund Often, a bund surrounds one or more process units to set a physical limit to the liquid spreading in case of accident. In this case, the maximum pool diameter corresponds to the bund diameter (for further details see also Brambilla and Manca, 2008). When the liquid reaches the bund, it stops spreading while, if the discharge rate is larger than the evaporation and drainage rates, the
40
Release rate [kg/s]
Fig. 4. Dynamics of the pool radius for a varying release rate: 20 kg/s up to 90 s when it is interrupted, then 30 kg/s from 110 to 300 s when it is finally cutoff. The dashed vertical lines show the instants when the outflow is cutoff.
s rL g
200 Time [s]
Time [s]
hmin f
349
30
20
10
0
0
100
200 Time [s]
300
Fig. 6. Dynamics of the release rate.
400
350
S. Brambilla, D. Manca / Journal of Loss Prevention in the Process Industries 24 (2011) 344e355
10
Pool radius [m]
8 6 4 2 0
0
100
200
300
400
Time [s] Fig. 7. Formation of a second pool after the first pool has vanished. Fig. 9. Geometrical representation of a pool-fire.
liquid height increases up to the bund top. Afterwards, the liquid flows out of the bund. At present, AXIMÔ does not account for the bund overflow (i.e. the liquid that starts spreading beyond the bund when the top of the bund is reached). Let us suppose that a continuous release of 75 kg/s of toluene on concrete is confined within a bund of 5 m radius. In this case, when the pool reaches the bund wall, it stops spreading and its height increases. Fig. 8 shows the comparison between the dynamics of a confined (solid line) and an unconfined (dashed line) pool. 4.2. Pool-fire scenario
30
350
25
300 Pool height [mm]
Pool radius [m]
The original model of Webber (1990) considered only the dynamics of a liquid pool. It was extended with models describing the ignition of vapors for flammable substances, i.e. the pool-fire scenario. According to Rew and Hulbert (1996), there are two approaches for modeling a pool-fire: the Computational Fluid Dynamics (CFD) algorithm, and semi-empirical models. Since an OTS works at least in real-time, the CFD approach is not practicable due to the amount of CPU-time required. Semi-empirical models are discussed for instance by Engelhard (2005), Koseki and Mulholland (1991), McGrattan, Baum, and Hamins (2000), Pula, Khan, Veitch, and Amyotte (2005), Raj (2006, 2007a, 2007b), Rew and Hulbert (1996), Society of Fire Protection Engineers (1999a, 1999b), and Zhou and Gore (1996). These models differ for the methodology adopted to evaluate the flame shape, the fuel burning rate, the emissive power, the atmospheric attenuation, and the view factors, i.e. the variables that determine the hazard related to the pool-fire event.
AXIMÔ sketches the flame as a tilted elliptical cylinder characterized by a larger diameter in the wind direction, due to the drag exerted by the wind (see also Raj, 2007a, 2007b). In addition, the smoke produced by the partial combustion of the vapors obscures the top of the flame (see Fig. 9). The wind exerts an influence on the flame not only because it tilts the flame in the wind direction, but also because it enhances the burning rate (Brambilla & Manca, 2009a; Muñoz, Arnaldos, Casal, & Planas, 2004). The models implemented in AXIMÔ come from different authors (e.g., Raj, 2009; Rew & Hulbert, 1996). Consequently, even if the correlations are not strictly new, their combination is original. In addition, the pool-fire features change in time following the pool dynamics. Correlations originally developed for risk assessment, whose interest is focused on the worst-case scenarios, are used here also to train both control room and field operators, where the dynamic attribute is essential. AXIMÔ simulates both the immediate and delayed ignitions of flammable liquid pools. In the latter case, the user has to specify either the instant or the condition (e.g., a given pool radius) that determines the ignition of the pool. The user can also simulate a sudden extinction of the fire. The simulator computes the geometrical dimensions of the flame to evaluate the heat radiated towards the surrounding targets. AXIMÔ takes into account two contributes, one from the lower visible portion of the flame, and the other from the upper portion that is obscured by the smoke and, consequently, radiates less heat. Finally, it computes also the dose absorbed by the targets, i.e. the time-integral of the radiation incident on a given target.
