THE ASSESSMENT OF MAJOR ACCIDENT HAZARDS CAUSED BY EXTERNAL EVENTS

THE ASSESSMENT OF MAJOR ACCIDENT HAZARDS CAUSED BY EXTERNAL EVENTS Valerio Cozzani 1, Ernesto Salzano 2, Michela Campedel 1, Martina Sabatini 3 and Gigliola Spadoni 1 1 Dipartimento di Ingegneria Chimica, Mineraria e delle Tecnologie Ambientali, Alma Mater Studiorum Università di Bologna, Viale Risorgimento 2, 40136 Bologna, Italy; e-mail: valerio.cozzani@unibo.it, michela.campedel@mail.ing.unibo.it, gigliola.spadoni@mail.ing.unibo.it 2 Istituto di Ricerche sulla Combustione, Consiglio Nazionale delle Ricerche, via Diocleziano 328, 80124 Napoli, Italy; e-mail: salzano@irc.cnr.it 3 Dipartimento di Ingegneria Chimica, Chimica Industriale e Scienza dei Materiali, Università di Pisa, via Diotisalvi 2, 56126 Pisa, Italy; e-mail: m.sabatini@ing.unipi.it The analysis of accident databases evidences that several of the major accidents recorded were caused by external events as domino effects from adjacent plants, or natural events as earthquakes or floods. More recently, high public concerns were raised among the possibility of external attacks to industrial facilities aimed to trigger severe accidental scenarios. In this framework, the assessment of equipment vulnerability to external impacts is a key issue for a correct identification of all accidental scenarios and a global quantitative risk assessment. To this aim, we have assumed that the impact should be classified and identified by means of only two criteria: i) the probability of occurrence; ii) the intensity of impact, as characterised by a single degree of freedom, for any accidental scenario. In the paper, this second point only has been developed. More specifically, radiation, overpressure and fragment impact were considered as variables to describe and classify respectively fires, vapour cloud explosions and catastrophic equipment failure when domino effects are of concern. On the other hand, peak ground acceleration was considered for the evaluation of equipment fragility with respect to seismic events. A slightly different approach was developed for external acts of interference, as terrorist attacks. In this case, models for the vulnerability of equipment and of the available layers of protection were introduced to understand the potential effects of the credible modes of external attack identified in SVA procedures. KEYWORDS: external events, domino effect, NaTech hazards, vulnerability assessment, security INTRODUCTION Quantitative Risk Analysis is mandatory in good engineering practices for the safe running of chemical/industrial processes manipulating hazardous materials. Nevertheless, deep inconsistencies, technical field-restricted view, or even trivial neglecting of possible hazards emerge when international guidelines, enforced norms, published papers and open or commercial software are analysed under the light of the interaction of external events (e.g. natural events, terrorist attacks) with industrial installations, or in the light of risks due to the interaction between different plant sections or even among adjacent industrial installation (domino effects). The analysis of accident databases evidences that several of the major accidents recorded were caused by external events. Several categories of external events were reported as causes of accidents: domino effects from other plants, natural events as earthquakes or floods, impact of vehicles. More recently, after September 11 th, a high concern was raised among the possibility of external attacks to industrial facilities aimed to trigger severe accidental scenarios. The assessment of external events caused by domino effect from nearby plants is required for all the industrial facilities under the obligations of the European Community Seveso Directives. On the other hand, accidental events coming from natural events are not explicitly mentioned, although the same Directives require to address all the possible major accidents, defined as an occurrence such as a major emission, fire, or explosion resulting from uncontrolled developments in the course of the operation of any establishment..., thus comprehending also accidents triggered by external events. With reference to the assessment of the possible effects of external attacks, no mention is given neither by the Directives concerned with the prevention of major accidents or by specific legislation. Nevertheless, due to the growing concern about this threat, the possible development of specific requirements for the assessment of this possible cause of accidental events is foreseeable. A further issue is that in the conventional approach to risk analysis, process plants or storage sites where hazardous materials are present are usually considered as a risk source. However, in the case of several external events (domino effect from nearby installations, natural events, external interference) the site of concern may be as well considered a critical target, due both to the consequences of activity interruption (e.g. in the case of critical facilities as gas and oil pipelines, oil refineries, oil storage and distribution centers, etc.) and due to the potential amplification of the consequences of the triggering event due to the damage of 1

