A SIMPLIFIED APPROACH TO THE ASSESSMENT OF DOMINO EVENTS CAUSED BY EXTERNAL FIRES

A SIMPLIFIED APPROACH TO THE ASSESSMENT OF DOMINO EVENTS CAUSED BY EXTERNAL FIRES Gabriele Landucci 1, Gianfilippo Gubinelli 1, Cristiano Nicolella 1 and Valerio Cozzani 2 1 Dipartimento di Ingegneria Chimica, Chimica Industriale e Scienza dei Materiali, Università di Pisa, Via Diotisalvi 2, 56126 Pisa, Italy; e-mail: gabriele.landucci@ing.unipi.it, g.gubinelli@ing.unipi.it, c.nicolella@ing.unipi.it 2 Dipartimento di Ingegneria Chimica, Mineraria e delle Tecnologie Ambientali, Alma Mater Studiorum Università di Bologna, Viale Risorgimento 2, 40136 Bologna, Italy; e-mail: valerio.cozzani@unibo.it Domino effect is responsible of severe accidents that took place in the chemical and process industry. Several studies pointed out that the more critical step in the quantitative assessment of domino hazards is the availability of reliable models to estimate the possibility of escalation due to the effects of the primary accident. In the case of fires caused by the accidental releases of flammable substances, it is well known that secondary events with catastrophic consequences may result as a consequence of flame impingement on equipment and pipes. Several technical standards suggest to evaluate the possible damage to process equipment caused by fire using threshold values for radiation intensity that do not take into account safety and site-specific factors, as the presence of improved thermal protection systems or the possible mitigation due to effective emergency response. An alternative to this oversimplified approach are very complex and time consuming models available for the detailed calculation of the time to failure of storage vessels, requiring a detailed description of vessel geometry and other design data. An important benefit to the safety management of possible domino hazards would come form the availability of an approach to the calculation of the possibility and probability of vessel damage following external fires based on simplified correlations able to take into account specific protection factors. The present study was focused on the development of a simplified methodology for the calculation of the damage probability of process vessels aimed to the quantitative assessment of domino effect triggered by fire scenarios. The methodology is based on simple analytical functions relating the time to failure of vessels to the radiation intensity. These were validated by an integrated approach, based on the use of available experimental data, of the ANSYS finite elements code for complete thermal and mechanical simulations of the behaviour of vessels exposed to fires and of a simplified model for vessel failure based on thermal nodes. The correlations were obtained for atmospheric as well as for pressurized storage vessels. Specific correction factors were introduced in order to take into account the effect of protection materials. Damage probability was estimated by a probabilistic function derived from layer of protection analysis (LOPA). LOPA was used to estimate the probability of effective mitigation on the basis of the calculated time to failure and of site-specific factors The presence and the delay time for the activation of protection systems were also considered. A fundamental issue in the development of the correlations resulted the presence of thermal protection layers on storage or process vessels. In particular, the possible use of innovative materials for passive protection systems as basalt rock fibres resulted in a high impact on the time to failure. Due to the lack of literature data on the properties of these materials, experimental data were obtained from a specific facility. The data were used to correctly analyse the effect of these protection panels on the time/temperature profile of vessel wall and to determine the physical properties of the materials, such thermal conductivity and emissivity, necessary input for finite elements simulations and for simplified threshold correlations. The approach evidenced that important differences in the possibility and probability of domino effect triggered by external fires should be expected if differences among vessel characteristics and protection systems are taken into account. This was confirmed by the quantitative assessment of the risk caused by domino effects triggered by fires, performed using a specific software and the damage probability models discussed above. KEYWORDS: domino effect, escalation, vessel time to failure, vessel passive protection INTRODUCTION Domino effect is responsible of severe accidents that took place in the chemical and process industry (Lees, 1996; CCPS, 2000; Khan & Abbasi, 2000). Several studies pointed out that the more critical step in the quantitative assessment of domino hazards is the availability of reliable models to estimate the possibility of escalation due to the effects of the primary accident (Delvosalle, 1998; Gledhill 1

