5.2. Techniques Used to Evaluate Hazards to Buildings In Process Plants

Transcription

1 5 Risk Assessment Chapters 3 and 4 described a series of screening tools that can be used to evaluate the design and siting of buildings in process plants. The results from the screening for a particular building will fall into one of three risk categories: 1. The initial, consequence, or risk screening results indicated that the building was designed or sited such that it was not a concern relative to explosion or fire events. As a result, the building was screened out as not needing further consideration. 2. The initial, consequence, or risk-screening results did not clearly determine that the building was a major concern, nor could the building be removed from further evaluation on the basis of any of the screens. 3. The initial, consequence, or risk-screening results indicated that the building design or siting presented significant concern. Buildings in category 1 require no additional action beyond screening described in Chapters 3 and 4. Buildings in category 2 are candidates for further evaluation, using qualitative or quantitative risk assessment techniques. Alternatively, risk-reduction measures could be implemented and the facility rescreened to confirm that a tolerable level of risk has been achieved. Buildings in category 3 require further risk assessment and may warrant risk reduction before conducting further analysis. As discussed in Chapter 2, it is important, for any building screened from further evaluation, that process safety management systems be maintained (PSM diligence) to help ensure that the risk from an event of concern remains low. This chapter provides general information for performing qualitative or quantitative risk assessments on buildings in process plants. For detailed guidance on risk assessment techniques, the user is referred to other CCPS books on this subject, including Reference 3, Guidelines for Hazard Evaluation Procedures, Second Edition, and Reference 4, Guidelines for Chemical Process Quantitative Risk Analysis.

2 5.1. Hazard Identification and Evaluation The first step in a process plant building risk assessment is to identify specific accident scenarios that endanger building occupants. As discussed in Chapter 2 and illustrated in Table 2.1, accident scenarios are sequences of events that lead to an outcome of concern. The specific outcomes of concern are those involving explosions or fires that could impact buildings in process plants. The risk assessment process begins by identifying specific accident scenarios that apply to the facility under review. Steps include: Identify the inventories of flammable and combustible materials within the process plant and the physical conditions under which they are contained. Similarly, identify other materials or process conditions that can result in explosion events, including condensed-phase explosions, physical explosions, or uncontrolled chemical reactions. Identify credible initiating events for accidents involving explosions or fires. Identify intermediate events that either propagate or mitigate the developing accident scenario. For each initiating event, determine the various accident pathways defined by the credible combinations of intermediate events. Identify the range of possible incident outcomes affecting process plant buildings and their occupants, including explosions and fires that can result from the various accident pathways. Document the hazard evaluation process for later use in determining event frequency and consequences Techniques Used to Evaluate Hazards to Buildings In Process Plants The CCPS publication Guidelines for Hazard Evaluation Procedures, Second Edition (Ref. 3) provides considerable information on various hazard evaluation techniques that may be employed. Evaluating hazards affecting buildings in process plants may be performed as part of a review focused specifically on the siting issue or as part of a more comprehensive review intended to identify and evaluate all facility hazards. The results of previous process hazards evaluations may be used if it can be confirmed that the reviews adequately addressed explosion and fire risks to process plant buildings Key Factors to Consider in Process Plant Building Risk Assessments Although qualitative and quantitative risk assessment techniques differ in approach, they have some features in common. Regardless of the technique