the installation. Scarce attention is paid in conventional approaches to the vulnerability of an industrial installation, and only few models are available to understand the behavior of industrial facilities considered as targets of external events. In spite of the growing concern that the issues cited above are receiving by public opinion and by European commission, the development of technical tools for the assessment of hazards coming from external events has received scarce attention so far. No well accepted or widely used methodologies exist to identify the possible major accidents triggered by external events on the basis of a systematic analysis of the plant lay-out. Indeed, at the state of the art, this assessment is often carried out by the use of generic and un-validated threshold values as in the case of domino effect from nearby plants. Besides, no specific assessment is usually carried out for natural events, although these are in general taken into account by conventional procedures in the structural design of plant equipment. Finally, only qualitative procedures, as safety vulnerability assessments (SVA) are proposed for the analysis of possible threats coming from external events. In this framework, the present contribution is focused on the following specific hazards: i) domino effect (also known as escalation or knock-on), i.e. catastrophic industrial accidents triggered by an escalation vector (a blast wave due to an explosions, radiation caused by fires, fragments projected by a catastrophic vessel failure) originated by a primary accidental scenario; ii) natural hazards, i.e. natural events interacting with industrial equipment; iii) terrorist attacks directly on equipment (e.g. by the use of projectiles) or un-directly, e.g. through explosives located at a certain distance with respect to the target equipment. An insight of these issues will be provided in the following, jointly to the discussion of the current and the future approaches for the quantitative evaluation of these events in a QRA framework. COMMON FRAMEWORK FOR THE ASSESSMENT OF EXTERNAL HAZARD FACTORS It is widely recognized that several very different types of external events may cause the damage of a process plant: e.g. domino effect and floods, seismic events and terrorist attacks, hurricanes and forest fires. Up to date, most of the approaches to the problem were focused on the development of specific methodologies to qualitatively or (more rarely) quantitatively address the risk coming from a specific external hazard factor. However, developing and applying a specific approach for each of the possible hazard factors that may impact on process plants or storage sites is time consuming and results in a disperse and ineffective strategy for a global risk assessment. As a matter of fact, although the external hazard factors are different, the escalation effects that may derive from the impact of these factors on the installation of concern may be schematized to a few possible alternatives. Thus, a common framework may be defined for the assessment of the possible consequences of the impact of external hazard factors on a specific installation. Moreover, if the modalities of impact and of damage generation of the different external events are considered, a quite limited variability results, indicating that rather few impact modes should be considered to assess the damage experienced by the installation of concern. These premises should make clear the potential advantages that may arise from the development of a common framework to the analysis of the impact of external events on industrial facilities where hazardous substances are processed or stored. Previous studies on the specific assessment of domino effect (Cozzani & Salzano, 2004; Cozzani et al., 2005) and on seismic events (Fabbrocino et al., 2005; Cozzani et al., 2007) suggested to adopt the general procedure schematized in Figure 1 for the implementation of such an approach. As shown in the figure, the starting point of the procedure is the analysis of each external hazard factor to identify the impact vectors. These were defined as the modalities by which damage to process and storage equipment may result due to the external event (e.g. radiation, overpressure and fragment projection in the case of domino events, seismic waves in the case of earthquakes, water height and velocity in the case of floods, etc.). Associated to the problem of the identification of the impact vectors is the identification of a intensity parameters for the characterization of their expected intensities. In this preliminary stage of the analysis, the framework of risk analysis calls for the selection of simplified approaches, able to yield a significant representation of the expected impact vector intensity, although in some cases associated to a limited loss of detail in the description of the event: e.g. the selection of static peak overpressure for the description of blast wave intensity in explosions (Cozzani & Salzano, 2004), or of peak ground acceleration to represent the intensity of seismic events (Salzano et al., 2003). Once the intensity parameters are defined, in most cases these may be estimated with a limited effort from existing risk or hazard maps (e.g. seismic maps, flood hazard maps, etc.) usually available for the region where the site of concern is located. This preliminary assessment step is the one that retains most of the information concerning the external events, thus requiring a specific approach for each different external event considered in the analysis. Moreover, the level of available information at this stage may be different, depending on the specific features of the external hazard and on the information available on the region where the site is located. In particular, a specific characterization is usually available for primary accidents likely to generate off-site domino events. Detailed information are as well available in most European countries and in the US on possible seismic or flood events, and on other natural events that may result in interference on normal plant operations. Data may be available on the expected frequencies and/or likely intensity of these events. On the other hand, no data are usually available on expected intentional external 2