& Lines, 1998; Khan & Abbasi, 1998; Cozzani & Zanelli, 2001). In the case of fires caused by the accidental releases of flammable substances, it is well known that secondary events with catastrophic consequences may result as a consequence of flame impingement on equipment and pipes. Several technical standards suggest to evaluate the possible damage to process equipment caused by fire using threshold values for radiation intensity that do not take into account safety and site-specific factors, as the presence of improved thermal protection systems or the possible mitigation due to effective emergency response. An alternative to this oversimplified approach are very complex and time consuming models available for the detailed calculation of the time to failure of storage vessels, requiring a detailed description of vessel geometry and other design data. An important benefit to the safety management of possible domino hazards would come form the availability of an approach to the calculation of the possibility and probability of vessel damage following external fires based on simplified correlations able to take into account specific protection factors. The present study was focused on the development of a simplified methodology for the calculation of the damage probability of process vessels aimed to the quantitative assessment of domino effect triggered by fire scenarios. The methodology is based on simple analytical functions relating the time to failure of vessels to the radiation intensity. These were validated by an integrated approach, based on the use of available experimental data, of the ANSYS finite elements code for complete thermal and mechanical simulations of the behaviour of vessels exposed to fires and of a simplified model for vessel failure based on thermal nodes. The correlations were obtained for atmospheric as well as for pressurized storage vessels. Specific correction factors were introduced in order to take into account the effect of protection materials. Damage probability was estimated by a probabilistic function. An approach derived from the Layer of Protection Analysis (LOPA) was used to estimate the probability of effective mitigation on the basis of the calculated time to failure and of site-specific factors. The presence and the delay time for the activation of protection systems were also considered. A fundamental issue in the development of the correlations resulted the presence of thermal protection layers on storage or process vessels. In particular, the possible use of innovative materials for passive protection systems as basalt rock fibres resulted in a high impact on the time to failure. Due to the lack of literature data on the properties of these materials, experimental data were obtained from a specific facility. The data were used to correctly analyse the effect of these protection panels on the time/temperature profile of vessel wall and to determine the physical properties of the materials, such as thermal conductivity and emissivity, that are a necessary input for finite elements simulations and for simplified threshold correlations. The approach evidenced that important differences in the possibility and probability of domino effect triggered by external fires should be expected if differences among vessel characteristics and protection systems are taken into account. This was confirmed by the quantitative assessment of the risk caused by domino effects triggered by fires, performed using a specific software and the damage probability models discussed above. THE APPROACH TO THE ESTIMATION OF ESCALATION PROBABILITY The use of simplified models, based on a limited number of parameters, is required to limit the computational time required for QRA procedures for escalation assessment, as they involve the analysis of a high number of accidental scenarios (Cozzani et al., 2006a; Khan & Abbasi, 1998). Thus, equipment vulnerability models were based on probit functions to relate a dose of physical effects to the escalation or damage probability of an equipment item. In the case of radiation as an escalation vector, vessel failure is caused by wall temperature raise and/or to internal pressure increase due to vessel heat-up. This is a rather slow process (time to failure of the vessel is usually of the order of minutes or higher), thus a time lapse exists between the primary event and the secondary events caused by escalation. Quite clearly, the time to failure (ttf) is a fundamental parameter in the analysis of the domino accidents of equipment exposed to fire: a higher time to failure results in a less credible