Application to a case study of the Aramis methodology for the identification of reference accident scenarios

Transcription

1 Safety and Security Engineering 277 Application to a case study of the Aramis methodology for the identification of reference accident scenarios C. Delvosalle, C. Fiévez & A. Pipart Faculté Polytechnique de Mons, Major Risk Research Centre, Belgium Abstract In the framework of the European ARAMIS project, two complementary approaches were developed to serve as a basis for the whole risk assessment process. On the one hand, through a Methodology for the Identification of Major Accident Hazards (MIMAH), according to a bow-tie approach and on the basis of the equipment type and the properties of the substance handled, the major accidents (without considering safety systems) are identified through generic fault and event trees. On the other hand, a Methodology for the Identification of Reference Accident Scenarios (MIRAS) was developed to study the influence of safety systems on the occurrence probability of the accident and on the extend of its effects. Finally, thanks to a "Risk Matrix", the Reference Accident Scenarios are selected on the basis of their frequency and their potential consequences, evaluated qualitatively. The Reference Accident Scenarios are those which are the most representative of the actual risk level of the plant. These methods were tested on five companies across Europe. One case study will be presented here. The feed-back from these case studies demonstrates that MIMAH and MIRAS are consistent and applicable. They provide a conceptual and methodological framework for risk analysis. The main difficulties met come from the lack of reliable data about frequencies and performances of safety systems, even if some various bibliographic data were obtained. These methods can have promising applications in other fields and are strongly connected with other parts of ARAMIS such as severity computation or management efficiency assessment. Keywords: Aramis project, accident scenarios, risk analysis, bow-tie, case studies, Seveso Directive.

2 278 Safety and Security Engineering 1 Introduction In the framework of the European ARAMIS project (Accidental Risk Assessment Methodology for IndustrieS), this paper aims at presenting the feedback of applications of the Methodology for the Identification of Major Accident Hazards (MIMAH) and the Methodology of the Identification of Reference Accident Scenarios (MIRAS) on five case studies across Europe. The first methodology, called MIMAH (Delvosalle et al [1]), defines the maximum hazardous potential of an installation. The term "Major Accident Hazards" must be understood as the worst accidents likely to occur, assuming that no safety systems are installed or that they are ineffective. The second methodology, called MIRAS (Delvosalle et al [2],[3]) takes into account the influence of safety systems on both the occurrence probability of the accident and on the extent of its effects. The reference accident scenarios are finally chosen with the help of a tool called "risk matrix", crossing the frequency and the consequences of accidents. This methodology leads to identify more realistic accident scenarios which are then used for the severity evaluation of the plant. These methodologies are applied here on one case study, a chlorine production plant. 2 Description of the plant The case study considered in this paper for the application of MIMAH and MIRAS and the presentation of feedback, is a production unit of chlorine. The chlorine is obtained by electrolysis of salt in water, and then purified, dried, condensed and finally stored in a cryogenic storage. 3 MIMAH The objective of MIMAH is to predict which major accidents are likely to occur on a chemical plant. The main tool on which MIMAH is based is a bow-tie, centred on a critical event (CE). The left part of the bow-tie, named fault tree, identifies the possible causes of a critical event. The right part, named event tree, identifies the possible consequences of a critical event. The 7 steps of MIMAH in order to build these bow-ties are: the collection of data needed; the identification of potentially hazardous equipment; the selection of relevant hazardous equipment; the association of relevant CE with dangerous equipment; the building of fault trees for each CE; the building of event trees for each CE; the building of complete bow-ties for each selected equipment. 3.1 Collect needed data In order to prepare the application of ARAMIS and in particular, of MIMAH, a preliminary visit is useful to meet the industrialists for a first contact, to explain the objectives of ARAMIS and to collect the data needed. First of all, general data about the plant are needed, such as plant layout, description of processes,