Figure 1. Flow chart of the general assessment procedure for the risk caused by external events impacting on process plants or storage installations where relevant quantities of hazardous substances are present interference acts. A relevant effort to harmonize the approaches in this step is still required. The results obtained in the present research project for domino effect, seismic events, and intentional interference acts are discussed in section Specific frameworks for external hazard factors of the present paper. As shown in the following, a limited number of impact vectors may derive from this analysis: e.g. the impact vectors identified for domino effect and for external interference are the same (radiation, overpressure and missile projection), although associated to very different primary scenarios and to different intensities. For each impact vector, a single degree of freedom was selected in order to characterize the intensity of the event. In the following step of the procedure, possible target equipment should be identified. This step is crucial to limit the analysis to relevant secondary accidents, that result in a relevant escalation of the external event triggering the accidental sequence. Past accident databases evidence that the more critical process equipment items are those where relevant quantities of fluids are present. Thus, thresholds based on substance quantities and on the physical state of the substance may be introduced (Cozzani et al., 2005). For each of the equipment items considered in the analysis, damage states may be defined on the basis of previous approaches proposed for the assessment of damage (HAZUS, 2004; Cozzani & Salzano, 2004). A discretization of damage states was introduced, defining a limited number of damage states associated to a limited number of release states. The reference scenario associated to the damage state may be the worst-case scenario deriving from the Loss of Containment (LOC) following the damage state of concern. Each damage state is associated to a conditional probability of occurrence that is dependent on the severity of the external event, as described by the above discussed intensity parameters. As shown in the following, simplified vulnerability models based on probit functions were derived for the more important equipment categories. Besides the category of equipment, these vulnerability models are mainly dependent on the characteristics and on the intensity of the impact vector. Since vulnerability models are associated to the impact vector, the same model may be used for different external events, provided that these result in similar impact vectors, thus limiting the complexity of the analysis. After the calculation of the probability of each damage state, a standard procedure may be used for all the following steps of the procedure: consequence analysis of reference scenarios may be based on conventional models available in the literature, while steps 6 to 9 in Figure 1 may be performed by the standard procedure for the assessment of multiple scenarios originally developed for the quantitative assessment of domino effect (Cozzani et al., 2005) and recently extended to the assessment of accidental scenarios triggered by seismic events (Cozzani et al., 2007). In the case of external interference acts, the unavailability of reliable data on the expected frequencies of the primary event suggests to limit the procedure to the assessment of the possible hazard. In this case, conditional probabilities estimated at step 4 and 3

combination probabilities calculated at step 7 define the probability of success of a given attack in triggering the overall scenario of concern. SPECIFIC FRAMEWORKS FOR EXTERNAL HAZARD FACTORS THE ANALYSIS OF DOMINO EFFECTS Domino effects are responsible of several catastrophic accidents that took place in the chemical and process industry. In the recent years a detailed study was performed on the definition, the methodologies for the assessment of escalation effects and on the integration of risk assessment procedure with simplified correlations (Cozzani & Salzano, 2004; Cozzani et al., 2005; Cozzani et al., 2006a; Cozzani et al., 2006b). The main impact vectors associated to domino events are radiation and overpressure, although escalation due to fragment projection is also possible. Whatever the primary scenario induced by the loss of control of any process, the assessment of possible domino scenarios starts with the identification of the possible secondary targets that may be damaged by the primary event. This is usually performed by the use of damage thresholds. However, this is a critical point in domino assessment. As a matter of fact, the use of un-necessary conservative assumptions to define thresholds for accident escalation may turn out in extremely high safety distances, un-practical or un-acceptable from a technical and Table 1. Summary of the specific escalation criteria for obtained for the