The analysis of domino accidents triggered by vapor cloud explosions

Reliability Engineering and System Safety 90 (2005) 271–284 www.elsevier.com/locate/ress

The analysis of domino accidents triggered by vapor cloud explosions Ernesto Salzanoa, Valerio Cozzanib,* a

Istituto di Ricerche sulla Combustione, Consiglio Nazionale delle Ricerche, via Diocleziano 328, 80125 Napoli, Italy b Dipartimento di Ingegneria Chimica, Mineraria e delle Tecnologie Ambientali, Universita` degli Studi di Bologna, viale Risorgimento n 2, 40136 Bologna, Italy Accepted 29 November 2004 Available online 23 February 2005

Abstract Domino effect is a well-known cause of severe accidents in the chemical and process industry. Several studies pointed out that the more critical step in the quantitative assessment of domino hazards is the availability of reliable models to estimate the possibility and probability of the escalation of primary accidents. This work focused on the revision of available models for the quantitative estimation of damage probability to plant equipment caused by pressure waves generated by a primary accident. Available data on damages to process equipment caused by pressure waves were analyzed. Several specific probit functions for different elements of process equipment were obtained from the analysis of failure data. The analysis of blast wave propagation in different types of explosions allowed the estimation of the expected damage probability as a function of distance from the explosion center and of explosion strength. The results obtained were used to assess safety distance criteria and to evaluate the contribution to individual risk of domino effect due to pressure waves. q 2005 Elsevier Ltd. All rights reserved. Keywords: Domino effect; Explosion; Equipment damage

1. Introduction The hazards caused by domino effect are well-known in the literature [1,2] and are widely recognized also in the legislation. The assessment of these hazards was already required by the first ‘Seveso’ European Community Directive (82/501/EEC), on the control of major accidents caused by dangerous substances. The ‘Seveso-II’ Directive (96/82/EC) extended these requirements also to the assessment of possible domino effects outside the site under consideration (e.g. to nearby plants). Although the severe consequences of domino accidents are known, a well established and widely accepted methodology for the identification and the quantitative assessment of accidents caused by domino effects is still missing. Indeed, several qualitative criteria were proposed in the literature to identify the possibility of domino events,

* Corresponding author. Tel.: C39 051 209 3141; fax: C39 051 581 200. E-mail address: [email protected] (V. Cozzani). 0951-8320/$ - see front matter q 2005 Elsevier Ltd. All rights reserved. doi:10.1016/j.ress.2004.11.012

mainly based on equipment vulnerability tables (e.g. see [1] and references cited therein), whereas only few pioneering studies addressed the problem of the quantitative assessment of risk due to domino effects [3–6]. Nevertheless, these studies were not specifically focused on the development of models for the evaluation of primary accident escalation. In several accidents where a ‘domino effect’ took place, the main responsible for the escalation was the propagation of pressure waves generated by the primary accident (an explosion). The present study focuses on the assessment and further development of probabilistic models to evaluate the damage to process equipment loaded by overpressure, in the framework of domino effect evaluation in quantitative risk analysis. Probit models were used to relate the peak overpressure to the expected damage probability. These were coupled to simplified models for peak overpressure as a function of distance from the explosion centre and of explosion strength, thus allowing a straightforward estimation of damage probability and of safety distances for escalation effects.

272

E. Salzano, V. Cozzani / Reliability Engineering and System Safety 90 (2005) 271–284

2. Damage probability of process equipment A necessary starting point in the assessment of probabilistic models for accident propagation due to overpressure is the analysis of both theoretical and experimental data on damage to equipment loaded by blast waves. Details on explosion types and behaviour are reported elsewhere [1,7–8]. It is only worth mentioning that pressure (or blast) waves are characterised by static and dynamic overpressures, and by the total duration (impulse) of the wave. The interaction of the pressure waves with surroundings is very complex and involves several phenomena: reflection of pressure wave either on the ground or on the loaded equipment (normal reflections, oblique reflections, Mach stem formation), flow separation, drag forces (explosion winds), effects due to equipment shape and relative orientation (geometry of loaded equipment), mechanical characteristic of equipment [7,9]. However, if most common industrial explosions are considered, i.e. excluding nuclear explosion or condensed high explosives, and only far-field interactions between the explosion source and the target equipment are analyzed, damages are mainly related to the incident peak overpressure (Po) and to the positive impulse (Is) whereas drag forces on bodies Pd (the explosion wind) may be negligible. Moreover, most of the authors relate damages to peak static overpressure only. Indeed, the use of pressure–impulse diagram for damage is actually inhibited by lack of data and by theoretical difficulties unless very idealised blast wave are considered. Only a qualitative conclusion may be drawn: the longer the loading impulse, the higher the energy transferred, the lesser the pressure required to produce damage to process equipment [10]. Therefore, in the following, it will be assumed that damage is mainly related to the peak overpressure. The damage probability will be only qualitatively related to the positive impulse considering the different characteristics of the different explosion types. A uniform blast load on equipment will be assumed. This is a conservative approach often used in the design criteria, and the assumption is certainly acceptable when pressure waves such as those produced by VCE impact on small and medium scale equipment and, as a first approximation, on large tanks [11]. A number of studies reports threshold values for damage to generic plant equipment, ranging from 9.9 to 70 kPa [3,12,13]. Several other sources report values of overpressure causing damage to a specific item of process equipment. Data retrieved are summarized in Table 1. As shown in the table, large discrepancies exist. This is caused at least by two factors which are strictly related to the ambiguity in the definition of ‘damage’: (i) not all the sources define accurately what is meant for equipment damage, thus reporting different types of damage (displacement, overturning, buckling, collapse, etc.) as consequences of pressure wave impact; (ii) differences in the resistance of equipment to pressure waves: even equipment of the same category may have a different resistance to pressure load,

and full details on structural or geometrical characteristics in the target equipment are not always provided with overpressure damage data. Eisenberg et al. [14] were the first who proposed the use of a simplified probit model to assess the damage probability of process equipment as a consequence of a blast wave Yblast Z a C b lnðDPo Þ