3 Safety and Security Engineering 279 description of equipment and pipes (size, temperature and pressure). It is also necessary to obtain information about the substances stored or handled (quantities, physical properties), and their hazardous properties (risk phrases). For example, the chlorine is stored in a cryogenic storage with a maximum capacity of 55 tons. It is operated at the atmospheric pressure with an overpressure of 20 mbar and at -34 C. The chlorine is in liquid phase with a boiling temperature of -34 C. This substance is toxic by inhalation (R23), irritating (R36, 37, 38) and very toxic to aquatic organisms (R50). 3.2 Identify potentially hazardous equipment On the basis of information collected, a list of the hazardous substances present in the plant is drawn up. To achieve this, MIMAH proposes a typology of hazardous substances based on the Seveso II Directive [4] and on the risk phrases found in the 67/548/EC Directive [5]. A list of equipment containing these substances is then drawn up. ARAMIS proposes sixteen equipment categories (Delvosalle et al. [3]). Finally, it is necessary to precise in which physical state the substance can be found in the equipment (solid, liquid, twophase, gas/vapour). The result of this step is the list of potentially hazardous equipment identified on the plant. Once the needed data are obtained, the identification of potentially hazardous equipment by this threefold typology (hazardous substances, physical state, equipment) is straightforward. 3.3 Select the relevant hazardous equipment Among the equipment containing an hazardous substance, only some ones are selected as relevant hazardous equipment. It means that they may participate significantly to the risk created by the plant. An equipment containing hazardous substances will be selected as a relevant one if the quantity of hazardous substance in this equipment is higher or equal to a threshold quantity. This threshold depends on the hazardous properties of the substance, its physical state, its vaporisation tendency and eventually its location with respect to another hazardous equipment (possible domino effects). The method for the selection of relevant hazardous equipment is inspired from the "Vade-Mecum" proposed by the Walloon Region [6]. For the chlorine plant, 17 pieces of equipment were pre-selected as potentially hazardous and only 7 were finally selected as relevant hazardous equipment. These selected pieces of equipment are those which will be studied in the following steps of the MIMAH methodology. The method for the selection of equipment must not be applied blindly. If an equipment is judged hazardous due to the presence of an hazardous substance and/or by the operating conditions inside the equipment, it can be selected as a relevant hazardous equipment and studied according to MIMAH, even if the mass in the equipment is lower than the threshold. Moreover, some equipment near the plant boundaries could be selected due to their possible effects on close targets.

4 280 Safety and Security Engineering 3.4 Associate relevant critical event with hazardous equipment The centre of the bow-tie, the critical event, is defined as a loss of containment or a loss of physical integrity. Twelve critical events are defined in MIMAH. Two matrices, one crossing the type of equipment and the 12 potential critical events and an other one crossing the physical state of the substance handled and the 12 potential critical events, allow to associate a list of critical events with each selected hazardous equipment. In our example, one of the equipment type considered is a cryogenic storage, handling a liquid substance. The combination of the two matrices gives as result that 5 critical events are retained and associated with the cryogenic storage of chlorine (fig. 1). The critical event CE5 "start of fire" was not analysed because it requires some specific risk phrases (R7, R8, ), and these risk phrases are not associated with the chlorine. The critical event CE11 "vessel collapse" was not possible due to a full vacuum design of the vessel. It remains thus 3 critical events to study for the chlorine cryogenic storage. Decomposition Explosion Materials set in motion (entrainment by air) Materials set in motion (entrainment by a liquid) Start of a fire (LPI) Breach on the shell in vapour phase CE1 CE2 CE3 CE4 CE5 CE6 CE7 CE8 CE9 CE10 CE11 CE12 Breach on the shell in liquid phase Leak from liquid pipe Leak from gas pipe Catastrophic rupture Vessel collapse Collapse of the roof Cryogenic EQ7 X X X X X X X Liquid STAT2 X X X X X X Results X X X X X Figure 1: Choice of the critical events for the chlorine cryogenic storage. Table 1: Causes tied to sizes of breach/leak. Causes tied to a large breach/leak Internal overpressure, excessive mechanical stress due to external causes, insufficient initial mechanical properties of the structure, brittle rupture Causes tied to a medium breach/leak Functional openings (pipe at the shell connection, relief safety valve, first valve, manhole) Causes tied to a small breach/leak Degradation of the mechanical properties (erosion, corrosion, ) For some critical events, namely the breaches on shell and the leaks on pipes, three sizes of breach/leak are defined: large, medium and small. The main causes which lead to these three sizes of breach/leak are quite different, as shown in Table 1. Moreover, even if the event trees (the right part of the bow-tie) are the same for the three sizes, they are considered separately because the consequences and the effects of a small, medium or large breach/leak are not the same. It is then important to give figures for these sizes. ARAMIS proposes to consider, by