3 used, the user should have a basic understanding of these common factors. This section presents general information about consequences of process plant explosions and fires and the factors that might affect the frequency of such events Selecting Scenarios for Study Using the techniques referenced in Section 5.2, a detailed list of potential accident scenarios can be prepared. This list can then be refined to give the minimum number of scenarios that need to be assessed to adequately reflect the spectrum of possible incidents and to satisfy the requirements of the study. The steps involved may include: Identifying trivial risks that do not require further evaluation Grouping similar incidents into subsets when possible and replacing them with one equivalent incident Factors that will influence the grouping are similarities in inventories, compositions, discharge rates, and discharge locations. Note that by grouping similar incidents, the frequency of occurrence of a grouped subset is the sum of the individual frequencies of the grouped events Explosion Consequence Evaluation Chapter 3 offers guidance on evaluating the characteristics (e.g., peak side-on overpressure, duration) of potential explosion or fire phenomena. Additional information is briefly summarized in Appendix A of this document. Information on performing more detailed evaluations of the consequences of these phenomena on buildings, structures, contents, and occupants is presented below. Explosion Effects on Buildings An explosion results in several structural loading effects, which can produce destructive consequences to buildings and equipment. These consequences range from minor damage to complete collapse, depending on the structure's ability to withstand the loading effects. Table 5.1 summarizes the structural loadings that result from various explosion effects. Diffraction and Drag Loading. Following an explosion, a blast wave propagates through the air outward from the explosion source and produces blast loads on structures in the blast wave's path. The shape of the blast wave depends on the nature and strength of the explosion and the distance from the epicenter. It is generally assumed to be either (1) an ideal shock wave (pressure instantaneously rises from ambient to the maximum value) for condensed-phase, pressure-volume (PV) ruptures, or very strong vapor cloud explosions (VCEs), or (2) a pressure wave with significant rise time for weaker VCEs. The blast loading on a structure includes two compo-

4 TABLE 5.1 Explosion Effects and Resulting Loading (Ref. 98) Explosion Effects Blast wave (Overpressure and negative phase pressure relative to atmospheric condition) Blast wind (Air mass movement) Projectiles (Missiles, fragments, debris) Ground shock Loading on Structures Diffraction loading forces on a structure resulting from the direct and reflected overpressure Drag loading forces on a structure resulting from the high velocity of the air particles in the blast wave flowing around the structure Impact loading forces on a structure resulting from objects moving at significant velocity and striking the structure lnertial loading forces on a structure induced by structural mass undergoing acceleration transmitted through the structure from the supporting ground nents: (1) the transient pressure distribution induced by direct and reflected overpressure (diffraction load) and (2) drag forces induced by particle velocity (blast wind) associated with the blast wave (drag load). Blast loading on objects with substantial lateral dimensions (e.g., buildings) is largely governed by the overpressure (diffraction load) aspect of the blast wave. On the other hand, slender objects (e.g., stacks, utility poles) are resistant to overpressure. Blast loading on slender objects is largely governed by the blast wind (drag load) effects of the blast wave. Also note that the overpressure consists of both a positive phase and a negative phase. The negative phase produces outward loading on the structure, which may be significant if combined with positive-phase rebound effects. Appendix A and Reference 5 provide additional information on diffraction and drag loading. Impact Loading. In addition to blast waves, an explosion may also result in the creation of fragments. Also during propagation by the blast pressure wave along the ground surface, debris may be picked up and carried along with the blast wave. This debris will travel at lower velocities than the fragments resulting directly from the explosion. The primary consequence of projectile or fragment loading is localized damage to walls or roofs such as spalling, scabbing, or perforation. Potential consequences include loss of integrity of the structure and damage to equipment or injury to personnel inside the building if fragments pass through the wall or roof with significant residual velocity. lnertial Loading. When an explosion occurs at or near the ground surface, a portion of the blast energy is transmitted directly to the ground and propagates outward as a ground shock. Also, as the blast wave propagates through the atmosphere across the ground surface, it can generate an

5 additional ground motion wave that propagates through the soil or rock to the location of buildings. Ground movement beneath a building caused by the passage of a ground shock wave will induce accelerations throughout the building, which in turn will cause inertial forces on the building and on items located inside the building. Ground-shock effects on the building will likely be insignificant compared to blast pressure loading. However, ground-shock-induced loads on items inside the building but not supported by its structure may be important and, in some situations, may represent the most significant effect on those items. Potential consequences of explosion-induced ground shock include personnel hazards such as light fixtures and ceilings falling, objects falling off shelves, and equipment being overturned. Other concerns include the effects on acceleration-sensitive equipment (e.g., a relay or switch changing state or tripping). The contents and internal components of the building can also be affected by inertial forces caused by the motion of the building structure itself as it responds to blast pressure, especially if these items are attached to the structure or in close proximity to the walls of the structure. Explosion Effects on People A blast wave's direct effects on people include damage to lungs and eardrums. The secondary effects of explosions involve the consequences of fragments and debris (Ref. 61). These may include potentially exposing personnel to building debris resulting from damage or collapse of portions or the entire building being subjected to blast overpressure. Cutting fragments can penetrate the skin, while noncutting fragments can lead to blunt trauma on impact. Tertiary effects of explosions are those injuries or fatalities caused as people are knocked down or thrown by the blast into stationary objects. Reference 101 provides additional guidance on explosion effects on people Fire Consequence Evaluation Consequences of fire depend upon the intensity and duration of the fire, the separation distance, and the thermal exposure that the receptor(s) can withstand. For structures, this level is the energy that will ignite wood or other combustible materials or will degrade the strength of materials such as steel. Reference 5 provides spacing criteria to limit the above effects. Guidelines for thermal damage are also provided in another CCPS publication, Guidelines for Chemical Process Quantitative Risk Analysis (Ref. 4). Guidelines for thermal radiation effects on people may be found in References 33, 62, and 63. Thermal radiation damage criteria for ignition of materials and injury to people are provided in References 40, 53, and 64. As discussed in Chapter 3, in evaluating fire consequences to people, consideration should be given to the ability of building occupants to evacuate and the potential for personnel exposure during evacuation,