escalation, since a higher time lapse is available for effective mitigation actions by protection systems or emergency teams. The ttf may thus be compared to a characteristic time for an effective mitigation (tte). The analysis of the effects of protection systems (dumping aimed to depressurization, water curtains by automatic systems, additional water protection by emergency teams) may be performed by LOPA techniques, and specific damage probability functions may be obtained for the plant under examination. A site-specific or a general evaluation of the tte and its comparison to the ttf may be easily turned out in a probabilistic assessment of the success of mitigation actions. This approach was used to develop specific models relating the radiation intensity on a target vessel to the escalation probability. ESTIMATION OF VESSEL TIME TO FAILURE Fire may affect a process or storage vessel by one or more than one of the following modes: i) distant source radiation; ii) full or partial fire engulfment; and iii) jet fire flame impingement. Modelling vessel time to failure in these three situations is extremely difficult given the high complexity of the flame geometries. The wall temperature behaviour in a vessel exposed to an external fire would require a detailed three-dimensional (3D) analysis of the thermal flux over the vessels shell, of the thermal gradients in the fluid contained in the vessel and of the effects due to the mixing of the content due to the natural convection. However, a model based on this approach would require a prohibitive run time, not justified in a QRA framework due to the 2

uncertainties that usually affect the characterization of the fire scenario. In this specific context, a simplified model able to yield a conservative estimation of the time to failure by a straightforward approach would be more useful. The model developed in the present study was based on a lumped approach for the modeling of the time and temperature profile, but was improved by an extended validation work, based on an experimental data set for the vessel time to failure, expanded by the use of results obtained from a 3D finite elements model implemented for this purpose. The development of the lumped model was based on thermal nodes modelling. Depending on the fire scenario, this approach attempts to divide the equipment in different zones (or nodes), each of which can be described by a simple set of parameters. The parameters represent physical quantities (e.g. temperature, pressure, thermal conductivity, etc.) averaged over each node. Boundary conditions together with global conservation laws, lead to a system of equations which determines the parameters of interest and in particular the temperature at each node. This allows the calculation of temperature-time profiles as a function of the radiation mode and intensity on the vessel. The estimation of these parameters allows the evaluation of the mechanical stress at which each zone of the vessels shell is subjected and to compare it with the admissible tensile strength of the vessels material (that is strictly dependent on the material temperature). The failure conditions are strictly dependent on the structural design: geometry, material, boundary condition. For the equipment of interest (horizontal cylindrical vessels, vertical cylindrical vessels, etc.) subjected to an intense heat flux the failure conditions that must be taken into account are: i) the wall-thinning due to hoop stress and high temperature material degradation; and ii) instability. A specific failure criteria should be associated to each type of failure to establish when there is the failure of the vessel, that may result in a loss of containment. A failure criteria is generally derived by a direct comparison between parameters representative of the stress field over the vessels shell and of parameters representative of the tensile strength of the material. Alternatively, the stability limit of the structure is considered. Thus, the failure criteria require the detailed analysis of the stress field over the vessel shell and on the boundary structures, that may be calculated only by more detailed modeling approaches. This means that with a lumped model only simplified failure criteria may be adopted, based on data fitting of available ttfs for similar vessels and for similar fire scenarios. An extended validation of the simplified model is required to ensure the reliability of the failure criteria implemented, in particular for atmospheric vessels, where the internal pressure is not the main factor affecting the vessel failure. A first set of validation runs was carried out using experimental data available in the literature. Although a significant number of case-studies resulted available, in particular for pressurized