(1)

where Yblast is the probit value for equipment damage (see [15] for details on the probit approach and for the relationship between probit and probability values), DPo is the peak static overpressure (in Pa), a and b are the probit coefficients (aZK23.8 and bZ2.92). The probit approach was followed also by Khan and Abbasi [13], which proposed a probit function similar to the equation of Eisenberg et al. [14]. However, both these sources did not take into account the different characteristics of process equipment although, for instance, it is quite clear that pressurized equipment, as well as elongated or ‘small’ equipment (e.g. pumps, heat exchanges, etc.), usually have a higher resistance to pressure waves than atmospheric storage vessels. When similar equipment are considered, similar damages (e.g. displacement of connected tube, buckling of shell, destruction of vessel, etc.) are observed at approximately the same value of peak static pressure, unless consistent differences in the design are present (mainly with respect to the design pressure). In order to take into account quantitatively these factors, probit analysis of literature data was undertaken, dividing the damage data into four categories: atmospheric vessels, pressurized vessels, elongated vessels, and small equipment. Data on piping failure were included in all categories. Since the present study was addressed to the assessment of domino effect, the reference damage was defined as a damage state resulting in a loss intensity sufficient to cause a secondary event having consequences at least comparable with those of the primary event (the blast wave). Damage probability values, i.e. the probability of having a mechanical failure or even the destruction of the equipment, were obtained from the original source or, if absent, were assigned using the criteria summarized in Table 2. Probit values were calculated from probability data. In the interactions between blast waves and process equipment in the far field, the dynamic pressure in general may be neglected. Hence, the static peak overpressure was assumed as the independent variable in the probit analysis. A linear least-squares regression was applied to calculate the best-fit coefficients of the probit functions. It is clear that the values of probability in Table 2 were difficult to define without introducing reasonable but somehow arbitrary decisions. Thus, even considering separately the different equipment categories, very low regression coefficients were obtained by a direct correlation

E. Salzano, V. Cozzani / Reliability Engineering and System Safety 90 (2005) 271–284

273

Table 1 Data reported in the literature for damage to process equipment loaded by blast waves with peak overpressure Po expressed in kPa Po

Damage

Ref.

42.00 42.00

Tubes failure Pressure vessel deformation

[33] [33]

[30] [14] [9] [31] [32] [32] [33] [33] [10] [30]

42.51 42.51 42.52 45.92 47.00 49.32 52.72 53.00 53.00 55.00

[30] [30] [30] [30] [33] [30] [30] [33] [33] [35]

[30] [30]

59.52 59.52

Minor damage, floating roof tank (100% filled) Catastrophic failure, cone roof tank (100% filled) Minor damage, extraction column Catastrophic failure, fractionation column Failure of non-pressure equipment Minor damage, heat exchanger Minor damage, tank sphere Pressure vessel failure Failure of spherical press. vessel 20% of structural damage of steel spherical steel petroleum tank Catastrophic failure, reactor Catastrophic failure, heat exchanger

[34] [33] [33] [32] [32] [14] [30] [30]

61.22 69.00 69.73 70.00 70.00 70.00 76.53 81.63 81.63

Catastrophic failure, pressure vessel horizontal Displacement of heavy equipment Catastr. Failure, extraction column Structural damage of equipment Deformation of steel structures 100% damage, heavy machinery, Process Plant Catastrophic failure, reactor: cracking Minor damage, press. vessel vertical Minor damage, pump

[30] [33] [30] [13] [33] [32] [30] [30] [30]

[33]

83.00

[35]

[30] [34] [10]

88.44 95.30 97.00

20% structural damage of vertical cylindrical steel pressure vessel Catastrophic failure, pressure vessel vertical 99% Structural damage of vertical, steel pressure vessel 99% damage of vertical cylindrical steel pressure vessel

P8

Damage

Ref.

1.72 5.17

Minor damage, cooling tower Minor damage, cone roof tank (100% filled) Minor damage, cone roof tank (50% filled) 1% Structural damage of equipment Failure of connection Failure of atmospheric equipment 5% damage of process plant 50% damage of atmospheric tank Minor damage of cooling tower Minor damage of atmospheric tank Minor damage, distillation tower Minor damage, floating roof tank (50% filled) Minor damage, reactor: cracking Catastrophic failure, cone roof tank (50% filled) Displacement of steel supports Tubes deformation Deformation of atmospheric tank 20% damage, Process Plant 100% damage, Atmospheric Tank 50% Structural damage of equipment Minor damage, pipe supports Catastrophic failure, cooling tower 20% of structural damage of steel floating roof petroleum tank Atmospheric tank destruction

[30] [30]

30.00 34.00 35.00 35.00

Minor damage, reactor chemical Failure of steel vessel Distillation tower and cylindrical steel vertical structure Failure of pressure vessel 99% Structural damage of equipment 80% damage of process plant 40% damage, Heavy machinery

[31] [14] [32] [32]

108.8 108.8 108.9 110.0

35.50 35.71 37.42 38.00 39.00

Structural damage of equipment Minor damage, fractionation column Catastrophic failure, pipe supports Deformation of non-pressure equipment Structural damage to pressure vessel

[3] [30] [30] [33] [36]

136.0 136.1 136.1 136.1 137.0

39.12

Minor damage, pressure vessel horizontal

[30]