20 15 10 5 0
250 200 150 100 50
0
100
200 Time [s]
300
0
0
100
200
300
Time [s]
Fig. 8. Comparison between the dynamics of a pool confined in a bund of 5 m radius (solid blue line) and an unconfined pool (dashed red line). The confined pool stops spreading radially when it reaches the bund wall. (For interpretation of the references to colour in this figure legend, the reader is referred to the web version of this article.)
S. Brambilla, D. Manca / Journal of Loss Prevention in the Process Industries 24 (2011) 344e355
25
F la m e h e ig h t [ m ]
Flame and pool diameter [m]
15
351
10
5
20 15 10 5
0
0 0
20
40 60 Time [s]
80
100
0
20
40 60 Time [s]
80
100
Fig. 10. Delayed ignition of an n-butane pool at 10 s from the beginning of the release and its sudden extinction at 80 s. On the left: pool (blue solid line) and flame (red dashed line) diameters. On the right: total flame height (solid line) and clear flame height (dash dotted line). (For interpretation of the references to colour in this figure legend, the reader is referred to the web version of this article.)
The following Sections illustrate some case-studies on the delayed ignition and the sudden extinction of a pool-fire, the dynamic evaluation of the flame geometrical dimensions, and the heat radiated to the surrounding targets. 4.2.1. Ignition of a pool Let us suppose that a pool forms due to the emission of 10 kg/s of n-butane at its boiling point (272.65 K) and it reaches an ignition source after 10 s. Let us suppose also that the mitigation system suppresses the fire after 70 s from the ignition. In this case, no bunds confine the pool spreading. Fig. 10 shows that both the flame diameter and height are null before 10 s and after 80 s. On the contrary, the pool diameter increases after the fire extinction because the evaporation rate is lower than the burning rate. Real mitigation systems take time to suppress fires (if possible). Nonetheless, the modeling of a sudden extinction allows evaluating their effectiveness in reducing the damages to the structures and process units in the neighborhood of the flame. 4.2.2. Pool-fire geometrical dimensions AXIMÔ evaluates not only the flame diameter and height (as shown in the previous example), but also the clear and obscured flame heights, and the flame tilt. Let us suppose that a 5 kg/s release of n-butane is ignited 10 s after the beginning of the release. As shown in Fig. 11, during the release phase the diameter increases until it reaches a steady-state, when the burning rate compensates the release rate. Both the total and clear flame heights show a trend
similar to that of the flame diameter because they depend on it (see Raj, 2006, 2007a, 2007b). 4.2.3. Heat radiation Under the same hypotheses of previous Section, Fig. 12 shows the heat radiated to an operator standing at 25 m downwind the flame center, and the dose he/she absorbs (under the hypothesis that the frontal area of a human being is w1 m2). These bits of information allow determining the maximum distance where a human being can stand without suffering any injuries. In fact, the literature (e.g., EPA & NOAA, 2006) reports that a 60 s exposure to a radiative flux of 10 kW/m2 is potentially lethal; a thermal flux of 5 kW/m2 may cause second degree burns; a radiation of 2 kW/m2 causes pain (see also Raj, 2008). These data relate to the bare skin, whilst the cloths can reduce significantly the radiative heat flux (Raj, 2008). In this example, an operator at 25 m from the flame center experiences pain and probably some burns. Therefore, he/she is not at a safe distance. The absorbed dose in Fig. 12 is the time-integral of the radiative heat flux impinging on the operator. Even if not obvious from the picture, the absorbed dose increases rapidly at the beginning, and slows down afterwards. 4.3. Link with a dynamic process simulator This section discusses a specific case-study to illustrate the interfacing of the dynamic process simulator and accident simulator.
25
10 Flame hei ght [m]
Flame and pool diameter [m]
12
8 6 4
20 15 10 5
2 0
0 0
100
200 Time [s]
300
0
100
200
300
Time [s]
Fig. 11. Features of a pool-fire generated by igniting an n-butane pool 10 s after the beginning of the release. On the left: flame (red dashed line) and pool (blue solid line) diameters. On the right: total flame height (solid line) and clear flame height (dash dotted line). (For interpretation of the references to colour in this figure legend, the reader is referred to the web version of this article.)
