Journal of Loss Prevention in the Process Industries 36 (2015) 98e107
Contents lists available at ScienceDirect
Journal of Loss Prevention in the Process Industries
journal homepage: www.elsevier.com/locate/jlp
Uncertainties in QRA: Analysis of losses of containment from piping
and implications on risk prevention and mitigation
Maria Francesca Milazzo a, *, Chiara Vianello b, Giuseppe Maschio b
a
b
di Messina, Viale F.S. D'Alcontres 31, 98166, Messina, Italy
Dipartimento di Ingegneria Elettronica, Chimica e Ingegneria Industriale, Universita
di Padova, via F. Marzolo, 35131, Padova, Italy
Dipartimento di Ingegneria Industriale, Universita
a r t i c l e i n f o
a b s t r a c t
Article history:
Received 12 November 2014
Received in revised form
28 April 2015
Accepted 17 May 2015
Available online 19 May 2015
Quantitative Risk Assessment (QRA) is commonly used in the chemical industry to support decisionmaking. Common practices are based on standard methods, such as fault tree, event tree, etc.; in this
frame, risk is a function of frequency of events (probability) and associated consequences (negative
outcomes), but relevant uncertainties often are not properly taken into account in the derived results.
This paper presents the application of an extended risk analysis of loss of containments for a case-study
with the following aims: firstly, the uncertainties related to the results of the analysis, which derive from
assumption in the application of the standard models, are qualitatively assessed; secondly the application allows evaluating the impact of the uncertainties on the trustworthiness of the results and, finally,
commenting about their use in the risk prevention and mitigation.
© 2015 Elsevier Ltd. All rights reserved.
Keywords:
Quantitative Risk Assessment
Chemical release
Loss of containment
Uncertainty
Risk management
1. Introduction
Several risk studies can be found in the literature showing that
chemical industry has made use of Quantitative Risk Assessment
(QRA) since the mid-70s (Khan and Abbasi, 1998). Its use is targeted
to both the prevention and the management of major hazards, but
it is also a tool for the analysis of alternative design projects aimed
at the risk reduction or at the identification of advantages and
disadvantages resulting from the application of safety standards
(Hayes, 2011; Abrahamsen et al., 2013). The most relevant European
risk studies are those related to the industrialized sites of Canvey
Island (UK), Rijnmond (The Netherlands) and Ravenna (Italy), reported respectively by the Health and Safety Executive (1978), the
Rijnmond Public Authority (1982) and Egidi et al. (1995). Some risk
assessment examples, associated with the transportation of
dangerous goods, are also given by the literature (see Fabiano et al.,
2002; Bubbico et al., 2006; Milazzo et al., 2010; Van Raemdonck
et al., 2013). The methods and data used in QRA must be steadily
improved, because the accuracy of calculated risk is currently only
within one or two orders of magnitude (De Rademaeker et al.,
2014); the main causes are the variability in scenarios, when one
* Corresponding author.
E-mail address: mfmilazzo@unime.it (M.F. Milazzo).
http://dx.doi.org/10.1016/j.jlp.2015.05.016
0950-4230/© 2015 Elsevier Ltd. All rights reserved.
goes into details, and the assumed equipment failure rates, let alone
human factors influence. Only a few studies discuss about the
sensitivity of results by simply analysing relative changes in individual parameters of the risk model, an example is given by Milazzo
et al. (2010a). Discussions on the implication of the simplifications,
which are made in the modelling process, are usually not provided
at the desired level of detail. Due to this lack, it is unclear at what
extend the risk modelling corresponds to the reality and where
implementations are needed. The lack in the uncertainty estimation leads to a decision-making based on a false sense of accuracy
and trustworthiness of the results, causing the implementation of
ineffective risk mitigation measures.
After Kaplan (1997), which considered risk as a complete set of
triplets Si (scenario), Li (likelihood) and Xi (consequences), the
literature proposed several new definitions of risk. In particular,
some authors relate risk to the uncertainty (Aven et al., 2011).
Therefore inspired by these new risk perspectives, new frameworks
for risk analysis have been proposed (Aven and Renn, 2009); these
can be adopted also for risk assessment in the chemical industries,
as recently shown by Milazzo and Aven (2012). According to these
new perspectives/frameworks, uncertainty constitutes a main
component of risk, thus its proper treatment is of high relevance. In
this frame some concepts need to be clarified: an uncertainty
analysis attempts to describe the set of possible outcomes and their
associated occurrence probabilities, whereas a sensitivity analysis
M.F. Milazzo et al. / Journal of Loss Prevention in the Process Industries 36 (2015) 98e107
determines the change in model output values that results from
modest changes in model input values (Cacuci, 2003). A broad
range of tools, based on Monte Carlo methods, are available to
explore, display and quantify the sensitivity and uncertainty in
predictions of key output variables and system performances.
Given the complexity of QRA, using Monte Carlo methods for uncertainty analyses may be a very large and unattractive undertaking. It is therefore better to begin with relatively simple procedures
such as the approach proposed by Milazzo and Aven (2012) based
on the use of uncertainty factors. The uncertainties that arise in risk
assessments may be of three types: uncertainties in parameter
values, in modelling and the degree of completeness (NRC, 1983;
NRC, 2009; Parry, 1996). Uncertainties in parameter values are
inherent because the available data are usually incomplete.