5.17 6.10 7.00 10.00 10.00 10.00 14.00 14.00 17.00 18.70 18.70 18.70 20.00 20.00 20.00 20.00 20.00 20.40 22.10 22.11 24.00 25.00 25.30 27.00 29.00

of data. In order to limit the variability of the data, the mean value and the mean square error of overpressure data corresponding to each probit value were calculated. Data whose differences with respect to the mean value exceeded the mean square error were discarded in the analysis. By this technique, more reliable probit functions were obtained for damage probability due to overpressure. The correlation of probit data to the logarithm of overpressure is shown in Fig. 1. Table 3 reports the probit coefficients obtained for the different process equipment categories. From the above discussion and from the analysis of data in Fig. 1, it is clear that some discordances are still present between the data and the probit functions. Thus, the probit

Catastrophic failure, tank sphere Catastrophic failure, pump 99% Structural damage of spherical, pressure steel vessel 99% damage (total destruction) of spherical steel petroleum tank Structural damage, low pressure vessel Catastrophic failure, floating roof tank (50% filled) Catastrophic failure, floating roof tank (100% filled) 99% Structural damage of floating roof tank 99% damage (total destruction) of floating roof petroleum tank

[30] [30]

[30] [37] [35] [30] [30] [37] [35] [36] [30] [30] [37] [35]

models listed in Table 3 may only be used as a rough estimate of the actual damage probability of process equipment with respect to overpressure. More reliable experimental data would be needed to increase the reliability of the probit models. The probit models obtained should be considered only as a comparative tool to be used in the framework of quantitative risk analysis. However, it is interesting to analyze the different trends of the probit functions. In Fig. 2, a direct comparison of damage probability calculated from the different probit models is reported. As expected, pressurized vessels show the lower damage probabilities with respect to overpressure. Moreover, higher overpressure values resulted to be

274

E. Salzano, V. Cozzani / Reliability Engineering and System Safety 90 (2005) 271–284

Table 2 Summary of criteria used to assign damage probabilities on the basis of reported damage data Reported damage

Assigned probability

Relevant loss of containment Catastrophic failure (catastrophic damage or collapse) Overturning or displacement of tanks or heavy equipment Structural damage of the main containment system Complete rupture of connections Minor structural damage of pressurized equipment Partial failure of atmospheric equipment Deformation of atmospheric equipment Minor damage of the auxiliary equipment Minor structural damage of atmospheric equipment ‘Buckling’ of the equipment

1.00 1.00 1.00 1.00 0.30 0.30 0.10 0.10 0.10 0.10 0.01

Fig. 2 also shows the damage probabilities obtained using the probit function proposed by Eisenberg et al. [14]. As shown in the figure, this model is almost coincident with that obtained in the present study for atmospheric equipment. Fig. 3, were the model of Eisenberg et al. [14] was compared to available data, evidences that, as expected, much higher errors or overconservative results would be obtained using a single probit correlation for damage probability, not taking into account the type of equipment.

3. The assessment of safety distances for damage to equipment in explosions 3.1. Assessment of peak overpressure as a function of scaled distance

necessary to produce damages to elongated vessels (as distillation or absorption columns) than to atmospheric storage vessels. Also small equipment resulted more resistant to pressure waves.

The assessment of safety distances and damage probabilities needs to be coupled to the specific explosion type and parameters (e.g. total explosion energy), not only

Fig. 1. Probit model for damage of atmospheric vessels (top left), pressure vessels (top right), elongated vessels (bottom left) and small equipment (bottom right).

E. Salzano, V. Cozzani / Reliability Engineering and System Safety 90 (2005) 271–284

275

Table 3 Probit coefficients for different equipment categories (dose: maximum static overpressure in Pa, see Eq. (1)) Equipment

a

b

Atmospheric vessels Pressurized vessels Elongated equipment Small equipment

2.44 4.33 3.16 2.18

K18.96 K42.44 K28.07 K17.79

to the equipment characteristics. To this aim, some generalizations on the primary scenario may be useful. Indeed, with specific reference to assessment of domino effects, only explosive phenomena which can propagate damages at a significant distance from the source point of the explosion are of concern. This point of view gives way to exclude from the present analysis some explosions among those cited above, which can produce severe consequences only in the close surrounding of the source point without generating a pressure wave. This is the case of confined explosion, even if accident propagation from this scenario may take place, for instance, due to missiles or to radiation. The generation of highly destructive pressure waves from unconfined dust explosions was considered unlikely. As a conclusion, physical explosion of enclosed volumes (due to internal pressure) and unconfined dust cloud explosions were not relevant in the present study. Boiling liquid expanding vapour explosion (BLEVE) only rarely gives very intense blast wave for the rapid evaporation of liquid, either for the thermodynamic conditions which are needed for the explosive evaporation, or for the total available energy of explosion [16]. Of course, if local conditions lead to the assumption that very intense BLEVE can take place and affects equipment in the far field, the explosion produced by vapour and liquid expansion can be assumed as point-source. However, it is more likely that BLEVEs cause escalations and domino accidents due to fireball radiation and to the projection of fragments.

Fig. 2. Comparison of the different damage probability models.

Fig. 3. Literature data for damage probability to process equipment compared to the damage probability calculated using the probit function of Eisenberg et al. [14].

From the above discussion, it is clear that unconfined or partially confined explosions of large gas or vapour clouds, accidentally formed within industrial installation are the main phenomena that should be kept into account when domino effects related to blast wave propagation are of concern. The large characteristic scale and the total positive duration in these scenarios consistently increase the total positive impulse of the produced blast wave. It must be remarked that even in CFD applications, due to the great uncertainties of the dispersion analysis and to the low development of combustion models for large-scale premixed turbulent flames, a ‘worstcase’ assumption is usually adopted for the cloud concentration, that is in general considered homogeneous and at stoichiometric concentration. On the basis of the above discussion, it was possible to approach the coupling of the probit functions for the damage of equipment loaded by blast waves with models which are able to predict the primary scenario and the propagation of the pressure wave in the surrounding environment. Quantitative Risk Analysis (QRA) is usually performed on complex plants or even on extended industrial areas. Thus, QRA generally requires simplifying assumptions and detailed models (e.g. Computational Fluid Dynamics, CFD, for dispersion and deflagration of vapour cloud explosion or for the propagation of blast waves) cannot be used for being too time consuming or for the very large scale of the area that needs to be considered. An almost universal hypothesis used in QRA to model the consequences of explosions is to assume that the accidental explosion phenomena produce blast waves which can be compared to the ideal blast wave produced by an equivalent charge of one or more solid ‘point’ explosions, regardless of the type of explosion. The value of the maximum peak overpressure as a function of distance may be then fairly estimated from the well-known TNT-diagram, or similar plots (see for instance Multi-Energy method [8]).