6 taking into account the fire, radiant heat, and smoke ingress impacts on the building and potentially mitigating factors, such as fire protection systems and the use of personnel protective equipment. NFPA 101, Life Safety Code, provides additional information on the protection of building occupants from fire Frequency Evaluation All risk assessment techniques, whether qualitative or quantitative, require an estimate of frequency of event occurrence. This frequency, which is extremely site specific, can be influenced by many factors. Factors Influencing Event Frequency Appendix A of Reference 4 presents a list (which does not presume to be exhaustive) of possible event scenarios for chemical processing facilities. These include: Overpressuring of a process or storage vessel caused by loss of control of reactive materials or external heat input Overfilling of a vessel or knockout drum Opening of a maintenance connection during operation Major leaks at pump seals, valve stem packing, flange gaskets, etc. Excess vapor flow into a vent or vapor disposal system Tube rupture in a heat exchanger Fracture of a process vessel, causing release of contents Line rupture in a process piping system Failure of a vessel nozzle Breaking off of a small-bore pipe such as an instrument connection Drain or vent valve inadvertently left open Condensed-phase phenomena All these events, along with the others included in Reference 4, have occurred in the chemical industry. Factors to consider when determining event frequency include the following: History of previous incidents. Frequent incidents, especially serious ones, indicate a breakdown in process safety management systems. They also indicate that the facility may be more likely to have additional incidents, unless the underlying causes have been determined and specific actions have been implemented to prevent their reoccurrence. In evaluating event frequency, past incidents can provide invaluable guidance. For example, if a pump seal failure is identified as having the potential to lead to a vapor cloud release, and if previous pump seal failures have occurred frequently, it might be reasonable to conclude that such a scenario is likely. This conclusion may be valid even though previous pump seal failures did not result in a vapor cloud.

7 Process operating conditions. Some process conditions that may increase the frequency of an event include extremely high temperature or pressures or extremely low temperatures; highly exothermic reactions; processes handling highly corrosive, erosive, or unstable materials; or processes subject to frequent pressure or temperature cycling. Conversely, processes that are not corrosive or operate at moderate pressures and temperatures may be less likely to have an event as a result of corrosion or a process-induced failure. Design allowance or design integrity. Although processing facilities are designed and built to appropriate codes and standards, many process mechanical designs have additional conservatism built into them. This can take the form of extra wall thickness for piping, upgraded metallurgy, or even additional processing capacity such as dual trains to allow for more frequent maintenance. Any of these factors might decrease the likelihood of an event of concern. Operating complexity. Complex operations may introduce the potential for overlooking safety-related issues in the design phase and may also present challenges for operators to accurately and quickly assess plant upsets and respond with appropriate action. Human factors. Frequent manual operations may increase the potential for an event to occur. Even under optimum circumstances, the probability of human error can be high. An example is an operation requiring the repeated draining of water from a vessel containing hydrocarbon. If the drain time is of sufficient duration that the operator is tempted to leave the drain valve open while attending to other duties, the operator could forget to return and close the valve, leading to a hydrocarbon release. Age of facility. Older equipment, particularly equipment subject to frequent thermal or mechanical cycling, may have a higher frequency of failure. Additionally, newer equipment may incorporate improvements designed to reduce the potential for equipment failure. This consideration can be applied not only to individual pieces of equipment but to entire process units. It is important to note that age does not necessarily increase the likelihood of equipment failure. Properly designed, inspected, and maintained equipment in fact may have a low likelihood of failure. Years of operating experience may provide valuable information such as the locations of high-corrosion rates areas in piping and may also bring about repeated design improvements. Overall effectiveness of protective systems and emergency controls. Protective systems, such as alarms, shutdown systems, and emergency controls, are often the keys to incident prevention and timely operator response. Protective systems that are properly designed, tested, and well maintained can reduce the frequency of event occurrence. Conversely, systems that are not tested and maintained may result in a high frequency of event occurrence.