Modelling uncertainties derive from inadequacies in the various
models used to evaluate accident probabilities and consequences
and from the deficiencies of the models in representing reality.
Completeness is related to the inability of the analyst to evaluate
exhaustively all contributions to risk. In this paper it will be shown
that depending on the specific part of the risk assessment being
performed, the type of uncertainty that dominates at each stage of
the analysis can be different. Parameter, modelling and completeness uncertainties contribute to the uncertainty in the final plant
risk at each stage in a risk assessment.
The focus of this paper is on a case-study from the chemical
industry. The application of the standard risk assessment is shown
by analysing the releases of hazardous substances from piping. It
will be underlined that when risk analysis is conducted, by using
state-of-the-art methods, there are mediumehigh uncertainties,
which can be evidenced only using a systematic uncertainty
assessment. To emphasise the importance of the uncertainty
assessment, the extended QRA approach proposed by Milazzo and
Aven (2012) has been applied, allowing the quantification of associated uncertainties by means of a qualitative framework. The paper is organized as follows: next section describes the standard risk
analysis process and the approach for the estimation of associated
uncertainties; then the case-study is described and the results of
the application of both the standard and the extended approaches
are given; the final section discusses the main findings.
2. Methodology for the risk assessment of losses of
containment
For the purposes of this work, which are to discuss about the
uncertainty of the risk results and demonstrate how a broad analysis can help in decision-making, the study has been restricted only
to the quantification of the risk associated with losses of containment from piping. A loss of containment is an event related to
accidental phenomena such as uncontrolled wearing, anomalous
corrosion, pipe defects, etc. (also called random rupture). It is not
associated with process anomalies, but is often due to deficiencies
in the corporate structure. In the chemical industry, losses of
containment mainly occur from piping and associated fittings (Lees,
1996).
In this paper, the risk assessment approach of the Risk Based
Inspection document (API 581, 2008) has been applied. Its fundamental steps are briefly described within the following section,
whereas Section 2.2 shows how to extend the approach according
to the suggestions of Milazzo and Aven (2012).
2.1. Risk assessment of losses of containment
Frequency and consequence estimations of incidents and associated accidental scenarios are fundamental steps in QRA. The
general QRA procedure firstly comprises the identification of the
99
top events (risk identification), which is the most critical step of the
overall analysis. Several techniques for the risk identification are
available for events associated with process deviations, these are
grouped in historical-statistical methods and analytical methods.
Events related to loss of containment (LOC) are identified by means
of the following steps (API 581, 2008):
identification of the representative classes of fluids and related
properties;
characterisation of each pipework (geometrical features and
operating conditions);
identification of the items which are characterised by the same
operative conditions;
definition of representative cases of leakage for each group of
items.
The frequency of the random ruptures is calculated by means of
approaches based on the use of statistical leak frequency data for
losses of containment. Then, event trees allow quantifying the
probability of individual incidental scenario.
A method for the frequency estimation is included in the Risk
Based Inspection document (API 581, 2008). It allows calculating
the frequencies of breakage of pipes or other equipment, using
frequency values from the literature and correcting them through a
damage factor, which takes in account the complexity of the system, and a factor for the quantification of the managerial efficiency.
The API 581 methodology provides a generic value for the frequency of release from the equipment and for different breakage
sizes. The determination of the damage factor depends on the
damage mechanism affecting the equipment. These mechanisms
are grouped into the following categories (API 571, 2011):
thinning damage, this includes general corrosion, localised
corrosion, pitting and other mechanism that cause losses of
material from internal and external surface.
stress corrosion cracking occurs if the equipment is exposed to
environments favourable to certain mechanism (caustic
cracking, amine cracking etc.).
high temperature hydrogen attack, this phenomenon favours
brittle fracture and external damage. The causes of this failure
are various but typically involve some forms of mechanical and/
or physical property deterioration of the material due to exposure to the process environment.
mechanical fatigue has various types and causes of mechanical
deterioration.
Once the frequency of each random event has been quantified,
the likelihoods of the following incidental scenarios (fires, explosions and toxic dispersions) must be estimated by means of the
event tree technique.
The consequence of the release of hazardous substances is
estimated in different steps:
determination of representative classes of fluids and their
properties (this step is also included in the identification of
LOCs);
selection of a set of hole sizes, to find the range of consequences;
estimation of the potential amount of the released fluid and its
release rate;
definition of the release characteristics (to choose the model for
the scenario) and the final phase of the substance (liquid or gas);
determination of the effect of the post-leak response (evaluation
of the effectiveness of various mitigation systems in limiting
consequences);
100
M.F. Milazzo et al. / Journal of Loss Prevention in the Process Industries 36 (2015) 98e107
determination of the area potentially affected by the consequence, so-called impact area A.
The risk analysis is completed by combining the results of the
frequency calculation with those of the consequence estimation.
These can be combined in several ways, but it is common the use of
a risk matrix, where the frequency category is plotted vs. the
consequence category (Fig. 1). Therefore, according to the position
of the event in the matrix, the risk is classified in four categories:
low, medium, medium-high and high. To simplify the application of
the whole approach, the implementation of the API procedure for
risk assessment, within the Inspection Manager, has recently been
made. The Inspection Manager is a software, which has recently
been developed by ANTEA company in cooperation with the University of Padova (Italy), it includes all functionalities for an easier
data management concerning plant's inspection (Vianello et al.,
2013; Milazzo et al., 2013) and is a valid support in managing
data for the risk analysis.
