State of the Art in the Technical Assessment of DOMINO EFFECT Valerio Cozzani LISES - DICAM, Alma Mater Studiorum - Università di Bologna, Bologna, Italy DOMINO EFFECT: Requirements for the control of major accident hazards Directive 82/01/EEC ( Seveso( Seveso ) ) required the analysis of possible domino accidental scenarios in safety reports Directive 9/82/EC ( Seveso( Seveso-II ) ) requires also the identification of domino effects outside plant limits Directive 2012/18/EU ( Seveso( Seveso-III ) ) reinforces the concept, introducing specific obligations for information exchange with respect to domino scenarios The severity of domino accidents raised a strong effort aimed at the prevention of escalation events in the EU Directives for the control of Major Accident Hazard 1
Features of a domino accident An accident in which a primary event propagates to nearby, triggering one or more secondary events resulting in overall s more severe than those of the primary event PROPAGATION ESCALATION Propagation: need to assess propagation possibility/probability : need to assess final (overall) s Risk Recomposition Propagation path should be correctly identified (multiple level propagation in parallel, not simple serial propagation) of multiple events (propagating both in space and time) of multiple scenarios V. Cozzani et. al., Journal of Hazardous Materials 12:1-0 (200) 2
Quantitative of domino scenarios 1 2 Analysis of the layout and reference Identification of the critical primary events Target selection based on vulnerability INPUT DATA Risk recomposition domino effect implementation DOMINO QRA Quantitative Risk Assessment is possible by a procedure that builds-on the ordinary QRA procedure Quantitative of domino scenarios
Thresholds for Damage and 1 2 Analysis of the layout and reference Identification of the critical primary events Target selection based on vulnerability INPUT DATA Risk recomposition domino effect implementation DOMINO QRA Threshold values for damage and escalation are widely applied to identify critical primary events criterion is that physical effects from the primary critical events should exceed a given threshold at the location of the secondary Separate thresholds may be considered for damage and escalation Threshold for damage 8 80 0 0 0 0 0 20 10 0 all atmospheric pressurized elongated small A strong uncertainty is present on threshold values and more in general on models for domino effect A number of contradictory models and threshold values is reported d in the literature: check for validation!
Threshold for damage 9 Structural damage Loss of containment Secondary events for flammable materials atmospheric pressurized elongated small DS1 LI1 Minor pool fire Minor jet fire Minor pool fire Minor flash fire Minor pool fire Minor flash fire DS2 LI2 Pool fire Flash fire UVCE Jet fire Flash fire UVCE Pool fire Flash fire UVCE Minor pool fire Minor flash fire DS2 LI Pool fire Flash fire UVCE BLEVE/Fireball Flash fire UVCE Pool fire Flash fire UVCE Minor pool fire Minor flash fire Depending on the type of substance released, the actual possibility of escalation may depend on the extent of the secondary damage to the target vessels. ESCALATION THRESHOLDS: V. Cozzani et al., Journal of Hazardous Materials 129:1 (200) Radiation Pool fire & Jet Fire: atmospheric vess.: 10 kw/m 2 pressurized vess.: 0 kw/m 2 Fireball: atmospheric vess.: not credible (unless engulfment and high duration) pressurized vess.: non credible Flash fire: not credible Overpressure Damage: atmospheric: kpa pressurized: kpa elongated: 1kPa small: 12kPa : atmospheric: 22kPa pressurized: 1kPa elongated: 1kPa (flammable); 1 kpa (toxic) small : unlikely (flammable); kpa (toxic) Fragments Distance: 10m (BLEVEs( BLEVEs) 000m (conf. expl.) Distance & Probability of Impact (P i ): 100m P i < 10-1 20m P i < 10-2