S. Brambilla, D. Manca / Journal of Loss Prevention in the Process Industries 24 (2011) 344e355
5
1200
4
1000
Absorbed dose [kJ]
2
Radiative heat flux [kW/m ]
352
3 2 1 0
800 600 400 200
0
100
200
300
0
0
Time [s]
100
200
300
Time [s]
Fig. 12. Heat radiated to an operator at 25 m from the pool-fire and the corresponding absorbed dose (in case of bare skin, assuming that the frontal area of a man is ∼1 m2).
Table 1 Geometrical dimensions of the intermediate vessel affected by the accident. The “Distance” term is measured from the center of the flame to the center of the process unit. Intermediate vessel Diameter [m] Height [m] Initial liquid height [%] Distance [m] Initial temperature [K] Initial pressure [atm]
2 2.5 20 8 300 12.4
The case-study does not refer to any industrial accidents happened in the past. However, it is noteworthy because, despite its simplicity, it clarifies the complexity and advantages of the risk assessment technique based on the simultaneous simulation of the plant and of the accident dynamics. The case-study implies the release of toluene from a pipe. The spilled liquid forms a pool on the concrete floor of the chemical plant, and is ignited immediately. The case-study assumes that the release is cutoff after 10 min. The scope is to analyze the variation of the process conditions due to the heat radiation from the pool-fire. In particular, the
manuscript discusses the variation of the operating conditions of an intermediate vessel, i.e. a vessel that compensates the variation of the feed flow rate acting as a mass buffer. Table 1 shows the geometrical dimensions of the intermediate vessel. The heat exchange between the process unit and the external air (at 25 C) is considered by means of an overall exchange coefficient. In addition, the simulation assumes that the heat radiation impinging on the process unit is transferred to the liquid hold-up. Fig. 13 shows the UniSimÒ (Honeywell, 2008) flowsheet, which is arranged to simulate two different accident scenarios, involving the formation of a hole in two different sections of the same pipe. In particular, the streams “To Atm 1” and “To Atm 2” represent the points of release to the atmosphere. The “TEE-101” and “TEE-102” are two splitters, i.e. units that divide a flow into two or more streams. The flow rate in the streams “Leakage 1” and “Leakage 2” attached to them is greater than zero only when the hole in the pipe forms. The outflows from the holes are evaluated by the spreadsheets “SPRDSHT-1” and “SPRDSHT-2” with the literature models that can be found for instance in the Yellow Book (TNO, 2007), i.e. on the basis of the pressure difference between the pipe and the atmosphere since the release is liquid. The computed outflows become the specifications for the streams “Leakage 1” and “Leakage 2”. Therefore, when one of the holes
Fig. 13. UniSimÒ flowsheet.
S. Brambilla, D. Manca / Journal of Loss Prevention in the Process Industries 24 (2011) 344e355
the user has to arrange the UniSimÒ flowsheet so that it can simulate the desired accident scenarios (see Fig. 13); the user has to input the data mentioned in the introduction of Section 4 in the GUI of the accident simulator, e.g., AXIMÔ (see Table 2 for the details pertaining this case-study); when all the input data are assigned, the simulation starts. Control routines check for the consistency of the input data before activating the two simulators, i.e. AXIMÔ and UniSimÒ; at each time step, the dynamic process simulator computes the plant dynamics, by taking into account a possible heat radiation impinging on the process units. If the hole is present, it computes also the leakage flow rate and properties; in the meantime, the dynamic accident simulator computes the evolution of the accident scenario with the source term determined by the user defined formulas implemented in the dynamic process simulator. In particular, AXIMÔ computes the heat radiated to the intermediate vessel. Specifically, the exchange of data from/to the simulators is done by AXIMÔ that exploits the object oriented approach of UniSimÒ, which exposes the input/output data of the flowsheet by means of the OLE (Object Linking and Embedding) protocol. In addition, a supervising layer in AXIMÔ synchronizes the execution of the two simulators (i.e. the process and the accident ones) and coordinates the exchange of data and time-marching procedures between these simulators. The case-study here discussed focuses on the second point of release. Therefore, the stream “To Atm 2” will be greater than zero when the hole forms. Since a valve is present on the release stream, it has to be a huge one to avoid the pressure drop in the valve determining the flow rate rather than conforming to the implemented literature model. The valve opening degree is set to 100% but there is a flow rate through it only when the release scenario is activated (flow specification). Fig. 14 shows the leakage flow rate computed with the model. The discharge of about 0.53 kg/s of toluene leads to the formation of a liquid pool of about 3 m in diameter, a flame drag diameter of about 5 m, and a flame height of about 7.6 m. Fig. 15 shows the heat radiation to the intermediate vessel, which is as high as 60 kW.