5 Safety and Security Engineering 281 default, sizes for which generic frequencies of critical event can be found in the literature. Proposed values are detailed in Table 2. Table 2: Values for the size of breaches and leaks. Size of breach / leak CE6 and 7: Breaches Diameter of the breach CE8 and 9: Leaks Diameter of the leak Large 100 mm diameter Full bore rupture Medium 35 to 50 mm diameter or diameter of the fitting 22 to 44% of the pipe diameter Small 10 mm diameter 10% of the pipe diameter During the five case studies performed during the ARAMIS project, 8 different critical events were identified among the 12 critical events defined in the MIMAH methodology. The four remaining ones (decomposition, explosion, materials set in motion (air/liquid)) were not considered because they are actually tied to solid substances, not present in the five test cases. 3.5 For each critical event, build a fault tree The left part of the bow-tie is a fault tree. MIMAH provides generic fault trees associated with each critical event. For the application of MIMAH, the generic fault trees must not be used blindly but they should be used as checklists and as support for further discussions during a second visit on site. It must also be pointed out that the whole generic fault trees must not be given to the analysis team, otherwise some particular causes linked to the plant and equipment could be missed. These fault trees must be adapted for a given equipment. Some causes in fault trees may be removed or added according to the design, the operating conditions, the actual external conditions of the equipment. For example, during the second visit on site, a very specific cause of catastrophic rupture of the chlorine cryogenic storage was identified and added in the fault tree. It was an internal explosion of NCl 3. NCl 3 is a by-product generated during the production of chlorine. This product is soluble in chlorine and can explode if its concentration in the solution is higher than 11%. The explosion does not need any specific ignition energy. It is also possible to build several fault trees for a same critical event according to the life phase of the equipment (during start-up, maintenance, shutdown, ) because the causes can be different than the ones in operating phase. Moreover, some safety systems are maybe not activated during these phases. Finally, the generic fault trees are not in opposition with other methods of risk analyses. For example, a risk analysis by an HAZOP was tested during one of test cases. The conclusions are that this systematic analysis of process variables and their possible deviations often lead to direct causes in the generic fault trees (overcompression, combustion/explosion, overfilling, thermal weakening, thermal expansion) and then to a critical event. So, HAZOP leads to obtain several different linear fault trees, made up of one single cause branch. Moreover, the HAZOP study does not take into account the external causes, the human errors and the degradation of mechanical properties. However, the

6 282 Safety and Security Engineering HAZOP seems a complementary method to the proposed generic fault trees in order to identify other possible causes, especially for process equipment (like reactor, distillation column, process unit). 3.6 For each critical event, build an event tree The right part of the bow-tie, the event tree, represents the possible consequences of the critical event studied. On the basis of the equipment type, the handled substance, its physical state and hazardous properties, the generic event trees are built with an automatic matrix-based method. An extensive description of the method can be found in Delvosalle et al. [1]. No difficulties were encountered with the building of event trees, but they can be modified if some events are not possible for the given equipment and for the actual external/internal conditions. In conclusion, the generic fault and event trees defined in MIMAH seem convenient and easy to use. 3.7 For each selected equipment, build the complete bow-ties MIMAH ends with the construction of complete bow-ties for each selected equipment. Each bow-tie is obtained by the association of a critical event, its corresponding fault and event tree respectively on the left and on the right. The bow-ties associated to each relevant hazardous equipment are major accident scenarios, assuming that no safety systems (including safety management systems) are installed or that they are ineffective. They are the basis for the application of the Methodology for the Identification of Reference Accident Scenarios, MIRAS. 4 MIRAS The objective of MIRAS is to choose Reference Accident Scenarios (RAS) among the Major Accident Hazards identified with MIMAH. The Reference Scenarios are those which have to be modelled in order to calculate the Severity of the plant (Planas et al. [7]), which in turn is compared with the vulnerability of the surroundings of the plant (Tixier [8]). The principal steps of MIRAS are: the calculation of the critical event frequency; the calculation of the dangerous phenomena frequencies; the qualitative estimation of dangerous phenomena consequences; and the use of the risk matrix in order to select the RAS. All these steps are performed taking into account the influence of safety systems and the safety management system. 4.1 Calculation of the critical event frequency The frequencies of critical events can be estimated either by the analysis of the fault tree or by using generic critical events frequencies. In the first approach, a complete analysis of the fault tree is made, starting from the frequencies (or probabilities) of the initiating events and taking into account the influence of safety systems in order to calculate the frequency of the