vessels, the number of available experiments was not sufficient to carry out an extended validation covering the entire field of vessel geometries and of radiation modes and intensities. Thus, a finite elements model was developed and validated on the basis of the experimental data. The finite elements model was used to generate a second data set used for the validation of the simplified lumped element model. The model was developed using a finite elements code (ANSYS Version 5.5) with which a detailed simulation of the thermal and mechanical conditions on vessel shells under fire radiation was possible. The model allowed a detailed simulation of the radiation mode, of the wall temperature and of the stress over the vessel shell. Adopting proper failure criteria it was possible to use the knowledge of the temperature and of the stress conditions in each point of the structure to estimate more precisely the time to failure. The first step in the simulations was the detailed calculation of the temperatures on the vessel shell as a function of time and radiation mode. A detailed definition of the radiation conditions on vessel shell was possible: Figure 1a shows an example of detailed temperature simulations for a horizontal cylindrical pressurized tank engulfed in flames. The second step of the modeling was the calculation of the stress field as a function of the local temperatures and of the other loads present on the equipment shell (Figure 1b). The calculation of the detailed temperature Figure 1. (a) Detailed simulation of the shell temperature (8C) calculated for a 100 m 3 pressurized vessel under radiation conditions due to flame engulfment (120 kw/m 2, 600 s); (b) detailed simulation of the correspondent shell stresses (Pa) 3

(a) (b) Figure 2. Examples of the comparison between ttfs obtained with finite elements simulations (ANSYS) and lumped model runs (RADMOD) for a 17500 m 3 atmospheric vessel (a) and 13400 m 3 atmospheric vessel (b) exposed to different radiation intensities (I) and stress maps allowed the application of the correct failure conditions and thus a quite accurate calculation of the equipment time to failure, also accounting for the decrease in the allowable stress due to the high temperatures of the vessel walls. The comparison of the results of the simulations carried out with the first set of experimental validation data showed that the predicted ttfs were always conservative and showed a relative error lower than 10%. Thus, the results suggested that the finite elements code could be reasonably used to extend the validation data set available. The validation of the lumped model carried out using both the experimental and finite elements data for the vessel time to failure pointed out that the lumped model always yields credible and conservative values for the time to failure of the vessels. An average relative error lower than 15% is present between the ttf calculated by the lumped model and those obtained by the ANSYS simulations (Figure 2). Therefore, the lumped model developed in the present approach may be used with sufficient confidence in the assessment of the time to failure of the equipment exposed to fire in the framework of domino quantitative risk assessment, also considering the uncertainties in the characterization of the fire scenario. The ttfs calculated by this simplified approach have a sufficient precision to be compared with the times required for an effective mitigation. The lumped model developed was thus the starting point for the calculation of the escalation probability due to fire and of the threshold values for escalation. However, in the risk assessment of complex industrial areas a huge number of possible domino accidental scenarios may be identified. Thus, a very high number of simulations may be required. Even if the RADMOD model is characterised by relatively low computational time, its use may require a relevant effort in the analysis of extended areas, also considering that the model, although simplified, requires to define and input several parameters of each vessel and radiation mode considered. The availability of further simplified tools to carry out at least a preliminary assessment of the time to failure is thus useful, in particular to identify the credible domino targets in a complex lay-out. To face this problem, a specific approach was used to define simple analytical functions for the evaluation of the time to failure of the equipment exposed to fire. The more important categories of secondary equipment involved in domino accidents were identified, and their geometrical characteristics were defined (shape, range of sizes, etc.). Vessel sizes were obtained from typical design data used by engineering companies in the oil and gas sector. The design data of the atmospheric