0.8 Discharge flow rate [kg/s]
forms, either valve “VLV-104” or valve “VLV-106” is opened, and the flow rate to the reaction section (i.e. stream “To Reaction Section”) decreases accordingly to the outflow. During the simulation of the accident scenario, the following data exchange occurs:
353
0.6
0.4
0.2
0
0
200
400
600 800 Time [s]
1000 1200
Fig. 14. Comparison of the leakage flow rate computed with the literature model (red dashed line) and the one released by the valve that describes schematically the hole (blue solid line). (For interpretation of the references to colour in this figure legend, the reader is referred to the web version of this article.)
Fig. 16 shows the dynamics of the pressure and temperature of the intermediate vessel. During the release, the vessel temperature increases due to the incoming heat radiation. When the outflow is interrupted (or significantly reduced), the pool-fire goes on burning up to the extinction. In the meantime, the dynamics of the vessel temperature depends on both the liquid flow (and the related enthalpy flux) and the incoming heat radiation. In this case, the vessel temperature decreases because of the heat balance on the process unit. The pressure inside the vessel is influenced by two conflicting factors. On one hand, it should decrease because the leakage causes the depressurization of the pipe and, consequently, of the upstream process units. On the other hand, the temperature rise of about 11 K should cause a pressurization of the vessel due to the increase of the vapor pressure. Fig. 16 shows that the net effect is a depressurization of the intermediate vessel of about 0.4 atm. This analysis allows determining the highest internal pressure reached during the accident and, then, the stress conditions that allow assessing whether the heat radiation can cause either the rupture or the total collapse of the process unit. Therefore, this analysis can, therefore, be used to estimate the possibility of a domino effect. The discontinuity point shown in Fig. 16 corresponds to the interruption of the release. This Paragraph did not present any accident scenarios involving a vapor cloud explosion because it is less interesting from the training point of view. In fact, in case of explosion, it is not possible to train operators for either restoring the nominal operating conditions or carrying out an emergency shutdown. Nonetheless, it can be interesting to show to the operators both the dramatic
Table 2 Input data for the simulation of the accident scenario.
70 293 K 1 atm 50% 1.5 m/s 30% Isolation concrete 293 K Toluene 5 mm
60 Heat radiation [kW]
Meteorological conditions Air temperature Air pressure Relative humidity Wind speed Cloud cover Surface Type Temperature Source term Emitted substance Hole equivalent diameter Other data Latitude Date Ignition at simulation time
50 40 30 20 10 0
45 20 Apr, 11 AM 0s
0
200
400
600 800 Time [s]
1000 1200
Fig. 15. Heat flux impinging on the intermediate vessel.
354
S. Brambilla, D. Manca / Journal of Loss Prevention in the Process Industries 24 (2011) 344e355
12.4
315
Pressure [atm]
Temperature [K]
12.3 310
305
12.2 12.1 12
300 0
200
400
600 800 Time [s]
1000 1200
11.9
0
200
400
600 800 Time [s]
1000 1200
Fig. 16. Dynamics of the operating conditions of the intermediate vessel.