7 Safety and Security Engineering 283 critical event. The initiating events are defined as the first causes upstream of each branch leading to the critical event in the fault tree. The risk analysis team has to determine the frequency or the probability of each initiating event with the help of qualitative frequencies (Delvosalle et al. [2],[3]). ARAMIS gives also an overview of data available for the frequencies (or probabilities) of initiating events. In parallel, the influence of safety barriers on the accident scenario (the bow-tie) is taken into account. The identification of barriers is made with the industrialists (operators, safety officers, ), with the help of "process and instrumentation diagrams" or with any other existing documentation. Once the safety barriers are identified and placed on the fault tree, it is necessary to assess their level of confidence (LC). More details about definitions, concepts, ways to assess the LC are given by De Dianous and Fiévez [9]. According to the type of barrier, their influence on the fault tree is different. The "avoid" barrier implies that the event located just downstream is supposed impossible. The corresponding branch will thus not influence the critical event frequency anymore. The "prevention" and "control" barriers decrease the transmission probabilities between two events in the fault tree and influence the critical event frequency. Indeed, if the level of confidence of a barrier on a branch is equal to n, then the frequency of the downstream event on the branch is reduced by a factor 10 -n (Delvosalle et al. [10]). An example issued from the test case is shown in fig. 2. After the evaluation of the initiating events probabilities, the identification of safety barriers and the evaluation of LC, it is possible to process throughout the fault tree in order to calculate the frequency of the critical event by a gate-to-gate method. Human error 1 E -1 B607: Maint., inspect, managmt of change B610: start-up procedure Blocked outlet 1 E -3 B253: level control, filling of another tank + empty space Overfilling 1 E -5 LC 1 LC 1 LC 2 Figure 2: Influence of safety barriers on a branch of a fault tree. The alternative way is to estimate directly the frequency of the critical event. Aramis proposes a compilation of published data. There are a lot of uncertainties on these values, the origin of these data are not very precise and their application conditions are not known. This means that the users have has to be careful when handling these figures. 4.2 Calculation of the dangerous phenomena frequencies The objective, at this stage, is to proceed step by step in the event tree to obtain, as output, the frequency of each dangerous phenomenon. A dangerous phenomenon is the last item on the right of the event tree, such as a poolfire, an explosion, a toxic cloud, etc.

8 284 Safety and Security Engineering In a first step, the transmission probabilities (e.g. probabilities of immediate or delayed ignition,...) in the tree must be assessed. In a second step, safety barriers related to the event tree side have to be taken into account, both in terms of consequences and frequency of dangerous phenomena. Briefly, it can be pointed out that the prevention and control barriers decrease the transmission probability between two events and influence the dangerous phenomena frequencies. The limitation barriers reduce the consequences of dangerous phenomena in limiting their source term or in limiting their effects. The methods for the identification and the assessment of safety barriers in the event trees are identical to the ones used for the fault tree. 4.3 Estimation of the class of consequences of dangerous phenomena The selection of Reference Accident Scenarios (RAS) is based on the evaluation of the frequency of dangerous phenomena, together with their potential consequences. The consequences of each dangerous phenomenon are evaluated. At this stage, the evaluation is only qualitative, based on four classes of consequences defined according to potential consequences in term of effects on human targets, effects on the environment and domino effects (Delvosalle et al. [2],[3]). A quantitative assessment will be made in the ARAMIS part devoted to the calculation of the Severity, but this step is made after the selection of RAS. 4.4 Selection of the Reference Accident Scenarios The selection of RAS is obtained thanks to a tool, called "Risk Matrix" crossing the frequency and the potential consequences of accidents (fig. 3). Three zones are defined in the risk matrix: the lower green zone ("Negligible effects" zone), the intermediate yellow zone ("Medium effects" zone) and the upper red zone ("High effects" zone) /year 10-3 /year 10-4 /year 10-5 /year 10-6 /year 10-7 /year 10-8 /year "High Effects" Red zone "Medium Effects" Yellow zone "Negligible Effects" Green zone C1 C2 C3 C4 Figure 3: Risk matrix. Each dangerous phenomenon resulting from bow-ties must be placed in the risk matrix, according to its estimated frequency and class of consequences. Dangerous Phenomena in yellow and red zones are the Reference Accident Scenarios and have to be modelled for the severity calculations.