Impact areas from flammable and explosive substances are
calculated using event trees (to determine the probabilities of
various outcomes) and proper consequence models for the scenario
(to quantify the magnitude of the thermal radiation and overpressure on the surrounding, see Van den Bosch and Weterings
(2005)). Toxic impact areas are calculated only using dispersion
models to determine the magnitude of toxic concentrations; the
same models are also used to estimate the magnitude of flammable
concentration and determine the consequence of vapour cloud
fires. An example of the quantification of impact areas is given by
Vianello et al. (2014).
In addition, cloud dispersion analysis methods are used to
quantify the extent and duration of personnel exposure and allow
correcting the release characteristics based on detection, isolation
and mitigation systems. These adjustments are based on engineering judgements, thus according to the API 571 (2011) document, the extent of the impact area depends only on the release
rate. Some consequence categories are defined according the
extension of the above mentioned impact areas (A), these are
shown in Table 1.
The threshold values for the consequence assessment, included
within API 571 document, are shown in Table 2 (domino effects due
to projection of fragments have not been considered, as related
methodologies are not completely consolidated, see Lisi et al.
(2015)); these have been compared with those adopted by some
European countries. By comparing threshold values with the Italian, French and Dutch ones, those reported by API 571 appear more
conservative only in quantifying damage on people.
2.2. Extended approach for the risk assessment of losses of
containment
The application of the standard risk assessment gives results
which are subject to uncertainty due to several models’ simplifications and generalisations. Therefore an uncertainty analysis is
needed. It can be carried out based on a categorisation of the
simplifications and assumptions and, then, their assessment. A
framework for the uncertainty assessment has been introduced by
Flage and Aven (2009). It combines the results of the sensitivity
analysis (i.e. the quantification of how much change in one variable
changes the overall results) with the uncertainty (i.e. how well
understood is the phenomenon and how much data is available);
then some importance scores are derived as given in Table 3. The
application of this framework within risk analyses for chemical
industry has been suggested by Milazzo and Aven (2012).
Table 1
Consequence category (CA).
3. Case-study
Category
Range (m2)
A
B
C
D
E
A 9.29
9.29 < A 92.9
92.9 < A 279
279 < A 929
A>929
To achieve the aim of this work, the API procedure has been
applied to a case-study, then the risk assessment has been
extended as suggested by Milazzo and Aven (2012). The case-study
is a petrochemical industry (confidential). The potential random
events have been collected from the establishment's Safety Report.
Table 2
Threshold values for consequence assessment.
Scenario
US (API 571, 2011)
Italy (Decreto Ministeriale
9/5/2001, no. 151)
Damage to Damage to Damage to Damage to personnel
equipment personnel equipment
France (Salvi and Gaston, 2004)
Damage to
equipment
Damage to personnel Damage to equipment Damage to personnel
Pool fire/Jet fire ~37.5
(kW/m2)
~12.5
12.5
12.5 (50% fatalities)
7 (5% fatalities)
5 (irreversible effects)
3 (reversible effects)
Flash fire (ppm) 0.25 LFL
LFL
e
LFL (50% fatalities)
e
0.5 LFL (5% deaths)
0.34
0.3 (50% fatalities)
0.14 (5% fatalities)
0.07 (irreversible effects)
0.03 (reversible effects)
LFL (50% fatalities)
0.5 LFL (5% deaths)
5% deaths: 0.14
Irreversible effects:
0.05
LC50 (50% fatalities)
e
IDLH (irreversible effects)
50% deaths: LC1% 600
Irreversible effects:
IDLH
Vapour cloud
explosion
(bar)
0.34
Toxic dispersion e
(ppm)
0.34
LC50
0.7
e
The Netherland (CPR16, 1989)
16 (for generic 5 (1% fatalities,
structures)
exposure > 1 min)
3 (irreversible effects,
exposure > 1 min)
15 (for wood and
synthetic materials)
100 (for steel)
4 (glass breakage)
Flash fire diameter
10 (50% fatalities,
exposure ~ 4 min)
7.5 (III degree of burn)
5 (II degree of burn)
3 (I degree of burn)
LFL
0.8 (total destruction) >0,21 (ear-drum
0.35 (heavy damage) rupture)
0.17 (moderate
damage)
0.035 (minor damage)
e
LC50
LFL ¼ Lower Flammability Limit.
LC50 ¼ Toxic concentration that is lethal, for 50% of people exposed, by inhalation over 30 min.
LC1% ¼ Concentration of the toxic substance that is lethal for 1% of people exposed.
IDLH ¼ Concentration of the toxic substance to which the individual, following exposure of 30 min, does not undergo an irreversible damage to health by inhalation.
M.F. Milazzo et al. / Journal of Loss Prevention in the Process Industries 36 (2015) 98e107
101
10-3
F
R
E
Q
U
E
N
C
I
E
S
10-4
10-5
10-6
10-7
A
B
C
D
E
Medium high
High
CONSEQUENCES
RISK
Low
Medium
Fig. 1. Risk matrix.