consequences of a vapor cloud explosion due to plant malfunctions and the operating conditions that may trigger the accident. 5. Conclusions This manuscript discussed the features that an accident simulator must implement to be connoted by the dynamic attribute. The dynamic feature is related to the capability of an accident simulator to follow the evolution of an accident scenario, in particular, when unpredictable variations of the source term are concerned. By implementing a model accounting for these features, the accident event is better characterized, simulated, and understood. The manuscript showed a new paradigm in the field of accident simulation for risk assessment, emergency preparedness, and accident investigation. In fact, by coupling a dynamic accident simulator to a dynamic process simulator, it is possible to account for the influence of the actions of both the control system and the operators on the source term. Furthermore, this link allows accounting for the feedbacks between the plant and the accident. In addition, the possibility to simulate dynamically the interactions between the process and the accident event allows increasing and enhancing the training features of the OTS tool. Finally, the manuscript showed the implementation of the aforementioned features in a program called AXIMÔ. The manuscript discussed only the modeling of a liquid release, although the proposed accident simulator can account also for jet-streams, gas dispersions (either dense or passive), and vapor cloud explosions. Symbols g h hmin qs t
nL rL s
gravity constant, [m/s2] pool height, [m] minimum pool height, [m] discharge rate, [kg/s] time, [s] liquid kinematic viscosity, [m2/s] liquid density, [kg/m3] surface tension, [N/m]
References ABSG Consulting Inc.. (2004). Consequence assessment methods for incidents involving releases from liquefied natural gas carriers. for the FERC (Federal Energy Regulatory Commission) under contract number FERC04C40196. AspenTech. (2008). http://www.aspentech.com/hysys/. Bauer T. J. (2009). Issues with use of toxicity values for emergency response. 89th American Meteorological Society Annual Meeting, Phoenix, Arizona (AZ, USA), paper J14.3, 1e6, January 11e15. Brambilla, S. (2009). A dynamic approach to the quantification of chemical accident consequences. Ph.D. thesis in Chemical Engineering, Politecnico di Milano, Italy.
Brambilla, S., & Manca, D. (2008). On pool spreading around tanks: geometrical considerations. Journal of Hazardous Materials, 158, 88e99. Brambilla, S., & Manca, D. (2009a). Accidents involving liquids: a step ahead in modeling pool spreading, evaporation and burning. Journal of Hazardous Materials, 161, 1265e1280. Brambilla, S., & Manca, D. (2009b). Dynamic process and accident simulations as tools to prevent industrial accidents. Chemical Product and Process Modeling, 4, 1e15. Brown, P. N., Byrne, G. D., & Hindmarsh, A. C. (1989). VODE: a variable-coefficient ode solver. SIAM Journal of Scientific & Statistical Computing, 10, 1038e1051. Buzzi Ferraris, G., & Manca, D. (1998). BzzOde: a new Cþþ class for the solution of stiff and non-stiff ordinary differential equation systems. Computers & Chemical Engineering, 22, 1595e1621. Casal, J. (2008). Evaluation of the effects and consequences of major accidents in industrial plants. In Industrial safety series, Vol. 8. Amsterdam, The Netherlands: Elsevier. Center for Chemical Process Safety. (2000). Guidelines for chemical process quantitative risk analysis (2nd ed.). New York, NY, USA: Center for Chemical Process Safety, American Institute of Chemical Engineers. DIPPR. (2004). Thermophysical property database for pure chemical compounds e DIPPR 801. Design Institute for Physical Properties. DNV. (2007). PHAST e Theory manual. Version 6.5. Engelhard, W. F. J. M. (2005). Heat flux from fires. In C. J. H. van den Bosch, & R. A. M. P. Weterings (Eds.), Methods for the calculation of physical effects due to releases of hazardous materials (liquids and gases). The Netherlands. EPA (Environmental Protection Agency), & NOAA (National Oceanic and Atmospheric Administration). (2006). ALOHAÒ areal locations of