Frequency Assessment /1 Damage Models 11 1 2 Analysis of the layout and reference Identification of the critical primary events Target selection based on vulnerability INPUT DATA Risk recomposition domino effect implementation DOMINO QRA Models for damage due to fires, blast waves, fragment impact are required Models for damage probability (example) 12 Approach to CFD/FEM integrated modeling of a vessel engulfed in fire COATING VESSEL [] [2] [] [8] [] [9] Insulating coating FEM finite elements modeling [] [1] [] [0] Steel wall Thermal nodes modeling (lumped parameters) 12
Models for damage probability (example) 1 Thermal results: T ( C) at 100min a) b) Mechanical results: σeq(pa) at 100min a) b) a) Constant properties Upgraded FEM with b) variable properties The highest temperatures are in contact with the vapour phase The wall in contact with the liquid presents extremely lower temperatures (100 C) The highest stresses are at the interface between liquid and vapour. Additional thermal tensions due to the temperature gradient between the upper and lower part of the tank (>200 C). 1 DAMAGE PROBABILITY MODELS: Probit 10 8 Literature Data Probit Model Overpressure Category a b Target categories: atmospher. 2. -18.9 atmospheric vessels pressuriz.. -2. pressurized vessels columns column.1-28.0 auxiliary auxiliary 2.18-1.9 Damage probability model: Probit function: Y=a+b ln(p ) V.Cozzani,, E. Salzano, Journal of Hazardous Materials, 10: (200) 2 0 1 10 100 Overpressure (kpa) Fragments Assessment of probability distribution for number, initial velocity, and friction factor of fragments Assessment of impact probability V.Cozzani et al., Journal of Hazardous Materials, 11:1 (200) G. Gubinelli, V. Cozzani, Journal of Hazardous Materials, 1:1008 (2009)
DAMAGE PROBABILITY MODELS: Radiation Probabilistic model based on the comparison among time to failure and time to effective mitigation: Y = a + b ln (ttf) a = 9.22; b = -1.8 ; ttf: time to failure in minutes Simplified correlations for time to failure Equipment Pressure Volume m Material ttf Vertical Cyl. Tank atmosph. (API 0) 2-20 unprotected (SA-299) ln(ttf) - 1.198 ln(i) n n - 10 - V + 10.11 Vertical Cyl. Tank atmosph. (API 0) 20-000 unprotected (SA-299) ln(ttf) - 1.128 ln(i) n n - 2. 10 - V + 9.8 Vertical Cyl. Tank atmosph. 2-20 20mm glass (API 0) wool (SA-299) ln(ttf) -2. ln(i) 19. Vertical Cyl. Tank atmosph. (API 0) 20-000 20mm glass wool (SA-299) ln(ttf) - 2.802 ln(i) n n. 10 - V + 20.092 Horizontal Cyl. Tank 1 bar, no PSV (ASME VIII) -20 unprotected (AISI 1) ln(ttf) - 0.80 ln(i) n n 0.01 ln(v) + 0. Horizontal Cyl. Tank 1 bar, PSV (ASME VIII) -20 unprotected (SA-299) ln(ttf) - 1.2 ln(i) n n 0.019 ln(v) + 0.81 Frequency Assessment /1 Damage Models 1 1 2 Analysis of the layout and reference Identification of the critical primary events Target selection based on vulnerability INPUT DATA Risk recomposition domino effect implementation DOMINO QRA Models for damage due to fires, blast waves, fragment impact are required Complete and detailed structural models may be used, but this may turn to be impossible in a real-scale industrial application Simplified models for vulnerable categories are suitable in a QRA framework due to the uncertainty affecting the primary scenario Work still needed in the field! 8
Frequency Assessment /2 Frequency calculation 1 1 2 Analysis of the layout and reference Identification of the critical primary events Target selection based on vulnerability INPUT DATA Risk recomposition domino effect implementation DOMINO QRA Conventional approach: sequential domino chain (1 to 1 to 1..) Alternative approach: parallel propagation (1 to n secondary) No solution is yet consolidated for the actual problem (1 to n, n to m, etc.) FREQUENCIES OF ESCALATION EVENTS (1 to n) If a single primary event may damage n target items, the total number of simultaneous scenarios is: n ned 2 1 The possible k-th order events (events in which at least k secondary simultaneous scenarios are present) are: n! k n k! k! The probability of a single scenario involving k secondary events is: P n 1 Pd i δ(i, J m d i k ) 2P (k,m) ed 1 i 1 J k m=[ 1,, k ]: vector of the combination indexes k k 1 i J m δ( i, J m ) k 0 i J m 9