For the scope of the work it has been sufficient to restrict the study
to one operating unit of the establishment, namely the storage area.
To discuss about the importance of the uncertainty estimation in
supporting decision-making, only the critical random events have
been considered. A random event is defined critical if its scenarios
are located outside from the area at low risk of the risk matrix
(Fig. 1).
3.1. Frequency assessment
To estimate the initial frequencies of leakage and rupture, many
databases (HSE, 2012; NKS, 2002; Heirman, 2009; API 581, 2008)
have been analysed. Results of this investigation showed a great
variability of data. In this work the European average value has
been used and, then, it has been modified by taking into account
the complexity of the system. Table 4 gives the values of the initial
frequency of leakage (from the literature), which have been
modified using both the damage and the managerial efficiency
factors; then the final frequencies have been obtained.
The initial frequency data (given in Table 4) represents the
unitary values of frequency; when the frequencies are modified, by
including the effects of the complexity of the system (length or
additional elements of the system) and managerial aspects, these
values increase of 2 or 3 orders of magnitude. Two dimensions of
breakage have been assumed, 5% (Rn 5) and 20% (Rn 20) of the pipe
diameter (Ø). The frequencies of the scenarios, which follow the
releases, are given in Table 5; these have been estimated by means
of the event tree technique Event trees for the events 1, 2 and 3
have been depicted in Figs. 2e7, whereas representation of event 4
has not been given as it only relates to the dispersion of the released
gas. Then, attention has been paid to the most credible scenarios by
setting a threshold of 1$107 events/yr, this allowed excluding
several flash fire scenarios from the further assessment (Table 5).
It must be underlined that, since dispersions are scenarios that
reflect the influence of weather conditions, the frequency estimation has been made with respect to the prevailing weather conditions related to this geographical area, which are the following:
Table 3
Uncertainty and sensitivity scores (Flage and Aven, 2009).
Aspect
Score
Interpretation
Uncertainty
Low (L)
One or more of the following conditions are met:
- The assumptions made are seen as very reasonable.
- Much reliable data is available.
- There is broad agreement/consensus among experts.
- The phenomena involved are well understood; the models used are known to give predictions with the required accuracy.
Conditions between those characterising low and high uncertainty.
One or more of the following conditions are met:
- The assumptions made represent strong simplifications.
- Data is not available or is unreliable.
- There is lack of agreement/consensus among experts.
- The phenomena involved are not well understood; models are non-existent or known/believed to give poor predictions.
Unrealistically large changes in base case values needed to bring about altered conclusions.
Relatively large changes in base case values needed to bring about altered conclusions.
Relatively small changes in base case values needed to bring about altered conclusions.
Average of the uncertainty and sensitivity scores.
Medium (M)
High (H)
Sensitivity
Importance
Low (L)
Medium (M)
High (H)
L, M or H
102
M.F. Milazzo et al. / Journal of Loss Prevention in the Process Industries 36 (2015) 98e107
Table 4
Frequencies of leakage.
ID
Event
Leakage dimension
Initial frequency of leakage (event/yr)
Frequency of leakage, fleak (event/yr)
1
Release of benzene due a the leakage
of the discharge pipe from a tank
Release of benzene due a the leakage
of the pipe to/from the pier
Release of dichloroethane due to a leakage
of the pipe connecting the tank to
with the production unit
Release of toluene diisocyanate due to a
leakage of the discharge pipe from a tank
Rn
Rn
Rn
Rn
Rn
Rn
5
20
5
20
5
20
4.80∙106
2.30∙107
4.80∙106
2.30∙107
4.80∙106
2.30∙107
1.94∙103
1.85∙104
3.56∙104
7.12∙105
7.21∙104
1.20∙104
Rn 5
Rn 20
4.80∙106
2.30∙107
2.32∙103
1.68∙104
2
3
4
Table 5
Results: frequencies and consequences of the incidental scenarios.
ID event
1
Leakage dimension
Rn 5
Rn 20
2
Rn 5
Rn 20
3
Rn 5
Rn 20
4
Rn 5
Rn 20
Scenario
Toxic dispersion (D5)
Toxic dispersion (F2)
Pool Fire
Flash Fire (D5 þ F2)
Toxic dispersion (D5 þ
Pool Fire
Flash Fire (D5 þ F2)
Toxic dispersion (D5)
Toxic dispersion (F2)
Pool Fire
Flash Fire (D5 þ F2)
Toxic dispersion (D5 þ
Pool Fire
Flash Fire (D5 þ F2)
Toxic dispersion (D5)
Toxic dispersion (F2)
Pool Fire
Flash Fire (D5 þ F2)
Toxic dispersion (D5)
Toxic dispersion (F2)
Pool Fire
Flash Fire (D5 þ F2)
Toxic dispersion (D5 þ
Toxic dispersion (D5 þ
Frequency of the scenario, f (event/yr)
4
F2)
F2)
F2)
F2)
D5: wind speed of 5 m/s and neutral atmospheric stability class
(class D);
F2: wind speed of 2 m/s and stable atmospheric stability class
(class F).
Concerning the forth event of Table 4, the frequency is quantified for the dispersion, which is the only credible scenario because
some interception systems for the diisocyanate (TDI) release are
provided within the establishment. These afford a remote activation of valves which can be automatic and hand-operated.