hazardous atmospheres e User’s manual. Ermak, D. L. (1990). User’s manual for SLAB: An atmospheric dispersion model for denser-than-air-releases. UCRL-MA-105607. Livermore, CA, USA: Lawrence Livermore National Laboratory. Fay, J. A. (1969). The spread of oil slick on calm sea. In D. P. Hoult (Ed.), Oil on the sea. Cambridge, MA, USA. Fewtrell, P., & Hirst, I. L. (1998). A review of high-cost chemical/petrochemical accidents since Flixborough 1974. IChemE Loss Prevention Bulletin, 140, 1e12. Hansen, O. R., Talberg, O., & Bakke, J. R. (September 28eOctober 1, 1999). CFD-based methodology for quantitative gas explosion risk assessment in congested process areas: examples and validation status. In Proceedings of the AIChE/CCPS international conference and workshop on modeling the consequences of accidental releases of hazardous materials (pp. 457e477), ISBN 0-8169-0781-1, San Francisco, CA, USA. Honeywell. (2008). UniSimÒ Design user guide. http://www51.honeywell.com/ honeywell/. Koseki, H., & Mulholland, G. W. (1991). The effect of diameter on the burning rate of crude oil pool fires. Fire Technology, 27, 54e65. McGrattan, K. B., Baum, H. R., & Hamins, A. (2000). Thermal radiation from large pool-fires. Fire Safety Engineering Division Building and Fire Research Laboratory. NISTIR 6546. Muñoz, M., Arnaldos, J., Casal, J., & Planas, E. (2004). Analysis of the geometric and radiative characteristics of hydrocarbon pool fires. Combustion and Flame, 139, 263e277. Pula, R., Khan, F. I., Veitch, B., & Amyotte, P. R. (2005). Revised fire consequence models for offshore quantitative risk assessment. Journal of Loss Prevention in the Process Industries, 18, 443e454. Raj, P. K. (2006). Spectrum of fires in an LNG facility. Assessments, models and consideration in risk evaluations e Final technical report. U.S. Department of Transportation Pipeline & Hazardous Materials Safety Administration. Contract number: DTRS56-04-T-0005. Raj, P. K. (2007a). Large hydrocarbon fuel pool fires: physical characteristics and thermal emission variation with height. Journal of Hazardous Materials, 140, 280e292. Raj, P. K. (2007b). LNG fires: a review of experimental results, models and hazard prediction challenges. Journal of Hazardous Materials, 140, 444e464.
S. Brambilla, D. Manca / Journal of Loss Prevention in the Process Industries 24 (2011) 344e355 Raj, P. K. (2008). Field tests on human tolerance to (LNG) fire radiant heat exposure, and attenuation effects of clothing and other objects. Journal of Hazardous Materials, 157, 247e259. Raj, P. K. (2009). A physical model and improved experimental data correlation for wind induced flame drag in pool fires. Fire Technology, doi:10.1007/ s1069400901077. Reynolds, R. M. (1992). ALOHAÔ 5.0 theoretical description. Seattle, WA, USA: National oceanic and atmospheric administration (NOAA). Rew, P. J., & Hulbert, W. G. (1996). Development of a pool-fire thermal radiation model. HSE. Contract research report n. 96/1996. Simsci-Esscor. (2006). Dynamic simulation suite user guide. http://www.simsciesscor. com/. Society of Fire Protection Engineers. (1999a). Assessing flame radiation to external targets from pool-fires. Engineering guide, m06/26355.
355
Society of Fire Protection Engineers. (1999b). Engineering guide: Assessing flame radiation to external targets from pool-fires. Society of Fire Protection Engineers Society of Fire Protection Engineers. TNO. (2007). TNO safety software EFFECTS version 7 user and reference manual. The Netherlands: Apeldoorn. van den Bosch, C. J. H. (2005). Pool evaporation. In C. J. H. van den Bosch, & R. A. M. P. Weterings (Eds.), Methods for the calculation of physical effects due to releases of hazardous materials (liquids and gases). Netherlands. Webber, D. M. (1990). A model for pool spreading and vaporization and its implementation in the computer code G*A*S*P. AEA Technology. SRD/HSE/R507. Zhou, X. C., & Gore, J. P. (1996). Measurements and prediction of air entrainment rates of pool fires. InCombustion Institute, Symposium (International) on combustion, 26th Proceedings, Napoli (Italy), Vol. 1 (pp. 1453e1459). Pittsburgh, PA, USA: Combustion Institute.