8 Effectiveness of process safety management systems. The above factors are addressed through a facility's process safety management systems. The CCPS Guidelines for Technical Management of Chemical Process Safety (Ref. 1), Guidelines for Implementing Process Safety Management Systems (Ref. 65), and Plant Guidelines for Technical Management of Chemical Process Safety (Ref. 2) describe the essential areas of management activity necessary for reducing the likelihood of explosions and fires. The effectiveness of these management systems is a key factor in assessing the overall frequency of an event. Factors such as those above may act independently of one another. An evaluation of event frequency should consider all such factors applicable to a specific site. Site-Specific Nature of Event Frequency and Management's Role It is clear from the above discussion that determining event frequencies is heavily influenced by site-specific factors, since both technology and management practices may vary greatly from site to site. In the case of technology, the variety and complexity of process plant operations demand that this be the case. A good design in one facility may be a poor design in another, depending on the application. Even with appropriate technology, the effectiveness of a facility's process safety management systems may be the key factor affecting the frequency of an event. For example, two similar facilities with similar technology may have different procedures for ensuring process and equipment integrity. One may have an effective mechanical integrity system, including a piping corrosion monitoring program, with a historical record of inspection findings, and a system for addressing identified corrosion problems. The other facility may have a limited corrosion program and a history of frequent corrosion leaks. The likelihood of an event from corrosion failure would be reasonably expected to be greater in the second facility. Similar analogies can be developed for any element and component of process safety management. Process safety management systems are dynamic and can become increasingly effective or ineffective with time. In the example above, the facility with the effective corrosion monitoring program may have significantly reduced the potential frequency of a release at the time the program was actively implemented. A change in priorities or personnel could result in a reduction of necessary resources for the corrosion monitoring program. In this event, the frequency of release could increase. In a similar fashion, establishment of an effective corrosion monitoring program at the second facility, over time, could decrease the frequency of a corrosion failure. The dynamic nature of process safety management systems requires management to continually monitor the effectiveness of these systems to ensure that plant risks are controlled to tolerably low levels. Reference 66, CCPS's Guidelines for Auditing Process Safety Management, and Reference 2, Plant Guidelines for Technical Management of

9 Chemical Process Safety, offer guidance on auditing methods and practices. Additional reference material can be found in CCPS's Guidelines for Technical Management of Chemical Process Safety (Ref. 1). As a final note, a history of incident-free operation and effective process safety management systems do not guarantee that an event impacting process plant buildings will not occur. Instead, this situation implies that likelihood of event occurrence may be low. Management should still weigh the likelihood of an event to occur against the consequences, recognizing that even the most effective process safety management system may break down from time to time. If a facility is designed with buildings that are sited inappropriately, or with construction insufficient to withstand an evaluation-case explosion or fire, the risk to these buildings could still be intolerably high Qualitative Risk Assessment Qualitative risk assessment uses experience, judgment, and engineering estimates as the basis for determining event consequences and frequency. Qualitative risk assessments are usually the result of the collective judgment of a multidisciplined team of qualified individuals. The expertise represented on a team to assess risk to buildings in process plants might include operations, process engineering, consequence modeling (e.g., blast overpressure, radiant heat), and civil/structural engineering. The team approach permits discussion, exchange of opinions, and debate, while reducing the possibility of one individual's opinion skewing the results. The advantage of a qualitative approach is that it can usually be accomplished more quickly than a quantitative study, with lower overall resource requirements. In addition, qualitative analysis methods are less narrowly focused than are quantitative methods, thus increasing the likelihood of identifying and evaluating a broad spectrum of hazards. Qualitative analysis often constitutes the basis, or starting point, for quantitative studies. Members of the team need to have a good grasp of the concept of risk to make accurate judgments. When undertaking a qualitative risk assessment, the team should be carefully instructed on the approach's potential pitfalls. The team's assessment of risk can be incorrect if its judgment of consequence or frequency is not appropriate. A team might attach a very low frequency to a scenario that has very severe consequences. This would result in a low risk prediction, possibly leading to dismissal of a risk that, in fact, may be a significant concern. If the team has doubt as to the validity of its risk assessment, partial or complete quantitative risk analysis should be used to increase the confidence in frequency, consequence, or overall risk estimates Qualitative Consequence Evaluation Qualitative consequence evaluation involves defining broad categories, which are based on the general level of injury and damage that could