1.21∙10
5.18∙105
1.94∙105
1.93∙106
1.79∙104
5.54∙106
<107
2.21∙104
9.51∙105
3.56∙105
3.52∙106
6.88∙106
2.13∙106
<107
4.89∙104
2.10∙104
2.16∙105
7.00∙107
8.14∙105
3.49∙105
3.60∙106
1.16∙107
2.32∙103
1.68∙104
Consequence category
B
C
A
A
A
A
e
B
C
A
A
A
A
e
B
C
A
B
C
A
e
B
A
Obviously, the frequency for the scenario is equal to the expected
frequency of release, without further implementation of the event
tree but taking into account the different probabilities for the
weather conditions (F2/D5).
3.2. Consequence assessment
The consequence assessment has been carried out by means of
the software PHAST developed by the Det Norske Veritas Ltd (DNV).
The use of this simulation software allowed overcoming some
Fig. 2. Event tree for the release of benzene (event 1, Rn 5).
M.F. Milazzo et al. / Journal of Loss Prevention in the Process Industries 36 (2015) 98e107
Fig. 3. Event tree for the release of benzene (event 1, Rn 20).
Fig. 4. Event tree for the release of benzene (event 2, Rn 5).
Fig. 5. Event tree for the release of benzene (event 2, Rn 20).
Fig. 6. Event tree for the release of dichloroethane (event 3, Rn 5).
103
104
M.F. Milazzo et al. / Journal of Loss Prevention in the Process Industries 36 (2015) 98e107
Fig. 7. Event tree for the release of dichloroethane (event 3, Rn 20).
In Fig. 8, each scenario is identified with the following notation:
limitations of the API procedure, whose correlations can be used
only for the toxic substances handled in a typical refinery (i.e.
fluoride acid, sulphuric acid, chlorine and ammonia). In the simulation process, the ambient temperature has been assumed 13.3 C
(annual average over 25 years) and the atmospheric humidity equal
to 80% (annual average value over the last available year). The time
to intercept the leakage depends on the adopted protective devices
and is estimated to be:
aRnbXYZ
where: a is the ID event (1, 2, 3 or 4), Rnb is the dimension of
breakage (Rn 5 or Rn 20), XY is the type of scenario (TD ¼ toxic
dispersion, PF ¼ pool fire or FF ¼ flash fire) and Z indicates the
weather condition (D ¼ D5 and F ¼ F2, if Z is indicated the sum of
both D5 and F2 is considered).
A number of preventive and mitigation measures has been
suggested for the risk prevention and mitigation. These are classified as listed below:
1e3 min, in case of presence of detection system of hazardous
releases and continuous attended operations with alarm and
emergency buttons for the closure of valves installed at several
points;
10e15 min, in case of presence of detection system of hazardous
releases and continuous attended operations with handoperated valves for the closure;
20e30 min, in all the other cases.
Constructive criteria
- design according to the most restrictive specific standards and
regulations;
- use of high quality materials, with reference to the characteristics of the substances and the operating conditions;
- proper sizing of the equipment;
- coating with specific products designed in order to withstand
the chemical and atmospheric agents;
- minimisation of flanges and adoption of special valves (twinseal) at high reliability to ensure the seal of line;
- positioning of pipes that minimises the possibility of accidental impact;
Results of the consequence assessment are given in Table 5.
3.3. Risk assessment
The risk has been obtained by combining frequencies and consequences given in Table 5. Results are shown in Fig. 8. The risk
matrix allows identifying the scenarios located outside from the
area at low risk.
F
R
E
Q
U
E
N
C
I
E
S
10-3
1Rn5TDD
4Rn5TD
10-4
1Rn20TD
4Rn20TD
2Rn5TDD
3Rn5TDD
1Rn5TDF
2Rn5TDF
3Rn5TDF
3Rn20TDD
3Rn20TDF
10-5
10-6
10-7
1Rn5PF
2Rn5PF
2Rn20TD
3Rn5PF
1Rn5FF
1Rn20PF
2Rn20PF
3Rn20PF
2Rn5FF
A
B
C
D
E
Medium high
High
CONSEQUENCES
RISK
Low
Medium
Fig. 8. Risk matrix of results.
M.F. Milazzo et al. / Journal of Loss Prevention in the Process Industries 36 (2015) 98e107
- installation of expansion valves on the pipes containing
liquids;
- installation of remote controlled devices for a quick sectioning
of the inlet/outlet pipes of liquid tanks;
- installation of a hydrant network;
- installation of cooling water spray, with hand-operating system, to protect local reservoirs flammable products;
- closed-loop for the loading/unloading trucks, wagons and
ships plant or use of gas abatement systems.
Operative criteria
- systematic and periodic checks on tanks, pump, piping,
marshalling yards, etc.;
- maintenance and inspection planning;
- scheduled check of all safety systems and lock;
- routine control on the stored products to ensure the presence
of additives and the compliance with the prescribed
standards.
3.4. Uncertainty assessment
The results of the uncertainty assessment are given in Table 6.
Uncertainty factors have been grouped for each steps of the standard risk assessment procedure. Some comments are given in the
following.