276

E. Salzano, V. Cozzani / Reliability Engineering and System Safety 90 (2005) 271–284

By the point-source methods, peak overpressure Po and impulse Io can be determined only on the basis of the total available energy of explosion, using an energy or mass scaled distance R [7–8]  r R Z p3 ffiffiffiffiffiffi (2) Eexp  Patm

where r is the effective distance from the explosion centre (m), Patm the atmospheric pressure (105 Pa), Eexp the explosion energy (J) which can be alternatively converted to equivalent mass of the reference explosive. This approach is certainly more acceptable in the far field, while a more accurate analysis is always necessary when near-field effects are analysed. Indeed, in the far field, similarity in the propagation of air blast wave produced by any type of explosion can be assumed. Hence, a first important problem arises in the definition of the ‘far-field’ distance itself, rff, above which the simplifying assumptions previously introduced may be accepted. To simplify this problem, a new scaled distance r may be defined as follows  r K r0 r Z p3 ffiffiffiffiffiffi Z R K r (3) Eexp   ff Patm

where r is the scaled threshold distance from the explosion ff center, having considered an additional distance r0 which is dependent on the explosion type. If point-source explosion are considered, the air blast behaviour is ideal with the exception of the region in the immediate vicinity of the explosion center, since the source term interests a very limited area, thus not influencing the blast propagation. As a conclusion, the far-field hypothesis has a general validity in these cases, and the distance r0 is approximately zero unless consideration on the scale of blast source are given, for instance, in the case of BLEVE of very large tank. In the case of VCEs, the flow field originated by the expansion of hot combustion products influences the source term. Thus, a different approach is needed, starting from the first assumption that detonation regime can be ruled out in practical conditions, due to the high ignition energy required [17]. In the low-Mach deflagration regime, which is typical of VCEs, the maximum overpressure in the system is given by the peak overpressure at the flame front. This is usually estimated by the maximum effective flame velocity [18]. Thus, it may be assumed that the blast wave produced by an VCE will start to propagate freely in the surrounding atmosphere at a distance equal or lower than the flame path Lf. The flame path, defined as the maximum flame front distance from the ignition point supposed in the barycentre of the cloud, may be then considered as the far-field additional distance r0 for VCEs, and calculated by taking into account the geometry of the cloud and the expansion factor, given by the ratio of the density r of the unburned (u) over that of the burned (b) fuel air mixture. However, it is well-known that in the case of VCE, the TNT-diagram are an oversimplified representation of

the actual phenomenon, and other methods should be used. A useful approach to evaluate the overpressure in industrial environment is the Multi-Energy Method (MEM), developed by the Netherlands Organisation for Applied Research (TNO) [19]. According to the basic concept of the MEM, the explosion consequences are primarily determined by the geometry of the environment: the congestion/confinement level enhances the turbulent combustion and causes flame speed acceleration. As a consequence, the zones characterised by a high level of obstruction will produce overpressures significantly higher than those related to zones in which the congestion degree is very low. Therefore, the flammable cloud must be divided in separate zones, depending on obstacles arrangement and dimension, each characterised by a charge size and by a strength explosion factor F, ranging from 1 to 10 [8]. The maximum overpressure at the ignition point (i.e. the strength factor) was recently related to the scenario geometry and to the reactivity of the fuel within each zone through the GAME (Guidance for the Application of MEM) guidelines. The GAME correlations were developed by TNO (NL), on the basis of the MERGE experimental data set [20,21]. The GAME relations for the peak overpressure with low ignition energies are the following 

VBRRf P Z 0:84 D o

Po Z 3:38



VBRRf D

2:75 2:25

0:7 S0:75 L D

(4)

0:7 S2:7 L D

(5)

where VBR is the volume blockage ratio of the vapour cloud, i.e. the portion of volume occupied by obstacles, Rf is the flame path with respect to unburned mixture, D is the average diameter of obstacles within the vapour cloud and SL is the theoretical laminar flame speed of the fuel. Eq. (4) applies to explosions in an open environment, while Eq. (5) is related to confinement between parallel planes (which is appropriate for instance in offshore installations or in racktype equipment). Table 4 shows the correspondence between the Po values calculated by the GAME method and the explosion strength factors F. Eventually, the GAME approach may be used for a more reliable calculation of Table 4 Correspondence between strength factor F and peak overpressure Po F

Po (kPa)

1 2 3 4 5 6 7 8 9 10

1 2 5 10 20 50 100 200 500 1300

E. Salzano, V. Cozzani / Reliability Engineering and System Safety 90 (2005) 271–284

277

the peak overpressure in the ‘far field’, using the F factor calculated from Eq. (4) or (5), data in Table 4 and the scaled distance from Eqs. (2) and (3). It must be also recalled that in this approach, the values of P8 may as well be estimated by any other applicable technique, e.g. by CFD simulations. 3.2. Damage probabilities as a function of distance from explosion centre

Fig. 4. Damage probability as a function of scaled distance, calculated using the TNT model [22].