10 reasonably be expected to result from accident events. Table 5.2 presents an example of qualitative consequence categories. Explosion consequences in terms of overpressure and other effects may be evaluated by appropriate methods such as those described in Reference 5 and Appendix A. In evaluating the consequences of potential explosions, all these methods account for the energy of the explosion, the location of the explosion source, and attenuation of explosion effects with distance from the explosion source. From such an evaluation, maximum blast parameters can be determined at all locations of interest. Evaluation results can be graphically expressed by plotting contours of equal blast overpressure on a site plan of the facility, as shown in Figure 4.4. Potential building damage and degree of occupant injury resulting from blast were discussed in Chapters 3 and 4. The consequences to buildings and people from blasts resulting from detonations have also been estimated by a number of investigators based on generic empirical data. Glasstone and Dolan (Ref. 52) provide data relating consequences to blast effects from nuclear explosions. These data are summarized in Appendix B of Reference 5 and in Reference 64. In addition, overpressure versus damage correlation is provided in References 54, 67, and 68. A correlation between overpressure and personnel injuries is given in Reference 69 and is summarized in Reference 64. Based on this empirical information and that given in Table 3.5, a simple and conservative relationship between qualitative descriptions of explosion consequences and blast overpressure may be developed. Table 5.3 presents an example adapted from Appendix B of Reference 5. The overpressure-consequence relationship in Table 5.3 is given for typical buildings of ordinary construction (i.e., not blast-resistant design). This qualitative characterization of consequences does not explicitly account for the specific structural characteristics of a particular plant building nor does it account for the impulse or duration of the blast wave. As a result, the TABLE 5.2 Example Qualitative Description of Consequences Damage Level 1. Minor 2. Moderate 3. Major 4. Catastrophic Associated Effects on Buildings, Personnel, and Plant Building performs function. Building is reusable following an explosion. Only minor repairs needed. Very little risk to occupants because of building damage. Zero to 10 days of downtime. Building performs function. Building is not reusable following an explosion. Major repairs needed that equal or exceed replacement cost. Risk of some injury to some occupants caused by building damage. Ten to 90 days of downtime. Building severely damaged. High risk of severe injury to occupants caused by building damage. Downtime in excess of 90 days. Building destroyed. High risk of fatality. Extended downtime.

11 relationship between consequences and overpressure must be conservative to encompass the characteristics of many possible types of plant buildings. Table 5.3 may be used in conjunction with the estimate of blast overpressure contours discussed previously to conduct a qualitative site assessment for the design and siting of buildings in process plants Qualitative Frequency Evaluation Qualitative frequency evaluation can be used to screen out events that are extremely unlikely to occur (i.e., have such a remote chance of occurring that further evaluation is unnecessary). This method is particularly appropriate for use in conjunction with qualitative consequence evaluation as a means of ranking risks. Qualitative frequency evaluation involves defining broad categories of event frequency, which can be used to assess the likelihood of occurrence of a specific incident outcome (consequence). These categories cover a full spectrum of frequencies, from those representing events that are likely to those that are highly unlikely. Definitions of likelihood categories vary, but Table 5.4 presents a typical list and definitions. As discussed in Section 5.3, site-specific conditions, including previous incident history, must be considered when assigning likelihood categories. The assessment team must have a thorough working knowledge of plant systems and practices to make a reasonable judgment of event likelihood. TABLE 5.3 Example Side-on Overpressure Consequence for Representative Buildings Consequence Category 1. Minor 2. Moderate 3. Major 4. Catastrophic Description Significant cosmetic damage to structure. Building repair is possible. Possible minor personnel injury due to glass breakage, scabbing, etc. Possible deformation of structural members, short of failure. Building may be reusable with repair. Possibly some debris. Personnel injury from debris is likely. Possible failure of isolated structural members. Partial building collapse. Building cannot be reused and must be replaced. Possible serious injury or fatality of some building occupants. Complete collapse of structure. Probable serious injury or fatality of all occupants. Side-on Overpressure Threshold for Ordinary Building, psi (bar) >0.5 (>0.03) >1(>0.07) >2 (>0.14) >3 (>0.21)