different primary scenarios Scenario Escalation vector Modality Target category Escalation criteria Flash fire heat radiation fire impingement all but floating roof tanks escalation unlikely floating roof tanks ignition of flammable vapours Fireball heat radiation flame engulfment atmospheric I. 100 kw/m 2 pressurized escalation unlikely stationary radiation atmospheric I. 100 kw/m 2 pressurized escalation unlikely jet-fire heat radiation fire impingement all escalation always possible stationary radiation atmospheric I. 15 kw/m 2 pressurized I. 40 kw/m 2 pool fire heat radiation flame engulfment all escalation always possible stationary radiation atmospheric I. 15 kw/m 2 pressurized I. 40 kw/m 2 VCE overpressure MEM F 6; M f 0.35 atmospheric P. 22 kpa MEM F 6; M f 0.35 pressurized; elongated (toxic) P. 16 kpa MEM F 6; M f 0.35 heat radiation fire impingement see flash fire see flash fire confined overpressure blast wave interaction atmospheric P. 22 kpa explosion pressurized; elongated (toxic) P. 16 kpa mechanical explosion overpressure blast wave interaction atmospheric P. 22 kpa pressurized; elongated (toxic) P. 16 kpa fire impingement all see flash fire fragment projection all fragment impact BLEVE overpressure blast wave interaction atmospheric P. 22 kpa pressurized; elongated (toxic) P. 16 kpa fragment all fragment impact point-source atmospheric P. 22 kpa explosion pressurized; elongated (toxic) P. 16 kpa I: heat radiation intensity; P: maximum peak static overpressure. 4

Table 2. Available vulnerability models for atmospheric and pressurized vessels Equipment category Escalation vector Type of vulnerability model Vulnerability model Atmospheric Radiation Probit model based on ttf and models for ttf vs. radiation Atmospheric Overpressure Probit model based on peak static overpressure Pressurized Radiation Probit model based on ttf and models for ttf vs. radiation Pressurized Overpressure Probit model based on peak static overpressure Y ¼ 12.54 1.847.ln(ttf) ln(ttf) ¼ 21.13. ln(i) 2.67.10 25 V þ 9.9 Y ¼ 218.96 þ 2.44 ln(p s ) atmosp. Y ¼ 228.07 þ 3.16 ln(p s ) elongated Y ¼ 217.79 þ 2.18 ln(p s ) auxiliary Y ¼ 12.54 1.847. ln(ttf) ln(ttf) ¼ 20.95. ln(i) þ 8.845 V 0.032 Y ¼ 242.44 þ 4.33 ln(p s ) ttf: time to failure (s); V: vessel volume (m 3 ); I: radiation (kw/m 2 ); Ps: maximum peak static overpressure (Pa). economic point of view. Moreover, the use of extremely conservative thresholds for accident propagation results in the need of assessing a huge number of possible secondary scenarios, in particular if complex lay-outs are considered. It must be remarked that the possible damage of n secondary units by a single primary event results in the possibility of 2 n different domino scenarios to be assessed in a QRA (Cozzani et al., 2004). Escalation criteria based on a thorough damage and consequence analysis were defined for four categories of equipment, respectively atmospheric tanks, pressurised tanks, elongated vessels and small reactors. Results are presented in Table 1. Probability of the different damage states may be estimated on the basis of literature vulnerability models developed for these equipment categories (Salzano & Cozzani, 2006; Cozzani & Salzano, 2006). Table 2 shows an example of vulnerability models developed for atmospheric and pressurized vessels. THE ANALYSIS OF INTERACTION OF SEISMIC EVENTS WITH INDUSTRIAL INSTALLATION When seismic events interact with industrial facilities and in particular with chemical, petrochemical and oil processing industries, severe releases of hazardous materials may be triggered, possibly resulting in direct damages and injuries to people in the nearby area, as well as in indirect damages due to the delay of rescue operations following the natural event. The peak ground acceleration of seismic signal (PGA) has been considered as the more appropriate parameter to describe the intensity of the scenario. For this specific natural event, as for the domino effects, escalation criteria should be considered. Fragility curves were developed, starting from a consistent data set describing the behavior of equipment loaded by earthquakes: P½ðDS or RSÞŠ ¼ F 1 PGA ln (1) b m where b is respectively the standard deviation of the natural logarithm of PGA for the damage state (DS) or the release state (RS) and m is the median value of the PGA at which the equipment reaches the threshold of damage state DS or RS (Salzano et al., 2003; Fabbrocino et al., 2006). Table 3 reports the minimum threshold value of PGA for loss of containment (PGA k ) for atmospheric storage tanks (anchored and unanchored). Results show that, as expected, PGA k strongly depends on the filling level. The absolute Table 3. PGA threshold values (PGA k ) for damage states DS and release states RS for atmospheric storage tanks subjected to earthquakes RS value DS value Type of storage Fill level PGA k [g] 2 Considerable loss of containment 3 Total (instantaneous) loss of containment 2 Low structural damages 4 High structural damage Anchored 50% 0.11 Near full 0.08 Unanchored 50%. 0.11 Near full. 0.03 Anchored 50%. 0.61 Near full. 0.29 Unanchored 50%. 0.17 Near full. 0.12 5