tanks were based on API 650 standards, while the volumes and diameters were based on data from several oil refineries (Table 1). In the case of pressurized vessels, the volumes and diameters were derived from vessels typically used for LPG, vinyl chloride, chlorine and ammonia pressurized storages (Table 2). Cylindrical vessels with horizontal axis and design pressures of 1.5, 2.0 and 2.5 MPa were considered. The design data were verified with respect to section VIII of the ASME codes, and the relief valves were considered to provide the vent area required by API RP 520 standards. In order to obtain conservative data, no thermal insulation and no active mitigation system was considered for both sets of vessels. An extended matrix of case studies was thus defined, considering the more credible primary events, the radiation modes and a credible range of radiation values. The lumped model was used to analyze each case study, estimating the time to failure of the selected equipment exposed to the selected type of fire scenario and to different radiation values. A fitting procedure was implemented to obtain specific analytical functions that directly relate the time to failure of the equipment (ttf) to the value of the radiating heat flow (I): log 10 (ttf) ¼ a log 10 (I) þ b (1) Table 1. Design data of the atmospheric tanks based on API 650 standards (D/H: diameter/height ratio) Volume (m 3 ) D/H 25 0.7 100 0.7 1000 2.5 2500 1.1 10000 2.1 13400 2.3 17500 2.7 4

Table 2. Design data of pressurized cylindrical vessels with horizontal axis Volume (m 3 ) Length (m) Diameter (m) Shell thickness (mm) Area pressure relief valve (m 2 ) 5 3 1.6 11 0.073 20 7.2 1.9 12 0.1642 50 10 2.7 17 0.2919 100 18 2.8 18 0.456 where the a and b coefficients depend on the vessel type and geometry and on the radiation mode. The a and b coefficients may thus be calculated from the fitting of simulation results to eq. 1. A first result obtained from the approach are envelop correlations obtained for different vessel categories, evidencing the minimum credible value of the ttf as a function of radiation intensity. Figures 3a and 3b show the envelope correlations obtained respectively for atmospheric vessels and pressurized vessels under distant source radiation conditions. ESCALATION THRESHOLDS AND PROBABILITY The modeling approach carried out in the present study allowed an extended revision of the escalation thresholds for fire scenarios. The envelop correlations shown in Figure 3 define the minimum credible time to failure for vessels exposed to fire. Thus, if the time to failure is compared to a maximum time required for effective mitigation, the threshold values of stationary radiation required for credible escalation may be identified. Table 3 reports the threshold values estimated by this approach. The Table evidences that the conditions leading to escalation due to fires are highly dependent on the target vessel and on the primary fire scenario. More the equipment is resistant to the fire, less credible is the escalation, since more time is available for effective mitigation actions by Table 3. Estimated threshold values for escalation caused by fire radiation Time to failure (s) Radiation Threshold, atmospheric equipment (kw/m 2 ) active safety systems or by emergency team operations. Thus, the probability of damage and escalation may be related to the time to failure of the equipment, comparing the ttf to the characteristic times required for successful mitigation (tte). These could be estimated implementing a specific analysis of the internal or the external emergency plan of the site. In a simplified approach, a specific probit function may be built to relate the time to failure to the probability of escalation, taking into account the time required for effective mitigation (tte): Pr ¼ c þ d ln(ttf) (1) In the absence of site specific data, tte1 was assumed of 5 min and tte2 was assumed of 20 min. The following probit function was thus used in the present study to estimate escalation probability: Pr ¼ 9:25 1:857 ln(ttf) (2) where ttf is expressed in minutes. Radiation Threshold, pressurized equipment (kw/m 2 ) 600 15 60 900 13 50 1800 10 40 MITIGATION BY PASSIVE PROTECTION SYSTEMS The correlations and the data reported above are conservative and do not take into account the protection systems of the storage vessels. Even if active systems have an important role in emergency management, active protections, although compulsory, have a limited reliability due to Figure 3. (a) Envelope of times to failure obtained for vertical cylindrical atmospheric vessels under distant source radiation; (b) envelope of times to failure obtained for horizontal cylindrical pressurized vessels (1.5 to 2.5 MPa design pressure) under distant source radiation 5