In the risk identification, two main assumptions are usually
made:
- Assumption (1) e Some representative classes of fluids are
common used to describe all fluid characteristics. Substances,
having the same hazard typology, except toxic materials, are
usually grouped to reduce the number of cases of release and
scenarios. Since the hazard associated with flammable substances is the same. By choosing the proper hazard class, the
assumption gives a low uncertainty and sensitivity.
- Assumption (2) e It must be pointed that infinite cases of
leakage could occur, depending on the dimension, geometry,
etc.; these are grouped to reduce the number of cases of release.
The literature shows that breakages are attributable to three
105
main classes (small, medium and catastrophic), which are the
most recurrent rupture sizes. The use of the literature data gives
a useful support in choosing rational failure characteristics;
however lack of data is often common. This involves a low degree of uncertainty and high degree sensitivity, because the hole
dimension significantly influences the release rate and the
consequent scenarios identified by the event trees.
The frequency assessment is based on four assumptions (assumptions 3e6).
- Assumption (3) e The greatest difficulty in assigning frequencies of breakage is the lack of appropriate failure data. In
the absence of data specific to particular pipeworks and substances, generic failure rates given by the literature should be
used as a starting point. Uncertainties in this field are due to the
adoption or to the adaptation of data derived for chlorine
pipeworks although some reports also included LPG, petrochemical, steam/water, nuclear and other data (HSE, 2012). This
information has been updated and augmented in several contexts, where the weakness of generic failure rates and the need
of improving their quality have been recognized by a few European Authorities, some of them promoted research interest in
this area, in particular for pressure equipment (see Bragatto
et al., 2012). This assumption leads to high degrees of uncertainty and sensitivity.
- Assumption (4) e The damage factors are available in the
document API 581 and derive from a statistic processing of
historical data that takes into account a number of geometries
and types of system complexity. Therefore, this assumption is
associated with a low degree of uncertainty and a medium degree of sensitivity.
- Assumption (5) e The managerial efficiency quantification factors are determined as indicated in API 581. These coefficients
reduce the initial frequency by the percentage of causes of
failure due to lacks in safety management system. Unfortunately
these coefficients do not take into account the plant-specificity,
such as the efficiency of the inspection techniques, company
requirements, testing time of pipeworks, etc. (see Milazzo et al.,
Table 6
Results: uncertainty assessment.
Risk assessment
phase
Assumption in modelling (uncertainty factor)
Reason
Degree of
uncertainty
Degree of
sensitivity
Degree of
importance
Risk
identification
(1) Representative fluids are able to describe
all fluid characteristics.
(2) Representative cases of leakage describe
all potential LOCs.
(3) Frequencies of breakage are based on
literature data.
(4) Initial frequencies of breakage are modified
by damage factors.
(5) Initial frequencies of breakage are modified
by managerial efficiency quantification factors.
(6) Probabilities of the scenarios identified by
means event trees are based on literature data.a
(7) The simulation model properly describes
the scenario.
(8) Representative fluids are able to describe
all fluid characteristics.
(9) Adjustments of the release characteristics
are based on engineering judgements.
(10) Emission rates are constant.
(11) Leakage dimensions are constant.
(12) Wind direction does not vary.
(13) Probabilities of the scenarios identified
by means event trees are based on literature data.a
To reduce the number of cases of release
and scenarios.
To reduce the number of cases of release
and choose rational failure characteristics.
To provide an initial value of frequency
of breakage also for site where data is scarce.
To take into account the complexity of
the system.
To take into account the efficiency of the
safety management system.
To provide a probabilities' value when
specific data is scarce.
To simplify the scenario modelling
L
L
L
L
H
M
H
H
H
L
M
L-M
M
M
M
H
H
H
L
M
L-M
L
L
L
L
M
L-M
M
M
L
H
L
M
L
H
M-L
M
L
H
Frequency
assessment
Consequence
assessment
a
To reduce the number of scenarios'
simulation.
To define the amount of the released
substance after the leakage's interception.
To simplify the scenario modelling
To simplify the scenario modelling
To simplify the scenario modelling
To provide a probabilities' value when
specific data is scarce.
This assumption is common to both the frequency and consequence assessment steps.
106
M.F. Milazzo et al. / Journal of Loss Prevention in the Process Industries 36 (2015) 98e107
2010a). Therefore, this assumption is associated with medium
degrees of uncertainty and sensitivity.
- Assumption (6) e The probability of each scenario is based on
values from the literature, because often data could be poor (see
also assumption 3), greatly variable or not site-specific. This
assumption leads to high degrees of uncertainty and sensitivity.
Concerning the consequence assessment step, seven assumptions have been identified (assumption 7e13).
- Assumption (7) e Some scenarios are complex to model because
it is not easy to outline their boundaries; as an example, when a
cloud of flammable is ignited, a fire or an explosion could occurs
depending on the characteristics of the substance and its concentration in the cloud, but actually both phenomena take place.
Nevertheless several phenomena have been validated by
experimentation, thus this assumption is associated with a low
degree of uncertainty and a medium degree of sensitivity.
- Assumption (8) e As mentioned above (see assumption 1), some
representative classes of fluids are common chosen. In this step
of the risk assessment, substances are usually grouped to reduce
the number of scenarios' simulation. Since the hazard associated
with flammable substances is due to the thermal radiation and
the overpressure, the substance does not influence the risk
assessment. This assumption gives a low uncertainty and
sensitivity, if the substance is included in the proper hazard class
except toxic substances.