From the above discussion, two different methods are suggested for the evaluation of peak overpressure trends: the TNT method, for point-source explosions, and the MEM–GAME method, for VCEs. Figs. 4 and 5 report the results of probit models for damage to equipment that should be expected, respectively, for point-source explosions and VCEs. The Baker–Strelhlow–Tang blast curve [22] relating overpressure to the scaled distance from the center of the explosion was used to obtain Fig. 4. The figure confirms that relevant differences should be expected between the damage probabilities of pressurized and atmospheric equipment. As a matter of fact, the distance

Fig. 5. Damage probability as a function of scaled distance and explosion strength factor, calculated using the MEM–GAME model. (a) Atmospheric vessels; (b) pressurized vessels; (c) elongated equipment; (d) small equipment.

278

E. Salzano, V. Cozzani / Reliability Engineering and System Safety 90 (2005) 271–284

at which the same probability value is expected is three times higher for atmospheric equipment than for pressurized vessels. Differences of about a factor of 2 are present between the different categories of atmospheric equipment, although very similar probability values are found for small and elongated equipment. In the case of VCEs (Fig. 5), the results are obviously dependent on the explosion strength factor, F. However, also in this case relevant differences are evident between pressurized and atmospheric equipment, both in the minimum explosion strength needed to result in relevant damage probabilities and in the scaled distance at which the same values of damage probability are found. As a matter of fact, in the case of pressurized equipment, an explosion strength factor at least equal to 6 is needed to obtain damage probabilities higher than 5%. On the other hand, a strength factor of 4 results in damage probabilities as high as 8% in the case of atmospheric equipment. A difference of about a factor of 2 is present between the values of scaled distance at which the same damage probability values are expected, if a strength factor equal or higher than 6 is considered for the explosion. The other categories of equipment show intermediate trends for the damage probability values. However, also in the case of elongated and small equipment, an explosion strength factor at least equal to 5 is required in order to obtain relevant values of the expected damage probability. 3.3. Safety distances for domino effect The results shown in Figs. 4 and 5 also allow the assessment of scaled distances at which a given value of damage probabilities should be expected. Tables 5 and 6 show the values of scaled distance at which a 1% damage probability value is expected, and the correspondent peak static overpressure values, as calculated from the probit models listed in Table 3 using, respectively, the TNT and

the MEM models. A value of 1% for the damage probability can be assumed as a conservative threshold for the escalation of the primary scenario. Thus, the data in Tables 5 and 6 may be used for a preliminary assessment of safety distances for domino effect caused by blast waves. It must be remarked that these scaled distances are calculated from the explosion centre: thus, the position of the explosion centre should be correctly assumed, also considering the possible effects of delayed ignition. Specific approaches reported in the literature for the assessment of safety distances from domino effect caused by blast waves are mainly based on peak overpressure threshold values, below which the possibility of domino effect is considered to be negligible. A number of different thresholds reported in the literature are shown in Table 7. The table evidences that most of these values do not take into account the equipment category, and are supposed to apply to any plant item. Tables 5 and 6 report the scaled distances corresponding to the different overpressure threshold values. As shown in the tables, important differences are found (up to a factor of 6 for atmospheric vessels) depending on the value selected for the damage threshold. Thus, it is clear that if the analysis of a plant lay-out has to be performed in order to identify possible secondary targets of domino events caused by overpressure, wide differences are likely to result from the application of the different threshold values. The comparison with probit models and data reported in the literature for overpressure damage to process equipment also points out that several overpressure thresholds proposed in Table 7 are not conservative, at least if atmospheric, elongated and small equipment are considered. A more specific approach to safety distance assessment is suggested by Gledhill and Lines [23] in a study commissioned by the Health and Safety Executive. In their approach, threshold values of 7 and 38 kPa are given, respectively, for the damage of atmospheric and pressurized

Table 5 Peak overpressure values (kPa) and scaled distance at which 1% damage probability is expected using the probit functions in Table 3 and the TNT model Equipment category Atmospheric P Models Probit models Considine and Grint model [24] Thresholds Bagster and Pitblado [3] Bottleberghs and Ale [31] Cremer and Warner [38] Glasstone and Dolan [9] Gledhill and Lines [23] Gugan [33] Khan and Abbasi [13] Wells [36]

Pressurized

Elongated

Small

r 

P

r 

P

r 

P

r 

7.10 7.00

3.65 5.45

34.60 38.00

0.92 1.84

17.00 –

1.69 –

12.30 –

2.27 –

35.00 10.00 14.00 23.80 7.00 14.00 70.00 35.00

0.89 2.70 2.02 1.27 3.69 2.02 0.49 0.89

35.00 30.00 35.00 65.00 38.00 42.00 70.00 35.00

0.89 1.05 0.89 0.53 0.84 0.77 0.49 0.89

35.00 – – – – 14.00 70.00 –

0.89 – – – – 2.02 0.49 –

35.00 – 14.00 – – – 70.00 –

0.89 – 2.02 – – – 0.49 –

Comparison to scaled distances correspondent to literature models and threshold values for damage from blast waves is also given.

E. Salzano, V. Cozzani / Reliability Engineering and System Safety 90 (2005) 271–284

279

Table 6 Scaled distance at which 1% damage probability is expected using the probit functions in Table 3 and the MEM model with different strength factors Strength Factor

Threshold

Equipment category atmospheric

pressurized

elongated

small

4

Probit models Bagster and Pitblado [3] Bottleberghs and Ale [31] Cremer and Warner [38] Glasstone and Dolan [9] Gledhill and Lines [23] Gugan [33] Khan and Abbasi [13] Wells [36]

0.9 – 0.1 – – 0.85 – – –

0.0 – – – – – – – –

0.0 – n.r. n.r. n.r. n.r. – – n.r.

0.0 – n.r. – n.r. n.r. n.r. – n.r.

5

Probit models Bagster and Pitblado [3] Bottleberghs and Ale [31] Cremer and Warner [38] Glasstone and Dolan [9] Gledhill and Lines [23] Gugan [33] Khan and Abbasi [13] Wells [36]

1.5 – 1.0 0.9 –

– –

0.0 – – – – – – – –

0.8 – n.r. n.r. n.r. n.r. 0.9 – n.r.