12 Qualitative Risk Evaluation Risk is determined qualitatively by combining the qualitative assessments of the consequences and likelihood. A qualitative risk assessment may be accomplished as part of a thorough process hazards analysis (PHA), such as a hazard and operability study (HAZOP), where the team addresses (qualitatively) the consequences and likelihood of scenarios that have the potential for impacting buildings. Depending upon the knowledge and experience level of the PHA team and the nature of the scenarios being evaluated, the PHA team may be able to reach sound, defensible conclusions about the risks to building occupants. One useful tool for assisting in qualitative risk decision making is a "risk matrix" utilizing the qualitative frequency and consequence categories previously described. Figure 5.1 presents an example of a risk matrix. By prioritizing the risks from each scenario evaluated, the risk matrix provides management with a tool for identifying possible scenarios that are candidates for risk reduction, or for more detailed quantitative risk assessment. For example, the risk matrix in Figure 5.1 is a 4-by-4 matrix with risk priority values ranging from I to IV. An event that is catastrophic (consequence category 4) and likely to occur (frequency category 4) gets a risk priority of I. This is a very high risk event and would be a candidate for risk reduction. On the other extreme, events that are minor (consequence category 1, as indicated in Table 5.3 or 5.6) receive a risk priority of IV, although they may be likely to occur. Because of the low severity of the consequences, further evaluation need not be considered. Using a tool such as a qualitative risk ranking matrix can be very useful in identifying low-risk buildings. For those events that have potentially major or catastrophic consequences to buildings and their occupants, however, a qualitative risk matrix may not always be an appropriate final evaluation. For events that are potentially major or catastrophic, regardless TABLE 5.4 Example Qualitative Frequency Categories Category 1. Extremely unlikely (or remote) 2. Very unlikely 3. Unlikely 4. Likely Typical Description Not realistically expected to occur Not expected to occur (but not incredible) Unlikely to occur in the plant's lifetime but could occur in one of a number of similar plants May occur at least once in the lifetime of the installation Approximate Corresponding Quantitative Frequency (per Year) <10' 5 icr 5 toi(r 3 10' 3 tolo" 2 >10" 2

13 of assigned likelihood, further analysis is needed. Caution should be exercised to ensure that buildings potentially subject to major or catastrophic consequences are not prematurely screened, based on unsubstantiated, qualitative judgment Quantitative Risk Analysis Quantitative risk analysis (QRA) involves the determination of event consequences and frequencies using detailed engineering calculations and estimates. The cost of conducting a QRA can be substantial. Such costs may be justified when the cost of risk reduction is very high and the actual risk appears to be marginally tolerable, based on previous analysis or historical data. However, QRA may be of limited value if the prior screening or qualitative analysis clearly indicates that risk-reduction measures are needed and those risk-reductions measures have been identified. The QRA will only confirm this conclusion, with the overall cost for identifying and addressing the issue increased by the cost of performing the QRA. Figure 5.2 presents a flowchart, which can assist in determining if QRA is justified for a specific building. Applying the decision flowchart to a building results in one of three outcomes: 1. The plant building under consideration will withstand the evaluation-case accident with little or no damage. 2. Low-cost modification of existing buildings may reduce or eliminate the risks to occupants. 3. No low-cost modifications that reduce risk to the building to a tolerable level can be identified. In outcome 1, no need exists to resort to risk reduction or QRA. In outcome 2, the major contributors to the risk have been identified and can be remedied at reasonable cost, and again QRA is not necessary. In outcome 3, either the contributor to the risk is not well defined or the cost to reduce the risk is unacceptably high. In this case, the insight provided by QRA can provide additional guidance in making risk-based decisions Quantitative Consequence Evaluation Quantitative consequence evaluation requires determination of the blast overpressure and other explosion or fire effects that can impact a process plant building and a detailed analysis of the building's response. This section presents a brief description of the methods for determining the building response to explosions and how to interpret that response in terms of consequences to the building. Appendix B contains a general discussion on the principles of building design and evaluation for explosion effects.