Figure 4. Comparison between ttf of pressurized vessels with and without thermal shielding. A 50 mm thick glass wool coating was used for the simulations delayed activation, possible damage in the primary event, possible failures of critical components. Therefore, passive protection of pressurized storage tanks is normally adopted to mitigate the effects of external fires. It is thus important to take into account the role of passive protections in the determination of vessel time to failure. A preliminary analysis of the influence of the thermal insulation layer, performed assuming full engulfment conditions of pressurised vessels, evidenced that the time to failure of insulated vessels (ttf pv ) could be obtained simply adding the time to failure of the insulation layer (ttf pl ) and the time to failure of the uninsulated vessel (ttf np ) without introducing a relevant error: ttf pv ¼ ttf np þ ttf pl (3) Thus, the effect of a protection layer on the vessel may be accounted with sufficient precision simply adding a further term to the ttf estimated for the unprotected vessel. In Figure 4 an example of simulation is reported for a 50 mm thick glass wool coating on the vessel. CONCLUSIONS A simplified approach was developed for the management of hazard due to external fires involving pressurized storage vessels. The approach was based on the development of tools for the straightforward assessment of vessel time to failure due to fire radiation in different radiation modes. The estimation of the vessel time to failure allowed the evaluation of the time available for effective mitigation actions and the timing of emergency response. The approach was extended to include the effect of passive protection. The results evidenced that specific and reliable values are needed for the parameters that characterize the performance of the passive protection systems, in particular under the conditions of hydrogen jet-fire impingement, where particularly high flame temperatures are present. NOMENCLATURE 3D [-] ¼ three-dimensional a[s m 2 W 21 ] ¼ first fitting coefficient for the radiation/time to failure correlation b [s] ¼ second fitting coefficient for the radiation/time to failure correlation c [-] ¼ first probit coefficient d [-] ¼ second probit coefficient D/H [-] ¼ diameter/height ratio for atmospheric tanks I[W m 22 ] ¼ radiation intensity LOPA [-] ¼ layer of protection analysis ttf [s] ¼ time to failure ttf np [s] ¼ time to failure of the uninsulated vessel ttf pl [s] ¼ time to failure of the insulating coating layer ttf pv [s] ¼ time to failure of the insulated vessel REFERENCES Cozzani, V. & Zanelli, S. 2001. An Approach to the Assessment of Domino Accidents Hazard in Quantitative Area Risk Analysis. Proc. 10th Int. Symp. on Loss Prevention and Safety Promotion in the Process Industries, Elsevier, Amsterdam, p.1263. Cozzani, V., Gubinelli, G. & Salzano E. 2005a. Criteria for the escalation of fires and explosions. Proc. 7th Process Plant Safety Symposium: 225. New York: AIChE. Cozzani, V., Gubinelli, G., Antonioni, G., Spadoni, G. & Zanelli, S. 2005b. The assessment of risk caused by domino effect in quantitative area risk analysis. Journal of Hazardous Materials, 127: 14. Cozzani, V., Gubinelli, G. & Salzano, E. 2006a. Escalation Thresholds in the Assessment of Domino Accidental Events. Journal of Hazardous Materials, 129: 1. Cozzani, V., Antonioni, G. & Spadoni, G. 2006b. Quantitative assessment of domino scenarios by a GIS-based software tool. Journal of Loss Prevention in the Process Industries in press. Delvosalle, C. 1998. A methodology for the identification and evaluation of domino effects, Rep. CRC/MT/003, Belgian Ministry of Employment and Labour, Bruxelles. Egidi, D., Foraboschi, F.P., Spadoni, G. & Amendola, A. 1995. The ARIPAR project: an analysis of the major accident risks connected with industrial and trasnportation activities in the Ravenna area. Reliability Eng. System Safety, 49: 75. 6

Gledhill, J., & Lines, I. 1998. Development of methods to assess the significance of domino effects from major hazard sites, CR Report 183, Health and Safety Executive. Khan, F.I., & Abbasi, S.A. 1998. Models for domino effect analysis in chemical process industries. Proc. Safety Prog., 17,107. Khan, F.I., & Abbasi, S.A. 1999. The worlds worst industrial accident of the 1990s - What happened and what might have been: A quantitative study., 19, 40. Lees, F.P. 1996. Loss Prevention in the Process Industries, II Ed. Oxford: Butterworth-Heinemann. Spadoni, G., Egidi, D. & Contini, S. 2000. Through ARIPAR- GIS the quantified area risk analysis supports landuse planning activities. Journal of Hazardous Materials 71:423. Spadoni, G., Contini, S. & Uguccioni, G. 2003. A GIS based software tool for risk assessment and management in industrial areas. Proc. Safety Env. P. 7