1.0 – n.r. 0.9 n.r. n.r. n.r. – n.r.

6

Probit Models Bagster and Pitblado [3] Bottleberghs and Ale [31] Cremer and Warner [38] Glasstone and Dolan [9] Gledhill and Lines [23] Gugan [33] Khan and Abbasi [13] Wells [36]

3.7 0.9 2.9 2.1 1.5 3.8 2.1 – 0.9

1.0 0.9 1.0 0.9 – 0.9 0.7 – 0.9

1.9 0.9 n.r. n.r. n.r. n.r. 2.1 – n.r.

2.5 0.9 n.r. 2.1 n.r. n.r. n.r. – n.r.

O6

Probit Models Bagster and Pitblado [3] Bottleberghs and Ale [31] Cremer and Warner [38] Glasstone and Dolan [9] Gledhill and Lines [23] Gugan [33] Khan and Abbasi [13] Wells [36]

3.8 1.2 2.9 2.3 1.6 3.7 2.3 0.7 1.2

1.3 1.2 1.4 1.2 0.8 1.2 1.0 0.7 1.2

2.1 1.2 n.r. n.r. n.r. n.r. 2.3 0.7 n.r.

2.6 1.2 n.r. 2.3 n.r. n.r. n.r. 0.7 n.r.

Comparison to scaled distances correspondent to threshold values of Table 7 for damage from blast waves is also given (n.r.: not reported).

equipment. An expression obtained from the approach of Considine and Grint [24], derived from the TNT model, is suggested for the calculation of the safety distance as a function of the threshold overpressure and of the flammable

mass of the cloud rt Z 

I 1=3 1=1:588

(6)

Pt 138

Table 7 Literature data for threshold values (kPa) for damage to process equipment caused by blast waves Source Bagster and Pitblado [3] Bottleberghs and Ale [31] Cremer and Warner [38] Glasstone and Dolan [9] Gledhill and Lines [23] Gugan [33] Khan and Abbasi [13] Wells [36] n.r., not reported.

Equipment category Atmospheric

Pressurized

Elongated

Small

35.00 10.00 14.00 23.80 7.00 14.00 70.00 35.00

35.00 30.00 35.00 65.00 38.00 42.00 70.00 35.00

35.00 n.r. n.r. n.r. n.r. 14.00 70.00 n.r.

35.00 n.r. 14.00 n.r. n.r. n.r. 70.00 n.r.

280

E. Salzano, V. Cozzani / Reliability Engineering and System Safety 90 (2005) 271–284

where rt is the safety distance (m), I is the mass of the flammable cloud (t), and Pt the overpressure threshold value (bar). The correspondent scaled distance may thus be obtained as     Patm 1=3 138 1=1:588 (7) Rt Z Pt aDHc where a is the explosion efficiency, DHc is the heat of combustion (J/kg) of the cloud, and Patm the atmospheric pressure in kPa. Assuming a value of 0.03 for a and of 46! 106 J/kg for DHc, the scaled value of the safety distance resulted of 5.45 for atmospheric vessels and of 1.84 for pressurized vessels. These values may be directly compared to those obtained by the TNT model and the probit functions developed in the present study, reported in Table 5. Comparison shows that the approach proposed by Gledhill and Lines [23] is the more conservative among those analyzed, with scaled safety distances higher of a factor 2 with respect to those obtained in the present study. However, even in this approach, a difference higher than a factor 5 is found between the safety distances for atmospheric equipment with respect to those obtained for pressurized vessels. Thus, the results obtained above as well as those reported in Tables 5 and 6 confirm the importance of a separate analysis of damage probability for the different categories of process equipment, if a quantitative assessment of domino hazard caused by overpressure has to be performed.

4. Quantitative risk assessment of domino accidents caused by blast waves 4.1. Definition of a case-study The models previously defined were specifically addressed to be used within the QRA framework to assess the contribution to industrial risk of domino effect caused by blast waves. Thus, it is important to verify if the approach developed above may be used in the quantitative assessment of risk due to domino events. A case study was defined, derived from the actual lay-out of an existing oil refinery. Table 8 shows a list of equipment considered in the analysis. Table 8 Process equipment considered in the case study

Fig. 6. Lay-out used for the case-study.

Fig. 6 shows a scheme of the lay-out defined for the casestudy. Primary events considered in the analysis were derived from a simplified hazard analysis of the storage farm. Consequences were calculated using literature models [25]. Expected frequencies of primary events were derived from the purple book [26]. Table 9 shows the characteristics of the primary scenarios considered in the analysis. In order to simplify the analysis, the primary accidents considered in the present analysis as possible causes of domino accidents were limited to the VCEs following the catastrophic failure of pressurized LPG storage vessels TK1, TK2 and of sphere TK3. With respect to secondary scenarios, a pool fire involving the entire catch basin of the tank was considered as the secondary scenario following the damage of atmospheric tanks due to blast waves. An VCE due to catastrophic failure of the secondary target was conservatively assumed as the secondary scenario following the blast wave damage of the pressurized LPG storages. Table 9 Distances and equipment damage probabilities calculated for the case study Distance (m)

Vessel

Type

Substance

Content, t

D26 D27 D28 D29 D30 D31 D32 TK1 TK2 TK3

Atmospheric tank Atmospheric tank Atmospheric tank Atmospheric tank Atmospheric tank Atmospheric tank Atmospheric tank Pressurized tank Pressurized tank Pressurized tank

Gasoline Gasoline Gasoline Gasoline Gasoline Gasoline Gasoline Propane Propane Butane