9 Safety and Security Engineering 285 It should be reminded that the matrix is not intended to acceptor not the risk, but it is only a guidance to select reference accident scenarios. The risk matrix should not be used blindly. One can always choose to model a scenario located in the green zone if it is believed necessary to do so. At the very worst, this will only be time consuming but also offer the possibility to appreciate the real impact of questionable scenarios. 4.5 Comments related to the MIRAS part during the test cases The synthesis of data published about frequencies of initiating and critical events shows that there is a great discrepancy in figures found, and in the quantity of data available for the different initiating events. It was thus preferred to use specific plant data, either available or estimated with the analysis team. During the test cases, check-lists of safety barriers developed during the ARAMIS project were very useful to identify actual safety tools. The feedback of applications shows that the assessment of Level of Confidence (LC) of safety barriers is sometimes difficult. Even if the IEC [11] and standards [12] give the criteria to assess this LC for safety instrumented systems, it is difficult to determine the needed parameters, like "Safe Failure Fraction" and "Fault Tolerance". Concrete data on equipment or methods in order to determine these parameters, especially for safety systems involving human factors, have still to be established. Excepting those difficulties, MIRAS was correctly applied during the test cases. On the chlorine plant, the scenarios identified are in the green or yellow zone of the risk matrix. Those in the yellow zone are modelled in order to evaluate the global severity induced by the plant (Planas et al. [7]). 5 Conclusion MIMAH and MIRAS were tested in five chemical plant across Europe. Feedback from these case studies were included in the tools presented here and thus these methods are believed to be consistent and applicable. They provide a conceptual and methodological framework for risk analysis. The main difficulties met come from the lack of reliable data about frequencies and performances of safety systems, even if some various bibliographic data were obtained. An European data collection program should be really interesting and could propose a truly ARAMIS compatible database. Moreover, these methods can have promising applications in other fields, like the occupational safety or the hazardous substances transportation safety and are strongly connected with other parts of ARAMIS such as severity computation or management efficiency assessment. Acknowledgements The work presented in this paper has been elaborated in the frame of the EU project ARAMIS Accidental Risk Assessment Methodology for IndustrieS,

10 286 Safety and Security Engineering co-ordinated by INERIS (F) and including EC-JRC-IPSC-MAHB (I), Faculté Polytechnique de Mons (B), Universitat Politècnica de Catalunya (E), ARMINES (F), Risø National Laboratory (D), Universita di Roma (I), Central Mining Institute (PL), Delft University of Technology (NL), European Process Safety Centre (UK), École des Mines de Paris (F), École des Mines de Saint Etienne (F), École des Mines d Alès (F), Technical University of Ostrava (CZ) and Jozef Stefan Institute (Si). The project is funded under the Energy, Environment and Sustainable Development Programme in the 5 th Framework Programme for Science Research and Technological Development of the European Commission. References [1] Delvosalle, C., Fiévez, C., Pipart, A., Casal Fabrega, J., Planas, E., Christou, M. & Mushtaq, F. ARAMIS project: Identification of Reference Accident Scenarios in SEVESO establishments, Proceedings ESREL, Maastricht, Netherlands, pp , 2003 [2] Delvosalle, C., Fiévez, C. & Pipart, A. ARAMIS Project: Reference Accident Scenarios Definition in SEVESO Establishment, SRA-Europe, Paris, France, in press [3] Delvosalle, C., Fiévez, C. & Pipart, A. ARAMIS Project: A comprehensive Methodology for the Identification of Reference Accident Scenarios in process industries, Journal of Hazardous Materials, in press [4] Council Directive 96/82/EC of 9 December 1996 on the control of major accident hazards involving dangerous substances, Official Journal of the European Communities, No L 10, pp.13-33, 14 January 1997 [5] Council Directive 67/548/EEC of 27 June 1967 on the approximation of laws, regulations and administrative provisions relating to the classification, packaging and labelling of dangerous substances, Official Journal No P 196, pp , 16 August 1967 [6] Ministry of Walloon Region, Belgium, Vade Mecum: Spécifications techniques relatives au contenu et à la présentation des études de sécurité, Direction Générale des Ressources Naturelles et de l'environnement, Cellule Risque d'accidents Majeurs, 2000 [7] Planas E., Ronza A., Casal J.,(2004) Aramis project: the risk severity index, Proceedings Loss Prevention, Prague, Czech Republic, 31 May-3 June 2004 [8] Tixier J., Dandrieux A., Dusserre G., Bubbico R., Luccone L.G., Mazzarotta B., Silvetti B., Hubert E., Rodrigues N., Salvi O., Gaston D. (2004) Vulnerability of the environment in the proximity of an industrial site, Proceedings Loss Prevention, Prague, Czech Republic, 31 May-3 June 2004 [9] De Dianous V. & Fiévez C., Aramis project: A more explicit demonstration of risk control through the use of bow-tie diagrams and the evaluation of safety barrier performance, Journal of Hazardous Materials, in press

11 Safety and Security Engineering 287 [10] Delvosalle, C., Fiévez, C., Pipart, A., Debray, B. & Londiche H. (2004) ARAMIS project: Effect of safety systems on the definition of Reference Accident Scenarios in SEVESO establishments, Proceedings Loss Prevention, Prague, Czech Republic, 31 May-3 June 2004 [11] IEC 61508, Functional safety of electrical, electronic and programmable electronic safety-related systems, parts 1-7, International Electrotechnical Commission, Geneva, 1998 [12] IEC 61511, Functional safety instrumented systems for the process industry sector, parts 1-3, International Electrotechnical Commission, Geneva, 2001