Table 4. Expected types of interference, level of information required (A: general; B: specific; C: detailed), impact vector and expected maximum release state (severity increases from R1 to R4) Type of interference Required level of information Impact vector Release state atmospheric eq. Release state pressurized eq. Deliberate Misoperation C n.d. R2 R1 Interference by C n.d. R2 R1 Simple Means Interference by C n.d. R3 R2 Major Aids Arson by simple Means C Radiation R3 R2 Arson by Incendiary B Radiation R4 R3 Devices Vehicle Accident B Impact R3 R3 Shooting (minor) A Impact R1 R1 Shooting (major) A Impact R4 R4 Explosives B Overpressure R4 R4 Plane Accident A Impact R4 R4 minimum value for RS3, which is important for risk assessment purposes, since catastrophic releases may trigger accidental scenarios, was reached for near full unanchored storage tanks. This value may be considered as the conservative option in a QRA context, if limited information is available on the type of tank and on the filling level. Similar approaches are currently under development for other natural events and for other equipment categories. THE ANALYSIS OF EXTERNAL INTERFERENCE ACTS In the case of external interference acts, in order to identify and quantify the possible hazards, the identification of the possible targets and of the typology of interference are the starting points. The analysis of conventional SVA approaches allowed the identification of the possible acts of interference (SFK, 2002; API-NPRA, 2003; Uth, 2005). These are listed in Table 4. The table also reports the level of information on the facility of concern needed to perform the attack. The impact vectors associated to each type of interference are also shown in the table. Data in Table 4 evidence that most of the impact vectors associated to the more severe interference acts are similar to those identified for domino effect. The analysis of the expected release states following these acts of interference are shown as well in Table 4. The identification of the impact vector and of the credible release states allows the selection of the appropriate vulnerability models and reference scenarios. By the way, the analysis of Table 4 shows that some of the vulnerability models required for the assessment of the probability of damage and release states following the attack may be derived from those developed for the analysis of domino effect. CONCLUSIONS A general framework was defined for the assessment of the risk caused by external events impacting on sites where relevant quantities of hazardous substances are stored or manipulated. The methodology allows a unified approach to the analysis of escalation triggered by the external event by the definition of impact vectors to which equipment vulnerability models correspond. Equipment vulnerability models were obtained on the basis of a simplified description of the external event, based on the identification of a single parameter to quantify the intensity of the event at the location of interest. A general procedure was applied to the identification of reference scenarios, and to frequency and consequence assessment of the overall scenarios. The procedure was applied to the analysis of off-site domino effects, seismic events and intentional external interference acts. Its extension to the analysis of other natural events is currently under development. REFERENCES American Petroleum Institute, National Petrochemical & Refinery Association, 2003. Security Vulnerability Assessment Methodology for the Petroleum and Petrochemical Industries. Antonioni G., Spadoni G. & Cozzani V., 2007. A methodology for the quantitative risk assessment of major accidents triggered by seismic events, J. Hazard. Mater. in press. Cozzani V. & Salzano E., 2004. The quantitative assessment of domino effect caused by overpressure. Part I: probit models. Journal of Hazardous Materials, 107:67 80. Cozzani V., Gubinelli G., Russo G., Salzano E., & Zanelli S., 2004. An assessment of the escalation potential in domino scenarios, Proc. 11th Int. Symp. on Loss Prevention and Safety Promotion in the Process Industries, PCHE: Prague p. 1153. Cozzani V., Gubinelli G., Antonioni G., Spadoni G. & Zanelli S., 2005. The assessment of risk caused by domino effect in quantitative area risk analysis. Journal of Hazardous Materials, 127:14 30. 6

Cozzani V. & Salzano E., 2006. Equipment vulnerability models for the assessment of domino hazard, Chem. Eng. Trans. 9:107 112. Cozzani V., Gubinelli G. & Salzano E., 2006a. Escalation Thresholds in the Assessment of Domino Accidental Events, Journal of Hazardous Materials, A129:1 21. Cozzani V., Tugnoli A. & Salzano E., 2006b. Prevention of domino effect: from active and passive strategies to inherently safe design. Journal of Hazardous Materials, in press. Fabbrocino G., Iervolino I., Orlando F. & Salzano E., 2005. Quantitative risk analysis of oil storage facilities in seismic areas. Journal of Hazardous Materials, 12:361. HAZUS, 1997. Earthquake Loss Estimation Methodology, National Institute of Building Science, Risk Management Solutions, Menlo Park, CA. Lees F.P., 1996. Loss Prevention in the process industries, II Ed., Butterworth-Heinemann, Oxford (UK). Salzano E., Iervolino I. & Fabbrocino G., 2003. Seismic risk of atmospheric storage tanks in the framework of quantitative risk analysis. Journal of Loss Prevention in the Process Industry, 16:403. Salzano E. & Cozzani V., 2006. A Fuzzy Set Analysis to estimate loss intensity following Blast Wave Interaction with Process Equipment. Journal of Loss Prevention in the Process Industry, 19:343 352. Stör-fall Kommission (SFK), 2002. SFK GS 38, Report of the German Hazardous Incident Commission. Uth H.-S., 2005. Combating interference by unauthorised persons. Journal of Loss Prevention in the process industries, 18:293 300. 7