8000 8000 8000 8000 8000 8000 8000 50 50 1000

D26 D27 D28 D29 D30 D31 D32 TK1 TK2 TK3

Damage probability

TK1

TK2

TK3

TK1

TK2

TK3

221 158 242 203 163 132 136 0 70 64

157 102 173 134 95 62 72 70 0 114

187 255 275 240 200 172 165 64 114 0

0.24 0.42 0.20 0.28 0.39 0.58 0.53 – 1 1

0.42 0.92 0.36 0.53 0.95 1 1 1 – 0.85

0.47 0.28 0.24 0.31 0.40 0.52 0.57 1 0.98 –

E. Salzano, V. Cozzani / Reliability Engineering and System Safety 90 (2005) 271–284

4.2. Damage probabilities and safety distances Table 9 shows the damage probabilities of each vessel on the basis of the distance from explosion center and of vessel category, calculated using the probit models developed in the present study. A cut-off value of 0.1% was used for damage probability values reported in the table. As expected, the results obtained point out that the safety distances are widely different for atmospheric and

281

pressurized vessels, and that the damage probabilities of atmospheric vessels are much higher (of about a factor 3) than those of pressurized vessels at the same distance from the explosion center. Thus, these results confirm the importance of using different damage probability models for the different equipment categories. Figs. 7 and 8 show the safety distances for atmospheric and pressurized vessels with respect to the primary events considered. The distances were estimated using

Fig. 7. Safety distances calculated for atmospheric vessels in the case study using a 1% damage probability, the model proposed by Gledhill and Lines [23] and a damage threshold of 35 kPa [3]. Primary event: (a) VCE from TK3 catastrophic rupture; (b) VCE from TK2 catastrophic rupture.

282

E. Salzano, V. Cozzani / Reliability Engineering and System Safety 90 (2005) 271–284

Fig. 8. Safety distances calculated for pressurized vessels in the case study using a 1% damage probability, the model proposed by Gledhill and Lines [23] and a damage threshold of 35 kPa [3]. Primary event: (a) VCE from TK3 catastrophic rupture; (b) VCE from TK2 catastrophic rupture.

the threshold approach (a 35 kPa threshold value was selected [3]), the model proposed by Gledhill and Lines [23] in the report to the HSE, and the 1% damage probability calculated from the probit models developed in the present study. The figures evidence that using a single threshold value and not taking into account the differences between target categories leads to results that are surely inadequate to correctly estimate escalation safety distances. Moreover, the figures also evidence that some of the threshold values

proposed in the literature and reported in Table 7 are not conservative for atmospheric equipment, at least if compared with the results obtained in the present study. On the other hand, the approach proposed by Gledhill and Lines [23] for safety distances results very conservative if compared to the safety distances estimated with the probit models. The comparison between Figs. 7 and 8 further confirms the importance of a separate estimation of the safety

E. Salzano, V. Cozzani / Reliability Engineering and System Safety 90 (2005) 271–284

283

distances for the different categories of equipment. Differences higher than 500 m were estimated for atmospheric vessels with respect to pressurized equipment for the more severe blast wave considered (see Table 9). These results confirm that the different resistance of different equipment categories should be taken into account for a correct estimation of safety distances for blast wave damage to equipment. 4.3. Assessment of individual risk due to domino effect A methodology for the quantitative assessment of risk due to domino effect was proposed by Cozzani and Zanelli [27]. In this approach, the expected frequency of each domino effect is calculated as fde Z fp Pd

(8)

where fde is the expected frequency of the domino event, fp is the expected frequency (events/year) of the primary event and Pd is the propagation probability, as obtained from damage probability models. The consequences of the domino event may be expressed as vulnerability (death probability) maps, calculated on the basis of the vulnerability maps of the primary and secondary event Vt Z FðV1 ; V2 Þ

(9)

where V1 and V2 are the vulnerability values in a generic position, respectively, caused by the primary and the secondary event, and F is a function that needs to be defined. The available probit functions used in the literature to calculate human vulnerability only consider the response to a single physical effect (radiation, toxic concentration, etc.). No data are available for the vulnerability following the exposure to multiple damage vectors. Thus, in a QRA context only the use of simplifying assumptions may allow the estimation of vulnerability in domino scenarios. Synergetic effects may be neglected in the calculation of the physical effects caused by the accidents, and a relationship between the different events can be assumed: e.g. death probability can be considered to be the sum of that of single events (non-contemporary events), or the value corresponding to the probability of the union of independent events. An extended discussion of the problem is provided elsewhere [28]. Among the several alternative approaches that are possible, it was shown that in a QRA context the more suitable method to be applied for the calculation of vulnerability in domino scenarios leads to the following definition of function F: FðV1 ; V2 Þ Z minfðV1 C V2 Þ; 1g

(10)

Individual risk due to primary events was calculated using the Aripar-GIS software [29]. Fig. 9(a) shows the results of the individual risk calculations not considering domino effect. Fig. 9(b) reports the modification of the risk curves if

Fig. 9. Individual risk calculated in the absence (a) and in the presence (b) of domino effect due to overpressure.

domino effect is introduced in the analysis, using the quantitative assessment methodology discussed above. These results evidence that domino effect severely influences the individual risk in the case study. This is in part due to the high severity of the primary and secondary events considered in the analysis, but also to the high damage potential of VCE blast waves. As a matter of fact, introducing domino effect

284

E. Salzano, V. Cozzani / Reliability Engineering and System Safety 90 (2005) 271–284

caused an increase of the individual risk of about an order of magnitude. It must be remarked that even more severe results would have been obtained not considering that the pressurized vessels have lower damage probabilities. Thus, it may be concluded that the quantitative assessment of domino effect due to blast waves may well be obtained by the probit models developed in the present study.

5. Conclusions In the framework of the quantitative assessment of domino effect, probit models were derived for the estimation of damage probability to process equipment due to blast waves. Different probit models were introduced, in order to take into account the different structural characteristics of different categories of process equipment. The probit models were coupled to simplified models for peak overpressure calculation. This allowed a straightforward approach to the estimation of safety distances for escalation events caused by blast waves, as well as of damage probability as a function of the scaled distance from the explosion center. The approach developed was also applied to the quantitative assessment of the contribution of domino effect to individual risk. The results obtained proved that a straightforward assessment of safety distances and of domino probabilities is possible using the simplified approach developed to blast wave damage calculations.