Frequency Assessment /2 Frequency calculation 19 Alternative models were proposed, based on: Monte-Carlo methods (e.g. Freedom) Bayesian networks Acyclic graphs Assessment of multi-level domino effect is possible, but may require new mathematical techniques Frequency Assessment / Time? 20 Atmospheric vessels Pressurized vessels Time may play a role in some escalation scenarios Failure probability of vessels exposed to fire is critically dependent on time 10
Frequency Assessment / Time? 21 A Probit model for escalation probability may be obtained comparing ttf and tte (time to effective mitigation): Pr = 1.8-1.8 ln(ttf) probability 0.9 0.1 tte (min) tte 1 = tte 2 =20 BBN may give new opportunities to account for time dependence of scenarios Consequence Assessment 22 The s of accidental scenarios due to domino effect need to be evaluated with simplified methods (multiple sources, simultaneous scenarios, etc.) If synergic effects of simultaneous scenarios are neglected, physical effects due to different scenarios may be directly summed up In order to optimize the risk recomposition procedure, it is possible to sum directly the death probability values calculated for each of the simultaneous scenarios: n (k,m) V min V δ(i, J k ed i m),1 i 1 Some studies evidenced that the errors introduced summing vulnerability maps are negligible G.Antonioni et al., ESREL 200, Berlin 11
1 Identification of primary events and final outcomes Domino QRA 2 2 Selection of a final outcome Identification and of escalation vector.1 Identification of escalation vector.2 Selection of meteo conditions Identification of possible targets by escalation thresholds Calculation of escalation probability for each target. Assessment of the of the final outcome. Consequence Analysis (map of Physical Effects). Assessment of escalation vector Selection of credible secondary scenarios (cut-off criteria) Consequence Analysis of credible secondary scenarios 8 9 Identification of credible combinations of events (domino scenarios) Assessment of domino scenarios 9.1 Frequency of domino scenario 9.2 Vulnerability map calculation for each primary/secondary scenario 9. Calculation of overall vulnerability map for domino scenarios G1 yes G2 yes Other meteo conditions? no Other final outcomes? no G 10 second level? no Calculation of Risk Indexes yes 11 Identification of secondary events with escalation potential Software tools 2 Reference software tools for risk due to domino scenarios are still lacking Home made software (Aripar-GIS, Freedom, etc.) are proposed Benefits may come from a software for risk able to include domino scenarios 12
Case-Study 1: jet-fire escalation 2 A hydrogen manifold is located close to an ammonia storage facility (S101-S110 horizontal pressurized vessels). A leak from hydrogen pipeline (LOC1 full bore rupture; LOC2 10% nominal diameter rupture) is supposed to generate a strong jet fire Hydrogen line data: D n =100mm, lunghezza 110m, P=bar Ammonia storage data: 10 tanks 100m capacity; P oper =10bar and P des =20bar Case-Study 1: jet-fire escalation 2 10 - curve: huge modification 10 - curve: slight change 1
Case-Study 2: the Ravenna area 2 INDIVIDUAL RISK: Dashed lines: no domino effect Full lines: domino effect considered Individual risk increase up to an order of magnitude Individual risk increase mostly inside the industrial area The high extension of the area made high protection distances available 1
1E-0 SOCIETAL RISK 1E-0 1E-0 F (1/yr) 1E-0 1E-0 All plants All plants - Domino Difference 1E-08 1E-09 1E-10 1 10 100 N High separation distances: low effect on overall societal risk Increase of societal risk in the F = 10 - N = 0 region (moderate severity moderate probability scenarios) Conclusions 0 Adequate methods are available for the identification of domino scenarios Threshold values for damage and escalation should be conservative and should be selected also considering the actual escalation potential of the scenario Frequency of domino scenarios still needs to take advantage of advanced mathematical methods (BBN, Acyclic, etc.) Consequence of multiple scenarios still needs to be specifically investigated QRA is a valid tool to support the exploration of the actual risk posed by domino scenarios and may lead to the correct identification of critical scenarios 1