14 Increasing Likelihood Frequency Category Consequence Category Source: JBF Associates, Inc., Knoxville, TN. Example Risk Ranking Categories Increasing Severity Number I Il III IV Category Intolerable Undesirable Tolerable with controls Tolerable as is Description Should be mitigated with engineering and/or administrative controls to a risk ranking of III or less within a specified time period such as six months Should be mitigated with engineering and/or administrative controls to a risk ranking of III or less within a specified time period such as 1 2 months Should be verified that procedures or controls are in place No mitigation required Source: Stone and Webster Engineering Corporation, Houston, TX Figure 5.1 Example qualitative risk matrix (adapted from Ref. 3).

15 STAGEl: EVENTIDENTIFICATION The major events that apply to the facility are identified (e.g., vapor cloud explosions, condensed phase explosions, exothermic chemical reactions, BLEVEs, ruptures, jet fires, pool fire, and fireballs). STAGE 2: DETERMINE EVALUATION-CASE EVENTS Those events that are judged to be plausible or reasonably believable for the facility are selected from the list generated in stage 1. Events considered to be impossible or highly unlikely are not considered. STAGE 3: ASSESS CONSEQUENCES The potential consequences for those evaluation-case events selected in stage 2 are estimated either qualitatively or quantitatively, and the case outcome, in terms of impact on the building under consideration, is identified. Refer to Section for guidance on consequence assessment. STAGE 4: ASSESSBUILDINGDESIGNANDLOCATION Can the building under consideration withstand the evaluation case consequences identified in stage 3? No further assessment necessary. STAGES: INVESTIGATEPOSSIBLEMODIFICATIONS For new or existing buildings, can improvements be carried out at reasonable cost? Carry out modifications. No further assessment necessary. STAGE 6: QUALITATIVERISKASSESSMENT Can issues be addressed with qualitative risk assessment? No further assessment necessary. STAGE?: QRA QRA is carried out for the building under consideration. A full QRA for the entire facility is not necessary. Only those accidents that may impact the building need to be considered. Figure 5.2 Is QRA necessary? Important Blast and Structure Characteristics Several factors affect the structural performance of a building or other structure subjected to explosion loadings (Ref. 71). These factors relate to the nature of the blast wave and the structural characteristics of the building components. The primary blast wave and structural factors are as follows:

16 Blast Wave Factors Peak side-on overpressure during the positive phase of the blast wave Impulse or duration of the blast load (Impulse is the area under the pressure-time curve. Duration is the length of time of the overpressure phase of the blast wave.) Shape and rise time of the overpressure waveform; shock (zero rise time) is usually the worst case Structural Factors Strength. Ability of each structural component of the building to withstand overpressure and impulse loads. Mass and stiffness. These relate to the natural period of vibration or natural frequency of the components. The relationship between the dynamic characteristics of the structure (i.e., natural frequency) and the dynamic characteristics of the blast load (i.e., duration or impulse) affects the magnitude of the structural response to blast pressures. Ductility. Ability of structural components to absorb the blast energy without collapse or excessive deformation and damage. Shape and configuration. One-story, rectangular-shaped buildings exhibit better resistance to overpressure than multistory or irregular-shaped buildings. Structural loadings from an explosion are of short duration and have limited energy content. Evaluation of dynamic structural response to blast pressure loadings differs from design practices for conventional static loads in that the time-varying characteristics of the loading, the inertial and vibratory characteristics of the structure, and structural response beyond elastic limits must be considered. Because of the short-duration, limitedenergy characteristics of blast loadings, slight amounts of inelastic (plastic) response of structures subjected to blast loadings will not result in significant damage as long as the structure has been designed for ductile behavior. As a result, nonlinear dynamic response analyses are usually needed to properly evaluate damage to buildings subjected to loading from explosions. Static elastic analyses will not provide realistic results for building response to blast loading. Based on detailed modeling of the building and the overpressure versus time loading, the building response can be evaluated by dynamic, nonlinear structural analyses as discussed above. Appendix B discusses the principles of such analyses. Building response is determined in terms of structural member displacements and stresses. Expected consequences in terms of building structure damage for various forms of building construction (e.g., steel, reinforced concrete, masonry) are given in many references, including References 7, 64, and 72 through 75. Appendix B discusses relating calculated building response to various levels of structural damage using such references. Consequences of interest for QRA can be determined from the calculated building displacements and the corresponding predicted damage