References [1] Lees FP. Loss prevention in the process industries. London: Butterworth/Heinemann; 1996. [2] CCPS. Guidelines for chemical process quantitative risk analysis. 2nd ed. New York: AIChE; 2000. [3] Bagster DF, Pitblado RM. The estimation of domino incident frequencies—an approach. Process Safety Environ Prot 1991;69:195–9. [4] Pettitt GN, Schumacher RR, Seeley LA. Evaluating the probability of major hazardous incidents as a result of escalation events. J Loss Prev Process Ind 1999;6:37–46. [5] Contini S, Boy S, Atkinson M, Labath N, Banca M, Nordvik JP. Domino effect evaluation of major industrial installations: a computer aided methodological approach. In: Proceedings of European seminar on domino effects, Leuven 1996. [6] Khan FI, Abbasi SA. Models for domino effect analysis in chemical process industries. Process Safety Prog 1998;17:107–23. [7] Baker WE, Cox PA, Westine PS, Kulesz JJ, Strehlow RA. Explosion hazards and evaluation. Amsterdam: Elsevier; 1983. [8] CCPS. Guidelines for evaluating the characteristics of VCEs, Flash Fires and BLEVEs. New York: AIChE; 1994. [9] Glasstone S, Dolan PJ. The effect of nuclear weapons 1977. [10] Schneider P. Limit states of process equipment components loaded by a blast wave. J Loss Prev Process Ind 1997;10:185–90. [11] Haaverstad TA. Structural response to accidental explosions and fires on offshore process installations. J Loss Prev Process Ind 1994;7: 310–6. [12] HSE. Canvey: an investigation of potential hazards from operations in the Canvey Island/Thurrock Area, London 1978.

[13] Khan FI, Abbasi SA. Risk analysis of a typical chemical industry using ORA procedure. J Loss Prev Process Ind 2001;14:43–59. [14] Eisenberg NA, Lynch CJ, Breeding RJ. Vulnerability model: a simulation system for assessing damage resulting from marine spills. . In: Rep. CG-D-136-75. Rockville, MD: Enviro Control Inc.; 1975. [15] Finney DJ. Probit analysis. Cambridge: Cambridge University Press; 1971. [16] Salzano E, Picozzi B, Vaccaro S, Ciambelli P. The hazard of pressure tanks involved in fires. Ind Eng Chem Res 2003;42:1804–12. [17] Leyer JC, Desbordes D, Saint-Cloud JP, Lannoy A. Unconfined deflagrative explosion without turbulence: experiments and model. J Hazard Mater 1993;34:123–50. [18] Strehlow RA, Luckritz RT, Adamczyk AA, Shimpi SA. The blast wave generated by spherical flames. Combust Flame 1979;35: 297–310. [19] Van den Berg AC, Lannoy A. Methods for vapour cloud explosion blast modelling. J Hazard Mater 1993;34:151–71. [20] Eggen JBMM. GAME: development of guidance for the application of the multi-energy method, TNO-PML 1995. [21] Mercx WPM. Extended modelling and experimental research into gas explosions. In: International conference on safety and reliability (ESREL), Lisbon, Portugal 1997. [22] Tang MJ, Baker QA. A new set of blast curves from vapor cloud explosion. Process Safety Prog 1999;18:235–40. [23] Gledhill J, Lines I. Development of methods to assess the significance of domino effects from major hazard sites. CR Report 183. Health and Safety Executive; 1998. [24] Considine, M, Grint, GC. Rapid assessment of LPG releases, as reported in [23]. [25] Van Den Bosh CJH, Weterings RAPM. Methods for the calculation of physical effects (yellow book). The Hague (NL): Committee for the Prevention of Disasters; 1997. [26] Uijt de Haag PAM, Ale BJM. Guidelines for quantitative risk assessment (purple book). The Hague (NL): Committee for the Prevention of Disasters; 1999. [27] Cozzani V, Zanelli S. An approach to the assessment of domino accidents hazard in quantitative area risk analysis. Proceedings of 10th international symposium on loss prevention and safety promotion. Amsterdam: Elsevier; 2001. [28] Antonioni G, Cozzani V, Gubinelli G, Spadoni G, Zanelli S. The estimation of vulnerability in domino accidental events. Proceedings of European conference on safety and reliability (ESREL). London: Springer; 2004 p. 3212–17. [29] Spadoni G, Egidi D, Contini S. Through ARIPAR-GIS the quantified area risk analysis supports land-use planning activities. J Hazard Mater 2000;71:423–36. [30] Nelson RW. Know your insurer’s expectations. Hydrocarbon Process 1977;103–8. [31] Bottelberghs PH, Ale BJM. Consideration of domino effects in the implementation of the Seveso II directive in the Netherlands. In: 20th European seminar on domino effects, Leuven 1996. [32] Barton RF. Fuel gas explosion guidelines—practical application. In: IChemE symposium series no. 139, Sedgwick 1995 p. 285–6. [33] Gugan K. Unconfined vapour cloud explosions. Rugby: The Institutions of Chemical Engineers; 1979. [34] Clancey VJ. Diagnostic features of explosion damage. In: Sixth international meeting of forensic sciences, Edinburgh 1972. [35] Brasie WC, Simpson DW. Guidelines for estimating damage explosion. Loss Prev 1968;2:91–7. [36] Wells GL. Safety in process plant design. Chichester: Wiley; 1980. [37] Pickering EE, Bockholt JL. Probabilistic air blast criteria for urban structures. Mello Park, USA: Report Stanford Res. Institute; 1971. [38] Cremer and Warner Consulting Engineers and Scientists. Guidelines for layout and safety zones in petrochemical developments. Final report prepared for Highland Regional Council, as reported in [23].