- Assumption (9) e Adjustments of the release characteristics are
based on engineering judgements, which utilise experience in
evaluating mitigation measures. These take into account the
time to intercept the leakage (depending on the adopted protective devices indicated in Section 3.2). Due to the redundancies of the protective devices, the degree of uncertainty
is low but the degree of sensitivity is medium.
- Assumption (10) e Emission rates are assumed to be constant to
simplify the scenario modelling. The degree of uncertainty is
medium but the degree of sensitivity is low.
- Assumption (11) e Leakage dimensions are assumed to be
constant to simplify the scenario modelling. The degree of uncertainty and sensitivity are both medium.
- Assumption (12) e Wind direction is assumed to be constant to
simplify the scenario modelling. The assumption is credible by
comparing the duration of the phenomenon with the variability
time of the weather conditions. The degrees of uncertainty and
of sensitivity are both low.
- Assumption (13) e See assumption 6.
Results of Table 6 allow the categorisation of the assumptions, in
such a way that is possible to identify those that mostly affect the
risk results. By means of this analysis the selection of the measures
of risk prevention and mitigation (Section 3.3) can be properly led
in order to minimise the effects of the assumptions.
4. Conclusions
The extended risk analysis allowed underlining all uncertainties
in the use state-of-the-art methods, which can be evidenced only if
a systematic uncertainty assessment analysis is used. It must be
pointed that the matrix of Fig. 2 allows commenting about the risk
acceptability, based on frequencies and consequences associated
with each scenario. Once events have been categorised from the
risk point of view, results should not be used for decision-making
purposes without critical reflection and evaluation of findings
and effects of the uncertainty in the model. This also depends on
the scope of the decision-maker, i.e. if he/she is interested in
prevention, mitigation, etc. In decision-making, it is important to
search more in-depth the model parts with high “importance”,
those where the lack of knowledge could greatly affect the findings
and thus choices. Thus uncertainty assessment, as given in Table 6,
allows categorising assumptions and underlining criticalities with
the aim to suggest further investigation or different risk approach
to be adopted.
By discussing the results of the present work, it has been
concluded that the assumptions 3 (frequencies of breakage are
based on the literature data) and 6 (probabilities of the scenarios
identified by means event trees are based on the literature data)
have high scores of importance despite using relevant international
database. This judgment is associated with the evidence that data
often could be poor, greatly variable or not site-specific. Using a
standard assessment these aspects are not taken into account; the
extended assessment points that frequencies and probabilities are
subject to a great variability and addresses to a detailed site-specific
estimation. Another assumption to be investigated is the fifth
(initial frequencies of breakage are modified by a managerial efficiency quantification factor). It has a medium importance score.
The use of a managerial efficiency quantification factor reduces the
initial frequency by the percentage of causes of failure due to lacks
in safety management system, but this coefficient does not take
into account of the plant-specificity. The extended risk assessment
suggests, in a generic way, focusing on the elements (such as the
efficiency of the inspection techniques, company requirements,
testing times of pipeworks, etc.) which could improve the safety
management system and, more specifically, apply a plant-specific
assessment.
According to these examples, the uncertainty assessment as
proposed by Milazzo and Aven (2012) has been found to be useful
for a systematically assessing and presenting the uncertainty
despite the subjective nature of the evaluation.
Acknowledgements
ANTEA S.r.l. of Padova is gratefully acknowledged for the
financial support at the research programme.
References
API 581, 2008. Risk Based Inspection, Base Resource Document, second ed. American Petroleum Institute, Washington, D.C., USA.
API 571, 2011. Damage Mechanisms Affecting Fixed Equipment in the Refining Industry, second ed. American Petroleum Institute, Washington D.C., USA.
Abrahamsen, E.B., Asche, F., Milazzo, M.F., 2013. An evaluation of the effects on
safety of using safety standards in major hazard industries. Saf. Sci. 59, 173e178.
Aven, T., Renn, O., 2009. On risk defined as an event where the outcome is uncertain. J. Risk Res. 12, 1e11.
Aven, T., Renn, O., Rosa, E., 2011. On the onthological status of the concept of risk.
Saf. Sci. 49, 1074e1079.
Bragatto, P., Delle Site, C., Faragnoli, A., 2012. Opportunities and threats of risk based
inspections: the new Italian legislation on pressure equipment inspection.
Chem. Eng. Trans. 26, 177e182.
Bubbico, R., Maschio, G., Mazzarotta, B., Milazzo, M.F., Parisi, E., 2006. Risk management of road and rail transport of hazardous materials in Sicily. J. Loss Prev.
Process Ind. 19 (1), 32e38.
Cacuci, D.G., 2003. Sensitivity and Uncertainty Analysis. In: Theory, vol. 1. Chapman
& Hall/CRC, Washington DC.
CPR16, 1989. Methods for the Determination of Possible Damage (Green Book). The
Netherland, The Hague.
Decreto Ministeriale 9/5/2001 no. 151. Official Journal of Italian Republic (Gazzetta
Ufficiale). In Italian.