17 levels. The consequence of interest is the probability of serious injury or fatalities as discussed in Chapter 4 for risk screening. Relationships between building damage levels and probability of serious injury or fatality can be developed in the same manner as that done for risk screening. Such relationships are developed assuming that building occupant survivability as a function of damage level is independent of the force system that caused the damage. Probability of serious injury or fatality versus building damage can then be developed from observations of past events (Refs. 55, 56, and 57), as discussed in Appendix B. From the calculated building damage versus response relationship and the empirical probability of serious injury or fatality versus damage relationship discussed above, the relationship between explosion overpressure (or other effects) and probability of serious injury or fatality may be constructed in a manner that accounts for the detailed structural characteristics of plant buildings. The steps involved are similar to risk screening (Chapter 4), with the addition of detailed quantitative structural evaluation of plant buildings and detailed quantitative frequency assessment as described in the next section Quantitative Frequency Evaluation In a quantitative frequency evaluation, the process plant is usually sectioned into definable volumes or inventories. Event scenarios, typically based on events identified and evaluated as discussed in Section 5.1, are defined. Failure rate data preferably, but not necessarily, site specific are applied to the process piping, vessels, machinery, and other equipment to quantify event frequencies. If failure data for a given event are not known, the frequency of the event can be calculated using other tools, such as fault tree analysis and event tree analysis. Frequency estimates, together with a quantification of the consequences resulting from the event scenarios, determine the risk. Once the frequency and the magnitude of the identified event scenarios are known, these can be combined with information on site-specific variables, such as ability to isolate, sources of ignition, and emergency response to estimate the probability that a scenario will lead to the event of concern. References 4 and 5 discuss further detail on quantitative frequency assessment, as well as the advantages and limitations of the techniques. Some specific determinations to be made for releases of flammable materials might include the following: Frequency of release (determined by appropriate methods, including data base search and/or fault trees) Probability of effective/protective isolation Probability of turbulent mixing with air Probability of ignition Probability of flame propagation into confined or congested areas

18 Probability of personnel present in process plant buildings Probability of personnel evacuation Guidance on performing a quantitative frequency evaluation is beyond the scope of this book. Reference 4 provides detailed guidance on frequency evaluation Quantitative Risk Determination Population and individual risk can be determined in the same manner as discussed in Chapter 4. These risk measurements can then be compared with risk tolerance criteria, or decision methodologies can be used, to assist in making risk-reduction decisions about process plant buildings. As QRA involves an explicit consideration of both the frequency and consequences of accidental events, it promotes a balanced perspective in the assessment and control of major hazards. QRA is valuable in reconciling divergent opinions that may arise between those who, irrespective of consequences, tend to dismiss the risk on the grounds of its remoteness and those who tend to concentrate on the possible consequences irrespective of their likelihood of occurrence. Risk Uncertainty The uncertainty in a risk estimate needs to be identified as part of a risk assessment. It is unproductive to carry out extensive, complicated risk assessments if the uncertainty in the final answer is high. Basic, simple risk estimates would be preferable in this case. Use of absolute risk estimates (i.e., comparison against a target risk value) is more sensitive to uncertainty than is relative use (i.e., risk ranking) (Ref. 4). The reason for this is that, with relative applications, the same methodology and assumptions are usually used to evaluate the various alternatives. As a result, comparative risk estimates are subject to similar uncertainties. The simplest and most appropriate way to evaluate uncertainty is by using sensitivity analysis on the risk assessments. Sensitivity to a parameter is defined as the change in risk measure per unit change in that parameter (Ref. 76). Sensitivity studies allow estimation of the contribution of various parameters to the total uncertainty in the result of a QRA. Such studies can identify major contributors to overall risk for a list of incidents and can identify which models, assumptions, and data are important to the final risk estimate.