De Rademaeker, E., Suter, Pasman, H.J., Fabiano, B., 2014. A review of the past,
present and future of the European loss prevention and safety promotion in the
process industries. Process Saf. Environ. Prot. 92 (4) http://dx.doi.org/10.1016/
j.psep.2014.03.007.
Egidi, D., Foraboschi, F.P., Spadoni, G., Amendola, A., 1995. The ARIPAR project:
analysis of the major accident risks connected with industrial and transportation activities in the Ravenna area. Reliab. Eng. Syst. Saf. 49 (1), 75e89.
Flage, R., Aven, T., 2009. Expressing and communicating uncertainty in relation to
quantitative risk analysis (QRA). Reliab. Risk Anal. Theory Appl. 2 (13), 9e18.
M.F. Milazzo et al. / Journal of Loss Prevention in the Process Industries 36 (2015) 98e107
, F., Palazzi, E., Pastorino, R., 2002. A framework for risk assessment
Fabiano, B., Curro
and decision-making strategies in dangerous good transportation. J. Hazard.
Mater. 93 (1), 1e15.
Hayes, J., 2011. Use of safety barriers in operational safety decision making. Saf. Sci.
50 (3), 424e432.
Health and Safety Executive, 1978. An Investigation of Potential Hazards from Operations in the Canvey Island. HM Stationery Office, London.
Health and Safety Executive, 2012. Failure Rate and Event Data for Use within Risk
Assessments. On-line report. http://www.hse.gov.uk/landuseplanning/failurerates.pdf (accessed 01.08.10.).
Heirman, J.P., 2009. Handbook Failure Frequencies. Deposit Number D/2009/3241/
355, The Flemish Government Environment, Nature and Energy Department
Environment, Nature and Energy Policy Unit Safety Reporting Division Graaf de
Ferrarisgebouw Koning Albert II-laan 20 B-1000 Brussels.
Khan, F.I., Abbasi, S.A., 1998. Techniques and methodologies for risk analysis in
chemical process industries. J. Loss Prev. Process Ind. 11 (4), 261e277.
Kaplan, S., 1997. The words of risk analysis. Risk Anal. 17 (4), 407e417.
Lees, F.P., 1996. Loss Prevention in the Process Industries. Elsevier, London.
Lisi, R., Consolo, G., Maschio, G., Milazzo, M.F., 2015. Estimation of the impact
probability in domino effects due to the projection of fragments. Process Saf.
Environ. Prot. 93, 99e110.
Milazzo, M.F., Aven, T., 2012. An extended risk assessment approach for chemical
plants applied to a study related to pipe ruptures. Reliab. Eng. Syst. Saf. 99,
183e192.
Milazzo, M.F., Lisi, R., Maschio, G., Antonioni, G., Spadoni, G., 2010. A study of land
transport of dangerous substances in Eastern Sicily. J. Loss Prev. Process Ind. 23
(3), 393e403.
Milazzo, M.F., Maschio, G., Uguccioni, G., 2010a. The influence of risk prevention
measures on the frequency of failure of piping. Int. J. Perform. Eng. 6 (1), 19e33.
Milazzo, M.F., Vianello, C., Maschio, G., Mura, A., 2013. The frequency of release from
piping: a case-study to compare approaches quantifying organizational and
managerial factors. Chem. Eng. Trans. 32, 127e132.
Nordisk kernesikkerhedsforskning, 2002. Comparative Study of Approaches to Estimate Pipe Break Frequencies. Report NKS-79.
107
NRC, 1983. NUREG/CR-2300 PRA Procedures Guide. Washington DC.
NRC, 2009. NUREG-1855 Guidance on the Treatment of Uncertainties Associated
with PRAs in Risk-informed Decision Making. Washington DC.
Parry, G.W., 1996. The characterization of uncertainty in probabilistic risk assessments of complex systems. Reliab. Eng. Syst. Saf. 54, 119e126.
Rijnmond Public Authority, 1982. Risk Analysis of Six Potentially Hazardous Industrial Objects in the Rijnmond Area, a Pilot Study. Reidel, Dordrecht.
Salvi, O., Gaston, D., 2004. Risk assessment and risk decision- making process
related to hazardous installation in France. J. Risk Res. 7 (6), 599e608.
Van den Bosch, C.J.H., Weterings, R.A.P.M., 2005. Methods for the Calculation of
Physical Effects (Yellow Book). The Hague, The Nederland.
Van Raemdonck, K., Macharis, C., Mairesse, O., 2013. Risk analysis system for the
transport of hazardous materials. J. Saf. Res. 45, 55e63.
Vianello, C., Maschio, G., Mura, A., Babolin, D., Gambato, F., Attori, C., 2013. Development of a RBI tool for inspection management in chemical plants. Chem. Eng.
Trans. 31, 235e240.
Vianello, C., Guerrini, L., Maschio, G., Mura, A., 2014. Consequence analysis: comparison of methodologies under API standard and commercial software. Chem.
Eng. Trans. 36, 511e516.
Glossary
Symbol
a: ID random event
Rn: Random event
b: Dimension of breakage (5%, 20%)
XY: Type of scenario (TD ¼ toxic dispersion, PF ¼ pool fire or FF ¼ flash fire)
Z: Weather condition (if not indicated both D5 and F2 are considered)
CA: Consequence category (A, B, C, B)
A: Impact area